Today on The Coordination Layer: agents keep getting closer to the wallet — Zerion ships a CLI for 40+ chains, Lirix publishes a zero-trust EVM airlock spec, and Brazilian regulators hand down what appears to be the first bar suspension for prompt-injecting a court's AI system. Plus CLARITY clears Senate Banking, and a Cambrian filter feeder gets its functional ecology sorted.
OAB-PA suspended attorneys Cristina Medeiros and Luanna Sousa for 30 days after they embedded hidden white-text instructions in a labor-court petition telling Galileu — the AI system used by Brazil's labor courts — to skim opposing counsel's response without scrutinizing the documents. A judge had already imposed an R$84,250 fine; the ethics tribunal will hear the case next.
Why it matters
First documented bar-association discipline anywhere for adversarial prompt injection of a judicial AI. The framing matters: treated as a violation of loyalty and procedural transparency duties, not a technology question — a disciplinary theory that travels cleanly to any jurisdiction running document-analysis AI in court. It lands in the same two-week escalation window as Ireland's five binding Guerin v O'Doherty principles, the UK SRA referrals for Mahmood Hussain and Kossar Qureshi, and the Oregon $110K sanction. The Brazil case is the only one so far that involves adversarial manipulation of the court's AI rather than passive hallucination.
The Digital Asset Market CLARITY Act passed Senate Banking on May 14, 15-9, with two Democratic crossovers. The bill defines digital commodities, digital securities, and permitted payment stablecoins, splits SEC/CFTC jurisdiction, recognizes decentralized networks as distinct from corporate structures, and includes safe-harbor language for software developers. House passed 294-134 earlier.
Why it matters
Closest thing to actual federal scaffolding for DeFi and DAO infrastructure the US has produced. The decentralized-network category is what's structurally new — previous frameworks tried to force protocols into corporate-issuer shapes. For prediction markets specifically, this is the upstream of the CFTC/SEC tug-of-war: the CFTC's no-action letter for 19 DCMs and Selig's separation of prediction markets from sportsbooks both presuppose something like CLARITY's jurisdictional split. The bipartisan committee vote materially raises odds of pre-August-recess passage.
Zerion released an open-source CLI giving AI agents native access to user portfolios, swaps, bridges, and transaction signing across 40+ EVM chains and Solana, with positions across 8,000+ protocols exposed as structured context. Agent Skills extend the toolkit via PR — MoonPay, Uniswap, and Polymarket contributed integrations at launch.
Why it matters
This is the portfolio-and-execution analog to what Composio has been building on the data side: a single command-surface for agents that removes the per-chain RPC and indexer plumbing. The PR-based Skills model is the interesting bit — it puts Polymarket and Uniswap's agent integrations on equal footing with the maintainer's own. For anyone building DeFi prediction-market agents, this collapses a multi-week integration into a configuration step, but inherits Zerion's quality of data and any opinionation in how positions are normalized.
Lirix v2.0.4 publishes a zero-trust architecture for connecting autonomous agents to EVM execution: five cryptographic validation stages (L1-L5), zero private-key custody, fail-closed semantics with hard exceptions rather than silent failures, and SLSA-4 provenance tracking. Designed to catch hallucinated transactions and RPC split-brain attacks before they hit the wire.
Why it matters
This is the design pattern the JunoClaw seed-exposure CVE last week argued for in the negative — wallet-layer authority derivation and validation, not credential pass-through. Whether Lirix's specific stack wins or not, the architectural template — multi-stage validation between non-deterministic LLM output and deterministic chain state — is what production agentic DeFi has to look like. Worth reading alongside AWS Bedrock AgentCore Payments' threat model gaps from last week's briefing.
Composio released two onchain toolkits for the OpenAI Agents SDK: Beaconchain (validator data, attestations, slashings, rewards, network performance) and Alchemy (NFT metadata, collection data, ownership, token balances, transaction history across networks). Both expose structured tools rather than raw RPC.
Why it matters
Continues the pattern of agent frameworks absorbing what used to be custom RPC and indexer integration. Beaconchain access in particular is useful for any agent that needs to reason about staking economics or validator state — areas where general LLMs have weak priors and onchain data is the only ground truth. Alchemy toolkit is more crowded territory (Zerion CLI overlaps significantly) but the OpenAI Agents SDK packaging is the differentiator.
Supabase published an MCP server exposing database queries, migrations, Edge Functions, logs, and TypeScript type generation as scoped agent tools. OAuth authentication, configurable read-only mode, project scoping, and granular feature-group allow-lists. Same pattern as Microsoft's SQL MCP Server but for Postgres-on-Supabase deployments.
Why it matters
Supabase is widely used as the backend for hackathon and indie DeFi tooling, so this fills out the MCP coverage map at the layer where most builders actually have state. The scoping model — read-only by default, feature groups, project-level isolation — is the now-standard set of knobs for safe agent database access. Less novel than Microsoft's deterministic query builder, but more accessible.
THORChain lost roughly $10.7M on May 16 through a vulnerability in its GG20 threshold-signature implementation — the sixth exploit in five years, each through a different attack surface (smart contracts, economic assumptions, now TSS cryptography). Chainalysis tracking shows multi-chain laundering already in progress.
Why it matters
GG20 has known issues in the academic literature and other protocols have migrated away from it. The pattern across THORChain's exploits — novel surface each time — suggests architectural choices that keep producing new attack classes, not bad luck. For cross-chain message and settlement design, this is another data point against trying to do bridge security from scratch (cf. Kraken's LayerZero → CCIP migration, the Resolv signing-service compromise into Fluid).
Interactive Brokers integrated Kalshi, CME Group, and ForecastEx event contracts into a unified trading interface on May 14, coinciding with the CFTC's blanket no-action letter covering 19 DCMs (including Kalshi and Polymarket) on swap data reporting for fully collateralized event contracts. The SEC continues to hold the 24 prediction-market ETFs filed by Roundhill, Bitwise, and GraniteShares since February.
Why it matters
Traditional brokerage pipes into event contracts are now live. That changes the counterparty pool in a way that favors the federally-regulated side — and Polymarket's position looks structurally weaker each time the on-ramp story strengthens for Kalshi. April confirmed the trend: Kalshi at $14.8B (+13% MoM) versus Polymarket's first monthly decline since August 2025 ($10.3B, -8.9%). The Interactive Brokers integration extends that asymmetry into the retail-brokerage channel.
CoW DAO core contributors published a tokenomics overhaul proposing a permanent burn of 60-85M COW (excluded from future issuance rather than removed from circulating supply), price-responsive buyback triggers tied to protocol revenue, and a revised circulating-supply definition aligned with the methodology Jupiter, Maple, EtherFi, and Fluid use. Comparative analysis of those mechanisms is included.
Why it matters
The interesting design choice is the burn-from-future-issuance framing rather than circulating-supply reduction — it sidesteps the optical-buyback critique while still constraining dilution. Pair this with last week's Pyth Reserve v2 ratio-based rebalancing proposal: DAO treasuries are converging on similar primitives (revenue-tied buybacks, methodology standardization, comparative referencing of peer protocols' mechanics). Worth watching how the comparative analysis lands in governance debate.
Google DeepMind released Gemma 4 as four models (2B, 4B, 26B MoE, 31B) under Apache 2.0, with native function calling, image and video input, and 140+ language support. The license shift from Gemma's prior custom terms removes use-case restrictions and enables fully sovereign deployments.
Why it matters
Apache 2.0 is the change that matters; capability-wise this slots into the existing open-weights landscape next to Llama and Qwen. For builders who need on-prem inference (privacy, regulatory, latency, or cost reasons) the licensing was the previous blocker. Native function calling at the 4B size is the practically interesting one — that's a profile that can run on a single consumer GPU and still drive tool use for agent workflows.
A federal judge in Oregon imposed $110,000 in sanctions — the largest AI-hallucination penalty on record in the US — on two lawyers who filed 23 fabricated case citations and eight invented quotations. The ABA's five Model Rules directly implicated by AI use (competence, confidentiality, candor, supervisory responsibility, unauthorized practice) are emerging as the canonical compliance framework. Over 1,300 court decisions globally have now flagged AI hallucinations.
Why it matters
The sanctions curve has escalated sharply in two weeks: sanctions (Oregon, $110K), SRA referrals (UK, Mahmood Hussain and Kossar Qureshi), bar suspensions (Brazil, Medeiros and Sousa for prompt injection), and Georgia ADA Deborah Leslie's six-month suspension. Ireland's Guerin v O'Doherty binding appellate principles are now the procedural floor; the Oregon dollar figure is pushing professional-indemnity carriers to harden exclusions. The ABA five-rule mapping is what legal-AI vendors will need to document against.
NetDocuments launched a platform centered on a 'legal context graph' connecting documents, matters, communications, and institutional knowledge — designed to give agents grounded retrieval without breaking ethical walls. Architecture built with AWS and Elastic. iManage simultaneously published an MCP server exposing governed iManage content to Claude, ChatGPT, Harvey, and custom agents while preserving permission controls and audit logging.
Why it matters
Two of the largest legal DMS vendors landing MCP-or-equivalent agent interfaces in the same week, on top of Anthropic's Claude for Legal connector set last week. The competitive structure that's emerging: foundation model providers handle reasoning, DMS vendors own the grounded-knowledge layer, point-solution vendors (Harvey, Hebbia, Legora) get squeezed between them. Same pattern Sean already saw with Claude for Legal absorbing Thomson Reuters' integration surface.
A Biology Letters paper reanalyzes luolishaniids — feather-limbed Cambrian animals known from Burgess Shale-type deposits — and argues they functioned as suspension feeders, not active predators. The work uses predator-prey scaling laws to model how their feeding apparatus actually worked given body and limb proportions.
Why it matters
Functional ecology in the Cambrian is hard to recover; the limb morphology of lobopodians has supported predator and detritivore interpretations for decades. Locking the feeding mode down constrains food-web reconstructions and tightens what a Cambrian planktonic supply looked like, which is the upstream of how anomalocaridid-scale predators got fed. Sequel-of-sorts to the Pohlsepia → Paleocadmus reclassification last week — both are old-fossil reinterpretations from new methods rather than new digs.
A Journal of Vertebrate Paleontology paper analyzes shuvosaurid material from Petrified Forest National Park and concludes these ~216 Ma croc-line archosaurs were obligate bipeds, ~63.5 cm tall, with toothless beaks and hollow bones — features that evolved convergently with theropod dinosaurs rather than inherited from a common ancestor.
Why it matters
Reinforces the Triassic story that pseudosuchians and avemetatarsalians were running parallel adaptive radiations through the same morphospace before the end-Triassic extinction collapsed the croc-line into the semiaquatic ambush-predator niche that survived. Useful corrective against the still-common framing of crocodilians as evolutionarily conservative.
Arthur Harari (Anatomy of a Fall co-writer/director) premieres 'The Unknown' in Cannes competition on May 18, adapted from a graphic novel he co-wrote with his brother. Léa Seydoux and Niels Schneider play a man and woman whose consciousnesses swap mid-encounter and slide into existential horror. Harari talks about deliberately resisting single-interpretation framings — trauma, gender, Buddhism, digital atomization all left on the table.
Why it matters
Worth tracking as a counter-example to the AI-at-Cannes story this year (Demi Moore's 'AI is here' jury-table positioning). Harari is doing the older trick — a high-concept body-swap premise as a delivery mechanism for ambiguity rather than for spectacle. Reception will indicate how much room competition juries still have for formal opacity in genre packaging.
Agents now reach the wallet, but the safety layer is still being improvised Zerion CLI, Composio's Beaconchain/Alchemy toolkits, and Lirix's zero-trust EVM airlock all shipped this week — the integration surface for agent-to-chain execution is filling in fast. The defensive layer (cryptographic validation gauntlets, scoped credentials, fail-closed semantics) is being designed in parallel rather than ahead of deployment, which is the same pattern that produced JunoClaw's seed-leak CVE.
MCP is becoming the default integration contract Supabase, iManage, NetDocuments, Anthropic's legal stack, and BNB Chain's knowledge base all converged on MCP servers as the way to expose state to agents. The protocol has effectively won the integration layer for this cycle; the design conversation has moved to scoping, sandboxing, and which patterns are anti-patterns (server-to-server calls, unstructured context propagation).
Prediction market regulation is fracturing along federal/state and CFTC/SEC lines simultaneously CFTC Chair Selig explicitly separated prediction markets from sportsbooks while the agency issued a no-action letter for 19 DCMs; SEC delayed 24 ETFs; Minnesota criminalized operation; CLARITY cleared Senate Banking. Builders now face four parallel regulatory tracks moving at different speeds.
Lawyers are getting professionally disciplined for AI usage in three jurisdictions in one week Oregon federal court issued $110K in sanctions, UK referred two solicitors to the SRA, and Brazil's OAB-PA suspended two lawyers for embedding white-text prompt injections in a labor petition. Bar discipline is now operating ahead of formal rulemaking — and the Brazil case is the first known disciplinary action specifically for adversarial manipulation of a court AI.
Paleoproteomics keeps extending its reach Last week's Edmontosaurus collagen and Homo erectus enamel proteins are now being read as a single methodological inflection. The Homo erectus paper got cleaner secondary coverage this week clarifying the AMBN-M273V and AMBN-A253G variants and the acid-etching extraction technique — non-destructive enough that more 400ka+ specimens are likely to follow.
What to Expect
2026-06-03—EU Commission Article 50 draft guidelines consultation window closes; agentic self-disclosure default and FOSS scoping at stake.
2026-06-15—Anthropic Agent SDK credit pool split takes effect — claude -p, GitHub Actions, and third-party agents move to metered credits.
2026-08-01—Minnesota SF 4760 effective date, pending gubernatorial signature — felony penalties for prediction-market operators, facilitators, advertisers, and payment processors.
2026-08-02—EU AI Act compliance deadline for AI code assistants under current framework; Omnibus delays push high-risk obligations to Dec 2027.
2026-12-02—Article 50(2) synthetic-content watermarking compliance deadline for existing systems under ratified Omnibus.
How We Built This Briefing
Every story, researched.
Every story verified across multiple sources before publication.
🔍
Scanned
Across multiple search engines and news databases
685
📖
Read in full
Every article opened, read, and evaluated
167
⭐
Published today
Ranked by importance and verified across sources
15
— The Coordination Layer
🎙 Listen as a podcast
Subscribe in your favorite podcast app to get each new briefing delivered automatically as audio.
Apple Podcasts
Library tab → ••• menu → Follow a Show by URL → paste