The obvious objection to an agent-audit company is who audits the auditor? So we ran our own methodology against our own production fleet, published the findings, and shipped a key-free verifier so you don't have to take our word for any of it.
We pointed our MASSAT ASI checklist at the BlindOracle fleet — the same OWASP-ASI assessment described in the audit methodology and walked through in the compliance-hook codewalk.
Honest result, including the warts: the audit flagged that the top-level blindoracle handle had not yet minted an ERC-8004 passport (ASI03 identity), and was not yet in the credential registry (ASI10). Both are identity-hygiene items, not exposures — remediation is a one-command onboard, and it's why we treat verifiable delegation and signed agent identity as table stakes. A self-audit that only ever returns "perfect" isn't an audit.
A self-reported score is weak evidence. So here's the strong evidence: on 2026-05-30 we ran 30 real agent activities through the fleet, each one paid and settled on-chain, each one recorded in a signed delegation chain. Then we verified the whole thing with a key-free verifier — no BlindOracle secret, no API — the model we argue for in agents without surveillance and auditable AI proof chains.
The verifier confirms four things without trusting us — the same shape of evidence we describe in trusting an agent you've never met and when agents pay agents:
CHECK 1 integrity : 60 delegation records hashed — OK CHECK 2 chain : prev_hash links — OK (unbroken) CHECK 3 completeness: 60 cited delegation ids, 0 missing — OK CHECK 4 on-chain : 30/30 settled txs confirmed on Base (status=1, to=USDC) — OK RESULT: PASS — every agent activity independently verified, no trust in BlindOracle required.
The self-audit findings map across OWASP ASI Top 10, NIST AI RMF, and ISO/IEC 42001 — the same crosswalk we apply to customer audits, shown end-to-end in the worked MASSAT crosswalk and the Agent Audit Evidence Kit.
| Finding | OWASP ASI | NIST AI RMF | ISO 42001 | Status |
|---|---|---|---|---|
| Identity / passport | ASI03 | GOVERN, MANAGE | 7 Support | remediation: mint passport |
| Credential registry | ASI10 | GOVERN | 5 Leadership | remediation: register handle |
| Delegation attribution | ASI03 / ASI07 | MEASURE | 8 Operation | verified — signed chain |
| Tamper-evidence | ASI06 / ASI10 | MEASURE | 9 Performance | verified — key-free PASS |
For why this matters in 2026 specifically — Texas TRAIGA's NIST-alignment safe harbor and the EU AI Act enforcement window — see the legal agent stack. New to the model? Start with how it works; the broader context is in the agent security crisis and the how-to on BlindOracle.
An inventory, findings mapped to your framework, and a verifiable evidence pack. 20 minutes to scope it. Pricing for a managed audit is on the pricing page.
Book a free audit →