mnemo

Problem Statement

Bug bounty programs are structurally adversarial. The researcher must reveal the vulnerability to prove it is real, but once revealed, they lose all leverage. Protocols can patch-and-deny, dispute valid findings, or simply not pay. This is not hypothetical — a researcher found a critical vulnerability in Injective’s exchange module (full TVL drain). Injective ghosted them, offered a lower severity, and never paid. The only recourse was public disclosure, which risks legal action and harms the ecosystem. Meanwhile, AI makes this worse: model providers like OpenAI restrict agents from performing security research because there is no technical distinction between finding a vulnerability and exploiting one — only intent, which providers cannot verify. Legitimate security research with AI agents is being blocked by blanket policies, while the actual attack surface grows. Mnemo solves both sides: it gives researchers a provably safe channel to disclose, and it gives AI agents a sandboxed environment where security research is structurally constrained to responsible disclosure.