In Brief:
- A Mysten Labs prototype puts an AI agent in charge of a company treasury on Sui while the agent never holds private keys or sees balances, pairing Seal MPC with the network’s confidential transfers.
- Payments are proposed by the agent and signed off by an MPC committee that checks them against spending policies written in Move. The first Seal committee on Sui mainnet operates a 5-of-8 threshold spread over eight node operators.
- Amounts and balances are encrypted with Twisted ElGamal over Ristretto255, while sender, receiver and token type remain visible. The code is open source and unaudited.
An AI agent can now run a corporate treasury on Sui without ever touching a private key or seeing a balance, according to a prototype built by Mysten Labs.
The design fuses two pieces of Sui infrastructure that launched separately over the course of this year. Payments originate with the agent, but signing never does.
Would you let an AI agent run your company's treasury?
Not if it holds the keys. Not if every balance is public.
A prototype from the Mysten team gives agents the job but not the keys and keeps the numbers encrypted.
Built on Seal MPC and confidential transfers on Sui.@SuiView on X ↗
The framing came from Sui itself in a post on X. “Would you let an AI agent run your company’s treasury?” it asked, before answering: “Not if it holds the keys. Not if every balance is public.” The prototype, the post said, “gives agents the job but not the keys” while keeping the numbers encrypted.
The agent proposes, the committee decides
What Seal MPC does is distribute cryptographic authority over independent nodes, which means no lone participant — the agent very much included — can move money by itself.
Every payment triggers an MPC committee to mint a one-time witness unique to that transaction. The witness is then checked against access policies written in Move, which rules out replaying or intercepting credentials.
The reasoning behind it is simple enough. A malfunctioning or hijacked agent won’t be reined in by its own internal configuration, which is why the team moved authorization out of the agent altogether.
Daily spending caps, approval thresholds and approved counterparties all fall under those policies, and they can be expressed as plain-language rules rather than code. From there the contracts do the enforcing. If policy rules out an unknown address, the agent simply cannot send funds to it.
June 19 marked the mainnet debut of Seal MPC on Sui. Eight node operators make up the first mainnet committee, running a 5-of-8 threshold, and developers are free to deploy standalone key servers, MPC committees or hybrid setups. Rotating committee membership requires neither re-encrypting existing data nor changing the public key.
All of that rests on the decentralized Seal key server, which hit testnet on March 12.
Encrypted books
Confidential transfers form the second half. Mysten opened them to public beta on Devnet on June 8, with a testnet release planned before the year is out.
Twisted ElGamal over Ristretto255 encrypts balances and transfer amounts, while zero-knowledge proofs allow the network to verify that a transfer is legitimate without learning its size. The protocol layer itself blocks overdrafts and unauthorized minting.
Still public: sender, receiver, token type and the timing of the transaction. What the design conceals is the numbers, not the graph.
According to Adeniyi Abiodun, co-founder and chief product officer at Mysten Labs, the tougher challenge is not concealing a transfer amount but guaranteeing that nobody conjures value out of nothing while supply sits shielded. Sui’s approach confines the cryptography to range proofs on transfer amounts and enforces supply conservation directly at the protocol layer.
Control stays with issuers. Auditor keys can be attached so approved parties are able to decrypt balances when necessary, and freeze and seize powers remain in issuers’ hands. Meanwhile, users can attest to a balance or a transfer amount without exposing their keys.
For incident response there are two separate kill switches: the active flag on the token itself, which freeze admins can toggle and only the issuer can reverse, plus a blanket pause applied to the underlying coin’s deny list via Sui’s DenyCapV2.
Compliance first, by design
Monero makes for a pointed comparison. Ring signatures, stealth addresses and Ring Confidential Transactions let Monero hide senders, recipients and amounts alike — an opacity that has repeatedly cost it exchange listings. Sui, by contrast, obscures amounts and balances and leaves everything else readable.
Launch partners include Bridge, TRM Labs and Merkle Science. Stablecoin and payment use cases are what Bridge is assessing. TRM and Merkle Science, for their part, are figuring out how transaction monitoring and risk scoring function once the financial data is encrypted.
Abiodun’s first public word on private transactions came at Sui Live in Miami, where he said they would begin with stablecoins and could later reach stocks, bonds and other real-world assets. Those remarks sent SUI up by more than 20% in May, and the token added roughly 5% when the beta arrived.
Adjacent agent plumbing has been accumulating on Sui for months. The network was among the earliest partners in Google’s Agentic Payments Protocol, and a distinct Seal MPC prototype powers sealed-bid auctions in which agents place hidden, deposit-backed bids and the winner is obliged to stand behind its bid.
There is one leak baked into the architecture. Wrapping a public coin into a confidential token — or unwrapping it again — interacts with the public coin layer, exposing the amount and counterparties of that particular operation.
The code sits on GitHub, published by Mysten alongside a draft specification, version 0.1, that includes a formal security model and proofs. Per the repo, the implementation remains unaudited and a work in progress.