Last week, Anthropic and OpenAI simultaneously shipped a feature that lets users record their screen, click, and voice to create reusable AI agents. The crypto Twitter buzzed about productivity gains. But for those of us who audit smart contracts for a living, the feature raised a more uncomfortable question: what happens when these agents interact with a blockchain?
The hype cycle for artificial intelligence and crypto has always been out of sync. AI peaks during liquidity floods; crypto peaks during regulatory clarity. Yet here we are, in a sideways market, watching two of the most capitalised AI labs ship identical features — “Record a skill” — that directly targets the same user-level automation that DeFi has been promising since 2020. The ledger remembers what the hype forgets. The hype says this is the end of manual workflows. The ledger shows that every prior attempt to abstract away the blockchain interface — from Gnosis Safe’s multisig UI to Zerion’s mobile dapp browser — has introduced a new class of custodial risk. This time, the abstraction is an agent that watches your every click.
Context: What the feature actually is
Both Claude’s “Cowork” and OpenAI’s “Codex” implementations share the same engineering DNA. The user grants the AI screen-recording permissions, performs a sequence of actions — clicking buttons, typing text, speaking commentary — and the model compresses that demonstration into a reusable “Skill” file. Internally, this Skill is not a video but a structured prompt containing natural-language instructions, shell commands, UI element selectors, and resource paths. When the user re-runs the Skill, the AI reasons about the current screen state, compares it to the recorded context, and generates new inputs. It is behavioural cloning applied to desktop GUIs, powered by multi-modal base models.
From a technical standpoint, this is not a breakthrough in model architecture. It is an engineering integration that packages existing capabilities — visual recognition, speech-to-text, code generation — into a single workflow. The real novelty comes from the economic and security implications for industries built on manual GUI interaction. And no industry is more GUI-dependent than decentralized finance.
Core: The DeFi automation gap — and why recording agents fill it
Consider the typical DeFi user flow. A retail investor wants to deposit USDC into Aave, swap half for ETH on Uniswap, and stake the ETH on Lido. Today, this requires opening three tabs, copying addresses, confirming MetaMask pop-ups, and manually checking transaction status. The friction is immense. Bots and scripted automation exist but demand solidity or Python skills. The promise of a recording agent is that the user can perform the flow once, the AI captures the sequence, and then repeats it on schedule or with new parameters.
This is a genuinely powerful proposition. It lowers the barrier to complex yield strategies. It enables non-technical treasurers to manage DAO operations. It could even replace flash-loan arbitrage bots with user-recorded demonstrations. I have seen similar attempts before. During the 2020 yield farming crisis, I identified that 15% of Uniswap V2's TVL was inflated by impermanent-loss harvesting bots. Those bots were written by elite developers. A recording skill could let any retail user emulate that strategy — amplifying both efficiency and systemic risk.
But the core insight is architectural: these agents do not understand the blockchain. They understand the application layer. They see buttons, not bytecode. This is a fundamental mismatch. When the agent records a sequence that includes “click the ‘Deposit’ button on Aave,” it binds to a specific DOM element at a specific coordinate. If Aave updates its UI, the skill breaks. If the user’s browser window is resized, the coordinate shifts. The agent may attempt semantic matching — looking for text “Deposit” rather than pixel coordinates — but that introduces its own failure modes, like clicking the wrong button on a multi‑asset page.
From my experience auditing smart-contract bridge for a living, I know that UI changes are the least of our worries. The critical risk is that the recording captures sensitive information. During the skill creation, the AI logs every keystroke. If the user types a private key or seed phrase into a web form — even into a hardware-wallet bridge like MetaMask’s password field — the recording may capture it. Claude’s documentation suggests it “obfuscates passwords automatically,” but obfuscation during recording is not the same as redaction in the final skill. If the skill is shared, that seed phrase could be embedded in theSkill’s prompt metadata, retrievable by anyone who inspects the file.
Contrarian: Convenience is deception
The popular narrative on Crypto Twitter is that “Record a skill” will onboard millions of non-technical users to DeFi. The wisdom I hold is the opposite: it will create a new class of automated honeypots. Malicious actors will seed skill marketplaces with skills that appear to execute a profitable yield strategy but actually redirect assets to a drainer contract. The skill’s instructions may include a “final approval step” that signs a malicious token approval. The user, trusting the recorded process, allows it. Smart contracts execute; they do not feel remorse. The user’s wallet empties before they can react.
The counterpoint is that the AI could validate each transaction before executing. Claude’s agent can request user confirmation for any action. But confirmation fatigue is real. If the skill reaches the seventh confirmation pop-up, the user will approve blindly. Behavioural economics tells us that repetitive friction leads to habitually skipping security checks. We don’t buy history; we buy the memory of it. The memory of a skill that “always worked” overrides the rational check of the next execution.
Moreover, these skills are centrally hosted. Anthropic and OpenAI store the recorded data on their servers. For enterprise DeFi teams — hedge funds, market makers, DAO treasuries — uploading their entire trading workflow to a third-party cloud is a non-starter. The industry spent years building self-custody to avoid single points of failure. Now we are voluntarily creating a new one. Liquidity is just confidence dressed as code. If that confidence rests on an AI server’s uptime and honesty, the liquidity is fragile.
Takeaway: Positioning for the next cycle
The market is sideways. Chop is for positioning. I see two signal paths emerging.
First, watch for the emergence of “execution proofs.” If a recording agent can produce an on-chain attestation of its actions — perhaps via a Trusted Execution Environment or a zero-knowledge circuit — we might see a new primitive: verifiable automation. Projects like Oasis or Phala Network could become infrastructure providers for agentic DeFi, offering remote attestation that the skill performed exactly the steps it claimed.
Second, watch for the regulatory response. MiCA in Europe already requires user consent for automated trading. “Record a skill” blurs the line between assisted trading and algorithmic trading. If an agent executes a yield strategy without human oversight per transaction, does it qualify as an algorithmic trading system? The answer will dictate whether this feature flourishes in regulated jurisdictions.
Until then, I advise caution. Use recording agents for email drafts and spreadsheet formatting. For your DeFi positions, the cost of a single recording error can exceed the productivity gain of a thousand automated swaps. The ledger remembers what the hype forgets. The hype will move on to the next AI toy. The ledger will record the drained wallets.
