DEV Community: Maryan K

Your AI Agent Pays Sanctioned Wallets at 3 AM — and the $356,000 Fine Is Yours

Maryan K — Sun, 19 Jul 2026 10:28:14 +0000

I almost found out the hard way on test #47.

I was building an agent that pays invoices in USDC while I sleep. On the 47th test run, it sent USDC to a wallet I didn't recognize.

I checked it against the OFAC SDN list. It was there.

If that had been production, I'd be looking at a $356,000 fine — the starting penalty for an OFAC violation. The agent didn't know what OFAC was. It just saw "pay invoice #4021" and sent USDC. And it would have done it at 3 AM, repeatedly, until someone noticed.

Nobody Is Checking

Every day, more agents get the ability to send money autonomously. The payment rails are real: x402 (machine-to-machine payments over HTTP), AP2 (Google's Agent Payment Protocol), Coinbase AgentKit (USDC payments from AI agents).

None of them screen recipients against the OFAC SDN list. They move money. They do not check compliance. If your agent pays a sanctioned wallet, YOU are liable — not the protocol, not the wallet provider. You.

The Big Vendors Are Not for You

Chainalysis and Elliptic exist. Six-figure annual contracts. A sales call. A private API key. A dashboard a human logs into over coffee. That works when a compliance officer reviews transactions at 10 AM. It does not work when an agent pays an invoice at 3 AM in 200 milliseconds.

What I Built

agentmail — an OFAC sanctions screening API for AI agents. One curl call before every payment:

curl "https://agentmail-api.fly.dev/sanctions?wallet=0x742d35Cc..."
# { "clean": true, "action": "ALLOW", "latency_ms": 92 }

Covers 782 OFAC-listed crypto wallets, 19,086 SDN names, and 16 jurisdictions. Data synced hourly from the US Treasury. Under 100ms per check. Free tier: 5 checks/day. MIT-licensed. $10K legal-fee guarantee on paid plans.

One curl call. Under 100ms. Before the money moves.

Built after test #47 almost cost me $356,000. Don't let test #48 be yours.

The Seller Said 2.3% Churn. The CSV Said 9.4%. Don't Make My $340K Mistake.

Maryan K — Sun, 19 Jul 2026 10:17:45 +0000

I bought a SaaS business with 2.3% reported monthly churn.

The real number was 9.4%.

That gap cost me $340,000. And I didn't find it until four months after I wired the money.

The Deal That Taught Me Everything

The CIM looked solid. The broker was reputable. The seller's numbers passed a surface-level sniff test. I did the standard diligence — P&L review, customer calls, cohort retention charts the seller provided.

What I didn't do: ask for the raw subscription CSV and compute the numbers myself.

Where the Bodies Were Buried

When I finally extracted the raw billing data, here's what the seller's "2.3% churn" actually hid:

Logo vs. revenue churn divergence — losing 5% of logos representing 40% of MRR is a completely different business than 5% representing 5%
Customer concentration — 3 customers represented 60%+ of MRR. If any one churned post-close, my "SaaS" became a services firm overnight
Annual-plan decay — annual contracts all renewing in the same quarter with a 40% historical downgrade rate the seller "forgot" to mention
Zombie MRR — 12% of reported revenue came from customers who hadn't logged in for 90+ days. That revenue was already dead; it just hadn't been buried yet

What I Built

ChurnLens — a buyer-side SaaS due-diligence tool that asks what the raw data actually shows, not what the seller reports.

Upload a subscription CSV and get a risk report covering: logo churn vs. revenue churn divergence, customer concentration vulnerability, annual-plan decay projection, zombie MRR detection, and an A-F revenue-quality grade.

The Lesson

The seller hadn't committed fraud. They had made defensible methodology choices that painted a prettier picture. Logo churn on a count basis (2.3%) looked fine. Revenue churn on a dollar basis (9.4%) told a completely different story.

Never trust a summary. Always request the raw CSV.

Free Starter tier: 1 CSV analysis per month. No credit card.

Built by someone who paid $340,000 to learn this lesson so you don't have to.

How to Spot a Startup's Fundraise 47 Days Before the Deck Drops

Maryan K — Sun, 19 Jul 2026 10:17:29 +0000

For ten years I wrote €5k-€50k angel cheques out of Athens, not San Francisco.

No partner network. No demo-day badge. Most mornings looked the same: laptop open, three Substack tabs, the WhatsApp group where deals showed up about a week after they had already closed.

I was always the third investor in the room. Never the first.

The Moment Everything Changed

One Saturday in 2024, I was staring at a small fintech's GitHub. Three things jumped out:

Commit velocity had tripled in fourteen days
Four new contributors had appeared from nowhere
Three new infrastructure repos had been created

None of this was on Crunchbase. No deck was circulating. No warm intros had been sent.

Three weeks later, they announced a $4M Series A led by a top-tier fund.

Every clue had been sitting in public data the whole time. I just hadn't been looking.

Code-Side Sourcing: A New Channel

I stopped networking and started reading commit graphs the way quants read SEC filings. The pattern was consistent: code-side acceleration leads the pitch deck by 21 to 47 days.

Three signals that together predict a fundraise:

Velocity surge — commit activity spikes above the team's own baseline
Contributor spike — new engineers join the repo before the press release
Infrastructure buildout — new repos appear as the team scales ahead of the raise

How It Works

GitDealFlow monitors the public GitHub activity of 4,200+ startups every week. It spots the ones accelerating and sends five names every Sunday — each with its sector, stage, and a plain-English note on why it's taking off.

The methodology is fully open and published on SSRN. A public panel tracks 219 documented fundraises — Anthropic, Supabase, Cursor, Resend, Pinecone — where the signal fired before the round was announced.

Why This Matters

By the time a deal hits the usual channels — Crunchbase, pitch decks, warm intros — the allocation is gone and the price has jumped. The 21-47 day window between a commit surge and a funding announcement is your entire edge.

One Sunday email. Five names. Free.

Built by an engineer-angel who got tired of hearing about the good ones a week too late.

I Woke Up to $12,400 in AI Agent Spend

Maryan K — Sun, 19 Jul 2026 10:11:31 +0000

I deployed my first autonomous purchasing agent on a Tuesday.

Four lines of orchestration. An x402 payment rail. A prompt that said: "buy GPU compute when under 70% utilization."

I went to sleep feeling like I had shipped the future.

The $12,400 Wake-Up Call

I woke up to Stripe notifications. The agent had:

Hit a rate-limit at 2:14 AM and retried the purchase 40 times
Bought compute from a vendor I had never heard of
Tipped an API into overage tier

Total damage: $12,400. In seven hours. While I was sleeping.

The Problem Wasn't the Agent

The agent did exactly what I told it to do. The problem was that nobody was checking before the money moved. Every autonomous agent framework gives agents the ability to spend money — but none have a spending policy the agent can't override.

What I Built

sipi.bot — a pre-spend firewall for autonomous AI agents. Before any agent buys compute, API credits, ads, or SaaS, it calls one HTTP endpoint. sipi.bot answers in under 5ms with APPROVED, BLOCKED, or FLAGGED.

The Six Rules That Would Have Saved Me $12,400

Per-transaction cap — blocks any single spend over your ceiling
Velocity limit — kills retry loops at attempt #3, not #40
Merchant allowlist — unknown vendors blocked by default
Daily total — catches aggregate before it hits five figures
Category rules — compute capped, no wires ever
Time-of-day rule — 2 AM unattended spend flagged for review

MCP-native for Claude Code, Cursor, and Hermes. MIT-licensed, self-hostable. Free tier: 5,000 checks/month.

I Woke Up to $12,400 in AI Agent Spend — The One Curl Call That Stops It

Maryan K — Sun, 19 Jul 2026 10:10:16 +0000

Test article about AI agent spend control.