AI Agent 杀不死 SaaS

Mar 23, 2026

AI Agent 杀不死 SaaS

By Sleepy.md

AI agents went mainstream, and suddenly people started writing obituaries for SaaS. The fear is understandable: if a model can write code, find bugs, call tools, and complete workflows end-to-end, why would anyone keep paying for “software seats”?

That anxiety spilled into public markets in early 2026. After Anthropic shipped new agent tooling and plugins for Claude, enterprise-software valuations repriced hard—less because “software is over,” and more because investors briefly imagined a world where the UI disappears and workflows get swallowed by autonomous systems (see reporting from Axios on the software selloff and Axios on Anthropic’s enterprise plugins).

Crypto is having the same debate—just with higher stakes.

In blockchain, an agent doesn’t merely complete tasks; it can move assets. Once you give an agent the ability to sign transactions, “SaaS is dead” stops being a hot take and becomes a security incident waiting to happen. The reality is: AI agents will reshape crypto SaaS, but they won’t kill it. They will raise the bar for what counts as real infrastructure, real security, and real trust.

1) In crypto, “agentic” doesn’t replace software—It changes what software is for

Most SaaS pessimism assumes a direct substitution:

Old world: humans click buttons in SaaS UIs
New world: agents do the clicking
Conclusion: the SaaS layer becomes useless

But crypto products are not just “UIs.” They are guardrails around irreversible actions: custody boundaries, policy controls, audit trails, and failure containment. Agents can automate intent, but the underlying system still needs to provide:

Reliable data access (indexing, RPC, pricing, risk signals)
Deterministic execution surfaces (APIs, smart contracts, signing flows)
Compliance and auditability where required (institutional workflows, treasury ops)
Safety controls (limits, approvals, simulations, rollback strategies—even if rollback is “impossible on-chain,” you still need prevention)

In other words, agents don’t erase SaaS; they shift SaaS from “workflow UI” to “verifiable infrastructure.”

That’s especially true in 2025–2026 crypto trends: more on-chain activity is composable, cross-domain (L2 + bridges + intents), and increasingly institutional-facing (stablecoin rails, tokenized real-world assets, treasury automation). Those are not “one prompt away” problems—they are systems problems.

2) The hard wall: private keys (and why agents make it more important)

AI agents excel at “figuring out what to do next.” Private keys are about “proving you are allowed to do it.”

This is the point where crypto diverges sharply from Web2. In Web2, an agent can often operate with revocable permissions: rotate tokens, lock accounts, reverse charges. On-chain, a signed transaction is final. If an agent is compromised—through prompt injection, tool poisoning, supply-chain attacks, or simple misalignment—the blast radius is immediate.

So the question becomes:

Who is the signer?

If your answer is “the agent,” you’re not designing a product—you’re outsourcing custody to a probabilistic system.

The industry’s direction is instead converging on layered permissioning:

Smart accounts / account abstraction to express policies in code (spending limits, session keys, whitelists). A good starting reference is EIP-4337 (Account Abstraction).
Intent-based execution where the agent proposes actions, but execution is constrained by policy.
Human-in-the-loop approvals for high-risk operations.
Hardware-based signing for strong isolation of the private key from the agent runtime.

This is exactly where crypto security remains non-negotiable: the agent can draft, plan, and optimize—but the final signature must be protected.

3) “SaaS dies” is really “SaaS UI dies”—and crypto should welcome that

In crypto, UIs are often the weakest link:

Users approve malicious transactions because they can’t parse calldata
They sign on the wrong chain
They trust front-ends that can be compromised
They copy addresses blindly
They don’t simulate outcomes before signing

AI agents can improve UX dramatically—by translating raw transaction intent into understandable summaries, detecting anomalous approvals, and auto-simulating outcomes.

But that doesn’t remove SaaS; it shifts SaaS value into new primitives:

The new crypto SaaS primitives agents will depend on

Transaction simulation as a service (pre-execution analysis, worst-case outcomes, MEV/slippage risk)
Policy engines (allow/deny rules, thresholds, whitelists, time locks)
Structured wallet permissions (session keys, scoped allowances, revocation flows)
Monitoring + alerting (on-chain “SIEM-like” pipelines, anomaly detection)
Proof and audit layers (who approved what, under which policy, with what context)

Agents will call these services constantly. If anything, agentic workflows increase SaaS usage—because they generate more actions, more transactions, and more demand for guardrails.

4) Agent attacks are not hypothetical—prompt injection becomes “transaction injection”

If you build agent-connected crypto apps, you’re now in a world where classic AI threats map directly onto financial loss.

Two practical principles help:

Principle A: Treat the model as untrusted

Assume the agent can be manipulated by adversarial inputs. Your system must enforce:

Explicit allowlists for tool calls (what contracts, what methods, what chains)
Maximum spend limits
Strict output schemas (no “free-form” execution)
Mandatory simulation and checks before signing

For general security background, the web-security community’s mindset is useful—see OWASP Top 10.

Principle B: Make every risky action require a hardened signature boundary

You want a signing boundary that is:

Off the agent runtime
Resistant to malware
Explicitly confirms destination, amount, and network
Designed for human verification

This is where self-custody practices—and hardware wallets in particular—become even more important in an agentic era, not less.

5) What this means for “crypto SaaS” companies in 2026

If you run a crypto product that looks like SaaS—dashboards, analytics, treasury ops, portfolio automation, compliance tooling—the opportunity is not to “compete with agents,” but to become agent-native infrastructure.

A simple repositioning often works:

From: “We offer a dashboard for humans.”
To: “We offer a reliable, policy-constrained execution and risk layer for agents and humans.”

A checklist for becoming agent-native (without losing control)

Expose APIs that are deterministic: prefer structured endpoints over UI automation.
Provide machine-readable risk outputs: not just charts; return explicit signals (e.g., high slippage risk, unsafe approval scope).
Ship policy controls first: limits, role-based approvals, chain allowlists.
Design for auditability: logs that survive disputes (“why did the agent do that?”).
Support smart accounts and scoped permissions: so automation can be safe-by-default.
Separate planning from signing: let agents propose; require hardened signing to execute.

This is the same story as DevOps evolution: CI/CD didn’t kill software teams—it forced them to become more disciplined. Agents won’t kill crypto SaaS—they’ll force it to become more secure, more composable, and more accountable.

6) Where OneKey fits (when AI is doing the “thinking”)

If AI is doing more planning and automation, your attack surface expands. The “brain” (agent) will be exposed to:

Browsers, plugins, and untrusted web content
Tool APIs and third-party services
Prompt injection attempts disguised as “helpful instructions”
Compromised dependencies in the automation pipeline

That’s why the signing device should be isolated.

A hardware wallet like OneKey can serve as the final, hardened approval layer: the agent can prepare an unsigned transaction, but the private key stays offline and the human verifies on-device before signing. In practice, this is one of the cleanest ways to keep the benefits of automation while preserving self-custody and minimizing “agent-as-custodian” risk.

If you’re experimenting with on-chain automation, consider adopting a workflow where agents generate transaction intents, your stack runs simulation + policy checks, and OneKey performs the final signature.

Conclusion: SaaS isn’t dying—It’s being forced to grow up

“AI Agent kills SaaS” is a catchy slogan, but crypto makes the flaws obvious:

Agents increase execution volume, so infrastructure demand rises
Keys and signatures create a hard security boundary that automation can’t wish away
The winning products will be those that turn workflows into verifiable, policy-controlled primitives

In 2026, the question isn’t whether crypto SaaS survives. It’s whether your stack is ready for a world where software doesn’t just serve humans—it serves autonomous operators with real money at stake.