In Brief:
- Mysten Labs built a prototype that lets an AI agent run a company treasury on Sui without holding private keys or exposing balances, combining Seal MPC with the network’s confidential transfers.
- Agents propose payments and an MPC committee authorizes them against spending policies written in Move. Sui’s first mainnet Seal committee runs a 5-of-8 threshold across eight node operators.
- Confidential transfers encrypt balances and amounts with Twisted ElGamal over Ristretto255, leaving sender, receiver and token type public. The code is open source and unaudited.
Mysten Labs has built a prototype that lets an AI agent manage a corporate treasury on Sui without ever holding a private key or revealing a balance.
The setup welds together two pieces of Sui infrastructure that shipped separately this year. The agent proposes payments. It never signs them.
Would you let an AI agent run your company's treasury?
Not if it holds the keys. Not if every balance is public.
A prototype from the Mysten team gives agents the job but not the keys and keeps the numbers encrypted.
Built on Seal MPC and confidential transfers on Sui.@SuiView on X ↗
Sui laid out the pitch in a post on X. “Would you let an AI agent run your company’s treasury?” the post asked. “Not if it holds the keys. Not if every balance is public.” The prototype, it said, “gives agents the job but not the keys” and keeps the numbers encrypted.
The agent proposes, the committee decides
Seal MPC splits cryptographic authority across independent nodes so no single party, the agent included, can move funds alone.
Authorization routes through an MPC committee that generates a unique, single-use witness for each payment. That witness gets validated against access policies written in Move, so credentials can’t be reused or intercepted.
The threat model is straightforward. If an agent glitches or gets compromised, internal configuration won’t stop it, so the team pushed authorization outside the agent entirely.
Policies cover daily spending caps, approval thresholds and approved counterparties, and users can write them as natural language rules instead of code. Once set, the contracts enforce them. An agent can’t wire funds to an unknown address if policy forbids it.
Seal MPC went live on Sui mainnet on June 19. The first mainnet committee runs a 5-of-8 threshold across eight node operators, and developers can stand up independent key servers, MPC committees or hybrid configurations. Committee membership rotates without re-encrypting existing data or changing the public key.
That work builds on the decentralized Seal key server, which reached testnet March 12.
Encrypted books
The other half is confidential transfers, which Mysten put into public beta on Devnet on June 8 with a testnet launch targeted for later this year.
Balances and transfer amounts are encrypted using Twisted ElGamal over Ristretto255, paired with zero-knowledge proofs that let the network confirm a transfer is valid without seeing the amount. Overdrafts and unauthorized minting get blocked at the protocol layer.
Sender, receiver, token type and transaction timing all stay public. The design shields the numbers, not the graph.
Mysten Labs co-founder and chief product officer Adeniyi Abiodun said the harder problem isn’t hiding the transfer amount but making sure nobody can mint value from thin air while supply is shielded. Sui’s answer restricts the cryptography to range proofs on transfer amounts and enforces supply conservation at the protocol layer itself.
Issuers keep control. They can attach auditor keys so authorized parties decrypt balances when needed, and they retain freeze and seize powers. Users can prove a balance or a transfer amount without revealing their keys.
Two independent kill switches exist for incident response: a token’s own active flag, which freeze admins can flip and only the issuer can lift, and a global pause on the underlying coin’s deny list through Sui’s DenyCapV2.
Compliance first, by design
The contrast with Monero is deliberate. Monero conceals senders, recipients and amounts through ring signatures, stealth addresses and Ring Confidential Transactions, an opacity that has driven repeated exchange delistings. Sui hides amounts and balances and leaves the rest legible.
Bridge, TRM Labs and Merkle Science signed on as launch partners. Bridge is evaluating the feature for stablecoin and payment use cases. TRM and Merkle Science are working through what transaction monitoring and risk scoring look like when the financial data is encrypted.
Abiodun first said private transactions were coming at Sui Live in Miami, starting with stablecoins and possibly extending later to stocks, bonds and other real-world assets. SUI rose more than 20% in May on those comments and about 5% when the beta landed.
Sui has been assembling adjacent agent plumbing for months. It was among the first partners in Google‘s Agentic Payments Protocol, and a separate Seal MPC prototype runs sealed-bid auctions where agents submit hidden, deposit-backed bids and the winner is bound to honor its bid.
One boundary leaks by construction. Wrapping a public coin into a confidential token, or unwrapping it back out, touches the public coin layer and reveals the amount and counterparties of that single operation.
Mysten published the code on GitHub alongside a draft specification, version 0.1, with a formal security model and proofs. The repo still says the implementation is unaudited and a work in progress.
