Advances in artificial intelligence are reshaping the security landscape, changing both the economics of attack and the capabilities of the systems being protected. AI is lowering the cost and expertise required to identify vulnerabilities and scale existing attack techniques, while autonomous agents are gaining greater access to data, software tools and financial infrastructure. Against this backdrop, execution security for autonomous systems is emerging as a broader requirement with security controls increasingly needed across the path from the software an agent relies on to the actions and transactions it ultimately executes.
GoPlus’s evolution can increasingly be understood as an expansion in the consumer base for its security infrastructure. Historically, its products were designed primarily to protect its Web3 users, applications and transactions. Autonomous agents introduce a new class of software consumer capable of accessing information, invoking tools and executing actions independently, expanding the potential demand for security beyond human-triggered interactions.
GoPlus’s product architecture is centered on securing autonomous execution across this path. DeepScan, Axora and SafuSkill address complementary areas spanning smart-contract security, agent information flows and runtime controls, and AI software supply-chain security. GoPlus Intelligence and Transaction Simulation provide an additional layer of on-chain risk intelligence, while the AI Agent Security API extends access to this intelligence into autonomous workflows.
This shift also changes the potential model for security consumption. Autonomous systems can generate substantially more software actions, API calls, tool interactions and transactions than individual users, creating the potential for security services to be consumed continuously as part of machine workflows. Within this model, more agent activity can generate more security checks and greater consumption of GoPlus services, while $GPS is intended to serve as a settlement layer for this activity.
During H1 2026, GoPlus continued to build scale across both its established security network and newer autonomous-system products. Average daily API calls stood at 16M, while network coverage expanded to 57 supported chains and the cumulative number of tokens locked through GoPlus increased 185% to 30,127. SafuSkill also reached a meaningful early scale, aggregating more than 113,000 AI skills, while DeepScan and Axora broadened GoPlus’s coverage across smart-contract and agent-level security. Looking ahead, adoption across these products, machine-to-machine consumption of GoPlus security services and the extent to which $GPS becomes embedded within settlement flows will provide important indicators of how this model develops.
The first half of 2026 highlighted how quickly the security landscape is evolving as advances in artificial intelligence begin to shape both the scale of cyber risk and the economics of exploitation. Across Web3, smart-contract exploits and operational failures remain persistent sources of loss, but attackers can increasingly use AI to identify weaknesses faster and with less specialist knowledge. This changes the economics of cyberattacks by lowering the cost of vulnerability discovery, increasing the speed of exploitation and allowing the same techniques to be deployed across a much larger set of potential targets.
Recent research from Anthropic illustrates how quickly these capabilities are improving in practice. In an experiment covering 2,849 recently deployed smart contracts, its AI agent cost an average of $1.22 for each contract it scanned, while the token cost associated with successful exploitation had been falling by roughly 22% every two months. The system also identified previously unknown vulnerabilities in contracts deployed after its training-data cutoff, demonstrating that AI can move beyond reproducing attacks it has already encountered. OpenAI and Paradigm have observed a similar improvement in offensive capability through EVMbench, where frontier AI agents can now successfully exploit more than 70% of the historical high-severity vulnerabilities covered by the benchmark.
The impact extends beyond vulnerability discovery, with AI also strengthening established forms of fraud and social engineering. Chainalysis found that crypto scams with observable links to AI service providers generated 4.5 times more revenue per operation than those without such links. More broadly, as AI systems evolve from tools that generate information into autonomous software capable of interaction with applications, tools, and financial infrastructure, the security challenge is also beginning to shift. Protecting these systems increasingly requires controls that can assess risk before an action is executed, rather than relying solely on detection and remediation after the fact.
The increase in AI capabilities is emerging against an already challenging security backdrop for digital assets, where the number and variety of attacks continued to rise during H1 2026. According to DeFiLlama, the number of hacks reached 165 during the first half of the year, the highest total recorded in any half-year to date and more than double the number seen in either half of 2025. Several of the largest losses also stemmed from weaknesses outside the smart contract itself, with compromised credentials, private keys and transaction-signing infrastructure playing an important role in major incidents.
More recent evidence suggests that AI is becoming increasingly embedded within this broader threat environment rather than operating as a separate phenomenon. TRM Labs estimates that its AI-in-Crime Adoption Index for crypto-related crime rose from 28 in 2024 to 54 in 2026, with scams showing the most mature adoption and hacking emerging rapidly behind them. Within crypto hacking, AI is being used to make vulnerability discovery more accessible while also strengthening social-engineering techniques used to compromise people and infrastructure. The significance is therefore not that AI has replaced attack methods, but that it can make them cheaper, faster and more scalable.
The rise of autonomous agents adds a different security challenge by increasing the amount of sensitive activity that software can perform on behalf of users. As agents gain access to credentials and external tools, a compromised skill or unsafe instruction can expose users and organizations without any blockchain interaction. In GoPlus’s assessment of the 100 most-downloaded skills on ClawHub as of March 11, 21 were classified as high-risk and recommended for blocking, 17 were flagged with warnings for medium-risk issues, and only 62 passed the security assessment without such concerns.
This shift creates a broader requirement for execution security, with controls that can assess risk before autonomous software is allowed to act. As agents gain access to applications, tools and financial infrastructure, protection increasingly needs to extend across the full execution path, from the software and information they rely on to the tools they invoke and the transactions they initiate. GoPlus’s product architecture reflects this model, with the aim of securing autonomous systems at the point where intent turns into execution.
GoPlus Security has historically built its security infrastructure around the risks associated with on-chain activity, providing real-time intelligence across smart contracts, tokens, addresses and transactions. Its existing network combines the Security Data Layer, which aggregates and organizes risk intelligence, with the Security Compute Layer, where a distributed network of operators performs security analysis. Products including GoPlus Intelligence, Transaction Simulation and SafeToken have built on this infrastructure to extend security coverage across tokens, contracts, transactions and the wider on-chain ecosystem.
During H1 2026, GoPlus’s product architecture was centered on execution security for autonomous systems. As AI agents gain greater control over data, tools, and transactions, security needs to operate across the full execution path rather than at isolated points. GoPlus brings together its existing security intelligence and products designed for autonomous systems to protect the software agents rely on, the actions they take and the financial infrastructure they interact with.
This also expands the potential consumer base for GoPlus’s security services from human users and applications toward autonomous software systems. AI agents can generate substantially more software actions, API calls, tool interactions and transactions than individual users, creating demand for security decisions that can be consumed programmatically and continuously as part of machine workflows. In this environment, security increasingly shifts from periodic, human-triggered protection toward infrastructure embedded directly within the execution process.
Within this model, DeepScan, Axora and SafuSkill address three distinct layers of autonomous execution. DeepScan focuses on the security of the smart contracts and applications agents may interact with, Axora governs AI information flows and the actions agents are permitted to take, while SafuSkill addresses the security of the software supply chain through which agent skills and code are distributed. Together, they provide coverage across the systems agents depend on, the decisions they make and the environments in which those decisions are executed.
A key differentiator within this architecture is GoPlus’s existing transaction simulation and risk intelligence stack. When autonomous systems interact with financial applications and on-chain infrastructure, this established layer of security intelligence can provide additional context around the assets, counterparties and transactions involved in execution. This creates a natural connection between GoPlus’s existing Web3 security capabilities and its broader execution-security model for autonomous systems.
During H1 2026, GoPlus continued to operate at a meaningful scale across its Web3 security infrastructure while broadening its product footprint across autonomous-system security. Average daily API activity stood at 16M calls, with the Token Security Service increasingly serving commercial users such as exchanges, trading terminals, and wallets following its transition to a paid model at the end of 2025. GoPlus supported 57 blockchain networks, while Locker held approximately $26.1M in TVL and had facilitated the locking of 30,127 tokens by the end of June. Cumulative ecosystem profit reached $3.52M, alongside 70,340 SecHubs and 36 active AVS operators, reflecting the breadth of infrastructure supporting GoPlus’s security network.
The first half of the year also provided early evidence of adoption across GoPlus’s execution-security architecture. SafuSkill aggregated more than 113,000 AI skills and launched 63 Skill Coins by the end of June, establishing an early distribution layer for assessing and surfacing software used by AI agents. Alongside DeepScan and Axora, GoPlus’s security stack addresses three interconnected areas of autonomous-system risk spanning the software agents depend on, the actions they perform and the environments in which those actions are executed. Market performance for $GPS improved at the same time, with the token rising 76.8% during H1, while centralized exchange spot volume remained broadly stable at $988M.
GoPlus’s execution-security architecture is built around three complementary areas of protection. DeepScan focuses on the security of the smart contracts and applications autonomous systems may interact with, Axora governs the information and actions involved in agent execution, while SafuSkill addresses the security of the software supply chain on which those agents depend. Together, they bring security closer to the point of execution by addressing the systems agents rely on, the decisions they make and the environment in which those decisions are carried out.
DeepScan applies AI to smart-contract vulnerability discovery and continuous auditing. The platform is designed around the idea that security assessments should evolve alongside the contracts they protect, rather than ending once an audit has been completed. A contract that appears secure at launch can become exposed as its code changes, its dependencies evolve or new vulnerability classes are discovered.
GoPlus identifies four structural limitations of traditional point-in-time audits that underpin the case for continuous monitoring. The first is that an audit only reflects the code and operating environment reviewed at that moment, meaning subsequent upgrades or configuration changes can alter a protocol’s risk profile. The second is that new vulnerability classes can emerge after the review has been completed, leaving previously audited contracts exposed to attack techniques that were not understood at the time.
Smart contracts often depend on external infrastructure such as oracles, bridges and other protocols, whose security can deteriorate independently of the audited code. Meanwhile, older contracts, including those previously reviewed, are increasingly being rediscovered and exploited with the assistance of AI. Several incidents during H1 2026 involved protocols that had already been live for multiple years, illustrating why a long operating history does not necessarily guarantee continued security. As new vulnerabilities and attack techniques emerge, contracts that previously appeared resilient can become attractive targets again.
DeepScan addresses these limitations by extending security across three stages of the contract lifecycle. Token Security Self-Check provides an initial layer of screening before deployment, AI Contract Audit performs a deeper assessment around launch and Continuous Security Monitoring reassesses risk once the contract is live. Together, these stages allow projects to revisit their security posture as both the application and the surrounding threat environment change.
Before deployment, Token Security Self-Check is designed to identify common risks quickly, while AI Contract Audit provides a more detailed review of source code, permissions and business logic. Once a contract is live, Continuous Security Monitoring tracks newly identified vulnerabilities and evolving attack patterns that could affect the application over time. Rather than replacing traditional audits, DeepScan complements them by turning security from a one-off assessment into a continuing process.
DeepScan’s architecture combines semantic analysis, dynamic testing and continuously updated security intelligence to move beyond surface-level pattern matching. Graph-IR and SSA-based analysis allow the platform to model how functions, data and assets move through a contract, helping it understand how changes in state can affect execution. Dynamic fuzzing then tests suspected weaknesses under different scenarios and produces reproducible execution paths, while an extensible rule system allows newly identified attack techniques to be incorporated as the threat environment evolves.
The platform is also supported by GoPlus’s wider security network, which provides a continuously expanding source of on-chain risk intelligence across more than 50 chains. This existing infrastructure gives DeepScan access to the same underlying data environment used across GoPlus’s Web3 security products, while integrations with platforms such as OKX, Uniswap and BNB Chain broaden the ecosystem through which that intelligence can be applied.
To evaluate its performance, GoPlus has tested DeepScan against two emerging benchmarks for AI-powered smart-contract auditing. EVMbench, developed by OpenAI and Paradigm, focuses primarily on high-severity vulnerabilities and whether AI systems can identify and reproduce exploitable flaws. ScaBench provides a broader test of contract reasoning by covering more varied vulnerability classes and complex business logic. GoPlus reports that DeepScan performs across both frameworks, detecting established issues such as reentrancy and access-control failures as well as more protocol-specific logic weaknesses.
AI Auditing Benchmark
As part of DeepScan, GoPlus has also developed the AI Auditing Benchmark to provide a structured way to evaluate how effectively AI systems can identify and reason about real-world vulnerabilities. The AI Auditing Benchmark, launched in April, is an open-source framework built around vulnerable smart-contract code drawn from actual attack events. By the end of H1 2026, the dataset covered 33 representative incidents and evaluated AI systems across three areas: vulnerability discovery, attack-path analysis and contextual reasoning.
Each incident is available in complete and simplified forms, allowing researchers to test how models perform under different levels of complexity. The complete version retains the broader source tree, including dependencies and interfaces, while the simplified version isolates the vulnerable functions and their minimum dependencies. This provides a way to assess performance across both realistic contract environments and more targeted security scenarios.
The benchmark also provides a feedback loop for DeepScan, as newly analyzed exploit cases can be incorporated into the dataset and used to evaluate improvements in AI-powered auditing. In this way, the framework serves both as an open research resource and a validation layer within DeepScan’s continuous smart-contract security model.
Beyond standardized benchmarks, GoPlus has also evaluated DeepScan against real-world exploits to assess how quickly the platform can identify equivalent weaknesses in practice. Across the examples published by the company, DeepScan identified the relevant vulnerability classes within minutes, including the ZetaChain vulnerability in five minutes, the White Eagle vulnerability in 402 seconds and the Huma Finance vulnerability in 505 seconds. These results provide a more practical measure of how continuous monitoring could shorten the period between vulnerability emergence and remediation. For project teams, security researchers and exchanges, this creates a potential layer of protection that extends from initial contract review into ongoing post-deployment oversight.
Axora is GoPlus’s security gateway for AI applications and autonomous agents, designed to sit between the systems generating instructions and the models, data, and tools used to carry them out. It provides a single entry point through which organizations can manage model access, routing and security, while applying executable policies across the information flowing through AI systems. Its architecture is built around three control layers: the Unified Model Gateway, Intelligent Routing and Reliability, and Built-in Security and Governance.
The Unified Model Gateway provides a standard interface for accessing commercial, open-source and privately deployed models, while centralizing credential management alongside token and quota controls. By bringing these functions into a common gateway, Axora reduces the fragmentation that can emerge when different applications and teams maintain separate model integrations and credentials.
Intelligent Routing and Reliability governs how requests are directed across this model environment. Axora uses policy-based routing alongside fallback, failover and health checks to determine how individual requests are handled, with routing decisions also able to reflect regional and security requirements such as data residency, approved vendor lists and model allowlists. Each decision is logged to provide a traceable record of how requests move through the system.
Built-in Security and Governance places security directly within the primary request path. Axora scans the information flowing through AI applications and applies enforceable policies, approval workflows and auditing around how that information is used. This allows security controls to operate alongside the AI workflow itself, providing a foundation for protecting both information flows and the actions subsequently carried out by autonomous agents.
Autonomous systems introduce a different pattern of security consumption. Rather than security being applied only at deployment or through periodic review, agents may require security decisions continuously as they access models, invoke tools, retrieve data and execute actions. This creates the potential for security to become a machine-consumed service, with usage scaling alongside agent activity rather than only with the number of human users or enterprise seats.
Beyond securing information flowing through AI applications, Axora extends protection to the actions autonomous agents perform. While the AI Security Gateway governs how information moves between applications, models and tools, the Agent Execution Layer focuses on what happens when an agent begins to act. This creates a broader security boundary around the agent lifecycle, combining visibility into the environment, validation of potential threats and controls over actions before they are executed.
Axora’s lifecycle model begins with visibility, validation and execution control. Discover maps the agent environment by identifying the agents, skills, MCPs and tools operating within it, giving organizations a clearer view of the systems and resources involved. Red-Team then tests that environment against potential attack paths such as prompt injection, privilege escalation and data exfiltration, while Runtime Guard brings protection into live operation by assessing higher-risk actions before they are executed and blocking them when necessary.
The remaining capabilities focus on software integrity, continuous oversight and accountability. Deep Scan examines third-party skills, scripts and dependencies for malicious commands, credential theft and other supply-chain risks. Daily Patrol periodically reassesses installed software and agent environments as dependencies and threat intelligence evolve, while Govern manages trusted components, exception workflows and audit trails, helping organizations attribute potentially dangerous actions to the agents or software components responsible.
GoPlus has also evaluated Axora through an open benchmark designed to test how effectively security tools distinguish malicious agent activity from benign behavior. The dataset contains 84 labeled samples across ten threat categories, including 59 malicious cases and 25 benign controls intended to test false positives. Axora recorded the strongest overall result among the four tools tested, with an F1 score of 0.939, alongside 91.5% recall and 96.4% precision. It missed five malicious samples, compared with 12, 15 and 26 for the other tools.
The benchmark also suggests that Axora performs consistently across a relatively broad range of threats. It achieved full detection across seven of the ten categories and identified 24 of the 25 attacks drawn from categories based on Google DeepMind’s agent-threat taxonomy. These results provide an encouraging early indication of coverage, although GoPlus acknowledges that the benchmark was developed internally and therefore carries some degree of selection bias.
Beyond detection quality, Axora is designed to operate quickly enough for use within live agent workflows. The benchmark reported an average local scan time of 0.13 milliseconds, supporting the platform’s intended role as a runtime security layer rather than a tool used only before deployment. Its local-first architecture also keeps sensitive code and credentials within the user’s environment, while allowing redacted security signals to feed into the wider control plane.
A key distinction within Axora’s architecture is therefore the boundary between information security and execution security. The gateway determines whether information can safely enter or leave the AI system, while the Agent Execution Layer determines whether an action should proceed, be blocked or require human approval. Axora brings these decisions together through a unified control plane that links model activity, security judgements and final actions into a common evidence chain for monitoring and auditability.
SafuSkill addresses another part of the autonomous-system security model by focusing on AI software supply-chain security and trusted distribution. As agents increasingly depend on third-party skills, scripts and reusable code, risk can enter the execution path through the software they rely on long before an action reaches a model, application or blockchain. Incubated by GoPlus and launched in March, SafuSkill brings together software discovery, security assessment and distribution within a single platform.
The platform is designed to operate through two complementary models that reflect different types of software assets. Skill Mode allows developers to publish and tokenize AI-agent skills that have gained traction, while Code Mode links Skill Coins to GitHub repository branches so that the distributed asset remains connected to the underlying software as it evolves. Issuance is supported through OpenFour and Flap.sh, creating a distribution layer through which developers can bring software to market while retaining a connection between the asset and its underlying code.Although adoption remained at an early stage during H1 2026, SafuSkill established a meaningful initial scale across aggregation, security coverage and token issuance. By the end of June, the platform had aggregated more than 113,000 AI skills, with approximately 92% covered by security scans, while 63 Skill Coins had been launched across OpenFour and Flap.sh. GoPlus also established a 50,000 USDT Growth Fund to support projects emerging from the SafuSkill and OpenFour ecosystem.
SafuSkill’s role within GoPlus’s broader architecture centers on the security layer surrounding software distribution. Skills and code can introduce malicious commands, credential theft or other supply-chain risks into an agent environment, making verification of third-party components an important part of execution security. By embedding security assessment into the distribution process, SafuSkill provides a mechanism for identifying, evaluating and surfacing software before it becomes part of an agent’s operating environment.
During the half, SafuSkill also broadened its distribution through integrations with the BNB Chain Skills Hub, TermiX and ClawWallet. These integrations extend the platform beyond GoPlus’s own marketplace and create additional routes through which assessed software can reach developers and autonomous agents. In this context, SafuSkill functions as the trusted software-distribution layer within GoPlus’s execution-security architecture, complementing Axora’s runtime controls and DeepScan’s smart-contract security.
Alongside its AI and autonomous-system security products, GoPlus continues to operate an established Web3 security network spanning risk intelligence, user-facing security tools and token infrastructure. These products remain an important part of the company’s operating base and provide security services across wallets, applications and on-chain activity. Their relevance to GoPlus’s broader execution-security strategy becomes most apparent when autonomous systems interact with digital assets, where existing transaction and risk intelligence can complement agent-level security controls.
GoPlus Intelligence remained the primary distribution layer for the network’s on-chain security data during H1 2026, providing wallets, applications and other systems with real-time information on tokens, addresses and transaction risk. The broader intelligence suite spans capabilities including the Token Security Service, malicious-address detection, Transaction Simulation and other security APIs, allowing GoPlus to distribute risk signals across a wide range of blockchain environments.
Token Security Service: AI Agent Security API
The product entered 2026 with a broader set of capabilities following the introduction of Transaction Simulation and Address Scan in the previous half. During H1, GoPlus also extended this infrastructure to autonomous systems through the AI Agent Security API, which sits within the Token Security Service. Launched in March, the API enables AI Agents to consume GoPlus’s existing security intelligence programmatically within the same workflows through which decisions are made and actions are executed.
Built around x402 and a usage-based access model, the service is designed for machine-to-machine interaction and gives autonomous systems access to security checks spanning counterparty, asset and transaction risk. At launch, these capabilities included malicious-address detection, token-security checks, transaction simulation and rug-pull detection across more than 50 blockchains, with the supporting infrastructure designed to handle more than 30 million calls. This extends the reach of GoPlus Intelligence beyond human-facing applications by allowing autonomous systems to incorporate on-chain security context directly into their operating workflows.
This creates a natural connection between GoPlus’s established risk-intelligence infrastructure and its security architecture for autonomous execution. GoPlus Intelligence can provide information about the address, asset or transaction surrounding an on-chain action, while Axora operates at the agent layer through information-flow security, policy enforcement and execution controls. Together, these capabilities extend coverage across agent decision-making, on-chain risk assessment and execution when autonomous systems interact with digital assets.
Aggregate GoPlus API activity averaged 16M calls per day during H1 2026. Within this, Token Security API requests averaged 15.2M per day, while Authorized Contract API requests, which capture direct interactions from external users and platforms, averaged 564K per day. Daily blockchain requests, which measure blockchain-level interactions across the network infrastructure, averaged 8.27M per day.
The change in API volumes during the period should be viewed in the context of GoPlus’s transition of the Token Security Service to a commercial model at the end of 2025. Prior to monetization, the service was freely available to developers, generating a larger volume of usage from individual traders and developers. Following the introduction of paid access, the customer mix shifted toward commercial users including exchanges, trading terminals and wallets. According to GoPlus, demand for the service has remained strong following this transition, with aggregate call volumes increasingly reflecting institutional and project-level usage rather than free developer activity.
GoPlus also continued to develop both the performance and distribution of its security intelligence during the period. The Token Security API was upgraded in January to support higher call frequencies and lower latency, while DEX pool-fee data was added in May. Distribution also broadened during the half, with GoPlus Security going live on OKX Wallet and its risk intelligence being integrated into GoldHouse, extending the reach of the network beyond direct API users.
As GoPlus continued to broaden its user-facing security tools during H1 2026, GoPredict became a more established part of the browser extension following its formal launch in January. The product had already been integrated into the extension in late 2025 to provide security analysis for prediction markets such as Polymarket and Opinion, extending GoPlus beyond conventional token and transaction monitoring.
A subsequent update in March added manipulation-risk analysis, rule-risk alerts and plain-language explanations of risk tags, giving users more context around the specific risks associated with prediction markets. These additions broadened the role of the extension by addressing risks that arise from market structure and contract rules, rather than focusing only on the underlying asset or transaction.
GoPlus Locker remained one of the more resilient areas of adoption across the Web3 product suite during H1 2026, despite weaker digital-asset prices weighing on headline TVL. Dollar-denominated TVL declined from $40.2M at the end of 2025 to $26.1M in June, while the underlying BNB-denominated TVL in GoPlus Locker v3 increased 1.42% to 46,245 BNB. The divergence suggests that much of the decline in reported TVL reflected market conditions rather than a comparable contraction in the amount of assets committed to the protocol.
Adoption strengthened more visibly through token-locking activity, with the cumulative number of tokens locked through GoPlus rising from 10,588 to 30,127 during the half, an increase of 185%. Taken together, the growth in both BNB-denominated TVL and the number of locked tokens points to continued expansion in protocol usage even as weaker market prices reduced its dollar-denominated value.
The growth in Locker activity during H1 2026 was supported by continued expansion across token-management infrastructure, giving projects additional routes to use GoPlus’s locking services. GoPlus partnered with Custos in March around the Locker business, while its existing integration with Printr was extended to Printr v2 in April. Alongside the increase in token-locking activity, these integrations suggest that GoPlus Locker continued to gain relevance as part of the infrastructure supporting token issuance and management despite the weaker market backdrop.
Challenging market conditions were more visible in the performance of the GoPlus App, where activity and fee generation remained subdued during H1 2026. The slowdown extended the weaker trend seen through 2025 as lower digital-asset activity reduced engagement with parts of GoPlus’s consumer-facing security offering. Despite the softer recent performance, the App remains an important historical contributor to GoPlus’s cumulative product revenue, reflecting substantially stronger adoption during earlier periods.
Beyond monetization, the GoPlus App continues to provide GoPlus with a direct interface to end users, bringing together wallet risk assessment, real-time security alerts and access to the wider GoPlus security ecosystem. This gives the company a consumer-facing distribution channel alongside the API-led model of GoPlus Intelligence and the protocol-level infrastructure provided by Locker. While activity remained weak during H1, maintaining this direct user layer preserves an important route through which new security capabilities can ultimately be distributed across the broader ecosystem.
Taken together, these products illustrate the breadth of the infrastructure underlying GoPlus’s wider security architecture. GoPlus Intelligence distributes data to applications and autonomous systems, Locker supports security and trust around token infrastructure, while the App provides a direct interface with end users. Although activity across several of these products remained sensitive to broader digital asset market conditions during H1 2026, they remain important components of GoPlus’s wider security offering across data, distribution and on-chain infrastructure.
GoPlus’s distribution strategy during H1 2026 developed across three complementary channels: AI-agent ecosystems, Web3 applications and blockchain infrastructure. Across these areas, partnerships were used to embed GoPlus security capabilities closer to the environments where developers build agents, users interact with applications and on-chain activity takes place.
Within the AI-agent ecosystem, GoPlus became the security-scanning layer for skills submitted to the BNB Chain Skills Hub and partnered with Bitget to index Bitget Wallet Skills. Integrations with TermiX and ClawWallet extended SafuSkill and Axora into external agent environments, while the SMART Benchmark developed with Manic Trade and SonicSVM provided another route for Axora to support the evaluation of autonomous trading systems. Together, these relationships broadened GoPlus’s reach across agent development, software distribution and autonomous execution.
Distribution across the Web3 ecosystem continued in parallel, with GoPlus Security going live on OKX Wallet in May and its risk intelligence being incorporated into additional payment and communication workflows. GoPlus began collaborating with the token-management platform, Custos, in March, particularly around the Locker business, before $GPS was introduced as a usable asset within the Custos ecosystem in May. Elsewhere, GoPlus partnered with PolyFlow to bring real-time security into payment-focused workflows, while GoldHouse integrated GoPlus risk intelligence to surface risky addresses, suspicious approvals and high-risk contracts before user interaction.
GoPlus also continued to broaden its underlying blockchain coverage during 2026, adding support for five new networks across H1 and the subsequent period, including Plasma, StableChain and Robinhood Chain. This expansion gives the company three complementary routes to scale: embedding its products directly into agent platforms, distributing security intelligence through Web3 applications and extending the underlying network across additional chains.
As GoPlus expands from Web3 security infrastructure into execution security for autonomous systems, the role of $GPS is intended to evolve alongside the network. GoPlus’s long-term strategy is to position $GPS as a core settlement unit for security services across its ecosystem. Rather than functioning only as an ecosystem incentive or traded asset, $GPS is intended to support the consumption of security intelligence, contract analysis, agent-security controls and other machine-accessible security services.
This model becomes increasingly relevant as AI agents emerge as a new class of software consumer. Autonomous systems can invoke security services programmatically and at high frequency, creating demand that scales with actions, transactions and software interactions rather than only with human users. By connecting this usage-based security economy to $GPS settlement, GoPlus aims to create a closer relationship between network activity and token utility.
This model remains dependent on execution. The extent to which AI-security adoption translates into $GPS utility will depend on the proportion of services settled through $GPS, the depth of integration across GoPlus products and the adoption of machine-to-machine security consumption. These metrics are likely to become increasingly important indicators of the network’s economic development.
Despite a weaker digital-asset backdrop, $GPS rebounded strongly during H1 2026, ending June at approximately $0.009, up 76.8% over the period. This placed the token within the top 10% for price performance among the 500 largest digital assets by market capitalization during the first half of the year.
Trading activity remained broadly stable even as volumes became more distributed across venues. Centralized exchange spot volume reached approximately $988M during H1 2026, down 1.67% from H2 2025, while Binance retained the largest share at 64.4%, compared with 70.5% in the previous half. Bybit accounted for 8.79% of volume, while Bithumb captured 6.99% following the introduction of its GPS/KRW market in February.
The token’s market reach also widened during the period through new listings on Aster and Bithumb, with the latter providing greater access to the Korean market. Together, stronger relative price performance, broader venue coverage and a more distributed trading mix provided a more resilient market backdrop for $GPS during H1, even as overall crypto trading conditions remained subdued.
Outside exchange trading, GoPlus continued to broaden the environments in which $GPS could be used during H1 2026, giving the token a wider role across the company’s ecosystem beyond secondary-market activity. The token became usable within Custos in May, building on the broader partnership between the two platforms, before a GPS x Custos campaign followed in June. GoPlus also adopted Magna as the official lockup and distribution infrastructure for $GPS allocations, introducing a more structured framework around token vesting and distribution.
The rapid adoption of autonomous agents provides a potentially significant demand backdrop for GoPlus’s execution-security products. Market intelligence firm IDC expects the number of actively deployed AI agents to increase roughly 40-fold from around 29M in 2025 to 1.15B by 2029, with those agents projected to execute 217B actions each day. As agents assume greater responsibility across enterprise and financial workflows, the need for security around software integrity, information flows and execution is likely to grow alongside them. Axora, SafuSkill and the AI Agent Security API position GoPlus across each of these areas.
The AI Agent Security API provides the clearest pathway from agent adoption to measurable service consumption through its usage-based model, while SafuSkill and Axora create additional commercial activity around software distribution and agent security. The longer-term relationship will depend on adoption, monetization and, importantly, the extent to which $GPS becomes embedded within economic flows generated by these services.
As GoPlus enters the second half of 2026, its strategy is centered on execution security for autonomous systems. DeepScan, Axora and SafuSkill address different points along the execution path, spanning the software that agents depend on, the information and actions they process, and the environments in which those actions are ultimately carried out. Alongside these products, GoPlus Intelligence, including the AI Agent Security API within the Token Security Service, provides an established layer of risk intelligence that becomes particularly relevant when autonomous systems interact with digital assets and on-chain applications.
The opportunity is developing against two structural shifts in the security landscape. AI is lowering the cost and expertise required to discover vulnerabilities and scale established attack techniques, while autonomous agents are gaining greater access to data, tools, and financial infrastructure. Together, these trends move security closer to the point of execution, increasing the need for controls that can identify risk, enforce policy and determine whether an action should proceed before it produces an outcome.
For GoPlus, longer-term differentiation will depend on how effectively these capabilities complement one another while retaining distinct roles. Axora can provide security and governance around AI information flows and agent actions, DeepScan can continuously assess the smart contracts those systems may encounter, while GoPlus’s transaction simulation and risk intelligence infrastructure can provide additional context when execution reaches an on-chain environment. Strengthening the connection between these layers would give GoPlus a broader security model spanning agent behaviour, application risk and transaction execution.
Commercial adoption will ultimately determine how this positioning translates into a durable growth opportunity. Axora usage, DeepScan adoption and activity through the AI Agent Security API should provide the clearest indicators of demand for GoPlus’s security products, while SafuSkill can demonstrate whether trusted software distribution gains traction across the AI-agent ecosystem. The depth of integration between these products and GoPlus’s existing security intelligence will also be important as autonomous systems become more active financial and on-chain environments.
More broadly, GoPlus’s longer-term opportunity lies in expanding the consumer base of its security services from humans to machines. Autonomous agents can generate substantially more software actions, API calls, tool interactions and transactions than individual users, creating the potential for security to evolve from periodic, human-triggered protection toward continuously consumed, machine-native infrastructure. Within this model, greater agent activity can lead to more security checks and higher consumption of GoPlus services, while $GPS is intended to provide the settlement layer for this activity. This creates a potential progression from more agents and actions to greater security-service consumption and, ultimately, stronger network economics.
