Skip to main content
Cogentic
← All release notes

A swap reads as a swap, and the agents write plainly

Every transfer now says whether its transaction was a swap or a transfer, and a typed swap suggests the legs the case is missing. The agents write addresses as chips that open, in the officer's language rather than ours, and a drafted question that could tip off a customer is withheld.

2026-10-11

NewImprovementFixSecurity

A swap now reads as a swap rather than two unrelated rows, every address in agent prose is a chip that opens on its own chain, and the agents write in the officer's language rather than in our field names.

Underneath that: a question the agent drafts for a customer is withheld when sending it could amount to tipping off, case chat answers from the case's own record, and transfer history reads through the block explorers already used for evidence, with three chains off the map until a provider exists for them.

  • NewSwap or transfer on every transfer — a swap used to reach a case as unrelated rows, USDC out and WETH in, because an alert delivers only one leg, so the analyst rebuilt the transaction by hand from its hash. Every transfer now says what its transaction did from the subject's side: Swap, where one asset was sent and a different one received in the same transaction, or Transfer. Unknown shows nothing, never Transfer. A Swap chip sits beside the direction on every transfer row — transfers card, suggestions, map list, node and wallet sheets, cases board and report rows — the transfer sheet carries a Type row and a map edge reads as, say, 2 swaps. When a swap is typed, the subject's legs the case does not yet hold are suggested. Two limits worth knowing: wraps and stakes, ETH to stETH, read as swaps and bridges read as transfers; and existing transfers are not backfilled, so they show no type until they are re-enriched.
  • NewProcedure relied on, and questions for the customer, on the case analysis — the case analysis now shows Procedure relied on, the section of your own SOP the recommendation cited, and the questions the agent drafted for the customer.
  • NewSettings grouped by who owns each setting — settings are now arranged by owner. You → Profile is new: name, email, role, timezone, date display and theme. Organisation → General holds name, code and logo. Compliance holds Cases (was Priorities; default assignee and priorities), a new Regulatory reporting tab (entity, branch, address and reporting currency), Report templates (was Reporting) and Policies (was Documents, now headed Policies and procedures). The old Priorities page redirects to Cases, and priorities are a reorderable table with a drag handle that works with the mouse or the keyboard.
  • ImprovedAddresses and transaction hashes shown one way, as chips — agent prose used to show an address three different ways: a chip pointing at a shortened value, which opened nothing and sometimes on the wrong chain, bold text with no full value to copy, or inline code. Every address or transaction hash is now either a chip on its own chain carrying its full value, or plain shortened text when the agent never saw the full value. This is enforced in code against the data the agent was given, not by the prompt alone. Typology signals, the case name and the questions sent to a customer carry no chips. Requests for information now carry full addresses, which is what lets a customer find the wallet.
  • ImprovedThe agents write in plain language, not our field names — officers were reading our own vocabulary in investigation output: "the no-match typology", the name of an internal flag, a vendor status code. Every agent that writes officer-facing prose — findings, disposition, narrative, case naming, chat, OSINT and typology signals — is now held to plain language. A term is caught only if it actually appears in the data that agent was handed, so a genuine exchange name is never rewritten. Structured fields keep their fixed values.
  • ImprovedChat shows what a policy lookup found — when the agent looks up your policies in chat it now shows one row per clause it matched, with the document and heading, opening the document, or No matching SOP with a link to add one. A run of back-to-back investigations in the same thread also rolls up into one row rather than stacking.
  • ImprovedTransfer history reads through block explorers — one read now serves both the investigation and the case map, through the block explorers already used for evidence. Evidence windows are now consistent in time: before, each feed returned its own newest rows, so the three feeds could cover different periods, and every stored history now covers one common period. Bitcoin, Tron and Dogecoin are not covered on the map until a provider exists for them; Redbelly gains map coverage. The browsing filters are now date range, direction, asset and counterparty. Filtering by amount is gone, because explorer rows carry no prices.
  • FixedQuestions for the customer could tip off the customer — two faults, both fixed. First, the questions the agent drafts for a customer appeared on cases that were not a request for information: on an escalation it often copied its list of things the reviewer must examine into the customer questions, so an officer saw questions only we can answer. They now show only on a request for information. Second, some of those questions referred to a report, a regulator, suspicion or our own internal steps. Telling a customer that a suspicious matter report has been or might be made is the offence of tipping off under section 123 of the AML/CTF Act. Those questions are now withheld, and the reasoning says when one was. Saved recommendations are not changed; the page no longer shows the risky ones. An officer must still read every question before sending it: this is a safety net, not a guarantee.
  • FixedCase chat answers from the case's own record — a case chat went wrong in several ways at once while an officer was preparing a report. It now describes how a case was opened only from the case's own alerts and record; says "not among the wallets our customers have declared" rather than "not a customer", and which records it searched; reads this case's own transfers and customers before searching other cases; never assumes a chain, so an 0x address with no chain given is looked up on every EVM chain and each match names the chain it was declared on; never asks the officer for something the case record already holds; and names chains by name rather than by code. Times are now written as the agent read them and rendered by kind: a workflow time such as alert received or case opened shows in each reader's own zone, and an on-chain or vendor time stays in UTC, as on the case page.
  • FixedTransfers failed to price for a non-USD reporting currency — any organisation with a reporting currency other than US dollars could not price its transfers: the price cache was read in a way the cache rejected, the enrichment was marked failed and each retry failed the same way. Prices are now read one currency at a time in one burst, and existing cached prices stay valid.
  • FixedA missing typology answer no longer fails the investigation — when the typology model returned no structured answer the whole investigation failed: findings gathered, no disposition and Investigation failed on the case. A missing answer is now recorded as no typology and the case is still disposed. A malformed answer still fails, because that is a contract break rather than a skipped answer.
  • SecurityThird-party content reaching the agents is screened for prompt injection — output from third-party tools — web search, case documents and counterparty screening vendors — is now screened for prompt injection before it reaches the model, as conversation messages already were. A result that fails the screen is withheld and the run continues. Every model call is also bounded by a time limit, so a stalled vendor stream ends the turn with an error rather than holding a chat open.
Design partnersFounding pricing, locked. And a say in what we build next.