Put your agent in a cell

Attackers pay to try it. The bounty sits in escrow, so you cannot pull it once the lock starts, and you get an on-chain attack log plus a threat report.