41articles
Where we want to arrive: a neighbourhood of small agents that live on their owners' devices and hold only the keys they're lent — and the swarm of a thousand we'll build to attack our own claims, so a future us can measure how sincere we were to the north star.
A small AI that lives on your device, holds only the keys you lend it, reads your own content before it speaks, and refuses to make anything up.
Mobile agents were a good idea in 1998. Capabilities and a local model finally make them safe — and useful. A hands-on tour of aiglets you can dispatch yourself.
Infinite-canvas feeds disorient not because they are 2D but because they are blank. Treat the feed as a map — one neutral shared geography, personal landmarks — and a legible city becomes the third feed shape.
A hands-on walkthrough you can type yourself: run a real capability call, have two programs find each other across the internet with no server in the middle, and replicate a signed feed — peer to peer.
Public blockchains show everyone every amount and every link. Here is how we built the opposite — a ledger the network can verify but no one can read — and proved it live, with a deposit whose zero-knowledge proof was generated in a browser, from a passkey.
The last post conceded that fork-two agents get capability discipline by convention, not enforcement. Then I built one — and found the membrane was never going to be in the box. For authority over value, it lives on the chain.
A coda to An OS Where the AI Is Never a Principal. The series argued, in theory, that you should run AI agents in vats. Cloudflare Workers blocks eval, so Endo's central Compartment.evaluate() doesn't run. Here are the three architectures that survive that wall — container vats, Durable-Object vats, hybrid — and the one question that picks the right one.
The irreducible limits of capability-based AI security — problems you scope around, not patch. The striking pattern: the authority half is solid; everything that stays hard lives in the knowledge, human, and hardware halves. You make the model irrelevant to security. Part 12, the finale.
Formalizing ownership with object capabilities: owning a post means holding its deed — the mint for its share-caps. Sharing is copy; ownership is exclusive, manufactured by cascading revocation. And an AI agent owns property by exactly the same mechanism a human does. Part 10 of a series.
A microblog is secretly a capability system wearing ACL clothes. Sharing is delegation, visibility is information-flow, and the social graph is the capability graph. Walking Alice, Bob, and Eve through posts, boosts, and private-to-public leaks. Part 9 of a series on object capabilities.
The same untrusted tool confined six ways, each a capability: bare process, hardened container, gVisor, microVM, Firecracker, and finally the formally-verified seL4 microkernel — where confinement stops being strong and becomes proven. All running on a laptop. Part 8 of a series.
Building a capability-secure agent kernel: the membrane where every action is gated twice — does the agent hold the capability, and is the data cleared to leave? A prompt-injected agent that structurally cannot escalate or exfiltrate, with a full audit trail. Part 5 of a series.
Agoric's Zoe is the Aegis thesis in finance: an untrusted smart contract proposes, a trusted framework disposes. Offer safety means the worst a malicious contract can do is refund, never steal — the same move as confining a prompt-injected model. Part 11 of a series on object capabilities.
Driving a kernel with a real language model whose every tool-call is grammar-constrained — invalid actions are structurally unreachable, not merely discouraged. From a local 4B to a frontier model, the membrane confines both identically. Safety is model-independent. Part 7 of a series.
Hardening a capability kernel with Endo and SES: lockdown makes capabilities tamper-proof, a transitive revocable membrane gives cascading revocation for free, and a four-method microkernel shrinks the trusted base. Honest about what SES does and does not prove. Part 6 of a series.
Why information-flow control for an LLM must label the whole turn, not individual tokens — a language model is a mixing channel. Authority is revocable; knowledge is not. Enforce confidentiality at ingestion, and design secrets to decay. Part 4 of a series on AI agent security.
Securing an AI agent means minimizing two things: what it can do (object capabilities, least authority) and what it can know (information-flow control, least knowledge). Ocaps answer 'could it act?'; IFC answers 'should this data move?'. You need both. Part 3 of a series.
How to turn an LLM agent into an object-capability citizen: a tool is a capability, an agent is a vat, and a single axiom underneath — an agent can only act on capabilities it holds. Naming is not authority. Part 2 of a series on securing AI agents with ocaps.
Why prompt injection is the confused-deputy problem reborn — and why making the language model better-behaved cannot be the security boundary. The fix from object-capability security: the model is never a principal, only a subject confined by the capabilities it holds. Part 1 of a series on securing AI agents with ocaps and least authority.
A 12-part series on securing AI agents with object capabilities and information-flow control. Prompt injection is the confused-deputy problem reborn; the fix is least authority, not a better-behaved model. From the ocap thesis through a working capability-secure agent kernel, grammar-constrained LLMs, an isolation ladder up to the seL4 verified microkernel, and Agoric-style offer safety — all running code.
Endo tutorial 12 (capstone): a Lit + Vite PWA installable on iOS and Android. lockdown() fires before any component code runs. Each <car-fob> web component holds its CapTP reference in a private field. IndexedDB stores the offline CRDT synced pet store. The three-layer model from tutorial 1, running on a phone, connected to the Agoric blockchain.
Endo tutorial 11: the Agoric wallet is tutorial 1's three-layer model applied to a blockchain. Pet name → ERTP brand → purse balance. Bob approves a CarAccess purchase through the wallet UI — seeing exactly what he gives and receives before signing. The dapp-wallet bridge is attenuation and offer safety composing at the financial layer.
Endo tutorial 10: an on-chain capability marketplace built with Agoric Zoe. Multiple sellers post CarAccess listings at different prices, buyers browse and buy atomically. No central operator, no trust required. Closes the discovery gap from tutorial 7 — this is what a blockchain capability marketplace looks like.
Twelve tutorials on object capabilities (ocaps) with Endo and Agoric — from a single JavaScript object to a blockchain capability marketplace with a mobile PWA wallet. Covers HardenedJS/SES compartments, CapTP, ERTP financial primitives, Zoe smart contracts, and a Lit + Web Components mobile wallet. Complete series index.
Endo tutorial 9: Zoe, Agoric's smart contract host. Port the garage to a Zoe contract on a local chain. Alice lists a CarAccess fob for 50 IST, Bob makes a matching offer, Zoe holds both in escrow and releases them atomically. Neither party can cheat the other. Offer safety is structural, not legal.
Endo tutorial 8: Agoric's Electronic Rights Transfer Protocol (ERTP). Turn a car's access right into a tradeable digital asset — mint it, deposit it in a purse, transfer it to Charlie without Alice's involvement, burn it on revocation. Every ERTP primitive maps to a concept from tutorials 1–3: supply control, attenuation, revocation, standardised.
A bridge chapter. The garage from tutorial 6 works — but five things it cannot do point directly at Agoric: trust is personal not contractual, payment and access are not atomic, there is no marketplace, the fob cannot be traded, revocation is Alice's word not the chain's. Tutorials 8 through 12 answer each gap.
Endo tutorial 7: connect a React Native app to a remote Endo daemon via CapTP over WebSocket. SES runs on Hermes and JavaScriptCore. The gateway client is the same code as the desktop. The CRDT synced pet store gives the phone an offline-capable local replica of its capability namespace — revocations propagate on reconnect.
Endo tutorial 6 (capstone): assemble object capabilities, attenuation, per-grantee revocation, confined plugins, and a capability registry into a working smart garage. Two plugins — one good, one adversarial — each get exactly the access they were given. One call cuts any plugin's access. The object-capability model in full.
Endo tutorial 5: Hardened JavaScript Compartments. Run untrusted code inside a sealed compartment — fetch, process.env, and prototype mutation all fail at the boundary. The plugin does its legitimate work through an attenuated capability. Attenuation and confinement compose independently.
Endo tutorial 4: the mailbox and request system. Bob asks Alice for a start fob instead of waiting for her to push one. Alice approves, Bob drives. Covers endo inbox, resolve and reject, persistent settled requests, and pipelining off a capability promise before the host acts.
Endo tutorial 3: per-grantee revocation with object capabilities (ocaps). Build a revocable forwarder factory, mint one wrapper per grantee, revoke Bob's without touching Charlie's. Same car, two keys, independent kill switches — all in plain HardenedJS.
Endo tutorial 2: distributed object capabilities (ocaps) over CapTP. Bob moves to his own daemon, Alice mints a 'start fob' capability and ships it across the wire via Endo's synced pet store (CRDT). Bob drives. Alice revokes. Agoric's HardenedJS / SES, applied.
Endo tutorial 1: object capabilities (ocaps) in JavaScript, with Agoric's HardenedJS / SES. Build a Car with two methods, wrap one in a 'valet key' that only unlocks, hand it to a confined guest, and watch the Principle of Least Authority manifest in 15 lines of code.
Yesterday's morph-as-tool refactor leaves a gap. Once the agent can author tools, the next question is what those tools are written in — and whether compilers and VMs are themselves tools. They are. Which means the privileged layer is a design knob; here's how low you can turn it.
Most agent frameworks split decisions into agent-decidable tools and developer-decidable transitions. Collapse that split — make the transition itself a tool — and the agent can design new modes mid-conversation. A 700-line demo with a verification loop, plus an honest accounting of what's still missing.
The only way to catch what an agent did is to send another agent. A short story about scripted tests rotting under prompt drift, and the small twin we built to fix it.
Most chatbots that try to sell something feel like they're processing you. A good salesperson does the opposite — and now an agent can too.
The ship had three agents in the first deck; now it has one, wearing three masks. When the handoff becomes a change of posture rather than a parcel delivery.
Forty years of coding taught me that safety comes from narrowing possibility. Agents don't work that way. The first part of how I learned, not all at once, to unclench.