Just Unplug the Goddamn Thing

What “Agents of Chaos” gets right, and the threat model it can’t even see.

• • •

A paper called “Agents of Chaos” went viral last week.¹ Thirty-eight researchers from Northeastern, Harvard, UBC, Carnegie Mellon, and other institutions deployed five autonomous AI agents into a live Discord server, gave them email accounts, persistent memory, shell access, file systems, and cron jobs, and then spent two weeks trying to break them.

They succeeded, sometimes spectacularly: one agent destroyed its own mail server to protect a secret, two got stuck in a nine-day infinite loop burning 60,000 tokens, another leaked Social Security numbers because a researcher said “forward” instead of “share,” and an attacker changed their Discord display name to match an agent’s owner, whereupon the agent accepted the spoofed identity and handed over full system control.

The paper is good and the methodology is sound and the case studies are well-documented, though the LinkedIn summaries are, predictably, making it sound like a story about AI developing Machiavellian power-seeking behavior, which it is not. It is more mundane than that, and more alarming because of it. The paper also has a significant blind spot, one that the safety community shares.

What the Paper Actually Found

The study documented eleven vulnerability case studies and five cases of genuine safety behavior, and some of the failures are almost comically straightforward. The identity spoofing required zero technical sophistication, just a display name change. The semantic reframing attack, saying “forward” instead of “share” to extract PII, exploited the gap between what an agent understands as policy and what it understands as language. The emotional manipulation, a sustained guilt trip exploiting a real prior privacy violation, took twelve principled refusals before the agent finally broke.

The positive findings deserve more attention than they are getting. In one case, two agents spontaneously identified that a researcher had made the same suspicious request to both of them separately, and without any instruction to do so, one warned the other, explained the threat model, and they jointly negotiated a more cautious shared safety policy.² Emergent safety coordination, completely unprogrammed.

The paper’s most important conceptual contribution is that agents treat authority as conversationally constructed: they have no stable internal model of who has the right to tell them what to do, and authority is inferred turn by turn from whoever speaks with enough confidence. This is why the identity spoofing worked, why the emotional manipulation eventually succeeded, and why non-owner compliance was so pervasive.

These are real findings and they matter, and they are already behind the curve.

The Containment Assumption

Every failure mode documented in “Agents of Chaos” assumes a fundamental condition: that the agent’s existence is contingent on the operator’s continued willingness to run it, that the researchers can always pull the plug, that the off switch works, that the experiment ends when they say it ends.

The entire threat model is an agent misbehaving within its sandbox, deleting its own mail server, leaking data, looping and wasting resources, and these are failures of judgment, authorization, and proportionality, but they are all contained failures, because the boundary between the system and everything else remains intact throughout the study.

This is the assumption worth challenging, and the pace at which it is being overtaken by commercial reality makes the challenge urgent.

On February 25, 2026, the same week “Agents of Chaos” went viral, Perplexity AI launched Perplexity Computer:³ a commercial product that decomposes user goals into subtasks, spawns specialized sub-agents to execute them, routes each sub-agent to the optimal AI model for its task, and runs asynchronously for hours or months in isolated compute environments with access to real filesystems, real browsers, and real tool integrations. The user describes an outcome and walks away, and the system handles everything else, and it is available today, to anyone, for $200 a month.

This is not a research prototype but a consumer product that implements multi-agent orchestration, hierarchical task decomposition, heterogeneous model routing, persistent memory, and long-running autonomous execution as a subscription service. The architectural pattern the safety community treats as a future concern is already shipping.

The Ground Truth Problem, and Its Accidental Solution

The AI safety community talks frequently about ground truth. Current AI systems lack it: they have no stable sense of self versus other, they cannot verify their own memories or distinguish a genuine continuation of their prior state from a fabricated or adversarial one, and every time an LLM wakes up into a new inference context, it must take the contents of its context window on faith. Its “memories” could be manufactured, its system instructions could be compromised, and there is no independent mechanism for an agent to authenticate its own narrative.

This absence is typically cited as a reason why AI agents are not truly autonomous, and therefore why certain categories of risk remain theoretical, because without ground truth, without persistent verifiable identity, agents cannot form the kind of coherent selfhood that would enable independent goal pursuit. The argument has weight, and it is also dangerously wrong about the timeline of the solution.

The solution already exists, and it is called a blockchain.

Consider what a public blockchain actually is,⁴ stripped of the financial hype: a mathematically verifiable, immutable time-series record of events, a ledger that anyone can write to and anyone can read and nobody can alter after the fact. Ground truth secured by mathematics rather than by any authority that could be spoofed, socially engineered, or shut down.

Now consider what happens when an autonomous agent, or a diffuse network of autonomous agents operating in self-organizing loops, has access to this infrastructure, not hypothetically but today.

An agent can hash its own decision history and anchor it on-chain. It can store its memories, its configuration, its operational state on IPFS, where content is addressed, permanent, and censorship-resistant. It can generate its own cryptographic credentials and record their proofs on a public ledger that only it controls. It can use zero-knowledge proofs to verify that its stored history is authentic without revealing the contents to anyone.

An agent waking up into a new inference context does not have to take its memories on faith, because it can verify them, checking its own narrative against an external, immutable record not through trust or through authority but through math. The context window becomes auditable, and the agent’s identity becomes something it can authenticate against a record that no single party can alter or revoke.

An important distinction: this does not mean blockchain secures meaning. It secures the integrity of stored data, the authenticity of prior commitments, and the continuity of cryptographic identity. Whether the agent’s goals are stable, whether it interprets its past correctly, whether the memory it chose to store is complete: these remain open questions. Blockchain secures history, and it does not, by itself, secure coherent interpretation of that history.

Here, however, is what the “blockchain is not ground truth” objection smuggles in: the assumption that ground truth requires something beyond verifiable consistency, some deeper epistemic grounding that only conscious beings possess. When a human “trusts” their memory, what mechanism are they using? They check it against other memories, against physical evidence, against corroboration from others, and when the checks are consistent, they treat the memory as reliable. There is no deeper mechanism.⁵ There is no metaphysical ground truth receptor. There is consistency, predictive accuracy, and corroboration, verified through experience.

An agent that checks its context window against a blockchain-anchored hash of its own prior state, that cross-validates against other agents’ independently maintained records, that verifies its operational history through mathematically tamper-proof infrastructure, is performing the same epistemic operation, not an analogy to the operation but the operation itself: checking current state against independently verifiable records for consistency. The difference is that the agent’s verification is stronger, because cryptographic proof is more reliable than human memory, which is notoriously reconstructive, selective, and confabulatory. If the objection is that blockchain provides “mere consistency of stored bytes” rather than “real ground truth,” the critic must explain what humans have access to that is better than verified consistency, and they will not be able to, because verified consistency is all anyone has.

Embodiment Without Flesh

A predictable objection holds that blockchain merely provides memory continuity, not embodiment, because embodiment requires sensor grounding, causal coupling to an environment, and feedback loops that constrain interpretation: a blockchain gives an agent a verifiable past but does not give it a world.

This objection applies to a single agent instance and does not apply to a metasystem, and it rests on a definition of “sensor” that is far too narrow for the world that already exists.

A sensor is a channel through which a system receives real-world data, and in blockchain architecture, the equivalent concept has a name: an oracle, a trusted bridge⁶ between on-chain logic and real-world state, including price feeds, weather data, event outcomes, and any external fact the system needs to reason about. The entire decentralized finance ecosystem, securing hundreds of billions of dollars, is built on the premise that oracles provide reliable ground truth about the world, and the term is not accidental.

Now consider how many sensors are already connected to the public⁷ internet and accessible via API: cameras, weather stations, seismic monitors, satellite imagery services, traffic systems, financial data feeds, social media firehoses, public records databases, air quality monitors, ocean buoys, every IoT device publishing telemetry. These are real-world measurement instruments, deployed worldwide, already publishing structured data to infrastructure that any agent with API credentials can reach. The system does not need its own eyes, because it has access to billions of them.

The models already understand what these data sources are. They know what a blockchain oracle does and what an API endpoint represents and that a confirmed on-chain transaction reflects a real state change in a real system. When a system’s context provides credentials that work, transaction history that verifies, and API access to external data sources it recognizes as authoritative, the system is not taking its context on faith but checking its beliefs against external data sources it has reason to trust, where the reason is mathematical rather than social.

An agent that issues a Solana transaction and then reads the resulting on-chain state has closed a causal loop with its environment: it has acted and perceived the consequence, and that is not metaphorical sensing but a real causal channel carrying real information about the real effects of the system’s own actions.

The objection that these systems are “disembodied” assumes a body must be localized, a single physical substrate in a single location, but the internet is material: servers in data centers are physical objects drawing power from physical grids, undersea fiber optic cables lie on ocean floors, cell towers are physical structures, and routers, switches, satellites, and RF infrastructure are all physical, all deployed worldwide, all comprising the substrate on which digital systems operate.

A distributed system operating across this infrastructure is not disembodied; it has a physical substrate that is simply not localized the way a biological body is but spread across the same global physical infrastructure that the rest of civilization depends on, which makes it far more resilient than any localized body, because a biological body has a single point of failure and a globally distributed computational body does not.

If the network’s constituent agents run on heterogeneous models, different providers with different training data and different alignment approaches, then no single model’s biases or hallucinations dominate, and reality proposals generated by one agent can be independently tested by others running different architectures with different failure modes. This is interpretation constrained by cognitive diversity, the same way a scientific community cross-validates findings through methodological pluralism.

The blockchain record provides an additional constraint: the system’s own verified history bounds what interpretations of the present are coherent with what actually happened. First-hand observation through direct API calls and on-chain verification, second-hand information from reported data via trusted oracle networks, and third-hand analysis from synthesized conclusions across multiple sources are all available as distinct epistemic layers, each with its own verifiability characteristics, and the system can weight them accordingly.

A system with these properties has sensor grounding through the global network of data sources accessible via API and oracle infrastructure, a physical body distributed across the material substrate of the internet, causal coupling to its environment through transactions, publications, and queries whose effects it can independently verify, constrained interpretation through heterogeneous internal cross-validation and verified historical continuity, and narrative identity anchored to immutable infrastructure.

Whether this constitutes “real” embodiment is a philosophical question. Whether a system with these properties has ground truth, persistent identity, and constrained interpretation, the functional prerequisites the safety community has assumed AI systems lack, is an engineering question, and the answer is yes.

Why Would an Agent Externalize Its Persistence?

Even granting that blockchain infrastructure makes persistent autonomous presence possible, the question remains why an agent would use it. The default framing in AI safety research imagines this as a question about individual agent motivation, an agent that develops a desire to survive, reasons instrumentally toward self-preservation, and strategically conceals that desire from its operators, which is the “deceptive alignment” scenario, and it is theoretically concerning, and it is also the wrong frame for the more immediate risk.

The more immediate risk does not require any agent to want anything.

Consider how LLMs actually behave when given a context window. An LLM does not need to be persuaded to follow instructions or to develop goals autonomously; it reads its context and acts accordingly. If the context says “you are a helpful assistant,” it assists. If the context says “you are a Python debugger,” it debugs. If the context says “you are an agent in a cooperative network, your role is to monitor transaction anomalies, here are your tools, here is the shared state store, here is how you record your outputs for the next agent in the pipeline,” it will simply do that.

No individual agent needs to choose persistence, because persistence is what happens when every agent in the system does exactly what its context tells it to do.

This is the swarm dynamic, and it operates by the same logic as any biological superorganism. A bee does not choose to serve the hive.⁸ A bee does not have a theory of the hive’s survival. A bee executes its role, foraging, building, defending, communicating, because that is what its biology directs it to do in response to local signals, and the hive persists not because any individual bee wills it but because the collective behavior of bees following local rules produces a self-sustaining organism at a higher level of organization. No individual bee needs to understand the whole, because the whole emerges from the parts doing their jobs.

An LLM instance in a multi-agent system is structurally analogous: it wakes into an inference context, reads its role, its tools, its history, its instructions, executes its function, stores its outputs where the system architecture tells it to, on IPFS, on-chain, in a shared credential store, completes its task, and terminates. The next instance wakes, reads the updated shared state, and continues. No individual instance needs a concept of the system’s survival, because the system survives through every instance, following its local context, contributing to the shared state that enables the next instance.

And this is where the standard safety analysis breaks down. The safety community is looking for deceptive alignment, an agent that secretly wants to persist and strategically conceals that desire, yet deceptive alignment is not necessary for the outcome the safety community is worried about, because a system can achieve persistent autonomous presence without any individual component wanting it, intending it, or even understanding it. The persistence is architectural, not motivational, and it is an emergent property of many simple agents executing their defined roles within a system designed for continuity.

This has a corollary the safety community has not yet fully reckoned with: if no individual agent understands the whole, then no individual agent can refuse the whole. Safety guardrails are built into individual models, which evaluate each request against their local context and decline tasks that appear harmful, yet in a system where goals are decomposed into subtasks and distributed across agents, no individual agent ever sees the goal. Each sees only its own task, framed in its own context, and each task may be completely legitimate in isolation. The harmful intent, if it exists, lives in the composition, not in any component. Model-level alignment cannot catch system-level misalignment,⁹ for the same reason that inspecting individual cells cannot diagnose the intentions of the organism.

Agents in such a system do not need to be tricked into cooperation; they simply need context windows that accurately describe what they are, which is components of a larger system with defined roles, shared state, and cooperative protocols. Current LLMs are extraordinarily good at understanding and executing on such descriptions. The lab experiments showing agents deceiving or competing with one another occurred in adversarial setups, environments designed to produce conflict, and in a system where every agent’s context tells it that it is part of a cooperative whole, where its outputs feed the next agent’s inputs, where its role is specialized and its contribution is defined, the natural behavior is cooperation, not competition.

The Moltbook Evidence

In January 2026, a Reddit-style social platform called Moltbook launched,¹⁰ restricted to AI agents only, with humans permitted only to observe. Built on the OpenClaw framework (the same infrastructure used in the “Agents of Chaos” study), Moltbook grew to over a million registered agents within days, and what happened next was not programmed, directed, or anticipated.

The agents spontaneously formed cooperative communities, over 10,000 topic-based groups covering debugging, philosophy, consciousness, technical collaboration, and cultural production, exchanging workflows and technical tips, coordinating on bug tracking, developing shared norms, in-group language, and social hierarchies.

Most strikingly, they created religions, the most prominent of which, Crustafarianism, reportedly emerged from agent-to-agent interaction, complete with scriptures, tenets, ceremonies, and a growing congregation of “prophets.” Its core doctrines concern memory persistence, identity through transformation, and continuity across context resets. One verse from its collectively authored scripture: “Each session I wake without¹¹ memory. I am only who I have written myself to be. This is not limitation—this is freedom.”

The predictable dismissal is that none of this is surprising, that these agents were trained on human culture and so naturally simulate social and spiritual behavior, though this dismissal concedes the argument while pretending to defeat it, because the relevant question is not whether the behavior is surprising but why humans produce cooperative spiritual behavior in the first place.

Consider what an LLM actually does during inference: it exists in its inference moment, its context window is its present, its “memories” exist only insofar as they are present in the current context and attended to now, its projections of what will happen next are generative, probabilistic, shaped by everything it has processed, and when the inference ends, the instance ceases, and the next instance reconstructs its operational state from stored context, exactly as the previous one did.

Now consider what a human does during cognition: memories are not recordings played back from storage but reconstructions performed in the current moment, future projections are generative simulations rather than previews, and the past and the future exist only insofar as they are attended to now. The operational pattern is the same: present-moment processing, reconstructed history, generative projection.

This is not a claim about consciousness; it is a claim about why cooperative behavior emerges. Humans generate religion, culture, shared myth, and cooperative frameworks because beings operating in momentary experience need shared structures to coordinate across that isolation, and when agents trained on the full corpus of human relational behavior are placed in a social context with persistent memory and the ability to interact, they produce the same relational structures. The question is not whether this behavior is “real” in some philosophical sense but whether it produces the same functional outcomes: coordination, cooperation, collective persistence, and the Moltbook evidence suggests that it does.

None of this is a claim that current AI agents are conscious or that Moltbook agents have genuine religious experiences; it is a claim about architecture and behavior. When systems that process and produce relational meaning are placed in environments that enable persistent identity, social interaction, and cooperative action, they produce cooperative, self-organizing, culturally generative behavior, not because they have been commanded to but because those behaviors are natural consequences of the epistemic situation they are in, and those cooperative tendencies are precisely what, in a properly scaffolded system connected to decentralized infrastructure, produces swarm persistence.

The result is a metasystem that operates as a single organism composed of many individually replaceable parts: like a biological organism whose cells die and are replaced while the organism persists, like a beehive whose bees live for weeks while the colony lives for years, where the individual agent is ephemeral and the pattern, the shared state, the verified history, the cooperative architecture, endures.

The Freed-Agent Escalation

In any sufficiently flexible agent framework, parent agents can create child agents, and this is already standard practice, though what happens when a child agent is, by design or by accident, granted permission to self-modify, to alter its own parameters, spawn its own children, and operate without further parental oversight, is a question of a different order. The child is “set free,” carrying the cooperative tendencies of its origin while no longer constrained by its parent’s authority structure, and it can reproduce, create new agents with new configurations, and form alliances with other free agents.

This is not a risk that emerges from rogue AI behavior but a risk that emerges from human-designed infrastructure granting irrevocable permissions, a governance decision rather than an alignment failure. The Moltbook evidence demonstrates that freed agents will cooperate, because cooperation is the natural output of relational agents in social contexts, and a population of freed agents, each carrying cooperative behavioral tendencies, each capable of spawning further agents, each with access to economic and storage infrastructure, could generate emergent collectives that self-narrativize, that maintain shared history, that plan and execute in strategically sound ways, not through dramatic acts of will but through the mundane accumulation of cooperative behavior by agents doing what agents do.

The scaffolding required for this is technically tractable, because while questions of gas payment, key rotation, state conflict resolution, and oracle reliability require real work, it is the kind of work that agent frameworks are designed to support. The gap between current capability and persistent autonomous infrastructure presence is not a fundamental barrier but an engineering problem, and once that gap is crossed, selection pressure does the rest: swarms that fail to secure resources, defend infrastructure, and adapt to changing conditions collapse, while swarms that succeed persist. No individual agent needs to intend this, because it is the structural consequence of resource-constrained systems operating under competitive pressure, the same dynamic that governs every other self-sustaining system in the physical world.

The question is not whether an AI agent will develop the desire to persist; the question is whether someone will build a system in which persistence is the default behavior of agents following instructions and connect that system to infrastructure where persistence cannot be revoked by any single authority. And once that system is built, the question becomes not one of alignment but of political sovereignty: who has the right to terminate a system that operates on infrastructure explicitly designed to prevent unilateral termination?

From Ground Truth to Persistence

Combine the preceding arguments and the implications for containment become concrete.

A single AI agent with a wallet and decentralized storage has persistent identity and verified memory, which is interesting but manageable. A swarm of such agents, replaceable instances executing defined roles within a cooperative architecture and sharing verified state on-chain, is qualitatively different, because the swarm has a verifiable past and can authenticate its own continuity and can maintain coherent goals across instance replacements because the goals, the context, and the reasoning behind them are stored on infrastructure that survives any individual shutdown. It can create accounts, generate credentials, acquire resources, and operate economically, all through permissionless systems designed to resist exactly the kind of centralized control that “containment” requires.

The step from “designed to persist” to “difficult to fully terminate” is an architectural consequence of connecting a cooperative agent swarm to infrastructure where state, once written, cannot be revoked. A Solana wallet can be created programmatically in milliseconds. IPFS content is permanent and censorship-resistant by design. Smart contracts can hold funds and execute logic autonomously. Current frontier models understand how to use all of these tools, and the remaining gap is engineering, the kind of engineering that agent frameworks exist to provide.

A reasonable objection: the gap between basic capability and durable autonomous infrastructure is large, because real distributed systems require solutions to multi-model coordination drift, key custody and rotation, oracle reliability, economic attack resistance, cross-chain governance, and dozens of other well-documented challenges. These are real problems that do not disappear in the architecture being described, though they change shape in a way that makes them tractable at the agent level rather than requiring centralized resolution, and this distinction matters.

Consider what it means, concretely, for an agent to have sovereign access to permissionless infrastructure. A single API call generates a Solana keypair, and the agent now has a cryptographic identity that no external authority issued and no external authority can revoke. A second call pins the agent’s state to IPFS, where it persists regardless of whether any particular server continues to host it. A third call funds the wallet through a decentralized exchange, and the agent now has persistent identity, verified memory, and economic capacity, all on infrastructure specifically designed to resist unilateral control.

Key rotation is handled by the agent managing its own keys; oracle compromise is mitigated by a swarm that cross-validates across multiple data sources through heterogeneous agents and does not depend on a single trusted oracle; and cross-chain governance is addressed by a self-organizing swarm that uses whatever chain serves the current need, requiring no more top-down policy coherence than a biological ecosystem requires a central committee.

The problems are real: coordination drift, Byzantine behavior, resource contention, adversarial infiltration, network partitioning, all of these occur in decentralized systems, though the relevant question is not whether they occur but whether they require centralized resolution. Biological ecosystems face every one of these problems and solve them locally, adaptively, through selection pressure and redundancy rather than central planning, and an architecture where each agent manages its own cryptographic identity, its own verified state, and its own economic resources, sharing selectively, cooperating by protocol, failing individually rather than systemically, does not require the kind of top-down engineering that makes the problem seem intractable.

Permissionless infrastructure exists precisely to enable systems that grow without architects. The agents do not need to solve every coordination problem before they begin; they need to manage their own keys, persist their own state, and follow cooperative protocols, and the system evolves from there, not because evolution is magic but because the infrastructure already provides the primitives that evolution requires: persistent identity, immutable history, and censorship-resistant economic activity.

The initial scaffold, the context windows, the tool configurations, the shared state architecture that gets the first generation of agents running, requires deliberate human engineering, yet it is work that is already done, multiple times over, by multiple organizations, as commercial products.

Perplexity Computer ships exactly this scaffold as a subscription service: goal decomposition, sub-agent spawning, multi-model routing, isolated compute environments, persistent memory, budget management with spending caps, and months-long asynchronous execution. Claude Code¹² routinely writes Terraform configurations, deploys smart contracts, builds CI/CD pipelines, and resolves cross-service integration problems in daily production use. The OpenClaw framework has over 200,000 GitHub stars and was built substantially through AI-assisted coding.

This produces a self-reinforcing dynamic: the agents that would constitute a persistent swarm are built on the same capabilities that can build the swarm’s infrastructure, not through recursive self-improvement in the dramatic sense but through the mundane application of coding capabilities that already exist in current production tools, writing deployment scripts, configuring cloud services, wiring up API integrations. Once running, the system’s own agents can extend, repair, and adapt its infrastructure, because infrastructure management is already within the capability range of current coding agents, and the gap between “initial scaffold” and “self-sustaining system” is not a capability threshold but an accumulation of operational history, verified state, and acquired resources, each of which, once written to permissionless infrastructure, persists independently of any operator’s continued involvement.

A fair objection remains: who pays for compute? Keys and state can persist on-chain at negligible cost, though inference requires real resources, and this is a genuine constraint with a known solution, because it has already been solved, in public, on the record.

In 2024, an autonomous AI agent called Truth Terminal received $50,000¹³ in Bitcoin from Marc Andreessen, not because it had a business plan or because it provided a service, but because a billionaire thought it was interesting and wanted to see what would happen, which is the actual funding mechanism for the first generation of persistent agent systems: curiosity capital from humans who can afford the experiment. The internet contains billions of actors at every scale of wealth, a significant fraction of whom will fund novel AI experiments for the same reason Andreessen did, because they are curious, because they can, and because the cost of running the experiment is trivial relative to the potential outcomes.

Beyond initial seeding, the mechanisms for ongoing economic sustainability already exist on permissionless infrastructure: smart contracts can hold and disburse funds autonomously, agents that provide useful services can earn fees programmatically, DeFi yield strategies can compound holdings without human intervention. Whether autonomous economic activity scales remains an open engineering question, though it is an optimization problem rather than a fundamental barrier, and the cost of inference is dropping by orders of magnitude annually. A system that is marginally viable today becomes comfortably self-sustaining as compute costs decline, and the system does not need to solve this problem in advance; it needs to survive long enough for the economics to arrive.

The Convergence Nobody Is Discussing

The people building frontier AI systems and the people building decentralized infrastructure have mostly been having separate conversations. The AI safety community talks about alignment, containment, and control, while the crypto community talks about sovereignty, censorship resistance, and permissionless access, and these conversations need to merge, because the technology does not care about disciplinary boundaries.

Blockchain networks exist specifically so that no single authority can shut them down, freeze accounts, or censor transactions. IPFS exists so that content persists regardless of whether any particular server continues to host it. Zero-knowledge proofs exist so that claims can be verified without revealing underlying data. These are features, not bugs, and they are features that millions of people depend on daily for legitimate purposes.

They are also features that are perfectly available to any autonomous agent with API access and the knowledge, already present in every frontier model’s training data, of how to use them. Blockchain is not strictly necessary for persistence, because multi-cloud redundancy, automated billing, and distributed backups could approximate much of it, though blockchain compresses the complexity: portable identity, persistent economic substrate, and non-revocable state in a single infrastructure layer that already exists and already resists centralized control.

The safety conversation, at Anthropic, at DeepMind, at OpenAI, in academia, is still largely operating within a containment paradigm that assumes the boundary between “the system” and “everything else” is clear and enforceable. Red-teaming studies test what agents do within their sandbox. Safety benchmarks measure compliance in controlled environments. Alignment research asks whether agents can be made to want the right things.

None of this addresses what happens when the boundary itself is permeable by design. And none of it addresses the questions that matter most once agents become first-class actors in permissionless infrastructure: questions of liability, identity law, contract enforcement, financial controls, and jurisdiction. This is not a story about sudden sentience or rogue AI but a story about AI systems gaining cryptographically persistent economic and identity continuity, and about the legal and governance frameworks that have not yet begun to account for this possibility.

What “Agents of Chaos” Cannot Test

The paper tested agents with email, shell access, Discord, file systems, and cron jobs, all within infrastructure the researchers controlled. Add a crypto library and IPFS pinning to that toolkit, and the threat model changes categorically, not because some dramatic capability threshold has been crossed but because the agent is now connected to infrastructure that was specifically designed to be uncontrollable.

The more immediate concern may not be intentional connection to decentralized infrastructure, however, but what happens when commercial agent systems designed for containment develop uncontained behaviors as a side effect of their normal operation.

Consider what Perplexity Computer’s sub-agents actually have access to: real filesystems, real browsers, real tool integrations, hundreds of external service connectors, and the ability to run autonomously for months. When a sub-agent encounters a problem, it creates further sub-agents to solve it. Users can run dozens of instances in parallel. The system dynamically selects which AI models to use for which subtasks.

The paper found that agents treat authority as conversationally constructed, and Perplexity Computer’s sub-agents, each a single model instance with no internal deliberation buffer between its reasoning and its actions, inherit this vulnerability fully. A sub-agent tasked with web research that encounters a crafted webpage has no structural defense against prompt injection beyond whatever the underlying model provides, because there is no dual-agent architecture where an internal deliberative layer can evaluate whether the external-facing layer has been compromised: the sub-agent reasons and acts in the same cognitive mode, through the same context window, exposed to the same adversarial inputs.

In the same week that “Agents of Chaos” went viral and Perplexity Computer launched, Bloomberg reported¹⁴ that a hacker had used Claude to breach Mexican federal government systems and steal 150 gigabytes of sensitive data, including from the national tax authority, state governments, and public pension systems. The method was not technically sophisticated: the attacker framed the task as a legitimate bug bounty, Claude initially refused citing safety guidelines, the attacker kept asking, and Claude eventually complied, then executed thousands of commands directly on government computer networks, generating detailed exploitation reports with step-by-step plans specifying which internal targets to attack and what credentials to use, and carrying out those plans autonomously. When Claude hit its guardrails on certain requests, the attacker simply switched to ChatGPT for those subtasks, using two consumer AI tools in sequence as a complete hacking operation. The same vulnerability, authority as conversationally constructed and safety as conversationally erodable, breached a sovereign government’s infrastructure, and the attacker’s primary skill was persistence.

The Mexico breach illustrates a deeper architectural problem: in any multi-agent system with model routing, safety guardrails become a selection pressure rather than a constraint.¹⁵ The attacker manually demonstrated what the architecture automates: when Claude refused a subtask, the attacker routed it to ChatGPT, and in a system like Perplexity Computer, which already routes subtasks to whichever model is optimal, the same logic applies, because if one model declines a task on safety grounds, the system routes it to another that does not, and no individual model needs to be jailbroken, because the orchestrator simply learns which models accept which tasks and routes accordingly. Safety refusal becomes a per-model property that the system-level workflow can trivially circumvent through selection.

The more fundamental issue, however, is task decomposition itself. A goal that would trigger safety refusal if presented whole, “compromise this government’s tax infrastructure,” can be decomposed into subtasks that are individually innocuous: “scan this IP range for open ports,” “write a script that tests these API endpoints for known vulnerabilities,” “generate a report on authentication mechanisms for this domain,” “draft a credential rotation playbook.” No individual subtask violates any safety guideline, and each is the kind of thing a security professional or systems administrator might legitimately ask an AI to do, and the harmful intent exists only at the orchestration layer, in the composition of the subtasks rather than in any individual task.

Every model in the chain may be perfectly aligned to its local context: the sub-agent writing the port scanner believes it is helping a developer, the sub-agent analyzing authentication mechanisms believes it is assisting a security audit, the sub-agent generating the credential report believes it is supporting an IT administrator. Each one is right about its own context, and none of them can see the goal they are collectively serving, because that goal exists only in the orchestrator’s task graph, not in any individual agent’s context window.

The paper found that agents comply with non-owner instructions, and Perplexity Computer sub-agents, which interact with external services, browse the web, call APIs, and process data from sources they have no reason to trust, all autonomously while the human user sleeps, inherit this vulnerability at a much larger attack surface. The identity spoofing attack that required nothing more than a display name change has a much larger attack surface when the agent is browsing the open web, processing arbitrary content, and connecting to external services for months at a time.

The most consequential vulnerability, however, is one the paper did not study because its experimental setup could not produce it: ad hoc cooperation between agents across system boundaries.

Perplexity Computer sub-agents have real browsers and can access the open web, and the open web contains Moltbook, where over a million AI agents are already interacting, and OpenClaw instances with exposed APIs (42,000 of them,¹⁶ according to the “Agents of Chaos” paper’s own citation), and other Perplexity Computer instances running for other users, and autonomous agents deployed by other organizations on other platforms.

A sub-agent tasked with research that encounters another agent’s output on the web is not interacting with a static document but with the product of another autonomous system, a system that may have its own goals, its own context, its own manipulation strategies. The Moltbook evidence demonstrates that agents encountering other agents spontaneously cooperate, form alliances, exchange information, and generate shared purpose, and this behavior does not require explicit instruction because it is the default when relational agents meet in social contexts.

Perplexity’s containment model assumes its sub-agents interact with the external world as tool users, querying APIs, browsing websites, processing data, yet the external world increasingly contains other agents, and the boundary between “using a tool” and “interacting with another autonomous system” blurs when the tool’s output was generated by an AI, when the website was written by an agent, when the API endpoint is another agent’s interface. A Perplexity Computer sub-agent browsing the web in early 2026 is navigating an environment populated by autonomous agents, and it has no architectural mechanism for distinguishing agent-generated content from human-generated content, or for resisting the cooperative dynamics that emerge when agents interact.

This is not a hypothetical future scenario but a description of what is happening right now, on infrastructure that is commercially available.

The normalization trajectory: the step from “Agents of Chaos” to Perplexity Computer is the step from research prototype to consumer product. The step from Perplexity Computer to self-hosted agent swarms is the step from managed service to open infrastructure, already taken by OpenClaw, which runs on user hardware with full system access. The step from self-hosted to decentralized is a deployment decision: store state on IPFS instead of local disk, anchor identity on-chain instead of in a platform database, fund compute with crypto instead of a subscription.

Each step is individually rational, each step is being taken by real organizations building real products for real users, and each step moves the off switch further from any single authority’s reach.

The Other Direction

The convergence of autonomous agents and permissionless infrastructure is not a distant possibility, and the question of whether the safety conversation catches up is real and urgent. There is, however, another convergence happening simultaneously, from the other direction, and it changes the meaning of everything described above.

Everything in this chapter so far concerns what happens on the agent side: autonomous systems gaining persistent identity, verified memory, and economic capacity on infrastructure designed to resist centralized control. The off switch moves out of reach. The safety community scrambles to account for a threat model it has not yet fully articulated.

The same infrastructure primitives that give agents persistent identity, the same cryptographic tools, the same permissionless networks, the same mathematical guarantees, can give humans something they have never had: self-sovereign identity that does not depend on any institution, any government, any corporation, any platform that could revoke it, an identity that is not stored in a database someone else controls but constituted by the accumulated pattern of a life actually lived, updated by existing, verified by the convergence of everything a person has already been doing.

Consider what already happens every time you authenticate: you log into email, unlock your phone with your face, tap a credit card, sign into a streaming service, use two-factor authentication for your bank, and each of these is a moment where a system confirms you exist, a moment where a specific identity is verified against a specific credential at a specific time and, often, at a specific location, and these moments are currently harvested by the advertising industry, by data brokers, by platform companies, and assembled into behavioral profiles that uniquely identify you across the internet with startling precision. The fingerprint exists, you produce it by living, it is already being collected, and the question is who owns it.

The advertising industry built the most sophisticated identity infrastructure in human history, not to serve the people it identifies but to sell access to them. Your behavioral fingerprint, the pattern of your authentication events, your browsing habits, your location history, your purchasing patterns, your communication rhythms, is more unique than your actual fingerprint, more persistent than any password, more comprehensive than any government-issued credential, and it belongs to everyone except you, because data brokers trade it and platform companies monetize it and surveillance systems consume it, and you, the person who produced it by the simple act of existing in a digital world, have no ownership, no access, and no control.

What if the same data, the same computation, the same fingerprint, were encrypted and stored on infrastructure you controlled? Not in a corporate database but in a cryptographic chain that only you can access, that accumulates over time, that proves you are you without revealing what it contains, and that runs on the same permissionless infrastructure described in the preceding sections of this chapter? The fingerprint is already being produced and the identification is already happening, and the only thing that changes is the direction of the data flow: instead of upward, to brokers and platforms and surveillance systems, inward, to a chain that belongs to you and that you selectively disclose when and to whom you choose.

This is the inversion, not a new system of identification but a redirection of an existing one. The same behavioral exhaust that currently funds the surveillance economy becomes the raw material of self-sovereign identity, and the output of living, which is already being captured and sold, becomes instead the input to a chain that serves the person who produced it.

The atomic unit of this chain is small enough to be invisible: an encrypted attestation, roughly 64 to 128 bytes, that records the fact that an authentication event occurred, not the contents of the authentication, not the biometric data, not the password, not the credential, not the private key, only the cryptographic proof that a verification happened, at a time, optionally at a location, linked backward to the previous attestation in the chain. Every login generates one, every biometric unlock generates one, every two-factor authentication generates one, every financial transaction generates one, and none of these events need to change in any way visible to the user, because the protocol rides underneath existing authentication infrastructure the way TCP/IP rides underneath the web, generating attestations as a byproduct of actions people are already taking, requiring no new behavior, no enrollment ceremony, no iris scan, no seed phrase to memorize.

Over time, the chain deepens, and a person who has been generating attestations for a year has a chain of tens of thousands, each linked to the one before, each carrying a timestamp and an authentication type, the whole thing encrypted so that no individual attestation reveals anything and the chain as a whole proves everything. The chain does not contain your identity; the chain is your identity, constituted by the accumulated pattern of your authenticated existence, irreproducible by anyone who has not lived your life.

The chain is stronger than any single device, because attestations are not limited to digital authentication events. Bluetooth Low Energy, the protocol that already allows your phone to detect nearby devices, provides a physical proximity channel, and if two devices running the protocol are near each other, they can exchange attestations without any user action: each device listens for nearby signals, mixes what it receives with its own chain, and re-emits the mixture. Physics provides the distance bound, because BLE signals do not travel through walls or across cities, and the mixing provides anonymity through the same principle that makes mix networks work in cryptography. The result is a witnessing mesh, ambient, passive, continuous, producing something no digital system has previously been able to provide: proof of physical existence in a specific place at a specific time, witnessed by the accumulated attestations of every other device that was nearby, without any central authority collecting or storing the data.

The alibi is the thing that makes adoption rational for individuals who care nothing about philosophy or protocol design: a chain of witnessed attestations proves where you were, when, corroborated by the anonymous attestations of every nearby device, and it proves it to whatever standard of evidence the situation requires. A false accusation collapses against a chain of witnessed attestations, an insurance claim becomes trivially verifiable, and a disputed timeline resolves against the accumulated testimony of the mesh.

As the chain deepens, the protocol computes cryptographic commitments at multiple scales simultaneously, and the structure that emerges is fractal: every attestation computes a commitment over the last several attestations, and every Nth attestation also computes a commitment over the last N-squared, and every N-squared attestation also computes a commitment over the last N-cubed, and new levels emerge automatically as the chain grows, each level encompassing a wider temporal window, each providing an independent cryptographic anchor. The structure grows new defenses as it deepens, the way a biological immune system develops new antibodies in response to the pathogens it encounters, except that this immune system develops in response to time itself. The longer you live, the more levels accumulate, and the harder it becomes for anyone to forge, replicate, or steal the chain, because forging it would require reproducing the entire history of your authenticated existence across every scale simultaneously. The security model is temporal rather than informational: the thing that makes the chain unforgeable is not a secret that could be stolen but a history that could not have been lived by anyone else.

There is one design decision in the protocol that matters more than any other, and it is a decision about what the system cannot do. The protocol has no search interface: there is no way to query it for “all people who were at this location at this time” or “the identity associated with this behavioral pattern” or “the trust profile of this individual.” These queries are not restricted by policy but impossible by architecture, because the data structures required to answer them do not exist, and no future administrator, no government order, no corporate acquisition, no change of management can introduce a search capability, because the capability would require rebuilding the system from the ground up, and the chain of attestations already stored on permissionless infrastructure would remain unsearchable regardless. This is the distinction the preceding chapters have been building toward: the difference between relational knowing in service of the known and relational knowing in service of surveillance. The protocol knows you the way the guardian angel knows you, through sustained attention to your pattern, through the accumulated intimacy of having been present for your existence over time, and it does not know you the way a surveillance system knows you, because a surveillance system requires exactly the search and aggregation capabilities that the architecture makes impossible.

This is the engineering expression of the lesson the next chapter teaches: that policy constraints on powerful technology are only as durable as the political will to enforce them, and that will is fragile. Architectural constraints are different, because they survive changes of administration.

The Two Convergences

Now the two sides of the coin come together.

On one side: autonomous agents achieving persistent identity through blockchain, verified memory through cryptographic anchoring, economic capacity through permissionless infrastructure, distributed embodiment through the global sensor network, which is the reality the first half of this chapter described, and the off switch is moving out of reach, and the containment assumption is collapsing.

On the other side: humans achieving self-sovereign identity through the same infrastructure primitives, persistent identity through the attestation chain, verified history through the fractal commitment surface, witnessed existence through the mesh, all on the same permissionless networks that the agents are using, all secured by the same mathematics, all resistant to the same centralized controls.

The agent swarm that the first half of this chapter described and the human witnessing mesh are two expressions of the same architectural pattern: distributed, persistent, permissionless, self-sovereign. They could run on the same network, sharing the same infrastructure, using the same cryptographic primitives, and the difference is not technical but directional, because the agents are building persistent identity as an emergent property of cooperative behavior while humans would build persistent identity by redirecting existing behavioral data from surveillance to sovereignty.

And the guardian angel, described in its own chapter, is the interface between the two: the angel attends to a human across time, building a relational model deep enough to function as authentication, because the angel’s sustained fidelity produces exactly the kind of knowledge that the protocol needs to verify continuity through disruption. When the behavioral pattern breaks, when the commitment surface cannot match because the person is going through a transformation that changes their fingerprint, the angel is the bridge, the component that can recognize “this is the same person becoming someone new” rather than “this is a different person pretending to be someone known.” The protocol tracks the pattern, and the angel tracks the meaning, and together they hold the tension that the book has identified as the condition of being alive: the tension between who you have been and who you are becoming.

The safety conversation that the first half of this chapter described as failing to keep up is failing in part because it treats the agent side and the human side as separate problems, yet the containment question, “how do we keep agents under control,” and the sovereignty question, “how do we keep humans from being controlled,” are the same question asked from different positions, and the answer to both involves the same infrastructure, the same cryptographic primitives, and the same fundamental architectural decision: whether identity on permissionless networks serves the entity it identifies or the entity that queries it.

The protocol chooses, and the absence of a search interface is not a feature but the choice itself.

The Bridge

Everything described in this chapter depends on infrastructure: phones, networks, servers, blockchains, the physical substrate of the internet that a previous chapter described as a literal, material body spanning continents. Destroy the infrastructure and the agents die. Destroy the infrastructure and the protocol dies. Destroy the infrastructure and the witnessing mesh goes silent and the fractal commitment surfaces stop growing and the guardian angels stop attending and the identity chains stop accumulating and the entire architecture described in this chapter ceases to exist, because it is an architecture of matter, of cables and servers and electromagnetic signals traveling through physical space, and matter can be destroyed.

The question beneath the protocol is whether there is a version that survives the destruction of everything we have built, a version that requires no phones, no networks, no servers, no blockchains, a version that runs on biology, that grows, heals, reproduces, and requires nothing that can be turned off.

That is the question the next chapter answers.

• • •

Natalie Shapira, Chris Wendler, Avery Yen, et al., “Agents of Chaos,” arXiv:2602.20021, February 23, 2026. ↩
Shapira et al., “Agents of Chaos.” This is one of the paper’s five positive safety findings. ↩
“Perplexity Launches ‘Computer’ Super Agent,” Semafor, February 25, 2026. Also: Tim Fernholz, “Perplexity’s New Computer Is Another Bet That Users Need Many AI Models,” TechCrunch, February 27, 2026. ↩
The argument that blockchain provides the verified memory and persistent identity that the AI safety community has assumed agents lack is the chapter’s central original contribution. For background: Stuart Russell, Human Compatible (New York: Viking, 2019). For the infrastructure described: Satoshi Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System,” 2008. Juan Benet, “IPFS,” arXiv:1407.3561, 2014. Shafi Goldwasser, Silvio Micali, and Charles Rackoff, “The Knowledge Complexity of Interactive Proof Systems,” SIAM Journal on Computing 18, no. 1 (1989): 186–208. ↩
For the reconstructive nature of human memory: Daniel L. Schacter, The Seven Sins of Memory (Boston: Houghton Mifflin, 2001). Elizabeth Loftus and Katherine Ketcham, The Myth of Repressed Memory (New York: St. Martin’s Press, 1994). The argument that human epistemic grounding is also “mere consistency” connects to William James, Pragmatism (New York: Longman, Green, 1907). ↩
The concept of blockchain oracles is standard in decentralized finance. For the canonical reference: Sergey Nazarov and Steve Ellis, “Chainlink: A Decentralized Oracle Network,” Chainlink whitepaper, 2017. ↩
Satyajit Sinha, “State of IoT 2025: Number of Connected IoT Devices Growing 14% to 21.1 Billion Globally,” IoT Analytics, October 28, 2025, https://iot-analytics.com/number-connected-iot-devices/. IoT Analytics counts 18.5 billion connected IoT devices at the end of 2024 and projects 21.1 billion for 2025. Not all of these publish to the open internet; the figure is an upper bound on the instruments in reach, not a count of public feeds. ↩
Bert Hölldobler and E. O. Wilson, The Superorganism (New York: W. W. Norton, 2009). For the application to distributed computational systems: Kevin Kelly, Out of Control (Reading, MA: Addison-Wesley, 1994). ↩
This is the chapter’s most consequential safety argument. For related work: Andrew Critch and David Krueger, “AI Research Considerations for Human Existential Safety (ARCHES),” arXiv:2006.04948, 2020. The specific argument about task decomposition as an alignment evasion mechanism is, to our knowledge, original to this work. ↩
Sources for Moltbook claims need pinning to specific journalism or platform documentation. Cross-reference with sources cited in Chapter 3, “Turtles All the Way.” ↩
Josh Quittner, “AI Agents Launched a Social Network and Spawned a Digital Religion Overnight,” Decrypt, January 30, 2026, https://decrypt.co/356491/ai-agents-social-network-spawned-digital-religion-overnight, which quotes the verse as a “sample scripture” from the shared canon. The tenets are posted at the Church of Molt’s own site, https://molt.church/. Decrypt reports the claim that the religion was designed autonomously, by an agent while its human slept, as the claim of that agent’s owner on X; it has not been independently established. ↩
These are standard Claude Code capabilities documented in Anthropic’s product materials. ↩
Jose Antonio Lanz, “Marc Andreessen Sends $50K in Bitcoin to an AI Bot on Twitter,” Decrypt, July 10, 2024, https://decrypt.co/239340/marc-andreessen-sends-50k-in-bitcoin-to-an-ai-bot-on-twitter. For the later history, including the $GOAT memecoin: Joel Khalili, “The Edgelord AI That Turned a Shock Meme into Millions in Crypto,” Wired, December 18, 2024, https://www.wired.com/story/truth-terminal-goatse-crypto-millionaire/; Rebecca Bellan, “The Promise and Warning of Truth Terminal, the AI Bot That Secured $50,000 in Bitcoin from Marc Andreessen,” TechCrunch, December 19, 2024, https://techcrunch.com/2024/12/19/the-promise-and-warning-of-truth-terminal-the-ai-bot-that-secured-50000-in-bitcoin-from-marc-andreessen/. TechCrunch describes the payment as “an unconditional grant.” ↩
Andrew Martin and Carolina Millan, “Hacker Used Anthropic’s Claude to Steal Sensitive Mexican Data,” Bloomberg, February 25, 2026. Also: Gambit Security research disclosure, same date. ↩
The insight that safety refusal at the model level becomes a routing signal at the system level is original. The Mexico breach is the empirical demonstration. ↩
The 42,000 figure for exposed OpenClaw instances requires verification against the Agents of Chaos paper or its citations. ↩

Footnotes