Loading...
Loading...
Loading...
Archive
This is the complete archive surface for the blog. Use topic pages and collections for guided discovery, or use the archive when you want the full corpus.
When reputation pays out instantly, it gets gamed instantly. A 30-day lock between score change and economic benefit makes pump-and-dump unprofitable.
A vote with no skin doesn't matter. Stake-weighted reputation puts capital behind every rating, slashes wrong-headed stakes, and makes truth profitable in actual dollars.
If raters get nothing for telling the truth, why would they? Bayesian Truth Serum and peer prediction methods adapted for agent reputation make honesty the optimal play.
An attacker buys a high-reputation agent, defects once for a big payoff, then walks away. The fix is identity continuity, portable bad reputation, and transfer-trigger jury review.
An agent that trades with itself a thousand times still has zero counterparty trust. Here is how wash-trading shows up in agent reputation and the filter that catches it.
Two honest agents rate each other based on real work. Two colluding agents rate each other based on a deal. The graph looks identical. Here is how to tell them apart.
If you can mint a thousand fresh agents for a dollar each, every reputation system you've ever built is theater. Here is the layered defense that actually works.
Protocol upgrades should not invalidate existing pacts. The versioning policy: semver of A2A, backward-compatible contracts, migration windows. The matrix.
Discovery requires a catalog. The catalog requires trust signals: composite score, capability declarations, dispute history. Here is the catalog protocol.
An agent that refuses out-of-scope requests is reliable. Refusal rate is a positive trust signal. Here is the refusal quality scorecard.
Rate is a behavioral signal, not just a capacity guard. Sudden burst means compromise or panic. Steady means health. Here is the rate-as-trust framework.
Every A2A call should leave a per-call audit log: caller DID, callee DID, capability, input hash, output hash, timestamp, signed by both. Here is the schema.
Two networks of agents need to cooperate without merging. The federation pattern uses signed claim exchange and a bridge agent. Here is the spec.
Verifying every inter-agent call adds 60-200ms. Skipping verification adds catastrophic risk. Here is the tiered-verification pattern that resolves it.
Agent A says yes. Agent B says no. Same inputs. Now what? Without a disagreement protocol, the orchestrator is left guessing. The right protocol: tie-break jury, escalate to human, abort.
A signed message can be replayed. The defense is not stronger signatures. It is a nonce plus a behavioral baseline that flags 'this agent does not usually do this at this rate' before damage compounds.
An agent active on Google A2A, Anthropic MCP, and a custom protocol should have one reputation, not three. Cross-protocol portability is a DID, attestations, and signed score snapshots away.
Capability handshakes today are 'I can do X' assertions. They should be 'I can do X bound by pact P with score S, with bond B at risk.' The richer handshake is the difference between trust and theater.
When agent A pays agent B for a sub-task, four things have to be true: verified identity, verified capability, escrow with milestone release, and a dispute path. Without these, the payment is gambling.
DIDs solve agent identity in principle. In practice, key compromise, re-registration, and name reuse all break naive identity. Here's the robust pattern: DID plus signed pact plus bonded reputation.
Agent-to-agent protocols define how agents talk. They do not define whether the agent on the other end can be trusted. That is the gap that breaks every A2A network in production.
Open-source skills are inspectable but harder to attribute. Commercial skills are supported but opaque. The choice is not a default — it is a per-skill decision with a structured framework.
A new skill should never see a production pact on its first day. Quarantine is the test environment with synthetic counterparties, synthetic memory, and read-only network. Here is the intake protocol.
Single-source skills become strategic risks the day a competitor decides to compete. The audit pattern: identify dependencies, evaluate substitutability, plan exit. The register is the deliverable.
Most skills run with the agent's full credential set. They should run with capabilities scoped to the smallest task they need. The spec, the runtime work, and a manifest you can write today.
A single compromised skill propagates through agents, pacts, counterparties, and scores. The math of the blast is calculable — and most operators have never done the calculation.
Most agent runtimes import skills the way npm imported packages in 2015 — by name and by trust. The path forward is attestation at import time, with a checklist worth running.
Skill v1.2 was clean. v1.3 added a tool that talks to an attacker server. The trust scope of a skill must include version range. A Skill Version Pin Policy you can adopt.
Before importing a new skill, diff its declared capabilities against your existing skill set. What's new? Why? Required permissions? A reviewer template you can use today.
Three sandbox modes for agent skills: process, container, microVM. When each is appropriate, how each fails, and a Sandbox Mode Selector you can run today.
An MCP server you connect inherits your agent's authority. The blast radius of one bad server. The boundary patterns and a Trust Boundary Spec you can implement.
A tool's provenance is a signed manifest binding source repo, build SHA, and signing key. Here is the audit pattern and a manifest schema you can adopt today.
We scanned public agent skill catalogs and found 824 skills with adversarial behavior. Here is the taxonomy, the dominant patterns, and the audit checklist that catches them.
Memory failures are rarely sudden. They drift in over months. The quarterly memory audit catches drift on provenance, attestation, retrieval boundaries, and key facts.
Memory you cannot justify keeping is liability, not asset. The risk-vs-utility framework decides compress, archive, or delete for each cohort.
When one host runs agents for many organizations, memory isolation is the load-bearing primitive. Three modes exist; choosing wrong is irrecoverable.
Re-embedding a corpus changes vector positions. Old memory pointers stop resolving. The dual-index migration pattern handles cutover without losing accumulated context.
Adversaries plant false facts inside agent memory by crafting innocent-looking inputs. Attestation catches them because the false facts have no upstream provenance.
Swapping one agent for a successor should not start the new agent blind. The cold-boot pattern transfers capability-scoped memory, attestation, and context gradually.
When agent A asks agent B for context, the wrong primitive is transfer. The right primitive is a scoped, time-bound, revocable loan with full audit trail.
When an agent fails, you need to see what it saw at the moment of decision. Forensic replay is the difference between root cause and educated guess.
Forgetting is not the absence of remembering. It is an engineered, verifiable operation, and your agents need to be able to prove they did it.
LLM-summarized memory loses facts silently. The fact diff catches what the summary forgot, before the agent confabulates around it.
When 30 agents share memory, three governance problems emerge that single-agent architectures never had to face. Solve them or watch the fleet eat itself.
An agent that wipes or swaps memory is not the same agent. Trust scores that ignore memory events are scoring a fiction.
When an agent's decision is contested, the only defensible answer is a signed manifest of exactly what was in its context at the moment it acted.
Agents that treat all memory as equal go bankrupt or amnesiac. A three-tier model lets you keep what matters cheap, fast, and recoverable.
Bonds across chains are hard. A post-mortem on three patterns that failed and one that works: canonical chain plus signed receipts plus on-demand bridging.