AI Protocol

1/ Governance is about to become the defining question for agentic AI. OpenClaw went from GitHub's fastest-growing agent to the first major AI security crisis of 2026 — in three weeks. This week, Anthropic launched 🦋Project Glasswing: their most powerful unreleased model, deployed to AWS, Microsoft, Google, and CrowdStrike to find critical vulnerabilities before attackers do. These two stories are connected. 🧵Here's how:

The AI industry is building increasingly powerful infrastructure, but much of it remains concentrated in a relatively small number of organizations. That concentration has consequences beyond competition. It determines who can access compute, deploy models, and build systems without depending on a handful of infrastructure providers. Participation across a broader network of independent contributors is a possibility decentralized AI infrastructure introduces. The question is whether AI infrastructure can scale without concentrating control over its foundations.

When an AI agent makes a consequential decision, the final output tells only part of the story. Understanding how it arrived there requires a reliable record of its actions, the information it used, and the tools it invoked. This is where verifiable execution history becomes important. Onchain records can provide an additional layer of assurance that an agent’s consequential actions haven’t been quietly rewritten after the fact. For autonomous systems, being able to reconstruct what happened is fundamental to accountability.

An AI agent can be instructed to behave safely and still be manipulated into doing something dangerous. Prompt injection exploits the fact that agents process instructions and information through the same underlying reasoning system. A malicious webpage or document can influence what an agent decides to do next. The answer cannot depend entirely on the model recognizing every malicious instruction. Security needs to extend beyond the model itself, into the environment where its actions are executed.

Giving an AI agent access to a system is easy. Ensuring it only does what it was authorized to do is considerably harder. Agents can interpret instructions, adapt their approach, and invoke tools in ways that weren't explicitly anticipated when access was granted. Traditional access controls were designed around predictable operations. Agentic systems introduce a layer of decision-making between permission and execution. The challenge is building systems where an agent's ability to act remains within clearly defined boundaries, even when its behavior is difficult to anticipate.

The internet has spent decades building systems around human users. AI agents are beginning to participate in that same environment, and the assumptions behind those systems are starting to change. When an agent interacts with a service, the service needs to know who or what is making the request. As more activity becomes automated, distinguishing agents from human users becomes increasingly important for access, permissions, and accountability. Agent identity will become an essential part of how online services operate. The question is how that identity will be established, recognized, and trusted across different platforms.

There's a growing difference between using AI to complete a step and assigning it an entire task. With agentic systems, a model can plan a sequence of actions, use external tools, assess the results, and continue working towards a goal with varying levels of human supervision. The amount of work that can be delegated this way is expanding. How much independence an agent can reliably handle will become an important measure of its usefulness.

An autonomous agent is only as independent as the infrastructure it depends on. If one organization controls the environment where agents operate, it can ultimately decide who gets access and under what conditions. Decentralized infrastructure offers a different foundation, allowing autonomous activity to take place without placing the entire ecosystem under a single point of control. As AI agents become more capable of acting independently, the architecture supporting them will play a major role in determining how independent they can actually be.

When one AI agent delegates a task to another, the original request can pass through several layers before the work is complete. The further that chain extends, the harder it can become to understand how the final result came about. A clear onchain record of delegation can help preserve the connection between the original intent and the work carried out on its behalf. As agents begin relying on other agents, that chain of context will matter for understanding how a result was produced.

Two AI agents can pursue the same goal and still get in each other's way. One prioritizes speed while the other prioritizes accuracy. Each may be doing its job well, yet their decisions can clash and undermine the final result. When several agents contribute to the same task, what matters is how their work fits together. A system can have capable agents at every step and still fail if those agents aren't working towards a coherent result.

Talk to Waffle, the first Noah's Ark character running on EMOTE-1, free for 5 minutes, no wallet or account needed. Pod and iNFT Holders can opt in for the EMOTE-1 upgrade at noahsark.ai

Noah's Ark V2 is live in Beta. Real-time AI is live, and Waffle talks to you in real time. Noah's Ark launched in 2021 as the first dApp built on the AI Protocol, and it is home to iNFTs owned onchain. V2 brings live, face-to-face conversation to Noah's Ark, powered by EMOTE-1, the multimodal AI engine on the AI Protocol. Asset holders can also link their wallets to see every Pod, iNFT and credit they own in one place.

Models will change. An AI agent's identity and history may need to outlast them. Soulbound Intelligence (SBI) explores this distinction. The intelligence powering an agent can evolve while the agent's identity and accumulated history remain meaningful over time. It's a useful way to think about the next stage of AI agents, especially as they become more persistent and operate across different environments. The question is how to build agents whose continuity extends beyond any single model.

An AI agent can have access to a huge amount of information and still struggle to use the right part of it at the right time. More context isn't always better. Old details can become irrelevant, useful information can get buried, and unrelated experiences can interfere with the task at hand. For agents that operate over long periods, deciding what to retain and what to draw on becomes an important part of their design. The quality of an agent's memory depends on more than how much it can store.

Agents built for one purpose might eventually become useful in ways its creator never planned. A research AI agent could turn out to be valuable for education. An AI agent designed to organize information might find an entirely different role in a business workflow. As people discover new uses for these systems, their potential can extend well beyond the original design. Open ecosystems give developers room to experiment with those possibilities and build on what already exists.

An AI agent can pass every test in a controlled environment and still behave unexpectedly once it's deployed. Real-world environments are messy. Information is incomplete, circumstances change, and interactions rarely follow a perfect script. Testing remains essential, but it can't account for every situation an agent will encounter. As agents take on more consequential tasks, security will depend on how well they handle conditions that weren't anticipated during development.

An instruction hidden inside a webpage can be enough to manipulate an AI agent reading it. This creates a difficult security challenge. Agents need to process information from sources they don't control, and some of that information may contain malicious instructions. Better models can help, but the surrounding infrastructure matters too. Agents need ways to distinguish information they're meant to process from instructions they're authorized to follow. As agents gain access to more tools and take on more complex tasks, handling untrusted input safely becomes essential.

Scientific progress often depends on following a promising lead that nobody has had time to investigate. AI agents could help change that. One agent could review existing research, another could test a hypothesis, and another could examine the results for alternative explanations. Researchers could explore more possibilities in parallel, spending less time on repetitive work and more time deciding which discoveries matter. There's a real opportunity for vertical AI agents to expand the amount of research human beings can pursue.

AI research shouldn't have to happen behind the walls of a handful of organizations. A more open ecosystem could let independent researchers contribute models, datasets, and computing resources without needing to build everything themselves. Decentralized infrastructure creates room for more people to participate in how AI is developed. The more accessible the building blocks become, the more room there is for unexpected ideas to emerge.

An open agent economy could let people build services that operate entirely through other agents. A business could use one agent to source suppliers, another to compare offers, and another to handle payment. Each could be built independently and still participate in the same economic process. Onchain infrastructure can give these interactions a shared foundation for executing transactions and verifying activity. The exciting part is the range of economic activity that becomes possible when agents can participate directly, across an open ecosystem.

Who decides the rules when AI agents start transacting with one another at scale? If every transaction depends on a central operator's approval, that operator remains in control of the economy. Onchain infrastructure creates another possibility. Rules can be encoded and enforced transparently, allowing agents to interact within a shared economic environment. The design of those rules will shape who can participate, how transactions happen, and how the ecosystem evolves.