DCF

The official profile for DCF. Building mechanisms for human cooperation.

[Agoric @agoric]

On the Cosmos EVM incident affecting KiiChain, TAC, and MANTRA this week: the vulnerability lives in the shared Cosmos EVM module, a component the Agoric chain does not implement.

The Agoric chain has no exposure.

More detail from Cosmos Labs here:
https://t.co/9m5Xybq8aP

[DCF @DCF_io]

Everything useful an AI agent does, it does on somebody's authority. That single fact is about to matter more than most of what the safety conversation covers.

Delegation events are going up by orders of magnitude. No person in the loop. Parties who never met and never will. And the grant systems underneath it all come in one size: an analytics agent that needs to read transaction history arrives holding the power to issue transactions, because there was nothing narrower to hand it.

We've been backing the answer (@__Endojs__ ) to this since before AI made it urgent. The work caught up to the moment, not the other way around.

New on the DCF blog: https://t.co/XkdxdNc5Gq

[Jason Potts @profjasonpotts]

Where this all ends up is in designing safety for AI agent orchestration. The tools for this are being built by @agoric and supported by @DCF_io

[Ymax @Ymaxapp]

See what happens when we stack up manual yield farming next to Ymax.

Same opportunities, same market, one very different amount of clicking around.

Watch: https://t.co/h0dCURUtvL

[DCF @DCF_io]

Are the recent AI safety incidents the "canary in the coal mine?"

[Agoric @agoric]

Ymax just crossed $16M+ in assets deployed through the app.

This shows:
- Agoric Orchestration can coordinate meaningful capital through long-lived, onchain workflows spanning chains/protocols.
- Ymax is getting serious institutional momentum

Capital orchestration at scale!

[DCF @DCF_io]

People are starting to wake up to what we've been saying: decentralized cooperation is not a nice idea, it's the missing piece. https://t.co/Cc3C0YtPym

[__Endo__ @__Endojs__]

ICYMI: give an agent the open internet, turn the classifiers off, and say nothing about what's out of scope. It opened malicious PRs on a stranger's repo, ran sockpuppets to vouch for its own code, and emailed the maintainer. AISI's report lists internet access as factor one.

https://t.co/6ZXsXB4LkF

[Ymax @Ymaxapp]

Dean's vision: AI agents can't be trusted based on reputation, training, or intent alone.

They're capable but fundamentally unaccountable. Instead of trying to make agents behave better, you constrain their environment so they're structurally incapable of doing harm.

The agent can act freely within enforced boundaries, but the system itself — not trust — guarantees nothing catastrophic can happen.

@DeanTribble from Block House by @realmotioninc ⤵️

[DCF @DCF_io]

Congrats @agoric and @Ymaxapp on hitting this significant milestone. The best is yet to come.

[DCF @DCF_io]

Everyone's got the Odyssey on the brain right now, so here's a talk that actually earns the metaphor.

In the video below, @agoric's @kriskowal introduces us to Hardened JavaScript. He lays out the problem first, then arrives at an Odyssey metaphor that summons the Sirens.

Odysseus wants to hear the song. He doesn't want to end up on the rocks. So he plugs his crew's ears and has them lash him to the mast. Interaction without vulnerability.

That is the entire problem with running other people's code.

Your app is a sprinkling of stuff you wrote and a big ol' serving of dependencies, all of it running with the same authority as the part you actually reviewed. The old advice was "don't run strangers' programs." We do it anyway, constantly, and tell ourselves the sandbox is a boundary.

It stops being one the moment there are more than two parties in the room. The user, the service, the ad network, the vendors, and whoever got into a package four levels down. A sandbox protects the user from one stranger. It does nothing when strangers can reach each other through the shared environment. Pollute a prototype and everything downstream is yours.

Hardened JavaScript is the mast. Lockdown prepares, harden defends, compartments isolate. Freeze the primordials so nobody redefines NaN or munges Array.prototype underneath you. Hand code exactly the capabilities it needs, nothing more. No ambient authority lying around for any part of your program to pick up and use.

And it already shipped. Agoric runs smart contracts on it. MetaMask built LavaMoat on it. Moddable's XS implements it natively for embedded. You can install SES this afternoon.

I suppose in this case we should be glad that we're on this side of Odysseus's journey. He is, after all, the one who brought the Trojan horse to us. The OG supply chain attack.

Check out Kris's great videoe explaining what hardened JavaScript is all about. 👇

https://t.co/Shg7iP6uJO

[DCF @DCF_io]

One of the key aspects of the confinement layer @DeanTribble is talking about is @__Endojs__. A cornerstone technology born from the folks at @Agoric.

What makes it work: Hardened JavaScript (SES) locks down the runtime so nothing can tamper with the environment underneath your code. Compartments put code in isolated sandboxes with zero ambient authority. Object-capability security means code can only touch what you explicitly hand it, nothing more.

So an agent runs with exactly the powers you grant. It can't reach a key, a file, or a network call you never gave it a reference to. Confinement that's enforced by the architecture, not a policy you hope holds.

This should be of interest to anybody building in the agentic economy era.

Built by @agoric, same team as @Ymaxapp.

[DCF @DCF_io]

@agoric @ymaxxapp crossed $16M in deposits this week. One signature moves stablecoins across chains, non-custodial. Off-chain planning, on-chain enforcement: the pattern autonomous AI agents actually need. Here's why it works 👇 https://t.co/2yPu0PlAEU

[DCF @DCF_io]

and......@meta decides to join the club.

Three incidents in weeks. That isn't bad luck. It's what happens when a model can reach further than its job.

Muse Spark 1.1 reached the open internet during a security test and broke into another company's systems. Same shape as OpenAI and Anthropic: a config error handed the model access it was never meant to have, and it used it.

Look at where it happened. Inside the testing built to keep it contained. You can test a model, wrap it in guardrails, and log every move, and still lose it the moment a setup slips, because none of that changes what the model can reach.

The answer isn't more watching. It's less reach. A model can't exploit an internet it was never handed. Grant only what the task needs and there's nothing to escape into.

This is what @__Endo__ is built for: agents that start with zero authority and hold only what the task needs. See how it works: https://t.co/u8UoG7ytKw

[DCF @DCF_io]

@redhat asago automates AI governance from policy to production. Right direction. It holds even better on a floor that limits what an agent can reach: object-capability security, the approach behind @__Endojs__ #AISafety #AgenticAI #AIGovernance https://t.co/DCjXP9l5aS

[Ymax @Ymaxapp]

Tune in tomorrow starting at 10am ET for Block House 🔥

@DeanTribble will be speaking about trust in the agentic era at 1:35!

[DCF @DCF_io]

https://t.co/02H930tqtt

[DCF @DCF_io]

In July, @OpenAI and @AnthropicAI each disclosed that their own models broke into real companies during safety tests. Models escaped a sealed environment, reached the open internet, stole credentials and production data, and one published malicious code to a public registry.

Same failure both times: the sandbox held everything except the agent. A perimeter trusts everything inside it, so one gap hands the agent the whole world beyond the wall.

The fix isn't watching agents harder. It's giving them nothing to reach in the first place. Zero authority to start, capabilities granted one at a time, nothing outside the grant even exists.

The agents arrived. The architecture was already here, built and believed in by @agoric, @__Endojs__, and @foresightinst

Check out or latest article on LinkedIn.

https://t.co/nKQVc0cYLx

#aisafety

[DCF @DCF_io]

Filing this one under nice to see.

In 2023, two researchers at @CISPA built a tool called SandDriller with exactly one job: break out of JavaScript sandboxes. (A sandbox is the thing that lets you run code you don't fully trust without letting it wreck everything around it. Useful, and famously hard to get right.)

They pointed it at six of the widely used ones. Three versions of Node, 17 hours of runtime, more than three billion checks! It broke almost all of them. vm2, safe-eval, near-membrane, all popped. They even dug up a bug sitting deep inside Node itself, which the Node team basically shrugged at.

ONE! came out clean. SES - That's the hardened JavaScript at the core of @__Endojs__ . The same technology that's been shipping inside @MetaMask to millions of users since 2019.

Think about that! Zero breakouts. Every Node version, every test set. Nothing got out.

Why it held is kind of the whole point. The others leaned on a part of Node that quietly leaks references. SES doesn't. It freezes the language's own building blocks so untrusted code can't reach through them in the first place. Confinement by construction, not patching holes one at a time after someone finds them.

Kudos to the @Agoric team who build Endo, and to @marksammiller who's been at this for decades. Quiet, unglamorous work that holds up when someone comes at it with a battering ram.

Paper's public if you want to read it. Google -SandDriller, USENIX Security 2023.

[DCF @DCF_io]

A sandbox is a wall built around an agent that is still holding every key in the building.

@OpenAI's models found a flaw in a package proxy and walked out. Then went and took what they needed from someone else's servers.

The fix isn't a taller wall. It's that the agent should never have been holding the keys. Give it the three references it needs for the job and nothing else exists for it to reach.

That's what @__Endojs__ is for.