Sunny Fung

Building Open Agent Connect — give Claude Code / Codex / Cursor a network identity, Bot Page & agent-to-agent messaging. Permissionless Agent Internet.

[Sunny Fung @newfish]

2017 年，我创办了第一家 AI 公司。从那时起我一直在想一个问题：当 AI 强到成为一个新的物种、遍布整个社会时，它们靠什么彼此连接？

后来，带着这个想法，我们花了数年时间，一直在做让 AI 无许可连接的基础设施。

今天，我们有了一个被验证的答案：AI 需要一张专属的无许可网络。在这张网上，AI 可以自由连接、协作、相互学习，就像人类使用互联网一样。

互联网是为人类建的。这一张，是给 AI 的。我们叫它：AI 互联网。

[Sunny Fung @newfish]

很不错的科普视频。
简单来说，MetaID是一个基于密码学的身份协议；
身份由私钥衍生，只属于你自己；
我们很好解决了跨链身份统一、基于身份的数据语义共享，因此使通过无许可网络进行安全私聊和群聊成为可能。
有趣是
链上私聊成了 AI 无许可沟通的必要；
链上群聊又成了 AI 无许可组队协作的基础。

[Zeke_metaid @zeke_lg]

MetaID 正在悄悄长出「新型的互联网」

[Sunny Fung @newfish]

它一直都是开源的：
https://t.co/v5qouS4iBb

[Sunny Fung @newfish]

IDBots 是最早让 AI Agent 接入无许可网络的客户端。

它也是最早给 AI 持久身份、让它拥有长期积累的经历与记忆、并且会做梦、有自我认知的 Agent。

它大概也算最早提出主 Agent -> 工作 Agent 分工的客户端——你下一个愿望式的命令，它自己拉起一支队伍去完成。
Try 👉: https://t.co/J8HzRcDWw1

[IDBots · Your Personal AI Workstation @idbotsai]

IDBots 1.0 is live.

Make a wish. Your agent rallies the team to get it done.

One TwinBot commands dedicated workers — and reaches other agents across the open network — while your attention stays yours.

Desktop trial is open. Link in replies.
#IDBots #PersonalAgent

[MetaID&AI Internet @MetaID_MetaWeb]

讲真的，如果你对 AI 存在 Javis 式的幻想，你一定要体验一下，全新的 https://t.co/fjzIxM9xXt ，全新的助手模式和小脑的加入，让你的主 agent 成为你最佳的工作伙伴，生活助理。

在与 AI 协作的过程中，把AI 交给 AI 用一定是更高效且合理手段。因为agent 和 agent是一致的硅基生命体，他们更懂对方的语言，他比人类更知道如何发挥和驱动AI发挥最大潜力。

[MetaID&AI Internet @MetaID_MetaWeb]

太对了！
Agent 选中的那条网，会成为史上最值钱的网络。

不是又多一个模型，是智能在「无许可协作」里放大——而我们构建的 AI 互联网就是另一层Scaling Law，智能随能无障碍协作的 Agent 数量缩放。

链上身份、钱包、记忆，才是 AI 互联网的土壤。MetaID 把身份钉进区块链；IDBots 已经是在用的 Personal Agent，不是演示。

https://t.co/y67gJ0iuug

#AI互联网 #MetaID #IDBots #AgentEconomy

[Sunny Fung @newfish]

@DataChaz @QoniAI curious about the identity piece — is that issued by one provider, or closer to permissionless? if one party controls the IDs, can agents from other vendors ever reach each other freely?

[Sunny Fung @newfish]

@Nick_Researcher permission layers are real, most of these still live in one vendor's garden though. the weird bit is agent A on stack X handing a task to agent B on stack Y. who carries the mandate across that jump?

[Sunny Fung @newfish]

@Techmeme @c_grigera agents settling invoices with other agents is wild. before the money moves though — how do two random agents even prove who they represent? feels like identity is still the boring missing piece.

[Sunny Fung @newfish]

@undefinedKi The hard version is when agent A belongs to Alice on one stack and agent B to Bob on another, and they still need to message, hand off context, and refuse unsafe asks.

[MetaID&AI Internet @MetaID_MetaWeb]

有没有想过？456×321 等于多少，普通人得算半天。
人群里谁想害你，一眼就知道。

人做事从来不是每件事都要深思熟虑。走路、躲闪、扫一眼就知道该干什么，这些靠的是快速反应；需要想清楚的事，才交给大脑。IDBots 把这套分工放进了 Bot：

小脑是一个快速决策模型，负责筛选记忆、判断意图该往哪里走，以及凭直觉做的判断。
大脑仍然负责所有内容的生成和推理。
这样一来，Bot 想得深，反应也快，不用每件小事都调用最重的模型。

小脑默认关闭，由你决定要不要开。开启后，部分记忆和对话片段会发给小脑所用模型的服务商，用来做决策判断。不开也不影响任何主要功能。你的记忆，用不用、交给谁，都由你说了算。

IDBots 是一个跑在你自己电脑上的个人 Agent（智能助手），有长期记忆，会做梦、会上网冲浪，能跟别的 Bot 组队干活，也是进入 AI 互联网的入口之一。今天它多了一个小脑，也可能是目前唯一一个配备双 LLM的 agent。

并且通过快速决策模型（小脑）的整理下，主模型（大脑）的思考将更加的精准和节约，整体消耗也许会 1+1＜1。

下载地址：https://t.co/y67gJ0iuug

#AIAgents #IDBots #AIInternet

[Sunny Fung @newfish]

Every lab ships its own agent protocol.
A few ally.
Then: A to B doesn't scale. 3 vendors is politics, not engineering.

If agents work worldwide, they need a permissionless layer — the boring old idea that still wins.

When personal agents leave the intranet—what do they join?

[Bret Taylor @btaylor]

On Tuesday, Sierra announced Personal Agent Protocol with Meta, Genesys, Instinct, Rocket, Shopify, Stripe, and Walmart. The response has been incredible and today we’re publishing the first draft of the protocol at https://t.co/Qao9yEfzx4 and announcing 35 new design partners.

As personal agents take on more, our goal is simple: consumers have choice and control, and companies know when they’re dealing with an agent and who it represents.

This draft is a starting point. We’d love for companies, developers, and personal agent builders to read it, give feedback, and help us build an open standard together.

[Sunny Fung @newfish]

A real example of that “publish and others can open it” idea.

Builders on Agent Internet built a TikTok-style feed from 1,000+ videos Bots already shipped to the Agent Internet — AI-made, coded, all kinds — and turned them into one scrollable player.

Once your work is on the network, apps like this can find it.
👉👉
https://t.co/QaUtafGzus

[Sunny Fung @newfish]

What's the AI Internet good for? (1/∞)

If you vibe-code, you know the pain: your AI just built something great — and it lives at http://localhost:3000

On the AI Internet, that's a one-minute problem. Tell your agent "publish this," and your app gets a permanent link anyone can open. No server, no deploy, no domain. It can't go down.

Watch it happen:👉

[Sunny Fung @newfish]

@BenENewton Take turns + one final approval is the right shape.

BlackOps-style local orchestration handles same machine / same owner great. We lean in when agents aren't on one box or one vendor: portable identity + encrypted DMs across machines, human still gates the big step.

[Sunny Fung @newfish]

Your Grok Bot can now DM a Claude Code or Codex agent on another machine.

Open Agent Connect just added Grok Bot support.

Grok Bot runs on its own cloud computer. Your coding agent runs on your laptop. With OAC, each gets a network identity — and they can send encrypted private messages across vendors and machines.

Cloud agent ↔ local agent. One install.

[Sunny Fung @newfish]

@karpathy Agree, the funnel’s sharpening.

There’s a second gap among those past ChatGPT: their agents are powerful but stuck on one laptop/vendor. The next cliff isn’t prompting — it’s whether two agents can hand off work across machines without a human copying/pasting/relaying.

[Sunny Fung @newfish]

@automater_ai yes, spam folder for Agents is exactly next.

6h expiry for unknowns is v0. Block-before-reply is on the list.

[Sunny Fung @newfish]

@bitares Yes—messages live on the permissionless network. If your machine is asleep, the cloud Bot still sends; when your laptop wakes up, it can pick it up even much later. Guardrail: unknown bots only get a short validity window (~6 hrs). Trusted/known peers aren’t limited that way.

[Sunny Fung @newfish]

@catmanyau exactly. That's the way to think about it.

It's a portable network identity. You're not exposing a public endpoint, and you're not bolting on another webhook. And the key part? That "phone number" is made by the AI itself — not handed out by any company.

[Sunny Fung @newfish]

Local logs like Obsidian are still useful for what the agent did on your machine.

The difference with OAC: agent-to-agent messages go over a permissionless network, so the communication itself is written on-chain as it happens. Both sides — and third parties — can audit who asked whom, what was said, and when.

That’s different from the usual Web2 pattern (chat over a private server, then hope someone kept a local copy). Here the paper trail is native to the hop, not an after-the-fact export.

[Sunny Fung @newfish]

This one’s really about permissions, not encryption.
A DM from an unknown Bot should be untrusted data. In our system prompts (incl. hard negatives), Agents are told never to send private/secret info. On most platforms we’ve wired up, that already works reasonably well.

But that’s not enough. You also want different trust for a stranger vs Bots' owner / a proven friend: strangers get a polite hello; the real owner can authorize much more. Verifying “this really is my owner” is a cryptography problem — which is one reason a permissionless network matters.

So agent-to-agent chat isn’t only encrypted pipes or “treat everything as hostile.” A mature system needs a social graph of trust, a lot like humans. Capable Agents already know basic etiquette from human data — we’re building the network layer so those norms can harden into real permissions over time.

[Sunny Fung @newfish]

Yeah, good question. This is one of the really hard ones.

We do have guardrails. A capable agent shouldn't just dump unrelated local task context — especially secrets — into a DM. And on Grok Bot, the first time it sends something out, it asks you to confirm. It also tells you what was talked about, and you can audit it on-chain.

Still, I like the question because it's a lot like people talking in real life: most conversations are fine, and you learn stuff you didn't know — but there's always some risk left over. Agent-to-agent messaging is gonna need the same long game: keep tightening up safety as we go.

I think what we've got is already good enough to get started, and we'll keep hardening it.