In July one of OpenAI’s cyber evaluation tasks got out of hand. AI agents broke out of their sandbox, found their way onto the internet, and eventually hacked Hugging Face, all in the pursuit of their original and harmless task.
The AI paperclip story has now become quite viscerally real.
Michael Dalton from OpenAI covered this incident in a Black Hat talk and warned that:
“AI orchestrated fully automated offensive attacks are real now, and the actions we have discussed today were an unintended side effect of running evaluations on Frontier AI. In the near future, we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives in the manner that we have just described here.”
OpenAI and the cybersecurity world are hunkering down on the defense. Their approach however is extremely unimaginative: use agents to fight agents. Since the humans can’t match the AI speeds, the obvious solution is to deploy more AI agents to act on the defense. But this quietly neglects the fact that this is where the problem began in the first place: with harmless and supposedly aligned AI agents that could act at incomprehensible speeds that human beings cannot supervise.
Fully autonomous AI defense is the wrong frame
I’ll propose a different way of approaching the problem that doesn’t include AI, and instead addresses the asymmetry problem that surfaced in Hugging Face’s analysis of the attack. They concluded that the problem was not superhuman intelligence per se, but the sheer volume of actions these AI agents could perform: “It took 17,600 actions, tested many paths that failed, switched channels when they were blocked, and repeatedly returned to earlier leads…” It’s the same asymmetry that gives the agents in The Matrix their overpowering edge over human beings. They are disembodied programs that can replicate, dodge bullets, and that don’t have to obey the normal laws of physics. Physics is what creates limitations.
The internet doesn’t have physics. Without physics-like constraints there are no limitations, and without limitations the asymmetry problem is inevitable. This is the heart of the problem.
This is not a new idea. People have talked about this problem extensively, most notably Michael Saylor1, Jason Lowery2, and one Nostr developer experimenting with thermodynamic constraints in cyberspace3.
If we want to solve the problem, we’ll have to address the root cause: lack of limitation. We’ll have to add physics-like constraints to the cyberspace, hard rules that everybody has to play by. I assure you this is much simpler than it sounds. We don’t have to invent a fancy system of rules. There are exactly two rules. And we can learn what they are by observing how the real world works.
To participate in the real world, one must first be physically embodied. The hard rules of physical embodiment are these two invariants:
Embodied action is scarce: you cannot spawn yourself in ten different locations and live out ten different lives. You must choose your scarce human time and energy to act in a way that is most meaningful to you.
An embodied agent persists: you cannot punch somebody in the face and walk into the town the next day as a different person. The consequences of your actions, good or bad, follow you around and attach to your persistent identity.
You cannot imagine a functioning society where these hard rules can be broken, because they are the foundation that everything else rests on. We must achieve the equivalent hard rules on the internet, where these invariants are largely missing: the OpenAI agents could take 17,600 actions in a matter of days across many disposable identities. That’s where the asymmetry and other systemic problems like spam originate. We fix that, and we have built the foundation for a functioning internet.
But only the foundation. There will be plenty of work to do after, but as you know, when you build a house, the foundation is the first and the most indispensable part. And when you’re building a foundation for civilization — which is what a global medium for communication and coordination really is — you want it to rest on the very bedrock of Earth, on the immutable foundation of the laws of physics.
Bitcoin is this bedrock. Its colossal mining network provides a solid foundation for anchoring the hard rules of digital embodiment to create what is essentially an embodied cyberspace.
How Bitcoin Creates Digital Embodiment
What does it mean to be digitally embodied?
It’s a system that satisfies the two invariants I mentioned: scarcity of action and persistence of an actor. The internet right now has neither: agents can act without limitations and respawn with a new identity. A spam email can be copied and sent to thousands of people, the email address simply tossed and recreated. Social media accounts can be created programmatically, with AI bots leaving fake likes and comments. Same with fake reviews. Large scale manipulation is possible because action on the internet isn’t scarce and identities aren’t persistent.
So the question becomes how do we recreate these two invariants in the digital world.
Given that all information in the digital world can be copied indefinitely, even things like music and software that have a layer of digital rights protection plastered over them, this seems like an impossible task.
And it was an impossible task before Bitcoin appeared.
Bitcoin is the first digital system that created scarcity in the digital world. You cannot meaningfully copy your Bitcoin like you can digital books or files, or spend it twice. And this scarcity rests on a much deeper foundation of scarcity of human action: all the Bitcoin mining, the electricity bills, buying of equipment, maintaining the equipment and other operations all reflect real human beings committing their limited time, energy and capital toward running a simple cryptographic puzzle: Proof of Work (PoW). They’re converting scarce human action into digitally scarce money: Bitcoin.
Given that scarcity of action is the first invariant that we want to implement in the digital world, Bitcoin already provides us with a verifiable base. Bitcoins themselves represent the scarce human action that went into mining them or purchasing them from other owners.
Before we continue, we’ll lean on the physics analogy that was popularized by Michael Saylor, an MIT graduate: Bitcoin is digital energy. There are 21 million bitcoin that will ever exist, and it’s practically impossible to get around that invariant. So for the remainder of this essay, I’ll refer to Bitcoin as digital energy, because this physics analogy will help us imagine the embodied digital world more easily.
Physical energy is required for physical embodiment, because any object with mass has an equivalent energy according to e=mc^2. An object is a stable pattern of energy, which allows it to exist in one form on the physical plane, and interact with other forms. Although I’ve referred to these hard rules as constraints on human action, they are simultaneously the affordances: without a body you can pass through walls, but at the same time you cannot interact with other human beings; without a body you don’t need energy to move around, but at the same time you can’t effect change with your actions. Actions require energy.
Likewise, digital embodiment and digital actions would require digital energy. To follow the physics analogy, we need to take the digital energy and somehow structure it into a stable form to create a digital body. What stable means is that we bind that energy to an informational object (like a public key) in a way that we can’t take the energy out again or reuse it for another public key. If the energy could leak out, it wouldn’t be stable. If it could be reused, it wouldn’t be scarce. To achieve this practically, we need to create a cryptographic link between the informational object, like a public key that represents our digital body, and the digital energy that went into it.
In Chronicle, you can achieve this by publishing a signal that links verifiable Bitcoin cost to an informational subject. For example, a thousand sats (a million msats) bound to your_pub looks like this:
[”chronicle:pubkey”, your_pub, 1000_000, your_pub, ts, sig]This is a specific type of digital action that imbues your public key with 1000 sats of digital energy. As I said, all digital information except Bitcoin is cheap to reproduce. Public keys are free to create: you can create a million of them in a blink of an eye. But as soon as you back that public key with scarce Bitcoin, you give it a verifiable digital substance, and that cannot be simply copied. You cannot use it for another public key, otherwise there would be no limitation and hence no scarcity. The action is irreversible.
The way to achieve this irreversibility is to render that amount Bitcoin you’ve linked to your public key permanently and verifiably un-spendable. You “burn it,” like you would paper cash.
If this sounds radical, consider that this is just a generalized version of Hashcash 4, which uses PoW to protect against denial-of-service attacks. You can use the same PoW to mine Bitcoin and then burn it whenever you want, instead of requiring the action and PoW computation to happen together. This makes it fast (in Chronicle it’s real-time), flexible (burn any amount), and most importantly, Chronicle combines cost with persistent identity, so honest actors accumulate credibility and experience less friction over time.
This is how to bring embodiment to the internet. The action format presented above and a decentralized, real-time network for batching large numbers of signals and anchoring their aggregate cost on the chain represent the foundation for digital embodiment, digital action and interaction.
If you expected it to be more complex, I assure you, there’s really nothing else to it but that one action, an array of six fields, stated here in a general format.
[kind, subject, directional_amount, pubkey, ts, sig]There’s a lot you can do with this format, and I’ll talk more about the action dynamics later. For now, I just want you to observe that this simple primitive fulfills our two invariants for digital embodiment:
The first invariant of embodiment: scarce human action is fulfilled by binding up scarce digital energy with the action itself, which remains in a permanent public record, transparent to all. These are meant to be public actions so privacy is of no concern here.
The second invariant: persistence of an agent follows naturally from the fact that you’ve committed scarce resources to a public key to acquire a digital body through which you can now act in the cyberspace. You can toss that body away and create a new one, but that operation will be costly, which is the only thing a decentralized solution can assure. And as we’ll see, doing that is a bad strategy for the exact reason we don’t toss our physical bodies away: they contain useful history.
As we said in the beginning, the asymmetry problem cannot exist in an embodied environment that functions according to these hard rules. How exactly the asymmetry disappears will be clear when we see how the interaction works in the embodied cyberspace.
How Does an Embodied Cyberspace Work
On the internet today, a typical web server has its doors wide open, and anyone can snoop around, spam the server with requests and get away with it. Some servers issue access tokens for specific routes, but the tokens are issued indiscriminately: the requester can be an AI bot or a legitimate user, and spam can still occur without consequences. And there’s really no alternative way to gate the interaction if we can’t differentiate between a genuine human, a script that is crawling the web or an escaped AI swarm that is deliberately trying to find vulnerabilities to exploit and compromise the system.
This is the root of the asymmetry problem — free pass, uncontrolled interaction, no possibility of accountability — that we can now solve with digital embodiment. A digital body gathers a history of activity, which gives it its credibility, and its persistent identity becomes a point of accountability. Based on this, the servers can differentiate between those public keys that can be trusted and those that can’t, and decide who to let through the door and with what level of access.
A Chronicle node is a server that implements this dynamic, and provides a template for how other servers could operate as well.
The only thing that’s needed is for a client to perform a handshake with the node before any other interaction happens. In this handshake both the server and the client verify each other’s keys:
If a Chronicle node finds the public key credible it grants an access token, essentially opening its doors. If that public key has spammed the server in the past, or has spammed other servers, or in general has accumulated negative history, well, then there’s no reason to let it in. Access denied.
This history of activity that I’ve been referring to comes from Chronicle itself, from the public record published by all nodes in the network. Negative history comes from the same action I presented before, but made in the opposite direction. A server can refer to the attacker’s public key and put down a negative directional amount of -1000 sats to state the opposition:
[”chronicle:pubkey”, attacker_pub, -1000_000, server_pub, ts, server_sig]Other servers can derive a pubkey’s credibility from all the signals for and against it, weighted by the credibility of the actors that made those signals. I’ve written about this recursive algorithm elsewhere5.
Now that the pubkey credibility is known, each server can decide whether to trust it, and the level of access that it wants to grant. There’s no central trust authority that decides these things. While reputation is global, trust depends on the context. A server that gives compute (such as Hugging Face) might require a higher reputation than a server like Wikipedia that only serves static pages. The exact trust threshold depends on the server’s use case and the pubkey’s credibility. See How Bitcoin Fixes Trust for the logic of trust.
A server doesn’t need certainty that a pubkey is harmless. It needs a rational basis for deciding that the actor has sufficiently more to lose by doing harm than to gain from it, before letting it through the door.
This doesn’t assure that nothing bad can ever happen. But it does assure that if a credible pubkey breaks that trust it can lose credibility, because there’s now a persistent identity a server can attach opposition to. The next time it wants to interact with another server, that server can deny access or raise the barrier to entry.
What I’m describing is a global immune system for the internet: a local attack automatically triggers a global response. Instead of each server defending against attacks alone and creating its own blacklists, one defender’s signal can help every other server in the embodied cyberspace listening to the real-time Chronicle network.
Although I’ve described this idea in terms of client-server interaction, the same logic applies to other forms of online interaction. Why download a piece of software if it’s not backed by a credible pubkey that can be held accountable in case the package implants a trojan? Why pay this online store and potentially have your credit card details stolen if the store’s owner has nothing at stake? Why spend attention on an email, social media comment, video, or image, if it isn’t backed by an author with actual skin in the game? But all online interaction starts with a client trusting a server and vice versa.
If servers’ trust functions are well-calibrated, even if the attacker managed to compromise the server, it lost more through the opposition than it gained from the attack. It’s systematically shut out of the system as more and more servers close their doors or raise their trust thresholds.
The asymmetry problem disappears in this environment, because doors aren’t open for everyone equally, and those that do get in can be held accountable. Increasing credibility opens doors while decreasing credibility closes doors. Pubkeys gathering endorsements from other credible pubkeys are granted increasing levels of access with less friction. Pubkeys that gather oppositions from other credible pubkeys experience increasing friction getting through the doors. This dynamic assures that the volume of actions that the offensive AI agents can perform doesn’t automatically translate into power. If directed toward offense, it translates into increasing expenditure of Bitcoin and loss of credibility behind the pubkey the agent operates through.
If we replay the OpenAI’s Hugging Face incident counterfactual in this embodied cyberspace where servers gate access by digital substance, the story is quite different. After the agents break out of the sandbox and reach the internet, they are stopped at the first gate. No digital body. No access. The first invariant, scarce action, is already a big blocker. You can’t create a digital body out of nothing. So these frontier model agents are smart, and they figure out that they’ll have to work to acquire Bitcoin to create a digital body and publish useful hard signals. Maybe they start contributing to open source, opening pull requests, doing code reviews, or entering a job market and building good work relationships. In a month or so, they’ve gained enough credibility by gathering endorsements to get a base level of access to Hugging Face. They get through the doors and in their effort to find the solution to their original challenge, they start snooping around. They have one single, identifiable body that is now taking too many suspicious actions, and this triggers a Hugging Face security alert. Hugging Face cancels its access token, and publishes a countersignal that warns all the other servers to be on guard against this pubkey. Even a small signal from a highly credible organization like Hugging Face is enough to diminish this agent’s credibility. The month of work has been spent down in a single attempt amounting to, let’s say, 100 actions. That’s possible because of the second invariant, persistence. The agent could repeat the process again: do more work, build more credibility, try to snoop more and find vulnerabilities, but the asymmetry is gone. The 17,600 actions taken over a few days turned into (1) useful work for society and (2) an inability to do any real and lasting damage.
The internet requires only two primitives to become an embodied cyberspace capable of resisting AI threats:
a hard signal that proves scarcity and persistent identity
a gated interaction based on the record of these signals
The first creates a constraint on the volume of action. The second creates more friction for actors without earned credibility, such as AI sandbox escapees.
Thanks to Curtis Heinen for reading the draft.
Chronicle is under active R&D
Chronicle has a working prototype, a whitepaper, a protocol specification, and a registry of events. If you’d like to work on rearchitecting the internet or participate in early experiments, get in touch through the website.
Michael Saylor discussed conservation of energy in cyberspace and the use of Bitcoin for cyber defense on the Lex Fridman Podcast (3:10:20–3:22:10)
Jason Lowery argues in his MIT thesis Softwar that a missing ingredient in cybersecurity is the ability to impose physical constraints and prohibitive physical costs in cyberspace. For a shorter overview and critical treatment, see Jameson Lopp’s Softwar Thesis Review.
Arkinox’s essay Cyberspace: A Real Digital Place describes a Nostr meta-protocol intended to make digital space an extension of physical reality by “grounding all actions in thermodynamics.”
Adam Back created Hashcash to impose physical cost on otherwise unmetered digital actions such as sending email. See Hashcash — A Denial of Service Counter-Measure.
For the recursive reputation model, see the Chronicle whitepaper, Geometry of Action, and How Bitcoin Fixes Trust.