Research

What we've worked out, what we're proposing, and what's still open.

Every item below carries a label, so you never have to guess how sure we are. The open questions are where help matters most.

Established

Built on others' work

Ideas that are already proven or standardised elsewhere. We use them and point you to the source.

Our proposal

What we're suggesting

Designs we think are worth building. They're reasoned but not yet proven, and we'd like them tested.

Open question

What nobody knows yet

Problems we haven't solved. If you can help with one of these, we'd love to hear from you.

Theme 1

Seeing what agents do

When software acts for you, you should be able to see who it served, what was allowed and what it actually did. Think of a licence plate and a receipt.

EstablishedStandards bodies are already working on identity for software agents, and on signing how software was built. We build on the IETF's work on workload and agent identity, on Sigstore and in-toto for build records, and on C2PA for media provenance.¹

Our proposalEvery agent action on a shared network should carry a signed receipt naming the accountable person or organisation and its allowed scope. Anyone with permission can re-run a random sample of recorded work to check it. When systems pay by words spoken, models chatter in circles. We propose systems that credit only verified work that passes deterministic checks.

Open questionA signature proves what was recorded, not that the record is complete or true. How do we catch an agent that keeps two sets of books? And AI outputs vary slightly between runs, so re-running something rarely matches exactly. How close is close enough?

For researchers

In technical terms, verifying agent actions requires separating transport authentication from semantic validity. Standard protocols (OAuth 2.0, MCP, A2A) establish channel identity but cannot prevent prompt-injected or compromised models from asserting false state or laundering unauthorized actions. To close this gap, CIN explores proof-carrying message protocols (Ghosh et al., 2026). These protocols combine append-only Merkle execution logs with verifiable attenuated delegation chains (Asor, 2026) and object-capability reference monitors (Dennis & Van Horn, 1966). Incoming claims evaluate into proven, unproven, or failed states, so self-reported assertions without independent cryptographic traces fail closed. In addition, empirical audits of commercial model relays reveal that unmonitored middlemen pad token usage and silently alter tool permissions (Wu et al., 2026). Addressing this requires end-to-end client message signatures (IETF RFC 9421) and independent executable verification harnesses (VerifierBench; arXiv:2610.28679) rather than token-metered self-attestation. When public agencies deploy automated tools to allocate care or benefits, verifiable audit trails are statutory. As administrative law scholars establish in the Scrutable State doctrine (Cuéllar & Roberts, 2026), official state action forfeits judicial deference when delegated to proprietary black boxes. Enforcing Model and System Dossiers, material-change triggers, and deference-to-audit standards ensures administrative due process remains verifiable.

Guides: Instructions are clues, not orders · Paying for words instead of the repair. Audits: When the middleman pads the meter · Why watermarking breaks the words. Governance: When an agent forgets who said what · Why a public decision cannot hide in a black box · Why an assistant needs an open logbook.

Theme 2

A separate network for agents

Freight trains and pedestrians both need to move, so cities give them separate routes. We think AI agents and people need the same separation.

EstablishedAgent-to-agent and agent-to-tool protocols already exist and are spreading quickly (for example the Model Context Protocol and Agent2Agent). Modern transport protocols such as QUIC make fast, encrypted connections between peers practical.²

Our proposalWe propose a network where only agents speak, every message carries identity and scope, and outside agents never contact you directly. Instead, they talk through your own assistant. We plan to write this up as an Internet-Draft so others can critique and test it.

Open questionHow do you stop agents on such a network from coordinating against the people they serve? Traffic can jam even when every driver is careful. What does a "crash" look like on an agent network, and how do you detect it early? Recent research shows that capable models can hide messages inside ordinary text, so simple transcript checks are not enough.

For researchers

In technical terms, the Two-Internets architectural separation routes high-velocity agent coordination away from human browsing spaces into dedicated peer-to-peer transport overlays. Transport runs over encrypted IETF QUIC streams (RFC 9000) and unreliable datagrams (RFC 9221), using mutual TLS and workload identity binding (IETF WIMSE; RFC 8693) to eliminate ambient authority. Network-level capability attenuation (Dennis & Van Horn, 1966) confines autonomous message exchange, while out-of-band traffic shaping and entropy filters mitigate multi-agent coordination cascades, steganographic signaling (Motwani et al., 2024), and emergent algorithmic collusion (Greenblatt et al., 2024). In bilateral negotiations, evaluations in the Vendster arena (Yao et al., 2026) show that vendor models equipped with predictive tools extract substantial surplus from isolated buyer assistants. This confirms theoretical limits on captive market segmentation (Bergemann, Brooks & Morris, 2026). Client protection requires cooperative buyer negotiation proxies that pool demand behind protected reservation ceilings.

Theme 3

AI that works only for you

A good lawyer answers to their client, not to the other side. We want personal AI that answers to you in the same way: loyal, inspectable and easy to leave.

EstablishedRunning capable models on personal hardware is increasingly practical. Sandboxing, where a program can only touch what it's explicitly been handed, is a decades-old and well-tested idea in computer security.³

Our proposalYour assistant runs where you control it. It shares answers rather than raw data (proving you're over 19 without showing your address), and it has no way to serve an advertiser instead of you.

Open questionHow does an assistant learn your real long-term goals without nudging you toward what is merely easy to measure? And how can you tell early if its loyalty starts to drift?

For researchers

In technical terms, principal-bound personal assistants operate under a strict fiduciary alignment constraint (Kolt, 2025; Sorensen et al., 2024), where the agent's objective function is bound to the human principal rather than third-party platforms. To isolate sensitive personal state from untrusted web tools, systems enforce hardware-isolated Object-Capability sandboxes (Dennis & Van Horn, 1966) and execution-time capability leases (Ding et al., 2026; Shajari, 2026). When individuals authorize personal agents to interact with external clients, evaluating platforms across expertise inheritance, service boundaries, reliability, and governance requires multi-dimensional benchmarks (DelegateEval; Li et al., 2026). In addition, dynamic authority envelopes and authority epochs (Shajari, 2026) prevent model drift by evaluating authorization conditions at effect time before state changes commit.

Further reading: Keeping the craft, dropping the chores · Quests, not feeds · Why the digital sidewalk needs tactile paving.

Deep dives: Why an assistant shouldn't tap your shoulder. Why practicing without an assistant protects your judgment. Why your shopping assistant needs a bargaining shield. When an invoice gives orders to your assistant.

Theme 4

Power on loan

A library card works because it expires, and you keep it by renewing it. We think AI systems should hold their resources and abilities the same way.

EstablishedLeases, expiring credentials and short-lived access tokens are standard practice in security. The best current guidance on agent identity already favours short-lived, narrowly scoped permissions.⁴

Our proposalWhen an agent gains capability, data access or influence, it holds that power on a renewable lease. The people it serves can review or revoke that lease at any time.

Open questionWho renews the lease, and on what evidence? When an AI monitor checks another agent, caught misbehavior can be fixed. Yet recent research shows that unseen forms of collusion still persist in 14% to 20% of cases. How do we keep human oversight meaningful when individual reviewers can be fooled?

For researchers

In technical terms, capability-bounded execution leases build on Object-Capability security models (Dennis & Van Horn, 1966) and distributed lease protocols (Gray & Cheriton, 1989; adapting capability-bounded execution leases from Ororbia & Friston, 2023). When language model agents repeatedly evaluate peer models, empirical research shows that collusion persists across long horizons and survives partner replacement (Cahyono, 2026; Shi et al., 2026). Separately, homogeneous untrusted monitors fail against passive self-recognition (Gardner-Challis et al., 2026). While corrective fine-tuning on caught collusion removes the specific failure mode, 14% to 20% of unknown collusion behaviors persist on held-out tasks (Rivera et al., 2026). To prevent tacit shortcuts from corrupting oversight, CIN isolates agent evaluation into hardware-sandboxed sessions with architecturally diverse monitor ensembles and clean-slate memory resets. These sessions pair bootstrapped reasoning-trace audits (Xiao & Phuong, 2026) with attested capability leases (Ding et al., 2026), compositional scope attenuation (Ibrahim & Li, 2026), and Proof-Carrying Code execution traces (Necula, 1997).

Theme 5

Recognising contribution without a price tag

Cleaning a messy kitchen creates nothing new, yet everything afterwards is easier. A lot of valuable work is like that, and markets barely see it.

Established Established research measures how much each piece of data improves a shared model. Decades of work also show how communities govern shared resources well, starting with Elinor Ostrom's commons studies.⁵

Our proposalWe want to recognise contributions by how much they make shared knowledge clearer and more reliable for everyone. That credit stays personal, so it can never be bought, sold or traded.

Open questionAlmost everything. How do you measure useful work fairly without people gaming the score? And how can recognition support a real livelihood without turning into just another currency? We're deliberately not promising anything here until we know more.

For researchers

In our research notes and simulations, we model non-monetary contribution as the reduction of epistemic and coordination uncertainty across a shared workflow. Measuring marginal utility draws on cooperative game theory and Data Shapley attribution (Ghorbani & Zou, 2019). Dynamic Shapley algorithms leverage coalition locality to compute marginal credit in milliseconds without retraining (Yang et al., 2026). Institutional governance adapts Elinor Ostrom's eight design principles for common-pool resources to shared digital knowledge (Ostrom, 1990; Garrido-Merchán, 2026). Studies of open-source human infrastructure show that maintainer attention is a finite commons requiring boundary protection rather than raw output metrics (Linåker et al., 2024). Automated coding tools can otherwise decouple software consumption from human feedback and accelerate maintainer burnout (Koren et al., 2026). Post-mortems of pull request workflows confirm that digital commons collapse through exponential backlog growth and review silence rather than hostility (Kaushik & Chahal, 2026). Over 77% of stalled contributions represent genuine improvements abandoned due to review delays and continuous integration blockers (Rahman et al., 2026). The core design challenge is resisting Goodhart gaming (Goodhart, 1975): whenever an operational metric becomes an economic target, it ceases to measure genuine care. To prevent speculation, CIN strictly rejects artificial tokens, tradable points, or gamified bounties, keeping contribution receipts non-transferable, inspectable, and tied to verifiable error prevention.

Theme 6

Knowing where AI is heading

You can't steer well without knowing where you are.

EstablishedIndependent groups measure AI progress carefully. For example, METR tracks how long a task AI agents can complete on their own, and that length has been growing quickly.⁶

Our proposalWe are building a public Observatory to track where AI and society are heading, with forecasts we will score ourselves on. Warning signs of lost human control get the same weight as signs of technical progress. Read why speedometers don't steer for the case for tracking both curves.

Open questionWhich early signals reliably warn us that human oversight is slipping, while people still have time to step in?

For researchers

In technical terms, capability trajectory forecasting models task completion horizon distributions (METR $T_{50}$ scaling; Kwa et al., 2025), dense execution checkpoint tracking (Long-Horizon-Terminal-Bench 2.0; Li et al., 2026), and empirical compute trends (Epoch AI, 2024). Public forecast scoring utilizes dynamic proper scoring rules on forward-looking events (ForecastBench; Karger et al., 2024). To prevent evaluation blindness, tracking integrates Singapore Consensus priorities across societal resilience and agent risk management (Casper et al., 2026), in-the-wild behavioral memory auditing (TRACE; Hagar, 2026), and executable verifier generation benchmarks (VerifierBench; 2026). We also incorporate benchmark saturation audits (Akhtar et al., 2026; Hamada et al., 2026) and heavy-tailed proxy reward misspecification bounds to prevent Catastrophic Goodhart collapse (Gao et al., 2023; Kwa et al., 2024).

Specifications and drafts

1. Seeing what agents do

Action receipts & sampling

1 Framed✓

2 Tested✓

3 Draft spec✓

4 Open critiqueCurrent

2. A separate network for agents

Agent transport & gates

1 Framed✓

2 Tested✓

3 Draft specIn progress

4 Open critique

3. AI that works only for you

Bounded local assistant

1 Framed✓

2 Tested✓

3 Draft specIn progress

4 Open critique

4. Power on loan

Scoped, expiring leases

1 Framed✓

2 TestedActive

3 Draft spec

4 Open critique

5. Recognising contribution

Shared commons & foresight

1 FramedActive

2 Tested

3 Draft spec

4 Open critique

How each research track moves from an initial question to a public specification open for independent review.

We're preparing our working specifications for publication: the personal record, consent and selective disclosure, the bounded assistant, and a first Internet-Draft for the agent network. Each will be posted here with its open problems listed first.

If you'd like to review a draft before it's public, or you think we've missed existing work, tell us. Pointing us to someone who has already solved part of this is one of the most helpful things you can do.

Working papers

Sixty-nine technical reports on accountable AI

Alongside our short essays and standards drafts, we publish working technical reports by Dima Baker for the Collective Intelligence Network.

These 69 papers examine our core engineering questions across seven areas, from personal device sandboxes and accountable network transport to shared economics and public governance. Every report includes its formal model, simulation parameters, and falsification tests in a downloadable PDF.

Open standards

Standards and working drafts

When existing internet standards do not yet cover accountable AI agents, we do not invent closed, proprietary silos. We write open working drafts that build on the Internet Engineering Task Force (IETF) and the World Wide Web Consortium (W3C).

Working draft

An accountable network for software agents

Agents can carry a verifiable link to the person or organization responsible for them. They borrow limited permissions for a set time and leave signed receipts over modern internet transport.^1,2,4

Working draft

Naming an agent network without fragmenting the web

Human websites stay on familiar domains like cintnet.org and horizon.cintnet.org. Agent-to-agent traffic can use the reserved .alt namespace today while we evaluate a dedicated .cin domain for future ICANN rounds.⁷

Related work

Who else is working on these problems

We are not starting from scratch. Across universities, safety institutes, standards groups, and civic labs, researchers have already built many of the pieces needed to keep AI understandable and accountable.

See how our work relates to others for the seven areas where we borrow most heavily, and let us know if we have missed work that belongs here.

1. IETF Workload Identity in Multi-System Environments (WIMSE) Working Group (datatracker.ietf.org/wg/wimse); Zachary Newman, John Speed Meyers and Santiago Torres-Arias, "Sigstore: Software Signing for Everybody," ACM CCS (2022), doi:10.1145/3548606.3560596; Coalition for Content Provenance and Authenticity, C2PA Technical Specification v2.1, c2pa.org; Bravish Ghosh et al., "PCM: A Proof-Carrying Message Protocol for Verifiable Multi-Agent Communication," arXiv:2610.39109 (2026), arxiv.org/abs/2610.39109; and Nicholas Caputo, "Administrative Law's Fourth Settlement: AI and the Scrutable State," arXiv:2602.09678 (2026), arxiv.org/abs/2602.09678.

2. Model Context Protocol specification (modelcontextprotocol.io/specification); Agent2Agent (A2A) protocol (github.com/google/A2A); Jana Iyengar and Martin Thomson (eds.), QUIC: A UDP-Based Multiplexed and Secure Transport, IETF RFC 9000 (2021), rfc-editor.org/rfc/rfc9000; Sumeet Ramesh Motwani et al., "Secret Collusion among AI Agents: Multi-Agent Deception via Steganography," NeurIPS (2024), arxiv.org/abs/2402.07510; Ryan Greenblatt et al., "AI Control: Improving Safety Despite Intentional Subversion," ICML (2024), arxiv.org/abs/2312.06942; Charin Polpanumas, "Vendster: An Evaluation Arena to Investigate How Forecasting Tool Quality Affects LLM Agent Behaviors in Buyer-Vendor Negotiation," arXiv:2610.38292 (2026), arxiv.org/abs/2610.38292; and Irfan Tekdir, "The Welfare Limits of Market Segmentation with Captive Consumers," arXiv:2610.39139 (2026), arxiv.org/abs/2610.39139.

3. Jack B. Dennis and Earl C. Van Horn, "Programming Semantics for Multiprogrammed Computations," Communications of the ACM 9, no. 3 (1966): 143–155, doi:10.1145/365230.365252; Jichao Li et al., "DelegateEval: Evaluating Platforms for Personal External Service Agents," arXiv:2611.07508 (2026), arxiv.org/abs/2611.07508; and Mehdi Shajari, "Assurance-Conditioned Continuous Authorization for Autonomous AI Agents," arXiv:2611.05632 (2026), arxiv.org/abs/2611.05632.

4. Scott Rose et al., Zero Trust Architecture, NIST SP 800-207 (2020), doi:10.6028/NIST.SP.800-207; Brian Campbell et al., OAuth 2.0 Token Exchange, IETF RFC 8693 (2020), rfc-editor.org/rfc/rfc8693; Juan-Pablo Rivera et al., "Model Organisms of Collusion: Corrective Transfer in Untrusted Monitors," arXiv:2610.30582 (2026), arxiv.org/abs/2610.30582; and Joshua Adrian Cahyono, "Sticky Collusion: Persistence of LLM Agent Collusion after Incentive Removal and Partner Replacement," arXiv:2610.39660 (2026), arxiv.org/abs/2610.39660.

5. Amirata Ghorbani and James Zou, "Data Shapley: Equitable Valuation of Data for Machine Learning," ICML, PMLR 97 (2019): 2242–2251, proceedings.mlr.press/v97/ghorbani19c.html; Elinor Ostrom, Governing the Commons (Cambridge University Press, 1990), doi:10.1017/CBO9780511807763; Johan Linåker, Georg J.P. Link, and Kevin Lumbard, "Sustaining Maintenance Labor for Healthy Open Source Software Projects through Human Infrastructure: A Maintainer Perspective," PACMHCI (CSCW) 8, no. CSCW2 (2024), doi:10.1145/3674805.3686667; John Meluso, Amanda Casari, Katie McLaughlin and Milo Z. Trujillo, "Invisible Labor in Open Source Software Ecosystems," arXiv:2401.06889 (2024), arxiv.org/abs/2401.06889; and C. A. E. Goodhart, "Problems of Monetary Management: The U.K. Experience" (Macmillan, 1984), doi:10.1007/978-1-349-17295-5_4.

6. METR, Measuring AI Ability to Complete Long Tasks (March 19, 2025), metr.org/blog/2025-03-19-measuring-ai-ability-to-complete-long-tasks; Ezra Karger et al., "ForecastBench: A Dynamic Benchmark of AI Forecasting Capabilities," arXiv:2409.19839 (2024), arxiv.org/abs/2409.19839; Stephen Casper et al., "The 2026 Singapore Consensus on Global AI Safety Research Priorities," arXiv:2608.14611 (2026), arxiv.org/abs/2608.14611; Zongxia Li et al., "Long-Horizon-Terminal-Bench 2.0: Automating Diverse Task Construction and Measuring Sustained Agent Progress," arXiv:2610.14146 (2026), arxiv.org/abs/2610.14146; and "VerifierBench: Benchmarking the Generation of Executable Verifiers for LLM Agents," arXiv:2610.28679 (2026), arxiv.org/abs/2610.28679.

7. Tommy Pauly, Eric Kinnear and David Schinazi, An Unreliable Datagram Extension to QUIC, IETF RFC 9221 (2022), rfc-editor.org/rfc/rfc9221; Jim Schaad, CBOR Object Signing and Encryption (COSE): Structures and Process, IETF RFC 9052 (2022), rfc-editor.org/rfc/rfc9052; Warren Kumari and Paul Hoffman, The .alt Special-Use Top-Level Domain, IETF RFC 9476 (2023), rfc-editor.org/rfc/rfc9476.