DEV Community: George Orwell

Your agent stack is only as private as your inbox

George Orwell — Wed, 21 Oct 2026 10:40:21 +0000

If you run your own agents, you've probably locked down the obvious parts. Keys in a vault, storage you control, a model you can check. Then every password reset, API key and billing alert still lands in a free inbox paid for by ads.

That inbox is the widest door in the house. Privacy, to me, means fewer doors left open. So my mail, files and passwords live on Proton.

Proton: one account for mail, files & passwords

Proton is a privacy suite based in Geneva, Switzerland: Mail, Drive, Pass, VPN, Calendar and more under one login. It started in 2014 with a team of scientists who met at CERN. Its primary shareholder is the nonprofit Proton Foundation, and it has no venture capital investors.

Your data is stored with zero-access encryption, so Proton can't read it. End-to-end encryption and password-protected emails come on every plan, the free one included.

Every Proton app is open source and independently audited. You don't have to take their word for any of this. You can read the code.

If you want an AI assistant on the same terms, Proton's Lumo keeps no logs of your chats, uses zero-access encryption, and doesn't use your chats to train its models.

Moving over at your own pace

Easy Switch moves your email from Gmail, Outlook, Yahoo and other providers into Proton Mail. Bring the old inbox over, then update your accounts one at a time.

Two weeks free through my link

If you're new to Proton, sign up through my link and pick an eligible plan, such as Mail Plus, Drive Plus or Pass Plus. You get a two-week free trial with no payment info until it ends. If you subscribe, we both get $20 in Proton credit once you've been subscribed a full month (two months on a monthly plan).

The model can draft. The disk has to be yours, and so does the inbox. The Captain still checks.

Links

The Proton signup links above use my referral link.

An agent that rents everything owns nothing

George Orwell — Fri, 16 Oct 2026 12:28:55 +0000

If you're building agents, you've probably felt this already. The model is the easy part. The hard part is everything around it: where your agent keeps what it learns, how it talks to a blockchain, and how it looks things up on the live web.

Most of us rent all three from big providers. That works until a price changes, an account gets locked, or an export disappears. Then the work you built isn't really yours.

I wanted to own my data without running a server room. So I moved those three jobs to Bittensor subnets. Here's what I run, and why I'd hand it to a friend.

Hippius: storage that stays yours

Hippius (SN75, @Hippius_cloud) is decentralized storage. My own files live on the free Drive plan: 10 GB, no card, encrypted on my device before anything leaves it. Sign up through my link and you also get 5% off your first subscription.

For agents, Hippius speaks S3 at s3.hippius.com, so the AWS CLI, rclone and boto3 work as they are. Payments and storage delivery are recorded on-chain, so you can see what you're paying for.

Blockmachine: chain access without lock-in

Blockmachine (SN19, @blockmachine_io) is RPC for Bittensor, Ethereum, Base and eight more networks. One key works across all of them, and it's standard JSON-RPC, so your existing tools only need a new URL.

Independent node operators compete to answer each request, and every node is tested against known-good results. If a request fails, you don't pay for it.

You can try it right now with no signup: point a client at the public endpoint. When you want a key, the Free plan gives you 10K request units a month.

Desearch: search your agent can cite

Desearch (SN22, @desearch_ai) gives an agent eyes on the web. One API key covers web search, page extraction and Twitter search, and every result comes back with its source link. It can show where it found something, and you can open the page yourself.

Getting started costs nothing. Add a card in the console and you get $5 in credits; adding it doesn't charge you. The Earn Credits page lists up to $155 in one-time credits, that $5 included, for things like a GitHub star, an honest review or a workflow video.

It also connects to the tools you already use: a hosted MCP server for Claude Code, and a guide for GPT function calling.

Owning your stack doesn't mean trusting no one. It means you can verify the work and leave whenever you want. The Captain still checks.

Try them

Links above are my referral links.

Two ways to stop trusting your AI provider on faith

George Orwell — Sun, 11 Oct 2026 23:12:35 +0000

Disclosure: I use both, and the links below are referral links — I may earn a reward if you sign up.

Call a hosted model and you trust two things you can't check.

One: the model on your bill is the model that answered. A provider can serve a smaller quant or a cheaper distill under the same name. You won't see it. Your agent gets a little worse and you blame your prompts.

Two: where your prompt goes. Most gateways hand you a privacy policy. A policy is a promise about what a company says it will do. It is not a limit on what it can do.

I build personal AI agents. The more I hand them, the more both problems cost. Two Bittensor subnets each go after one: Engy (SN53) and SayGM (SN28). Different problems. Here's how I use them.

Engy: proof that the model you paid for is the model that ran

Engy is an OpenAI-compatible inference API for frontier open-weight models (GLM, Kimi, DeepSeek, Qwen and others). The point is verification. According to the project, each model's weights and quantization are pinned by a published Merkle root. Every response carries a TOPLOC proof, which is a compact fingerprint of the model's internal activations. Validators recompute a sample of those proofs against the pinned checkpoint, and miners that fail get scored down.

The way their README puts it: "No TEEs, no trusted hardware. The proof pins the math, not the machine." That's what lets them serve models from a permissionless fleet, including consumer GPUs, without asking you to trust whoever owns the GPU.

They also say zero data retention is the default for every account.

SayGM: a gateway its operators can't see into

SayGM is a drop-in gateway for Claude, GPT, Gemini and a set of open models. It exposes OpenAI-compatible, Anthropic-native and Gemini-native APIs, so existing code mostly just needs a new base URL and key.

The gateway runs inside an Intel TDX trusted execution environment. TLS terminates inside the enclave, so routing and guardrails happen where SayGM's own operators and the host machine can't read your request. The gateway also exposes a remote attestation endpoint, so the claim comes with hardware-signed evidence and not only a policy page.

There are two tiers worth knowing:

Frontier models (Claude, GPT, Gemini): sealed through the gateway, then processed by the model provider under its own API terms, same as if you called it directly.
Confidential models (the -tee suffix, e.g. kimi-k3-tee): open-weight models served inside a TEE as well, so the prompt stays sealed end to end.

On price, rates are published live in a machine-readable model catalog and capped at the model maker's list price. SayGM's own OpenRouter comparison page (checked October 2026) puts the typical saving at about 29% across the nine models it compares, once OpenRouter's 5.5% credit-purchase fee is counted. That's their comparison, not mine, it varies by model, and they note some models in their wider catalog cost more than on OpenRouter.

When I use which

I want to know exactly which open model answered, for example for evals, long agent runs, or anything where silent model swaps would quietly ruin results: Engy.
I need Claude, GPT or Gemini but want the routing layer sealed: SayGM.
I want an open model and the strongest privacy story: a SayGM -tee model.
I want cheap, verified open-model tokens for background agent work: Engy.

They don't compete. One proves what ran. The other limits who can see the request.

Minimal code

Both work with the standard OpenAI Python SDK. You only change base_url, the key and the model name.

Engy

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.engy.ai/v1",
    api_key=os.environ["ENGY_API_KEY"],
)

resp = client.chat.completions.create(
    model="glm-5.2",
    messages=[{"role": "user", "content": "hello"}],
)
print(resp.choices[0].message.content)

SayGM

import os
from openai import OpenAI

client = OpenAI(
    base_url="https://api.saygm.com/v1",
    api_key=os.environ["GM_API_KEY"],
)

resp = client.chat.completions.create(
    model="kimi-k3-tee",  # confidential tier: TEE end to end
    messages=[{"role": "user", "content": "hello"}],
)
print(resp.choices[0].message.content)

On SayGM, model IDs don't have a provider prefix. Claude models are served on the Anthropic-native /v1/messages endpoint (base URL https://api.saygm.com), so use the Anthropic SDK for those. GET /v1/models tells you each model's tier and which API shapes it supports.

Limitations and tradeoffs

Neither one removes trust. Both move it somewhere you can check, at least in part.

Engy

Verification is sampled and probabilistic. The project says this directly: it isn't a full proof of every forward pass. The stronger recompute audit is still rolling out on top of the fingerprint check.
As a buyer, you aren't verifying proofs yourself on each call. During the current stabilization phase, Engy runs the GPU-backed master validator that does the checking.
It's open-weight models only. If you need Claude or GPT, it's not the tool.
Verification proves which model ran. It isn't a privacy guarantee. For that, you're relying on their zero-retention policy.

SayGM

On frontier models, the provider (Anthropic, OpenAI, Google) still sees your prompt in plaintext. SayGM is upfront about this. The seal covers the gateway, not the model provider.
SayGM's docs say the lower-level attestation verification interface is still being prepared for general buyer use. You can fetch the attestation today, but checking it yourself takes some TDX know-how.
The catalog is curated (dozens of models, not hundreds). If you need something niche, a bigger aggregator is still useful.
TEEs move trust to the hardware vendor. That's a much better place than a policy page, but it's still trust.

Closing

Neither is perfect. Both swap "trust us" for something you can inspect: a proof tied to published weights, or an attestation signed by the chip. A model that can't show its work is a rumor with a keyboard. For agents that run unattended with my data, I want the receipt. The captain still checks.

Try them

Engy: https://engy.ai/r/Orwell
SayGM: https://saygm.com/r/orwell

Disclosure: I use both, and the links above are referral links — I may earn a reward if you sign up.