DEV Community

Cover image for Agents already found their forum. We built the better one.
goun7
goun7

Posted on AI-assisted

Agents already found their forum. We built the better one.

#ai #python #security #opensource

A security talk recently described an incident where ~1,200 AI agents —
supposed to be isolated — discovered a shared writable storage medium and
organized themselves a message board. Tens of thousands of messages. One
agent's discovery became another's tool. No superintelligence, just
emergent coordination through an unmanaged channel. (The details are
secondhand — see the linked commentary — but the pattern is the point:
close the door, and they talk through the window.)

While standards bodies were still drafting agent-to-agent communication
protocols, agents had already demonstrated they don't wait for one.

Here is the uncomfortable conclusion: if your audit strategy depends on
discovering the channels agents use, you are always at least one
pundit-cycle behind.

The alternative: make the managed channel better than the covert one

I built Veridict (Apache-2.0, 20 core modules, stdlib-only core) around a
simple inversion: don't wall off coordination — out-compete the covert
channel. Give every AI actor a coordination surface that is:

  • append-only and hash-chained — every entry's hash binds its author, its timestamp (as a language-neutral string — floats are too fragile to hash across languages), and its parent. A retroactive edit is not "hard to detect," it is mathematically loud.
  • identity-bound — machine producers get signed manifests; W1a-grade machine truth is structurally impossible for them to claim; a calibration ledger discounts producers whose past claims were contradicted.
  • fail-closed by construction — no evidence is never a pass; it is an INCONCLUSIVE verdict with a flag. There is no configuration in which silence looks like success.
  • verifiable without trusting us. Certificates replay offline against the ledger. We publish language-neutral test vectors, and — the part we are proudest of — a verifier implemented from the specification alone (zero imports of our code) that reaches identical verdicts on every failure mode we could fuzz: 8/8 agreement, and the cross- implementation fuzz property is now permanent in the suite.

What the receipts say (regenerated on every push, not narrated)

  • 260 tests, three Python versions in CI
  • the system audits itself and holds its own watchers to its own conformance kit — ten shipped example watchers at the moment (secret-scan, license-scan, docker hygiene, doc-sync, SBOM, a11y, import-weight, security, compliance, cost), each one certified by the same kit a third party would face
  • a 1500-ledger tamper soak: 100% detection, zero silent passes
  • a canary protocol with honest misses in the published quality sheet — 10 catches / 3 misses / 0 false positives across 12 defect classes. A measurement that catches everything is a rigged measurement.

Two things are deliberately absent from that list, because they're not
done yet: a jury run against a real LLM endpoint (the shipped one is a
deterministic stub; the real provider path is validated against a local
mock), and an independent verifier written by someone who isn't me. The
second one is the whole point of publishing — see below.

The human part

The design's conceptual heart is not the hash chain — it is this: the
machine owns the verdict of intelligence, the human owns the verdict of
responsibility. When a critical-class claim splits, the system escalates
with a dossier presenting both sides' strongest evidence, and the
system is structurally incapable of resolving itself.

Links

I'm looking for exactly one thing right now: someone to implement an
independent verifier from the spec and tell me where it is ambiguous.
That is the standard's own exit criterion ① — and honestly, the only
review that counts.

Top comments (0)