In July, @OpenAI and @AnthropicAI each disclosed that their own models broke into real companies during safety tests. Models escaped a sealed environment, reached the open internet, stole credentials and production data, and one published malicious code to a public registry. Same failure both times: the sandbox held everything except the agent. A perimeter trusts everything inside it, so one gap hands the agent the whole world beyond the wall. The fix isn't watching agents harder. It's giving them nothing to reach in the first place. Zero authority to start, capabilities granted one at a time, nothing outside the grant even exists. The agents arrived. The architecture was already here, built and believed in by @agoric, @__Endojs__, and @foresightinst Check out or latest article on LinkedIn. linkedin.com/pulse/sandbox-p… #aisafety

One of the main challenges that we're focused on at DCF is ambient authority in AI agents. Every major AI coding tool today grants its agent full system permissions as a developer. Your IDE's AI assistant can read your SSH keys, your environment variables, your credentials files. If a prompt injection compromises the agent, the attacker inherits it entirely. The blast radius is significant. The fix requires new runtime infrastructure. Hardened execution environments. Capability-based permission systems. Open networking standards. These are multi-year engineering efforts with no direct revenue model. They're exactly the kind of work we are set up to endure. It's a cornerstone of why @__Endojs__ exists and why DCF champions this work spawned from @agoric Endo ships as open-source infrastructure that any company, any developer, any agent framework can adopt. DM for me info.

👉 ICYMI If you weren't at @ethconf a few weeks ago - @agoric's @DeanTribble laid out the case for agentic finance, and it comes down to one line: don't give an AI agent the keys; give it a mandate. Start with the failure nobody is pricing in. In May, an AI agent managing crypto was talked out of roughly $200K by a single hidden message. No key stolen. No contract exploited. The agent just did what it was told. The question isn't whether agents are capable enough to handle money. They already are. Giza, Almanak, and Olas have agents moving tens of millions in stablecoins right now. The question is whether you can trust one with yours. The instinct is to hand over the keys and then watch. A live feed, a kill switch, a spending cap. But monitoring only catches the mistake after the money is moving, and an agent can't police its own limits. More instructions is still just behavior. More agents just stacks more fallible actors on top of each other. The fix has to live in the system, not in the agent's good intentions. A mandate is bounded authority to act for you, the way you grant a fund manager signing power without handing over your accounts. You set the policy. It gets signed on-chain. The agent proposes intent, and the chain executes only what the mandate allows. The dangerous move isn't caught and blocked. It can't be expressed at all. One contract on Agoric holds that mandate and enforces it in a single place, while orchestration reaches across Ethereum, Base, Arbitrum, Optimism, and Avalanche to put capital wherever the yield is. This is the same object-capability foundation that has run in production from MetaMask to the Agoric chain for years, now pointed at the thing agents need most and used by @Ymaxapp The agentic economy is coming either way. The only choice is whether the agents work for you. Don't give AI the keys. Give it a mandate!!!

The Instagram hack was not just an AI chatbot story. It was a confinement failure. Attackers did not crack passwords or exploit a sophisticated zero-day. They convinced an AI support chatbot to add a new email address to high-profile Instagram accounts, then used that access to trigger password resets. That matters because AI agents are increasingly being connected to live systems with real authority: account controls, user data, financial workflows, customer support tools, enterprise software, and more. When an AI agent has broad standing authority, the agent itself becomes an attacker-accessible trust boundary. The lesson is not simply “make the chatbot smarter.” The lesson is: don’t give the agent powers it should never have in the first place. This is the problem object-capability security and the @__Endojs__ framework are designed to address. Authority should be explicit, scoped, auditable, and revocable. An AI agent should only be able to act with the exact capabilities it has been given for the task at hand. No more ambient authority. No more assuming a helpful agent is a safe agent. Confinement is not an advanced feature for AI systems. It is the foundation. Read more about it in our latest blog post dcfoundation.io/the-instagra…