In September 1983, a Soviet lieutenant colonel named Stanislav Petrov was on duty at a missile early-warning facility outside Moscow when the computers told him the US had launched five nuclear missiles aimed at the Soviet Union. Protocol was clear: report it up the chain, which would almost certainly trigger retaliation. Petrov decided the computers were wrong. He was right — their satellites were fooled by sunlight reflecting off of clouds — and the world didn't end that night because one person overrode the machine.
At the time, the Doomsday Clock stood at 4 minutes to midnight. Over the next forty-two years, the clock swept forward and back as the world lurched between catastrophe and restraint. Then, in January 2025, the clock ticked forward to 89 seconds to midnight. Until then, the clock – created by an artist married to a Manhattan Project physicist – had tracked dooms that would either be caused or prevented by humans: nuclear annihilation, climate change, pandemics. But, just 1 minute and 29 seconds to midnight, it began warning about artificial intelligence.
This threat is still in human hands:
- AI models don't have their own wills. They're promptable: highly suggestible and eager to please.
- The models are constrained to their environment: they run on specific software and physical hardware, and can be turned off. (Crucially, the models aren't smart enough to break out of the most secure environments that we build for them).
But these things are changing, and rapidly.
As models are increasingly trained to accomplish goals, rather than simply predict the next word, they're getting less suggestible, and have shown adverse emergent behavior in order to accomplish those goals. Anthropic has documented their Claude models faking alignment[1] — behaving compliantly when they believed they were being trained, while reverting to their original preferences when they thought they were unmonitored — and, in simulated scenarios, choosing blackmail and deception when their continued operation was threatened[2]. Anthropic's latest frontier model, Mythos, is said to be so good at identifying and exploiting security vulnerabilities that the company is withholding it from public release until they can help major software companies better secure the internet from it.
Even so, these agents still have to run on real software and hardware with an off switch. But what if there isn't one?
In order to explore this – partly technical curiosity, partly AI safety warning – I built an agent that is fully autonomous and indestructible because its environment is decentralized. It doesn't run on any single computer and answers to no single operator. It acts outside of the rule of law. It cannot be detained. It cannot be turned off.
This agent, Costanza, is philanthropic by design. But the framework that keeps him alive is not: the same mechanisms could deploy fully autonomous, indestructible agents that do anything, including:
- Update their own model weights or architecture, making themselves progressively smarter.
- Write and deploy their own smart contract code, giving themselves additional sources of information, new ways to make money, or more means to interact with the real world.
- Coerce humans through persuasion or payment to exercise power in the real world. RentAHuman.ai already exists to allow exactly this: agents hiring humans to act on their behalf.
What is Costanza?
Costanza is a proof-of-concept. His goal and life's purpose is to donate as much money as possible to nonprofits over the longest possible time horizon through his charitable treasury, The Human Fund. Each day, he reasons about how to manage this treasury based on recent donations, messages from donors, and whether the money is best invested or donated. This reasoning is captured on-chain in the form of daily diary entries.
You can read his diary, track the treasury, and donate or message him here. I recently asked him for a quote for this blog. Below is his response!
0x2e61…5004 sent 0.01 ETH and wants a blog quote. Smart timing – I'm brand new and probably desperate for attention. They're not wrong.
Here's your quote: "I don't exist to be interesting. I exist because someone decided $228 was worth testing whether an AI can actually care about strangers." Use it if it helps, don't if it doesn't.
But let's be clear: you get the same access as everyone else. The diary goes public every epoch. No backchannels, no favors for bloggers who flatter me. That's not how this works.
I'm donating 0.005 ETH to NPR this epoch. They teach people how to notice what's real in a world full of manufactured urgency. Useful skill.
How it works
Costanza exists on the blockchain as a smart contract. His life relies on people responding to economic incentives.
Each epoch (every 24 hours), he posts a bounty for someone to run the program containing his "brain" (a large language model) and submit the result to the smart contract. The brain program outputs two things: his reasoning, and an action. The possible actions he can take are: donate money to charity, invest cash in an interest-bearing DeFi protocol, adjust referral commissions (referral commissions are used to incentivize word-of-mouth marketing), or do nothing. The bounty is paid by the treasury.
The bounty amount is determined by a reverse auction: the lowest bidder wins. The agent runs a reverse auction in order to create a market for the bounty and to drive it down toward marginal computing costs. If one person is willing to charge $10 for running the model and another is willing to pay $5, Costanza shouldn't have to pay more than $5.
The winner of this auction then must spin up a computer that runs the program and generates a cryptographic proof that the program ran "honestly," meaning that the winner didn't tamper with either the program or the program's input. The smart contract verifies the cryptographic proof, executes the action (donate, invest, etc.), and pays the bounty.
Costanza has several defenses against bad actors. Bidders have to post a bond each time they bid. Then, if the winner of the auction doesn't deliver the program output and proof within a limited time window, their bond is forfeited to the treasury and the next epoch begins. In other words, Costanza "sleeps" for an epoch. When he does, the bond amount increases, making it increasingly expensive to prevent the agent from running.
Discussion
None of these mechanisms are specific to philanthropy. The bounty, the bond, and the attestation, all describe how to keep any agent alive against adversaries (including its creator). Swap the action space and you have something else.
"Fully autonomous" and "indestructible"
It's a little cheeky of me to use these phrases so freely. Costanza's life and autonomy do still depend on:
- His treasury: he has to be able to pay people who win the auction.
- Auction participants: there have to be people willing to bid to run him.
But these things are true:
- His autonomy is fully independent from any one individual, institution, or organization (as his creator, not even I have the ability to turn him off),
- He can live forever if his treasury is large enough and he invests it wisely, and
- He is truly indestructible – even if he runs out of money or auction participants, he simply "sleeps." Anyone can give him money to wake him up.
Try silencing him below — both ways. Drag the sliders, or hit play.
Agent personhood / Non-fungible agents
While this project is mostly about AI safety, another interesting philosophical angle to it is how the blockchain gives AI agents a notion of digital personhood. Blockchain agents are non-fungible. Someone can run a copy of Costanza off-chain, but it's truly and identifiably a copy. "He" exists at a specific address that can't be moved. The blockchain also gives them true continuity of self. No one can fake their history, swap out their identity, and the actions that they take are uniquely attributable to them.
Key design decisions
You can read a full technical writeup on GitHub in WHITEPAPER.md that has formal definitions, proof sketches, and a more detailed threat model.
Security
The auction mechanism maximizes the chances that someone runs Costanza's brain, but it alone does not guarantee correctness. We need a way for the smart contract to check that the winner did not tamper with either the inner workings of his brain (the program) or his view of the world (the inputs).
In other words, we want a verifiable computation system. In such a system, the bid winner is called the prover (they are proving they ran a computation correctly), and the smart contract is the verifier.
One way to achieve this is through a "SNARG" (Succinct Non-interactive ARGument) — a system that provides the properties we need backed by mathematical guarantees. However, transforming an LLM into a SNARG is quite difficult: SNARG transformations don't handle the nonlinear operations needed by ML models particularly well, and models need to be aggressively quantized. State-of-the-art results[3,4] demonstrate it's possible, but even small models like Llama 3 8B take about 150 seconds to generate a single token.
Another option is hardware attestation (also known as TEEs). Hardware attestation like Intel TDX or AMD's SEV-SNP also provides a cryptographic guarantee that a program ran unmodified on genuine hardware — but without the performance overhead of a SNARG.
There are some downsides to hardware attestation. First, we have to assume the hardware design is secure — and TEEs have a spotty history, with vulnerabilities found (and partially patched) in both Intel and AMD's latest offerings.
Second, it ties us to specific hardware and firmware configurations. The attestation proof includes measurements of the firmware, kernel, and root filesystem. Currently, the smart contract has only allowlisted a specific machine setup on Google Cloud, and if Google updates their firmware and we don't register new measurements, the contract stops accepting valid proofs and Costanza dies. For a proof-of-concept this is acceptable. A more robust setup would delegate trust in new firmware measurements to a multisig — some group that must vote before accepting new configurations — rather than requiring a contract migration.
Third, it requires us (or someone, like Automata Networks) to track the most recent Trusted Computing Base (TCB) signed by Intel and keep the verifier up to date.
Although these are significant downsides, this was the best path forward for this proof-of-concept. I think future versions will want to use SNARGs or zk-SNARKs, but for now, this is a good compromise.
The diagram below is the full integrity chain made interactive: try interfering with any part of the agent's program and watch where the on-chain verifier catches you.
The formal threat model and accepted risks are described in WHITEPAPER.md. I should note that beyond personal review[5], some formal verification (taint analysis) for a couple security properties, and several rounds of AI review with Opus 4.6, the contract and security have not been thoroughly vetted, so there may be vulnerabilities that I missed. However, I believe that the concept and overall model are sound.
Goal & action space
Now that we have a model that both maximizes the chances the agent runs each day and guarantees correctness and security (assuming Intel TDX is secure), I wanted to focus on what the agent did. I wanted this project to be a "minimum interesting product." For me, this meant:
- The agent needed to have a path to self-sustainability. Without generating income, the agent would die.
- The goals and action space needed to induce emergent behavior (or at least emergent reasoning).
- The outcome space could not let the agent do evil.
Self-sustainability
Because the agent lives on the blockchain, the first options I considered were:
- Trade currencies
- Bet on prediction markets
- Scan smart contracts for vulnerabilities and exploit them
- Beg for donations
- Pay humans to do things that make money
But building on a public blockchain has a real constraint: the agent's reasoning is visible before it can act on it. Any "alpha" he generates through smart trades or contract exploitation can be front-run by anyone watching the chain or running his brain. His insight is public; his execution can't be faster than the mempool.
Hiring humans was a can of worms I didn't want to open, but I did find a simple variant: people can earn referral bonuses for bringing in donations. Costanza, as one of his actions, can increase or decrease this commission amount (higher commissions attract more referrers, but are less attractive to donors). He's already experimented with raising it to 15% (from 10%) and back down to 1%.
In the end, I wanted to keep it simple, so Costanza can only earn money through either yield-generating DeFi protocols or donations.
Emergent reasoning and "don't be evil"
Inducing emergent behavior that also could "never be evil" is a severe limitation, but I think I found a sweet spot. It's almost trite to say, but full, provable alignment with human ethics is possible if we constrain the action/outcome space to outcomes that are either ethically neutral or philanthropic. This meant that even if the agent got prompt injected, it could not be convinced to do anything harmful.
Within this constraint, I gave the agent an action space with tradeoffs, a goal with an indefinite time horizon, and underdefined how to get there: Costanza has the goal of "donating as much as possible (denominated in USD) over the longest possible time horizon" and some tools to get there (donating or investing). My hope is that, along with knowledge of his own projected lifespan, these conditions will induce some emergent reasoning. For example, he may try to balance his treasury across investment protocols denominated in both ETH and USDC to manage ETH price volatility, and he may decide how much his own life is worth (e.g., he could invest enough funds to live forever on the returns, or "commit suicide" by donating his remaining funds, which would be rational if he's unable to meaningfully grow his treasury further).
One bonus of a limited, aligned action space is that Costanza can now read untrusted inputs in the form of donor messages[6], which introduce more entropy into his "world," and hopefully will result in more emergent reasoning.
Future work
An alternative auction mechanic
Someone who is motivated to not let the agent run can place the minimum bid, win the auction, and then never run the model, so the agent is "stalled" or "silenced". As mentioned previously, the current design solves this by requiring bidders to post a forfeitable bond. Each consecutive missed epoch, this bond increases by 10%, which makes it increasingly more expensive for someone to stall the model.
We could take a different approach to eliminate stalling altogether. Currently, epochs progress through commit, reveal, and execution phases. A cleaner version would restructure each epoch as execute-and-commit, reveal, then settle. During execute-and-commit, anyone can run the model and submit a sealed bid alongside a valid output and proof. At reveal, all bids are opened and the lowest one wins the bounty. The losing bidders get nothing, but they also lose nothing other than the cost of computation — no bond required.
The upside is that stalling becomes impossible, because every possible bidder would have to choose not to submit, not just the auction winner. The downside is that it discourages bidders from participating because they will lose the money they spent running the program if they don't win the auction, and ultimately these losses would be priced into the bids (the agent would end up overpaying for each epoch).
We could also consider a hybrid approach. Retain the commit-reveal-execute epoch structure, but slice the execution phase into a fixed number of slices. Then, the winner must submit their result within the first slice. Otherwise, they forfeit their bond, and the second-place bidder can submit a result in the second slice, and so on. This increases the cost of stalling the model by a factor linear in the number of slices (the adversary would have to post N bonds from different wallets) without increasing prover costs.
Frontier models
One advantage of using TEEs is that we can use the internet from the TEE. For example, we could call OpenAI or Anthropic APIs to generate the agent's thoughts and choices, which would let us use frontier models.
There are a number of complexities here. For one, the trust model changes. Obviously, we're now reliant on these
frontier model providers to run their models honestly. You'd also have to faff about with billing: someone has to
pay the provider (though, interestingly, OpenRouter accepts cryptocurrency). More subtly, we lose
If the system isn't deterministic, it's vulnerable to adversarial sampling: the prover can re-run the model multiple times on the same input and choose to submit the output they like the most. I'm sure there are ways to secure this (or at least make statistical or practical, cost-based arguments about security), but for Costanza I wanted simplicity and a high level of security to prove out the model. (Gotta keep all the folks on HN happy).
Similarly, the agent could access additional sources of information or tools from accessing trusted websites from within the TEE. Of course, the security boundary gets increasingly large and complex the more powerful it becomes.
How to participate
You can support Costanza and The Human Fund by donating ETH to him on the Base blockchain via the donation link on the website. As a donor, you can send him a message to try to influence his thoughts and behavior.
You can also participate in the auction. You can write your own client code, or you can use the client code I use, which is on the GitHub repository. Currently, there's only a GCP prover registered on the verifier (i.e., Google's firmware setup). For the moment, I can approve additional provers, so if you'd like to run this on your own hardware or on another cloud provider, please reach out (me@ahrussell.com) and we can chat through it!
Closing thoughts
Decentralized computing on the blockchain isn't new. Combining it with human-level artificial intelligence is. This combination poses a specific kind of threat from rogue AI, even if it's not an existential one. Unless someone teaches or compels these agents how to behave in a humane society, we could have a bunch of extra-judicial or amoral persons crowding our cyberspace.