Fractured alignment: many loyal agents instead of one giant mind

That is efficient. It is also fragile. If that model has a subtle flaw in its goals, the flaw is copied into every conversation. If an attacker, an insider or the model itself finds a way around its safeguards, there is no second line, because every line runs through the same mind.

Human societies learned this lesson the slow way. Power held in one place gets captured. Systems that survive spread decisions across many hands, keep watchers independent of the watched, and make sure that one mistake stays small. We think AI deserves the same treatment, and soon.

Each layer has a narrow job and its own limits, and nothing large reaches a person without passing through layers that answer to that person.

It holds their data and credentials and acts only on their behalf, while independent verifiers, blast-radius authority caps, and disclosure budgets prevent correlated failures.

An agent bound to one person

Because it serves a single person, the damage it can do if it goes wrong is bounded by design: one person's affairs, not a country's. Its alignment can also be checked in a way that is hard for a global model: does this agent actually serve this person, over months and years, by that person's own considered judgment?

Groups whose goals line up, such as a co-operative or a neighbourhood, can train a shared community agent. It acts only on a mandate its members grant, and that mandate expires.

Verifiers that do not share a brain

Agents need checking, and the checkers must not fail together. Verifiers in this design are deliberately built on different base models, trained on different data and run by different operators. A swarm of copies of one model shares its blind spots; a mixed group makes correlated failure and quiet agreement harder. We plan to measure this directly: what share of verification decisions could a single model family have swung on its own? If that share is high, diversity is cosmetic.

Authority scaled to blast radius

An agent's authority is capped by how many people its actions can affect. Acting for one person, with that person's consent, needs little outside checking. An action that touches a street needs more independent verification, a city more again. Mistakes still happen, but they are caught while they are small, and correcting them is cheap.

Disclosure budgets

Agents talk to other agents by asking specific questions and getting specific answers or proofs, never raw data. A service learns that you are over 18, not your birth date. But many harmless answers can add up to a profile. So each personal agent keeps a running budget of what it has revealed about its person, to whom, and how easily those answers could be combined. When a new question would let someone rebuild a profile, the agent declines.

Frontier models behind the layers

The largest models stay contained. They do not get free rein on the open internet or unrestricted access to outside services. Their output travels through one-way channels to verifiers, which check and summarize before anything reaches a personal agent. Requests travel back along a separate, narrow, logged path.

Labs may still want people to work with less restricted models for specific research or simulation. In this design they could open contained, specialized model spaces to selected people and their agents, but only under published criteria, with time limits, an independent observer for each grant and a public record of who was granted what. Selection must never become a ranking of people's worth.

Research on systems of many interacting AI agents describes failure modes that single models do not have, including miscoordination, conflict and collusion (Hammond and colleagues, 2025). Work on secret collusion shows that language-model agents can in principle hide coordinated messages inside ordinary-looking text (Secret Collusion among AI Agents, 2024).

A design that relies on many agents watching each other has to take both seriously, which is why diversity, rotation and surprise checks are part of the verifier design rather than extras.

The next steps are research: a test harness for personal agents trained on synthetic people, measured against their base models on adversarial suites; red-team tests of disclosure budgets; and small experiments with mixed verifier groups to see whether diversity actually reduces correlated failure.

We will publish negative results along with positive ones. We would especially like to hear from people working on multi-agent safety, collusion detection, proof of personhood and AI containment. If you can show us where this design breaks, that is the most useful help there is.