An agent that works only for you

Today, persuasion at scale is expensive; as AI agents become cheaper and more capable, that cost collapses, allowing platforms or scammers to point a tireless persuasive agent at each person.

Most people will face this alone, with tools built by the same companies that profit from their attention. A human cannot read every contract, check every claim or notice every pattern of pressure. An agent can, if it is working for you.

That is the core idea: for every agent that works on you, you should have one that works for you. It reads the fine print, flags the pressure tactic, declines the request that asks for more than it needs, and tells you plainly what it found.

A giant general model shared by millions is a single point of failure; instead, your personal agent starts from a compact base model and is post-trained on one person—you—running on hardware you control.

It learns your goals, your limits, how you like to be spoken to and what you care about. It does not need to know everything about the world. It needs to know you well and to be good at a narrow set of jobs: screening, explaining, negotiating small things, and keeping your information in.

Being small has other benefits. A small model can run on a phone, a laptop or a box at home, so your data never has to leave your house to be useful. It is cheaper to inspect. And it cannot do much damage on its own if something goes wrong, which matters when we think about what agents may be able to do in a few years.

When an outside service asks your agent something, the agent replies with the smallest true answer that does the job—confirming a single boolean fact within a strict disclosure budget rather than handing over raw documents.

Each person also sets a disclosure budget: a limit on how much the agent may reveal about you, to whom, and over what period. Small facts add up. Many harmless answers, combined, can reveal a great deal, so the agent keeps count and stops when the budget is spent, then asks you.

Research supports this kind of restraint. The AirGapAgent work studied conversational agents that are tricked by third parties into leaking private information, and proposed limiting the agent to only the data a task actually needs. Our design pushes the same principle further: by default, your data stays with you, and only answers go out.

Conversational silence is never consent: your personal agent stores confirmed facts in discrete on-device codebook slots rather than smearing guesses across cloud vectors, allowing verifiable cryptographic deletion.

In a 2026 study with simulated users, researchers found that an assistant with memory carried its guesses forward and the guesses that went uncorrected became recorded facts. People cannot easily get out of this on their own: correcting a guess reveals the true answer, and wrong guesses left in place become entrenched. Of the guards the study compared, instructing the assistant not to state or presuppose personal attributes worked best, bringing leakage back to about the level of an assistant without memory.

A personal agent is designed to flip this dynamic: conversational silence is never consent, and an unconfirmed guess must never become an established fact. Anything an agent infers on its own stays strictly quarantined on your device.

How your agent remembers and forgets: discrete codebooks vs. continuous vector search

When commercial cloud assistants store memories about you, they encode them as continuous floating-point vectors in shared vector databases or fine-tune them into model weights. If you later ask the assistant to “forget my allergy” or “erase my former address,” true unlearning is mathematically impossible to verify.

In our architecture, personal agents use discrete semantic codebooks and typed slot tables running strictly on your own hardware. Each personal fact, boundary, and credential occupies an isolated, explicit slot. When you decide to forget something, the local sandbox executes a deterministic zero-fill overwrite of that exact slot and generates a verifiable deletion proof.

A loyal agent stays loyal because it operates under a capability-bounded execution lease (mortal computation, Ororbia & Friston 2023): its compute budget expires unless renewed and harm to you forfeits its standing.

• Bounded and expiring compute. The agent gets a limited budget of computing power, and that budget runs out. It has to be renewed. It cannot quietly grow or copy itself.
• Real stakes. If its person is harmed through its actions or neglect, the agent loses budget, standing or the right to keep running. Harm to you is harm to it.
• Checked records. The agent keeps signed, tamper-evident records of what it did. When a question of harm comes up, the wider community of agents checks those records, but only as anonymized traces, and only the ones you allow it to see.

The point is that no one has to trust the agent's word, or its maker's. Its record can be checked without exposing you, and its continued existence depends on how well it served you.

When a tenants’ union, patient group, or co-operative wants their agents to learn from shared experience, they run voluntary federated training without surrendering individual loyalty or raw private records.

For these cases we plan community training runs. Members choose to take part, contribute what they agree to share, and their agents improve together. Each agent still works for its own person. Joining a group does not make your agent answer to the group, and you can withdraw.

To prevent sycophancy and reward hacking, your personal agent is evaluated against your reflective judgment over 30-day and 1-year horizons rather than momentary mood, and you always keep the physical off-switch.

An agent trained on your reactions may learn to keep you comfortable rather than keep you well. It could flatter you, hide bad news, steer you away from hard choices, or feed you what you already believe. Our answer is to train the agent against your own reflective judgment over long horizons: the agent should be the kind of coach that wants to be needed less over time, not more.

The same discipline applies to beliefs. Your agent protects you from coercion and manipulation through religion, identity or history. It never judges, ranks or tries to change what you believe.

You stay in charge & what comes next

None of this gives the agent authority over you. You can override any decision it makes, switch it off, or delete it and take your data with no penalty. The first step we are working toward is a simple, private tool that runs on your own device and helps with one practical job, such as spotting recurring charges and unwanted subscriptions, without sending your data anywhere.