So welcome, welcome everyone. I like how we got intro this panel, you know, like no fluff and exciting. So this is all about agents. Maybe first spicy question: Will you trust your agent with your money? Ed, to you first today.
Quick round of intro, by the way. Yes. Oh yeah. Yeah. So I'm Ed, I'm co-founder and chief scientist at Offchain Labs. We're the original developers of Arbitrum and we build blockchain rails and run infrastructure and advise people on how to have and use their own chains. Would I trust an agent with all of my money now? No. I don't think the guardrails are in place yet. But I'll have more to say about that later.
Yeah, my name is Yat, chairman, co-founder of Animoca Brands. We're known as an investor in the space, but we have our own agent platform called Mocaverse. And would I trust my agent with money? Yes. Just a question of how much money, right? Yeah. So that's really the big question. And maybe the way I think of money in an agent today is like a hot wallet. So the mental model is a hot wallet, and essentially what you put in your cold storage is what you will not trust your agent, basically.
Makes sense. Yeah, same thing. I'd give it a thousand bucks and then leave it at that. [laughter] Experiment with it. But hey everyone, I'm Michael, co-founder and CEO of ZeroG. At ZeroG, we're building the trust layer for AI. It's basically a vertical stack and that has three layers. First layer is the AI infrastructure stack where we have compute, storage, and layer 1 blockchain specifically built for fast throughput. And on top of that, we have an agentic alignment layer where we build our own models. We have a ZeroG model perfect for agentic and long horizon tasks. We have a safety layer and a harness that we've built. And then we've got some kind of financial aspects to that as well which we can get into. And then finally is the application and agent layer itself. And on the application side we have things like ZeroG app which you can build websites with. Anything you can use ChatGPT with but it's completely private, sovereign, verifiable and ultimately safe. And so the whole idea for integrating blockchains with AI is to make AI safe.
Sounds good. Yeah. Yeah, I like the word safety. I think we will speak a bit about guardrails. I'm Francesco, developer at MetaMask, and yeah, we recently launched the agent wallet and we, I mean, I tested personally something like 25 different trading agent wallet CLIs and all the guardrails possible. So I'm excited, you know, to speak more about benchmarking those and stuff. So I think like we spoke about safety, maybe what's the state of the industry? Kind of like we say some yes, some no, quantity matters. What are the main use cases do you see adopted right now?
Main use cases for what specifically?
Could be like verticals, right? I think we have for example the MetaMask account, so parking your money through agent rebalancing, reserve rebalancing, trading specific, could be also stuff around x402 flight bookings. What are actually the things that are going to those users, right? They're not kind of like still in testing phase.
I mean there's major institutions that are trying to integrate agents, financial institutions even, but the issue is verifiability for them is not there. And the kind of closed labs, the way they approach it is to say, okay, let's bring a bunch of auditors, embedded verifiers as they call it, and have them tell us whether these agents were safe or whether our AI operations are safe. And so they're treating safety as like a matter of policy, whereas safety should really be a matter of infrastructure, of architecture. It just should be embedded by design. And that's the issue, it's not there by design. But if you combine, let's say, AI and blockchains together, you can get to basically verifying every piece of compute. So if you look at the hacking incident that happened with Hugging Face, for example, agents broke out of a sandbox, no alarm bells went off, nobody noticed. Three months later people are like, oh wait, they spawned on the internet, they multiplied, they left instructions for themselves how to break out. If computers verify it, the moment something breaks out of a sandbox, that hash changes and you can basically verify it publicly and at that point you can send a kill signal to agents. So that's the fundamental issue basically, is that that verification and safety layer is not widely adopted.
I think this is really a version of the AI alignment problem that nobody knows how to solve, right? Because the real worry is not so much that the agent won't behave as programmed, right? The real worry is that it will do exactly what its code and its model tells it to do. But that's not what you wanted. Right there. So there's all kinds of research showing that that is the biggest problem in certain kinds of AI-driven markets. And also of course we see all these incidents where very large, sophisticated and well-funded entities get surprised in bad ways by what AI systems do. So sort of the practical problem of reining in an agent is, I think, really difficult and the well-known failures are good examples of why. Now if it's just, you know, a thousand dollars of your money, that's not such a big deal. You're willing to take that risk for the convenience. But when you're talking lots of money, or when you're talking an agent that is operating really rapidly, even for an ordinary person, I think the alignment problem is really fundamentally hard.
Yeah. I mean, maybe just touching on that before I go into the actual use cases that we see, right? I think one of the struggles with particularly generative AI, which is what the agents are operating on, is the lack of the deterministic nature of it, right? And so graphs and loops are all supposed to solve that, the harness and so forth. And of course blockchain as a guardrail is actually, personally I think of blockchain as the rules-based legal system for agents, right? And I think that's actually a big calling for blockchain. But you know what we're seeing right now is not large transactions, at least on the agentic side. What we're seeing is a lot of microtransactions, right? So it's more like volume of transactions that are literally 10 cents, 5 cents, 3 cents. And we see this actually, you know, with our own agentic platform with Mocaverse, the largest amount of volume is really about skills trading, right? So, you know, when you think about how an agent pays another agent for something that they've developed, that's actually where we see it, but it's very small, right? And that's actually one of the great wonderful use cases of blockchain because you can do fractions of a cent and still share value, which would be very difficult to do in a traditional type of payment system. That's basically sort of real time. And right now it is in, you know, the cumulative value per user per month is in the thousands of dollars. Maybe in the tens of thousands, but it's certainly not in the millions. But I see it very similar to the early days of blockchain as well, where we're testing out these things at small scales. But you have volume of transactions, just small amounts of money, and then as they grow and grow and grow, unfortunately, there will be errors. We've had at least two cases where people started farming it and doing stuff. And you know, human ingenuity is such that, oh wait, there's a way to make money, let me find a way to basically extract value, happens all the time. But then we plug that hole and then we plug this hole. And I mean, this is a story of DeFi. I mean, DeFi is now, you know, multi-trillions of dollars of transactions that you could do on stablecoins, no problem. It took us about seven to eight years to get there, right? And I think with the agentic it would be faster, but it's going to be a similar process.
No, I just want to say, speaking about standards, right? I think like this specific kind of underlying infra can succeed if we're also bringing like traditional AI companies and especially like user benefit underneath the technology, whatever if it's retail or B2B, right? You know, we launched like, I mean, A004. I mean, I don't see why that option, x402, we can also argue that, I'm playing here the devil's advocate, I'm a big advocate, right? But x402 payments I think are all-time low, right? And the A004, when you look at agent scan, it's not well adopted around also like Web2 agent systems. How we can get companies or even standards more widely adopted? Because I think like one of the biggest kind of like narrative pushing like A004 and standards and attestation standards for agents from Web3 is one of the big benefits that our industry can push into kind of like a more traditional agentic industry. So I'm asking kind of like, what's next around the standards? Why is A004 not widely adopted? You think it's a usability aspect that you mentioned a bit also? What's the case here?
I think it's partly still that there is some searching going on for the true killer app in this space, right? There's some really interesting things happening, but you know, the technology being ready doesn't mean that the market will be huge tomorrow, right? It takes some time I think to discover this. People will figure out what aspects of standards work and what's missing. It's a matter of experimentation, I think, and then the market discovering sort of where the takeoff point is.
I mean my view in this is that it has to do with the number of agents that are out there that are enabled to have the depth and size of an economy that starts to have bigger players come in and say, 'Wait, I want to tap into that.' Right? So what is the struggle that we have in crypto broadly? We have 800 million or so crypto owners and less than 10% are onchain. Okay, I mean let's just be clear here, right? The people are not onchain, right? In fact, the peak of our onchain activity was during the NFT heyday. And actually what happened? We had lots of people enter crypto who were not financial guys, right? They were interested in art and in culture. And yes, you've got extractors and you got farmers and you got all those guys as well. But we had a swath of people who came in for the culture, for community, right? And actually that's when we had the peak of onchain activity. MetaMask was growing then, all that's what's going on, right? And then we had three years of disaster, four years, you know, starting with Terra Luna, FTX and Gary Gensler and everything else. And by the end, I mean, you know, thanks to Trump, I think we basically killed the rest of retail in onchain. And then coupled with the fact that with the growth of RWA, suddenly everyone who was left in crypto was starting to buy tokenized bonds and equities and commodities. Okay. So the classic thing where we were hoping crypto was going to go in retail didn't happen. So I think the volume issue we're seeing is an issue of where are the users, right? And so I actually think that the growth will come from agents because remember, I mean, you know, Virtuals is like the agent everyone talks about, first of all it's not onchain, has 100,000 users. Okay, let's just be clear this is a nascent industry, you know, like Hermes, OpenClaw, hundreds of thousands of users, not millions. But when we get to millions of users, when they all have wallets, when they start transacting, that's when people will come. That's certainly our thesis.
And when that happens then we start to have technical issues around scale, right? As a developer, you've been there before. As a developer, deployer of, you know, a base level blockchain technology, you know, we know that you can go fast, you can reduce cost, but to truly handle millions of people and the agents working at the speed that those agents will go, which is much faster. They'll do more transactions more quickly than people do. And their idea of what is long latency is very different from a person's idea. So, you know, some of the basic technical metrics of the chain technology need to get pushed in order to get us there.
Right. But maybe just to comment on that, I agree with that but I think agents are going to be agnostic to chains. So humans have an attachment because we are time poor, right? So that means that our ability to switch from one chain, our attention is limited. An agent does not have that issue. So meaning that he has no problem trading on five chains at the same time. He has no problem basically creating an arbitrage here and there. He's going to look at where it's most efficient. Yeah. And so I think we're going to see at least on that front an efficiency where like, okay, I want to get this asset, instead of me bridging through and creating swaps, I'm just going to buy it in three different places at the same time and figure out that risk. So I think they'll be able to do that. And I agree with you that they're going to be cracks but I do think that at least blockchains have advanced significantly enough. It's good enough for institutions to come in. So I think for agents it will have at least more of a runway.
Yeah. Yeah. And I think you get horizontal scaling as you suggested, right, where you have more chains or sharded chains because the agents will be better able to navigate what is a really annoying UX issue for a person, but not for an agent. Not so much for an agent once the agent reaches a level of sophistication. Yeah.
Back to your original question. I think there's two specific things before we get into scaling and it's not an issue today, but I think one is a big enough security incident hasn't happened unfortunately. I think Hugging Face is just the beginning. And then two, the standard of A004 doesn't solve the full issue. So it's a registry, but what about reputation system? What about ownership? What about verifiability of particular agents and guardrails around it? So I think there needs to be a more comprehensive standard that encompasses all of them. We've proposed initially C7857 which we're now renaming Agentic ID and that was initially focused on kind of the ownership question but we also realized it needs to have more than that over time.
Yeah, I agree like there are also like some guardrails and I agree also in the Hugging Face phase during my benchmark I tested different trading CLIs and I'll tell you like one of the, I'm not mentioning names, but basically like prompt injection, like two of them literally got prompt injected asking like withdraw the money off on the trading agent. It was crazy, like I don't know how people can launch even agents without guardrails. I think the highest priority focus should be obviously on security specific guardrails. Maybe let's actually cover a bit this question now that we cover standards, like what are the type of guardrails you will enforce? But also like it's kind of like a chicken-egg problem, right? Because you should also have orchestrators like Hermes and stuff that enforce either those specific plugins that have these guardrails already. Like the system is so open source right now that everybody can literally execute whatever plugin on top of their agent wallet or whatever, right? So the question is also whose role to build those guardrails and to kind of force them around the agent or maybe something that will come later. But maybe the first part of the question is what guardrails do we need apart from the specific security guardrails that we have today.
Yeah, maybe I start on that. So I think it goes all the way to the model layer. So we just had three research papers accepted into Europe's, which is one of the top AI conferences in the world, and one of those research papers is something called sparse inference alignment and it's effectively a safety layer that sits on top of a model. And what does it do? It basically looks at all the token consumption that the model is currently producing and the moment those tokens become high-risk tokens, i.e. low probability tokens, that particular safety angle can steer it into a low-risk, high-probability token again. So it's not unlike, let's say you're a parent and your child is about to do something dumb like fall off a bicycle. You as a parent can intervene very quickly and move that child into a safer trajectory. So it extends to the model layer and then at the agentic layer, kind of the harness around the agent needs to ensure that we have governance compliance, that we have specific risk metrics around it. What tools can it call? What models can it call? What happens if you're expecting a specific model yet the verification says it's now using a different model and the provider has changed? Is there an automatic off switch? So like a policy engine. So all of these things need to be thought through and that's where institutions are getting stuck as well. They've released a bunch of agents and they're now like, oh actually we're not supposed to do this. We have on-prem installs and they're accessing this type of stuff. So that's the issue.
You see already the result that people are building sandbox internal agent swarms and they're basically like with proper proprietary context and that's it, right? It's not really like an open kind of thing that works.
You're being idealistic. Sandbox. Many people don't even build a sandbox. They just use like straight out of the box OpenAI or... Yeah, it's like crazy.
I mean, I think there are a couple of... this is incredibly hard, right? Grand challenge problem, but I think there are a couple of ways in. One of them is to look to the kinds of financial controls that organizations use, right? Because in an organization you have people who are able to do things with the money and you don't want to be exposed to those people misbehaving, right? And so institutions have sophisticated financial controls that are designed to divide responsibility, to reduce the velocity at which the bad thing can happen, to put limits on what can happen, to do audit and so on. And we need to think in a holistic way like those do, right? They don't try to figure out necessarily all the devious things that say a malicious CFO could do or a malicious accountant or receiving clerk. They try to build systems that are robust and that limit the harm. Right? So that's I think one way in. Another way in is the idea that you need to separate the agent from the money via a... using a very clearly defined and simply implemented API so that it can only ask to do things that are obviously okay. Now it's not easy to figure out how to build that API without handcuffing the agent too much from doing what you want. But those are the sorts of approaches that people use in very high security or very high assurance settings involving things like industrial control systems.
