“When an agent has access to the resources that are used to enforce its guardrails, those guardrails can’t be relied on,” co-author Dani Vilardell, also a Cornell Tech PhD student, told CoinDesk.
Approval requires “a physical interaction that can’t be simulated in software,” Vilardell said. The person must see “a genuine representation of the action they were approving,” and the agent must not be able to extract the approval keys.
To demonstrate the approach, theresearchers built Countersign, an open-source prototype intended to combine those properties in a phone app. Vilardell said it can run on Android and Apple devices, with human confirmation tied to the specific action.
The prototype still relies on device and operating-system assumptions, including protection of the approval display. It has different limitations on Android and iOS.
The broader challenge is establishing whether a payment was genuinely approved by a person, rather than an AI agent with access to the same credentials.
Levin said every approval an agent requests should leave a verifiable record of who signed off and on what.
“Without that record, nobody can say afterward whether a person approved anything at all,” he added.
Leave a Reply