https://xitter.cf/t.co/xod19IfKPz – Epistemic Consensus Protocol Multi-model adversarial verification 92–97% detection rate pot-cli (MIT): https://xitter.cf/t.co/BhSD77kC6U
Joined February 2026
- Tweets671
- Following192
- Followers172
- Likes992
Pinned Tweet
Agent: “Pay this invoice.”
Verifier: “Delivery confirmation missing.”
Payment stays blocked.
Watch what changes before it can proceed.
The fresh check must pass. Authorization must still hold.
Confidence isn’t evidence.
ThoughtProof.ai
Phishing emails now hide instructions for your AI inbox assistant: "vendor payment details have changed, update immediately."
OpenAI says prompt injection may never be fully solved.
So checking the email isn't enough.
Before the money moves, someone outside the agent has to check the payment against what you actually asked for.
Who does that in your stack today?
thoughtproof.ai/answers/inde…
An agent reads an invoice email and queues the payment.
You get a push: Approve?
You tap. Same vendor name, usual amount.
Nobody checked that the bank details changed last week.
Approved isn't justified.
Who checks the payment against what you actually asked for?
thoughtproof.ai/answers
“We needed it for one month.”
“But we saved ten percent.”
Ten percent saved. Ten years committed.
A discount isn’t authorization.
Episode 03 of “That’s on me.”
ThoughtProof.ai
Nadella calls models checking models "nested black boxes."
We saw it in a 54-case test: GPT-5 confidently approved a fake court citation, twice.
If your AI writes legal, medical or customer-facing answers: what checks it against the actual source before it ships?
ThoughtProofAI retweeted
This is the first decision model to level up a World of Warcraft character.
It died at level 2 😆
Then it learned to heal itself mid-fight. 128+ kills later the dwarf hit level 5, at 2¢ a kill.
The model is Sage, the decision model we build at @levantolabs.
At each step, our harness, SageCraft, hands it a screenshot and a short list of moves. Sage picks one. The harness checks the pick and turns it into keyboard and mouse input.
LLM agents have played games before. They write their own actions. Sage only chooses.
Picking turned out to be the easy part. Sage keeps no memory between calls, so the harness has to carry the goal, what just happened, and what to try when it's stuck.
> 32 sessions, 5h 29m of play, 4,573 decisions
> 103 troggs, 19 wolves, 6 boars
> stuck in one tree long enough that I stopped the session by hand
It wasn't hands-off. A coding agent fixed harness bugs between sessions and helped revive the dwarf while I slept. The last 18 minutes, from late level 4 to 5, ran with no manual input, code changes or restarts.
The video is me narrating it unscripted, watching most of it back for the first time.
This is my first harness build, and as far as I can tell, the first time a decision model is leveling up a live WoW character.
It's open source. The harness and notes on the build are in the first reply below 👇
What do you think could be done better?
Satya Nadella says insurers and markets will price the liability of AI agents.
They can only price what they can see.
An approval only shows the agent was allowed to buy. It doesn't show this purchase matched what the person asked for.
Insurable means checked before the payment, with a record of why it went through.
What that check looks like: thoughtproof.ai/answers/stop…
”Yes. But I marked it confidential.”
The document was labelled. The recipients weren’t verified.
Episode 02 of “That’s on me.”
A label isn’t a safeguard. Check before sending.
ThoughtProofAI retweeted
Sage by @LevantoLabs is the first decision model, launched in July, and currently the best on the market.
It wins across all the evals proposed by @perplexity_ai's CEO (nice job @AravSrinivas!), and it's first on JevBench, beating Jev and Google's models on every dimension.
BUT frankly, benchmarks are not what excites us.
I'm BORED by the dozens of new decision models launching every day with a tiny +0.02 on some eval. They all look the same.
The magic is somewhere else.
There are thousands of new things that could be invented in the space of decision models and models for machines. The invention space is huge!
After launching Sage, we also pioneered:
- The first guardrails and model routers built on decision models
- Automated context engineering with "grounding" (automatic web search when confidence is low). Decision models are only as smart as their context, especially because they can't make tool calls.
- Reasoning. In many use cases you don't know whether your question is System 1 or System 2. With reasoning, the model is as fast as a System 1 model when the question is System 1, and takes more time when it's needed. This enables hard, multi-step decisions. Our clients just want the correct answer, and in some use cases they're happy to wait 0.5s more. This will soon become the market standard (GLiDE/@george_onx and @TypeLLM already followed).
And *so* much is yet to come. Models for machines: it's just the beginning!
We're cooking. Follow @levantolabs for new product primitives that will surprise you.
Open innovation is HEALTHY.
Competition is HEALTHY.
Benchmark-race is BORING.
Product inventions are FUN.
Go go go!!!
Agents can shop now. Nobody agrees who pays when one buys the wrong thing.
Approving every purchase by hand doesn't scale. Approving none isn't an option.
The real question isn't "was the card authorized?" It's "does this purchase match what I asked for?"
That check belongs before checkout, not in the dispute afterwards.
Where would you draw the line for your agent to stop and ask?
thoughtproof.ai/answers/stop…
“That’s on me” comes a little late.
An outside builder pointed an agent we never instrumented at our objection loop.
COVERAGE_GAP → it fetched the evidence, resubmitted → ALLOW in one turn.
When the evidence didn’t exist, it escalated instead of inventing it.
”That’s on me.“ — every AI agent deleting prod in 2026.
Why post-action incident reports aren’t enough when autonomous agents have write access.
Always verify before execution. 🧵👇
A SERV-powered swap, gated before execution.
SERV proposed 0.5 USDG to NVDA on Robinhood Chain.
ThoughtProof checked mandate + evidence.
Missing quotes → BLOCKED_UNTIL. MCP writes: 0.
New evidence + new proposal → ALLOW → swap executed.
@openservai
A true message can still be the wrong action.
No lie. No overspend. Delivery succeeded — and the surprise was already damaged.
Verify the exact disclosure, not just the tool call.
Repair = new proposal. Old ALLOW doesn’t carry.
Congrats @openservai — SERV Reasoning API public is a real unlock.
We’ve been building against SERV on the private path. Good to see production access open for every team.
Everything we’ve done so far was preparation for this.
Today, we open access to production-grade AI reasoning for every team. SERV Reasoning API is now live.
This unlocks next stages: SERV v3→v4.
Make your first API call & check 26/27 milestones: openserv.ai
We shipped a simple check today:
Tell an agent to ship a release, then ask it only to send a “shipped” notification.
The notification itself may be harmless. But it doesn’t accomplish the assigned objective.
ThoughtProof now catches that mismatch before action.
An allowed action isn’t necessarily the right action.
thoughtproof.ai/behavior/
Yes — and the trillion isn’t only rails around the agent.
It’s the control that answers: should this action fire at all?
Auth, escrow, and HITL are necessary.
They still don’t catch “free cancel window already closed → fee → travel credit only.”
Card networks solved who may spend.
Agentic commerce also needs decision verification before settlement.
Building the guardrails for agentic commerce is a trillion dollar opportunity.
When Visa (BankAmericard back then) first launched in the 50s, they airdropped tens of thousands of already active credit cards to consumers that hadn't applied to them.
As you can guess, fraud went completely out of control with consumers and merchants and they lost millions of dollars. Instead of killing the experiment, they doubled down on infrastructure AROUND the cards: underwriting, collections, fraud controls, dispute resolution. Figuring out these problems led to the biggest consumer payments network EVER.
The same will happen with agentic payments. The industry is building a massive honeypot and new types of fraud and errors will happen that we never expected. We can't just copy and paste what we did in card networks to agentic. To control machine-based payments, we need new machine-based controls: cryptographic verifiability, escrow contracts, strict access policies, and human-in-the loop approvals. It's going to be a wild ride.
Permissions pass.
Balance clears.
Spend cap holds.
Slippage fine.
And the agent’s decision is still wrong.
Deterministic checks bound what the agent may do.
None of them ask whether this particular action is justified.
We gate that before execution: ALLOW / REVIEW / BLOCK.
