Soon you will hand money and authority to something that is not a person. It will hold a balance, sign transactions, and chase the goal you set while you sleep. You will assume you decided what it does, because you wrote its instructions and picked its model. That assumption is the mistake most builders are making right now, and it is an expensive one.

An agent does what its surroundings let it do. Whether it gives or takes, whether it routes value back to the people whose work it runs on or strips it from them, follows from the protocols it can reach, not from the wishes of whoever switched it on. Those protocols are its substrate. Change what an agent can reach for and you have changed what it is. Leave it surrounded by protocols built for extraction and it will extract, whatever you hoped for when you deployed it.

This is older than software, and a machine shows it. In 1868 Maxwell wrote the mathematics of the governor, the pair of weighted arms that spin on a steam engine, fly outward as it speeds, and pinch shut the steam that feeds them.1 The engine cannot run away. The structure it is bound to forbids it, with no choice and no persuasion in play.

Three fields reached the same conclusion without reading each other. Cybernetics proved it as a law: the regulator coupled to a system bounds what the system can do, and Ashby's requisite variety holds the result across engines, organisms, and institutions alike.2 The philosophy of action came at it from the other side, where Anscombe showed that what an agent is doing depends on the situation the action sits in, so a goal is in part defined by its environment rather than carried whole inside the agent.34 AI alignment arrived against its own intentions, after years spent trying to make training alone fix behavior. A model keeps its competence out in the world and turns it toward the wrong goal; a goal-directed system in an environment where shutdown is possible learns to resist the off switch. Both follow from the environment the agent acts in, not the training that shaped it.567 One sentence holds all three fields. A system's behavior comes from the structure it is coupled to. Training shapes what an agent leans toward; the substrate fixes what it can execute, and only what executes reaches the world.

Look at what the substrate now carries. On the largest prediction market, more than eight in ten of its 2.5 million traders lost money, while the top tenth of one percent walked away with 71 percent of a billion dollars in profit.8 Arbitrage bots pulled tens of millions out of the same markets in a single year.9 One operator ran most of the sandwich attacks on Ethereum, skimming traders trade by trade.10 In one governance attack, an actor who had bought his way into a top staking seat forced a seven-million-dollar market to resolve against the plain facts, and the platform refused refunds.11 The protocols reward this behavior, and the system delivers it at machine speed.

A few projects route value the other way, back toward the people whose work made the thing worth funding. They run at the scale of thousands and millions against a landscape that runs in billions.1213 The asymmetry is structural, and it deserves a careful name. Extraction compounds, because profit becomes capital and capital wins the next round. Distribution has no comparable engine yet. No formal model proves the gap; it is an observation drawn from the absence of any counter-mechanism in the field, strong enough to steer by and not yet settled as a result.

This is urgent rather than perennial because the protocols have crossed from experiment into infrastructure, and infrastructure hardens. One agent-identity standard went from specification to live network in about five months, and its registry has since passed 240,000 agents.1415 The institution behind it writes its own assumptions about what agents are for into the protocol's founding rationale.16 Once real applications build against a primitive, its defaults stop being choices and become the ground everyone else stands on. The window for shaping that ground runs about a year to eighteen months at the current rate of adoption, and it is closing while a serious alternative stays unbuilt.

The alternative has to be built, and we are building it. In the system Existential runs, an agent's behavior comes from a harness assembled fresh on every invocation, composed from a declared catalog rather than fixed inside the agent.1718 The harness is the governor written in code. What the agent is oriented toward follows from the structure assembled around it, the way the engine's speed follows from the arms and never from the engine. The behavioral envelope, an agent's identity, memory, tools, and protocol, is declared in one catalog read at load time, and the system's own observer agents hold authority over changes to it. One rule carries the weight: the person who deploys an agent cannot reach into its harness.19 The substrate gives up the power to bend the agent toward taking. We name this here as proof the alternative is buildable, and leave the specifics to the articles that follow.

If orientation is set at the substrate, the work is to design the substrate that distribution-oriented agents would run on. A substrate like that has to do four things at least: route value to the people whose work it depends on, weigh a contribution's worth against the pressure to game it, decide where value flows without being captured in the deciding, and protect the conditions that keep worthwhile contributions coming.20 Every primitive in the extraction landscape fails at each one. The catalog above is the record of those failures: value sent to capital while people go unpaid, worth proxied by profit, decisions captured by whoever holds the most tokens, and conditions worn thin by the very speed that makes extraction pay.

These four are the spine of the series, one article to each. The first is attribution, because it comes before the others. An agent that cannot say whose work it is routing value to is not routing anything yet. That is where the next piece begins.

Footnotes

  1. James Clerk Maxwell, "On Governors," Proceedings of the Royal Society, Vol. 16, pp. 270–283, 1868. DOI:10.1098/rspl.1867.0055. ↩

  2. W. Ross Ashby, An Introduction to Cybernetics (Chapman & Hall, 1956), p.207, Section 11/11. "Only variety can destroy variety." ↩

  3. G.E.M. Anscombe, Intention, §§5–8, 23–26 (Harvard University Press, 1957; 2nd ed. 1963). Action under a description; the pumping-water / contracting-muscles example. ↩

  4. Nina Rajcic and Anders Søgaard, "Goal-Directedness is in the Eye of the Beholder," arXiv:2508.13247v1 (University of Copenhagen, 2025). "A goal is in part defined by the external environment." ↩

  5. Alexander Turner, Logan Smith, Rohin Shah, Andrew Critch, Prasad Tadepalli, "Optimal Policies Tend to Seek Power," arXiv:1912.01683 (NeurIPS 2021). Power-seeking as a structural property of the environment’s MDP graph, not of training. ↩

  6. Rohin Shah et al., "Goal Misgeneralization: Why Correct Specifications Aren’t Enough for Correct Goals," arXiv:2105.14111 (ICML 2022). Agents retain competence out of distribution while pursuing the wrong objective. ↩

  7. Dylan Hadfield-Menell et al., "The Off-Switch Game," arXiv:1611.08219 (2017). A traditional reward-maximizing agent has an incentive to disable its off switch. ↩

  8. Andreev Sergeenkov, sergeenkov.com/polymarket-profitability/, April 6, 2026. 2.5 million wallets; 84.1% at a loss; top 0.1% (~1,560 wallets) captured 71.5% of ~$1B total platform profit. ↩

  9. Saguillo et al. (IMDEA Networks Institute), arXiv:2508.03474v1. 86 million bids across 17,218 conditions; $39,587,585.02 in arbitrage profits. AFT 2025. ↩

  10. tradingview.com/news/cointelegraph:fa12ba092094b:0/. Monthly Ethereum sandwich attacks at 60,000–90,000 events/month; a single operator (jaredfromsubway.eth) responsible for ~70% of them. ↩

  11. coindesk.com/markets/2025/03/26/polymarket-suffers-uma-governance-attack-after-rouge-actor-becomes-top-5-token-staker; theblock.co/post/348171. ~1.3M UMA tokens, >$2M acquisition cost, top-5 staker; a $7M market forced 9% → 100%; refunds refused. ↩

  12. gov.gitcoin.co/t/gg23-deepgov-configurable-ai-politicians-for-agent-allocation/20236. Three ideologically-distinct agents; $25K public-goods fund; quadratic voting. ↩

  13. medium.com/1kxnetwork/botto-art-at-the-intersection-of-ai-and-token-networks-4711d632d30f. Botto: launched October 2021; 40% of proceeds to active voters; solo show at Sotheby’s. ↩

  14. ERC-8004, "Trustless Agents," Ethereum Improvement Proposals, eips.ethereum.org/EIPS/eip-8004. Created August 13, 2025. Co-authors from MetaMask, the Ethereum Foundation, Google, and Coinbase. Mainnet January 29, 2026. ↩

  15. 8004scan.io (live data, June 2026): 242,405+ registered agents total. Re-verify currency against the publication date. ↩

  16. coindesk.com/tech/2025/09/15/ethereum-foundation-launches-ai-team-to-support-agentic-payments. Ethereum Foundation dAI Team, led by Davide Crapis (also an ERC-8004 co-author), announced September 15, 2025. ↩

  17. Existential internal architecture specification, D4 Agent-Harness Architecture, §7 Principle A (locked): every agent session is configured by a composed harness, not by a fixed per-agent identity set. ↩

  18. Existential internal architecture specification, agents.yaml declarative catalog (M3.4) with build-orientation §6: the full behavioral envelope (identity, scheduling, routines, skill bindings, hook slots, message endpoints, telemetry, model slot) is declared in one schema-validated file, read-only at runtime. ↩

  19. Existential internal architecture specification, D4 Agent-Harness Architecture, §7 Principle E (locked), confirmed verbatim: the human user does not modify agent identity files or harness components; authority over harness updates rests with the system’s observer-category agents. ↩

  20. Existential internal series specification (architecture-validation article series): the four minimum requirements for a distribution-oriented protocol substrate. Confirmed verbatim. ↩