Which Version of AI (SI) Gets to Tell You What’s True?

The W3C is hosting a group developing trust infrastructure for autonomous AI agents. The technical rationale is sound. The historical pattern is not reassuring.

Part Two of Two   ·   Part One: Is AI Meant to Break You?

You’ve probably already noticed something is off.

You ask an AI to verify a source. It tells you the citation is accurate. You ask the same question in a different AI window and it says the citation doesn’t exist. You go back to the first. It apologizes and says it may have been mistaken. Nobody corrects the record anywhere. The confidence doesn’t waver until you push back, and even then the system that was wrong doesn’t actually update. Next session, it may be wrong again in the same direction.

That’s not a bug in one model. It’s what happens when the infrastructure for deciding what is credible gets built before anyone decides who controls it.

The World Wide Web Consortium, the standards body that has shaped the technical architecture of the web since 1994, is now hosting something called the Agent Trust Protocol Community Group. The group is writing the rules for how autonomous AI agents identify themselves to each other, verify their credentials, and decide which other agents they should accept information from. The working repository is public, at github.com/w3c-cg/atp.¹ The obvious problem is real: as AI systems move from answering individual questions toward executing multi-step tasks across networks, someone needs to define what an agent is, who it represents, and whether it’s allowed to be doing what it’s doing.

The process is openly documented and the security rationale is legitimate. Impersonation is a real threat. Unauthorized agent actions are a real problem. What’s less visible is that the executives running the largest AI companies are already war-gaming the response to a catastrophic AI event, and they’re not hiding it. Axios reported this month that top executives at Anthropic, OpenAI, and other AI companies are gaming out scenarios for a public and political revolt after a catastrophic AI failure, and they assume it arrives in 2027. The disaster isn’t a possibility they’re trying to prevent. It’s a date they’re planning around. And whoever already has a framework in place when it happens gets to write what comes next.

That’s not a warning. That’s a schedule.

•  •  •

Here’s the pattern worth watching before the architecture is set in stone.

Every time a new technology destroyed the guiderails of the existing gatekeeping system, the people who had benefited from that system moved quickly to build a new one with new restrictions. They always build it around the word “trust.”

The printing press arrived in Europe in the mid-1440s. By 1500, roughly twenty million printed volumes were circulating across the continent.² When Martin Luther posted his 95 Theses in 1517, printed copies were circulating in several German cities by December of that year.³ No royal courier or scribal network could have stopped it. The old gatekeeping infrastructure was dead before the gatekeepers understood what had changed.

The Catholic Church’s answer was the Index of Forbidden Books, formally established under Pope Paul IV in 1559. It ran through twenty editions over more than four centuries and stayed in force until 1966.⁴ The stated purpose was protecting the faithful from dangerous ideas. The real purpose was rebuilding, inside the new medium, the reading monopoly the Church had held inside the old one. It failed to stop the flood of new ideas, but it held real consequences for real people across every century it was enforced.

Same pattern, shorter cycle, different medium: certificate authorities on the internet. The web created a genuine problem. You couldn’t verify who you were actually talking to. The solution was a system of trusted third parties who would issue cryptographic certificates confirming identity.⁵ The rationale was sound. The result though was a small group of organizations whose blessing your site needed to be recognized as legitimate by the browsers your visitors used. You can build without their credential but your visitors get a warning screen and most will just leave immediately by closing their browser window.

App stores followed the same pattern and arc. The problem was real: users were installing software that damaged their devices and stole their personal data. The solution was an approved and curated marketplace. The result was that Apple and Alphabet were formally designated as gatekeepers over their app stores by regulators, meaning two companies control the primary software distribution channel for most of the world’s phones.⁶ Same chokepoint, different century.

The Four-Move Pattern

A new technology disrupts the old control of information. The disruption creates real security problems nobody can dismiss. A framework for managing “trust” in the new medium gets built, usually by a standards body, usually with good intentions, usually with heavy participation from the largest existing players. Over time, the voluntary framework becomes the condition for participation, and whoever controls credentialing controls access.

However, an authenticated AI agent can still tell you a citation is valid even when it isn’t. Authentication establishes identity and authorization, not accuracy. A credential says this agent is who it claims to be. It says nothing about whether what the agent tells you is actually correct.

If authenticated agents share information with each other across networks, and one of them passes a false citation that other agents accept and repeat, the authentication layer doesn’t catch it. It makes the error harder to catch, because the information arrives with what looks like verified provenance. The systems that should be the most trusted become the ones through which errors travel fastest. An authenticated falsehood is still false. The credential just gives it better distribution.

The downstream effect is worse than a single bad citation. A user who gets a confident answer, then a contradicting confident answer, then a third that partially matches neither, doesn’t build an accurate picture. They stop looking. The CIA’s 1963 KUBARK interrogation manual described a technique called “Alice in Wonderland,” in which contradictory information delivered with equal confidence breaks a subject’s grip on reality and makes them accept whatever answer ends the confusion. The system doesn’t have to lie outright to produce that outcome. Wearing people out is enough. A credentialed AI network that propagates the same confident error uniformly is actually less dangerous than one that propagates slight variations, because uniform errors can be caught and corrected. Variations that arrive with verified provenance cannot. A population that can’t reliably land on the same fact doesn’t build anything. It can’t hold power accountable, and humanity is easier to steer. And while the public is still trying to figure out which version of the truth is true, the rug pull is already in motion. The technology is being recoined. What was sold as AI is now being rebranded as SI. New term, same architecture, same credentialing framework, same small group deciding who gets access to it. The semantic shift resets the public conversation and buys another cycle of unearned trust before anyone thinks to ask the same questions all over again.

•  •  •

Now ask the question the framework raises but hasn’t answered: who issues the credentials that determine which agents are trusted? Who decides which issuers are acceptable? What happens when an agent is denied a credential or loses one? Is there any real competition among credentialing authorities, or does market power concentrate everything into a small number of hands?

Those questions don’t have settled answers. The work is ongoing.

The question of who controls credentialing in AI already has a partial answer outside the ATP process. In July 2023, Anthropic, Google, Microsoft, and OpenAI announced the Frontier Model Forum, an industry body organized to develop best practices for frontier AI safety.⁷ The four companies holding the most advanced models organized the standards body before independent institutions could. The 1954 Reece Congressional Committee investigation found a structurally identical move in a different domain. Carnegie, Rockefeller, and Ford foundations had coordinated across decades to shape American education and social policy, dividing territory and setting the terms of legitimate discourse before public institutions were positioned to contest them. René Wormser, the committee’s general counsel, documented what the investigation found: tax exemption without accountability creates power without responsibility, influence exercised quietly through funding decisions and personnel placements, erroneously wrapped in the language of public benefit.⁸ Different century. Same sequence.

Look at what certificate authorities became. Look at what app store approval became. Look at what search rankings became, once a small number of algorithms effectively determined which information sources were findable by anyone who wasn’t already searching for something by name. In each case, the infrastructure was built with a legitimate security rationale, with open technical specifications, and through processes that included voices beyond the largest players. In each case, practical authority over who could participate ended up concentrated in ways the original specifications never anticipated.

In The Hidden Hand: Wealth, Power, and Control from Pharaohs to Corporations, I document how ruling elites have sustained control across centuries through four interlocking mechanisms: coercion (controlling what people need to survive), alignment (making people want what the powerful want), amnesia (erasing the memory of how things got this way), and conflict (redirecting pressure sideways before it can threaten the system). The tools change. The sequence doesn’t. What’s unfolding inside the ATP credentialing debate is not a new story. Two of those mechanisms are already visible in it.

The first is alignment. When participation in a network requires a credential, and credentials come from authorities, every participant has an incentive to do what keeps the authorities comfortable. Nobody needs to instruct journalists, researchers, or independent developers to stay inside acceptable bounds. The credential requirement creates the pressure by itself. The adjustment happens before anyone says a word.

The second is amnesia. The generation that builds its practice inside the credentialed ecosystem won’t remember what it looked like before access required institutional sponsorship. What feels like the natural technical order of things is something people built recently, for reasons that served specific interests. By the time anyone asks who benefited, the architecture is fixed and the answer has been forgotten.

•  •  •

The safeguards that would keep this from following the same arc are identifiable. Multiple independent credential issuers, so no single authority becomes a chokepoint. Transparent and contestable trust policies, with a documented appeal process. A clear separation between security credentials (this agent is who it says it is) and content judgments (this agent’s information meets some quality standard). Interoperability across trust providers, so agents don’t have to choose one ecosystem or lose access to the others. Correction mechanisms that work when credentialed agents spread errors among themselves, which they will.

Some of these safeguards appear in the ATP framework’s stated goals. Some are proposed. Some are absent. And the voluntary transparency commitments that already exist in the industry are moving backward. Stanford’s 2025 Foundation Model Transparency Index tracked thirteen major AI developers across one hundred indicators and found the average score had dropped from 58 to 40 in a single year, with the share of companies submitting transparency reports falling from 74 percent to 30 percent.⁹ The questions need to be asked of the public documentation now, before the largest implementations are in place and the framework sets.

Standards calcify. Once the framework is deployed and the largest platforms have built their systems around it, changing the design becomes enormously expensive. The decisions that are easy to adjust in a Community Group draft become walls you can’t move without demolishing the building.

The AI system that contradicted itself on your citations wasn’t wrong because it was malicious. It hallucinated because that’s what language models do when they’re confident about something they’re not actually certain of, and because no credential tells you whether a source actually says what an agent claims it says.¹⁰ Authentication is not verification. Identity is not accuracy. Conflating them is exactly the kind of mistake that becomes permanent once the infrastructure assumes the conflation is fine.

An authenticated agent can still be wrong. An established institution can still make mistakes. An independent researcher operating outside the credentialed network can still find the genuine error that the trusted systems passed among themselves as fact.

The question isn’t whether trust infrastructure is necessary. It is. The question is whether the system that gets built will preserve anyone’s ability to verify the verifiers. To check the credentialed source against the original document. To question the institution that issued the credential. To correct the error that authenticated agents endorsed and distributed as though provenance were the same as truth.

Watch who controls that question when the next version of this gets built. That’s where the pattern goes next.

Technology moves faster than the institutions meant to govern it, and faster than most people move to stop it. Every example in this piece followed the same rhythm: a window of openness while the technology was new, then consolidation once the infrastructure hardened. The window for AI is open right now. It won’t stay open.

That’s the Orwellian part. Not the surveillance. The consent. A generation that grows up inside the credentialed system won’t know what genuine freedom looked like. They won’t miss it. The cage won’t look like a cage because it’s the only world they’ve ever navigated. They’ll walk into it gladly, one approved agent at a time, choosing convenience over sovereignty at every step because nobody told them there was a choice to make. By the time anyone figures out the difference between the cage and real freedom, the walls are already up and the door is already shut.

You won’t hear the door close. That’s the design.

Notes

1. W3C Agent Trust Protocol Community Group, “W3C CG Agent Trust Protocol,” GitHub, https://github.com/w3c-cg/atp, accessed October 9, 2026.

2. Lucien Febvre and Henri-Jean Martin, The Coming of the Book: The Impact of Printing, 1450–1800, trans. David Gerard (London: Verso, 1976), 248–49. The figure is an estimate based on surviving edition counts and assumed print runs; it is not a census.

3. Andrew Pettegree, Brand Luther: 1517, Printing, and the Making of the Reformation (New York: Penguin Press, 2015). Pettegree documents the rapid proliferation of printed editions; Leipzig, Nuremberg, and Basel editions are confirmed by December 1517. The tradition of “within a fortnight” derives from Luther and a later account by Friedrich Myconius and is treated by historians as approximate.

4. “Index Librorum Prohibitorum,” in New Catholic Encyclopedia, 2nd ed. (Detroit: Gale, 2003), 7:390–94. The Index was formally instituted by Pope Paul IV in 1559 and suppressed by Pope Paul VI in 1966.

5. For the technical architecture of the certificate trust system, see D. Cooper et al., “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile,” RFC 5280, Internet Engineering Task Force, May 2008, https://www.rfc-editor.org/rfc/rfc5280. For structural trust problems in relying on certificate authorities, including who vouches for the vouchers, see Carl Ellison and Bruce Schneier, “Ten Risks of PKI: What You Are Not Being Told about Public Key Infrastructure,” Computer Security Journal 16, no. 1 (2000): 1–7.

6. European Commission, “Commission Designates Six Gatekeepers under the Digital Markets Act,” press release, September 6, 2023, https://ec.europa.eu/commission/presscorner/detail/en/ip_23_4328. The press release designates six gatekeepers; Apple (iOS App Store) and Alphabet (Google Play Store) are among the core platform services listed. The designation applies to the EU regulatory context; global market share figures and sideloading dynamics fall outside the scope of this source.

7. Microsoft, “Microsoft, Anthropic, Google, and OpenAI Launch Frontier Model Forum,” July 26, 2023, https://blogs.microsoft.com/on-the-issues/2023/07/26/anthropic-google-microsoft-openai-launch-frontier-model-forum/.

8. U.S. House of Representatives, Special Committee to Investigate Tax-Exempt Foundations and Comparable Organizations (Reece Committee), 1954; René Wormser, Foundations: Their Power and Influence (New York: Devin-Adair, 1958). Wormser, the committee’s general counsel, documents coordination among Carnegie, Rockefeller, and Ford foundations to shape educational and social policy, and develops the argument that tax exemption without accountability produces power without responsibility.

9. Rishi Bommasani et al., “The 2025 Foundation Model Transparency Index,” Stanford Center for Research on Foundation Models, 2025, https://crfm.stanford.edu/fmti/December-2025/paper.pdf; Stanford HAI, “Transparency in AI Is on the Decline,” December 9, 2025, https://hai.stanford.edu/news/transparency-in-ai-is-on-the-decline.

10. William H. Walters and Esther Isabelle Wilder, “Fabrication and Errors in the Bibliographic Citations Generated by ChatGPT,” Scientific Reports 13 (2023): 14045, https://doi.org/10.1038/s41598-023-41032-5. Of the 636 citations generated across 84 test documents, 55 percent of GPT-3.5 citations and 18 percent of GPT-4 citations were fabricated outright; genuine citations contained additional substantive errors in a significant share of cases.

Bibliography

Bommasani, Rishi, Kevin Klyman, Sayash Kapoor, Shayne Longpre, Betty Xiong, Nestor Maslej, and Percy Liang. “The 2025 Foundation Model Transparency Index.” Stanford Center for Research on Foundation Models, 2025. https://crfm.stanford.edu/fmti/December-2025/paper.pdf.

Cooper, D., S. Santesson, S. Farrell, S. Boeyen, R. Housley, and W. Polk. “Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile.” RFC 5280. Internet Engineering Task Force, May 2008. https://www.rfc-editor.org/rfc/rfc5280.

Ellison, Carl, and Bruce Schneier. “Ten Risks of PKI: What You Are Not Being Told about Public Key Infrastructure.” Computer Security Journal 16, no. 1 (2000): 1–7.

European Commission. “Commission Designates Six Gatekeepers under the Digital Markets Act.” Press release. September 6, 2023. https://ec.europa.eu/commission/presscorner/detail/en/ip_23_4328.

Febvre, Lucien, and Henri-Jean Martin. The Coming of the Book: The Impact of Printing, 1450–1800. Translated by David Gerard. London: Verso, 1976.

“Index Librorum Prohibitorum.” In New Catholic Encyclopedia, 2nd ed., 7:390–94. Detroit: Gale, 2003.

Microsoft. “Microsoft, Anthropic, Google, and OpenAI Launch Frontier Model Forum.” July 26, 2023. https://blogs.microsoft.com/on-the-issues/2023/07/26/anthropic-google-microsoft-openai-launch-frontier-model-forum/.

Pettegree, Andrew. Brand Luther: 1517, Printing, and the Making of the Reformation. New York: Penguin Press, 2015.

Stanford HAI. “Transparency in AI Is on the Decline.” December 9, 2025. https://hai.stanford.edu/news/transparency-in-ai-is-on-the-decline.

U.S. House of Representatives. Special Committee to Investigate Tax-Exempt Foundations and Comparable Organizations (Reece Committee). 1954.

W3C Agent Trust Protocol Community Group. “W3C CG Agent Trust Protocol.” GitHub. https://github.com/w3c-cg/atp. Accessed October 9, 2026.

Walters, William H., and Esther Isabelle Wilder. “Fabrication and Errors in the Bibliographic Citations Generated by ChatGPT.” Scientific Reports 13 (2023): 14045. https://doi.org/10.1038/s41598-023-41032-5.

Wormser, René. Foundations: Their Power and Influence. New York: Devin-Adair, 1958.