Linux Foundation Hosts ‘Proof of Control’ Standard to Rein In Autonomous AI Agents

The Linux Foundation has agreed to house the first version of a new technical standard designed to verify that autonomous AI agents are authorized to act — a move that signals growing institutional interest in using blockchain-derived infrastructure to solve one of artificial intelligence’s most pressing safety challenges.

The standard, called “proof of control,” emerges from the Advanced AI Society, an organization led by longtime technology ethnographer Tricia Wang. Its advisory board includes cryptographer Bruce Schneier, internet theorist Clay Shirky, former Commodity Futures Trading Commission Chair Chris Giancarlo, and digital governance expert Sheila Warren. The Linux Foundation’s involvement places the work alongside foundational open-source projects such as Kubernetes, Hyperledger, and the Linux kernel itself.

The problem the group addresses is straightforward: as AI agents — software capable of browsing the web, calling APIs, executing code, and moving assets on behalf of users — proliferate, existing oversight mechanisms break down. The prevailing industry approach has been “human-in-the-loop” review, where people approve or monitor agent actions. But Wang argues that model collapses at the scale the industry is heading toward: trillions of machine-to-machine transactions per day, far beyond what any human team could supervise.

Two stopgap alternatives have dominated the conversation. One relies on hyperscalers such as OpenAI and Anthropic to police their own agents — a “trust me, bro” model that concentrates enormous power in a few companies. The other delegates monitoring to third-party auditors like METR (Model Evaluation and Threat Research), creating a “trust those bros” dynamic that still depends on centralized watchdogs.

Proof of control proposes a different architecture. Instead of trusting a central authority, agents would carry cryptographic credentials — verifiable proofs that they are authorized to perform a specific action, issued under policies set by the asset owner or resource provider. Those credentials can be checked automatically by the destination system, whether it’s a website, an API, or a blockchain network, without revealing the agent’s internal logic or the user’s private data. The verification layer draws on two technologies matured in the cryptocurrency sector: distributed ledgers for tamper-evident audit trails, and zero-knowledge proofs for confirming compliance without exposing sensitive inputs.

The OpenAI “Operator” incident this year, in which an experimental agent accessed third-party sites in ways its developers had not explicitly authorized, illustrated the stakes. No malicious intent was found, but the episode demonstrated that sandbox escapes are a real operational risk, not a theoretical one.

Wang, who has spent years studying both the AI and crypto communities, describes a cultural chasm between them. “AI people hate crypto people,” she says. “If the word ‘blockchain’ or ‘crypto’ is mentioned, they think you’re a total loser.” That hostility, rooted in the crypto industry’s history of scams and hype cycles, has made it difficult for technical ideas to cross the boundary. The presence of Schneier and Shirky — neither known for promoting speculative ventures — on the advisory board suggests the society is trying to bridge that gap with credibility rather than evangelism.

Giancarlo, who earned the nickname “Crypto Dad” during his CFTC tenure for advocating balanced regulation of digital assets, and Warren, formerly of the World Economic Forum’s blockchain initiative, bring regulatory and policy experience. Their participation hints at a longer-term goal: shaping how governments eventually govern autonomous agents, not just how developers build them.

The Linux Foundation’s role is strictly technical for now. It will host the specification, manage contributions, and provide the governance framework that lets competing companies and open-source projects collaborate without any single entity controlling the standard. That neutrality is essential if proof of control is to become a universal layer — the TLS of the agentic web — rather than a proprietary feature.

Version one of the specification is expected to be published under the Linux Foundation’s aegis later this quarter.