The worm brought its own model
A price put on proving who is acting, a context nobody owns, and a worm that writes its exploit at each machine and needs no vendor's API.
How we organise
Visa is buying BioCatch for $2.4 billion
BioCatch reads thousands of signals while somebody uses a bank: keystrokes, touch gestures, how a device is held. From those it separates a customer from an attacker while the session runs, across 760 million users. Visa’s reason is that AI now runs account takeovers at a scale nobody has seen.
We tell a client to count the systems where a typed secret is the only thing standing between an attacker and a payment. A secret proves a person only while secrets stay expensive to steal, and that condition has gone. Most firms cannot say how many such systems they hold.
How we build
Deciding what a model sees at each step
Instructions, history, retrieved documents, tool outputs and the agent’s own notes all compete for the same space. Fitting them into a token budget is the easy part. The hard part is what to keep out, what to select back in, what to compress. A larger context fixes none of the four named failures.
Our position is that the context is either something a person designed or whatever happened to accumulate, and in most firms it is the second. It is where policy, data and instructions reach the model. An agent reading the wrong document at step forty has followed a design nobody made.
How we assure
A worm that writes its exploit at each machine
It carries an open-weight model that fits on a single accelerator, unmodified. On a test network of 33 mixed machines it exploited 73.8 per cent and copied itself to 61.8. It takes its compute from the machines it has already taken, so the cost of each new infection is nothing.
We judge a control by where it sits. Everything held at a vendor’s API counts for nothing here, and that covers much of what has been bought under the heading of AI safety. What still works is patching, segmentation, and knowing which machines can run a model at all.