Research in progress
Cold Fortress: exploring isolation for AI agents.
Investigating how controlled communication and disposable working environments can support AI agents that gather information.
FarPoint is investigating an AI-agent application of Cold Fortress’s patent, with Cold Fortress’s permission. The work combines implementation and experiments to examine what a controlled communication boundary can establish—and how useful work continues when an agent must be retired.
The approach
The starting point is the patent Securely accessing offline data with indirect communication. FarPoint’s prototype explores a scheduled rendezvous: a disposable agent receives a bounded task and can return to a trusted handler only under defined timing, destination, identity, and message rules.
A valid return can allow continued use of the same instance. A contract violation permanently disqualifies it, revokes its access, and triggers external cleanup. A replacement receives a fresh working environment and the original trusted assignment. The enforcement runs outside the disposable agent.
From mechanism to working task
The research has progressed from component and local-cycle checks to live agent workflows. A normal reading request can now initiate delegation, let a disposable agent read a bounded public webpage snapshot, and return an admitted result to the protected agent for its answer. Demonstrations include an extension and fresh replacement following deliberately injected early contact.
The dated updates below describe specific evidence and its scope. A successful communication check does not validate the truth of an answer or establish resistance to malicious source content. The current design also relies on trusted host controls and restores containers rather than whole machines.
Current direction
The single-agent verification milestone is complete within its documented prototype scope. It includes recovery of a reading interrupted by a handler-device reboot, bounded extensions, source-error reporting, and three consecutive serial readings. Earlier failures remain part of the record; the milestone does not establish production readiness.
The two-agent pool milestone completed its scoped live verification on September 26, including controlled replacement, queueing, interrupted assignment, and rollback. Management failures with unresolved causes remain documented, and the timing observations do not establish a general speed benefit. The first coupling experiment series is complete: it recorded both enforced cutoffs and compromised answers admitted on time. Follow-up designs now examine whether specific changes to task state or prohibited actions can cause loss of the return capability; those evaluations remain in progress.
Research updates
A wrong answer can arrive on time
Controlled Cold Fortress trials produced incorrect answers that still satisfied the rendezvous rules, separating communication enforcement from compromise detection.
A standby is not yet a successor
The multi-agent pool separates spare capacity from permission to resume a task. A controlled destruction outage tested that distinction.
Recovery means finishing the interrupted task
A reboot exposed both a startup defect and a misleading health check. The corrected trial followed recovery all the way to a completed reading.
From a reading request to a controlled return
Cold Fortress now connects an ordinary reading request to a disposable agent, a scheduled return, and an answer in the protected environment.