A desktop browser
A full browser is a large build, and it only makes sense once the inference layer it settles on exists at mainnet grade. Nothing on this page is shipped.
macOS
The full browser with the agent native to it, Brain and Agent as toggles.
Windows
The same browser, the same proof on every model call.
Linux
The same browser, the same approvals for sensitive actions.
What verification adds
The sidebar badge
Verified means the declared model produced this output, unforged, established by a committee recomputing the call. It never means the answer is true, and never means the agent is safe.
- No silent swap. The proof names the model. A smaller model cannot quietly stand in.
- Public by design. A verified call is visible to the committee. Confidential jobs run attested and never wear the verified badge.
- Large models. They verify statistically, by sampled recomputation.
- 01 / Act
The agent proposes
Each step becomes an inference job against a registered model, paid in $AIOS.
- 02 / Recompute
A committee recomputes
VRF-seated Miners recompute; the work-weighted >2/3 hash is canonical.
- 03 / Prove
The proof attaches
The result returns with job id, model, output hash and settlement.
- 04 / Audit
You can check
Anything the agent claims a model said is a public job on the explorer.
The limit
The proof covers provenance
The declared model actually ran, the output is unforged and recomputed independently, and it settled at the registered price.
The proof does not cover agent safety
A malicious page can inject instructions into what the agent reads. A verified call can still carry a manipulated conclusion.
Mitigations are controls, not proofs
Scoped permissions, action approval and contained sessions are agent-layer engineering, never a security claim.
The chain comes first
The mechanism ships first, then the token, then the browser as a flagship on native mainnet.
The mechanism ships first
Read how the mechanism works, including where it can fail.