The Machine Acquires an Office: A Briefing on AI Agents, Machine Learning and Cryptography

Tuesday 18 August 2026

Artificial intelligence is passing through an institutional transformation. For several years the public encounter with AI was principally conversational: a person posed a question and a machine produced an answer. The emerging systems of 2026 are different. They may search for information, operate software, write and test computer code, instruct other specialised systems and return only when a task has been completed. The machine is no longer merely composing a memorandum — it is beginning, in a limited and carefully qualified sense, to hold an office.

This change has produced a dense undergrowth of terminology. “Agents”, “reasoning models”, “world models”, “test-time compute”, “zero-knowledge proofs” and “post-quantum cryptography” are routinely invoked as though their meanings were self-evident. They are not. Nor are all these developments equally mature. Some are genuine changes in the architecture of computing. Others are ingenious engineering improvements surrounded by more extravagant philosophical claims than the evidence yet warrants.

What is an AI agent?

A conventional large language model receives an instruction and predicts a sequence of words in response. An AI agent places such a model inside a larger system. The model may formulate a plan, select a tool, observe the result and decide what to do next. The essential feature is the loop: instead of producing one answer, the system repeatedly acts and reassesses until it reaches a stopping point.

An agent asked to investigate a company might search public records, inspect its accounts, compare conflicting sources and compose a report. A coding agent might examine a software repository, identify an error, change several files, run tests and revise its work after a test fails. Each individual step may remain fallible — yet the capacity to inspect the consequences of one’s earlier conduct gives the system something resembling practical judgment.

The resemblance must not be overstated. An agent does not necessarily possess desires, intentions or consciousness. “Goal” normally means an instruction supplied by a human or another computer. “Memory” may mean nothing more mysterious than information written to a database. “Reflection” frequently denotes a second pass through a problem.

Anthropomorphic language is useful shorthand — but dangerous metaphysics.

The most important recent development is not therefore that machines have acquired wills. It is that language models have been connected to tools. A model can now use a browser, database, calculator, compiler or communications service — subject, ideally, to permissions imposed by its operator. Anthropic’s Model Context Protocol, or MCP, offers a common method by which AI applications can connect to such external resources. Google’s Agent2Agent protocol, or A2A, addresses the adjacent problem of enabling agents built by different organisations to communicate and coordinate. A2A was transferred to the Linux Foundation in 2025, an attempt to give the proposed standard vendor-neutral governance. See the links to ⁠Anthropic’s introduction to MCP, ⁠Google’s announcement of A2A and ⁠Linux Foundation governance announcement.

The distinction is simple. MCP is chiefly a socket into tools and information; A2A is intended as a diplomatic protocol between artificial actors. If these standards become widely adopted, an agent need not contain every capability itself. It may discover an appropriate service, exchange instructions with it and incorporate the result into a larger course of action.

This creates the possibility of multi-agent systems. A supervising agent divides a problem into parts and commissions subordinate agents to address them. One searches documents, another analyses data and a third challenges the emerging conclusion. Anthropic has described a production research system built on this pattern — a lead agent plans the enquiry while parallel agents investigate different aspects of it. See ⁠Anthropic’s account of its multi-agent research system.

The analogy with a human office is irresistible. Yet artificial bureaucracies can reproduce the defects of human ones at electronic speed. Agents may duplicate work, misunderstand instructions, conceal uncertainty beneath confident prose or pass an error from one to another until nobody can identify its origin. Coordination does not abolish fallibility — it may distribute it.

Machine learning after the age of sheer scale

Machine learning is the general practice of constructing systems that infer useful patterns from examples rather than following only rules written explicitly by programmers. A large language model is trained on enormous quantities of text and other data, adjusting billions of numerical parameters so that it becomes increasingly good at predicting what should follow what.

During the first phase of the contemporary AI boom, progress was associated principally with training-time scaling: more data, more parameters and more computing power were applied before the model reached its users. That approach continues, but attention has moved towards what the model does after receiving a problem.

This is called test-time or inference-time computing. “Inference” is merely the operation of a trained model when it is being used. Rather than issuing the first answer that occurs to it, a model may generate several possible solutions, examine intermediate steps, consult external tools and spend more computation upon difficult questions than easy ones.

A verifier is a system that judges candidate answers or intermediate steps. In mathematics, the verifier may check whether a calculation is correct. In programming, the computer itself can run the proposed code. In less exact fields — law, history or diplomacy — verification is harder because there may be no mechanical answer-key. Recent research indicates that simply allowing a model to produce longer reasoning is not enough: gains increasingly depend upon reliable methods for distinguishing better reasoning from plausible error. See the ⁠Survey of verification and test-time scaling, and ⁠research on scaling test-time compute.

This explains the significance of systems such as Google DeepMind’s AlphaEvolve. It combines a language model’s ability to propose computer programs with automated evaluators that test those programs. Successful proposals are retained and modified through an evolutionary process — an engineering analogy to variation and selection. The achievement lies not in permitting a model to speculate indefinitely, but in enclosing speculation within an environment capable of rejecting failure. See ⁠Google DeepMind on AlphaEvolve.

A second development is multimodality. A multimodal model can process several forms of information — such as text, images, sound and video — within a related architecture. This matters for agents because the ordinary world does not arrive as a neat sequence of written prompts. A robot must interpret space, objects and movement. A scientific agent may need to compare prose with diagrams and numerical observations. A computer-using agent must understand what appears on a screen.

A third development is the world model — a learned representation of how an environment behaves. World models allow an AI system to predict the possible consequences of actions before taking them. Google DeepMind’s Genie 3, announced in 2025, generates interactive virtual environments in real time, while its SIMA research explores agents capable of acting and learning within three-dimensional worlds. These remain research systems, not synthetic persons wandering freely through reality — but they indicate movement from recognising static patterns towards modelling change, causation and consequence. See ⁠Google DeepMind on Genie 3, and ⁠Google DeepMind on SIMA 2.

The deeper development is therefore architectural. Intelligence is being distributed between a trained model, external memory, tools, evaluators, simulated environments and repeated opportunities for correction. The model is becoming less like an encyclopaedia and more like the central clerk of a complicated institution.

Why cryptography has entered the argument

Cryptography is the science of protecting information by mathematical means. Encryption makes information unreadable without the appropriate key. A digital signature permits the recipient to verify who authorised a message and whether it was altered. A hash compresses data into a short mathematical fingerprint: changing the underlying material should produce a different fingerprint.

AI agents make cryptography more important because agents do things. Once a system can read confidential records, purchase services, modify software or instruct another agent, identity and authority become central questions. Which agent issued the instruction? Was its message altered? What was it permitted to do? Can the action later be audited?

Cryptographic signatures can authenticate messages exchanged by agents. Capability tokens — digital credentials granting narrowly defined powers — can restrict an agent to particular resources or operations. Secure logs can preserve evidence of what was requested and what occurred. These mechanisms will not make an unreliable agent intelligent, but they can make its authority bounded and its conduct traceable.

There is also a more ambitious field known as verifiable computation. Here one computer performs a calculation and supplies mathematical evidence that it was performed correctly. A zero-knowledge proof goes further: it can demonstrate that a statement is true without disclosing all the secret information upon which the proof depends. In principle, an organisation might prove that an AI inference was made by an authorised model, or that a prescribed procedure was followed, without publishing proprietary parameters or confidential input data.

This is closely related to privacy-preserving machine learning. Homomorphic encryption allows certain calculations to be performed while data remains encrypted. The party conducting the calculation need not see the underlying information in ordinary form. The attraction for medicine, finance and government is obvious — although present systems may involve considerable computational expense. The important proposition is that privacy need not always require abstaining from calculation; mathematics may permit calculation without ordinary disclosure.

Meanwhile cryptography faces its own external revolution. A sufficiently powerful quantum computer could break several forms of public-key cryptography now used to secure communications and digital signatures. Post-quantum cryptography does not require a quantum computer. It consists of new algorithms, designed for conventional computers, whose underlying mathematical problems are believed to resist both conventional and quantum attack.

The United States National Institute of Standards and Technology has finalised three principal post-quantum standards and now urges organisations to begin migration. In 2025 it also selected HQC — a code-based key-establishment algorithm — for future standardisation as an additional option. Migration matters before a powerful quantum computer exists because an adversary may collect encrypted information today and preserve it for decryption later — the strategy commonly described as “harvest now, decrypt later”. See here for ⁠NIST’s post-quantum cryptography programme, and the ⁠NIST standardisation status.

The practical term to remember is crypto-agility: the ability of an organisation to identify where cryptography is used and replace an algorithm without rebuilding every system around it. This sounds like administrative housekeeping — and in large organisations it may be a greater challenge than inventing the mathematics. NIST’s 2026 guidance accordingly emphasises inventories, migration planning and systems capable of changing cryptographic mechanisms over time. See ⁠NIST post-quantum migration guidance.

The convergence

AI agents, modern machine learning and cryptography are converging around a common problem: how may increasingly capable machines be trusted with limited authority?

Machine learning supplies adaptable judgment. Agent architecture supplies memory, tools and the capacity to act. Cryptography supplies identity, confidentiality and evidence. None is sufficient alone. A clever agent without secure credentials is dangerous; a perfectly authenticated agent that reasons badly is no improvement; an accurate model that cannot act remains an adviser rather than an administrator.

The decisive question is no longer whether a machine can produce an impressive paragraph. It is whether a network of machines can exercise delegated powers reliably — and whether human beings can still determine afterwards which authority was granted, which evidence was consulted and why a consequential action occurred.

That is where the grander language of “autonomy” should be treated with care. In constitutional thought, authority is not legitimate merely because it is effective. It must be conferred, limited and reviewable. The same principle ought to govern artificial agents. A system should possess no more access than its task requires; significant actions should demand explicit approval; uncertainty should be exposed rather than concealed; and records should be intelligible to someone other than the system that created them.