When people are building using automated systems, there's always a central problem: when an AI does things for other people, it should always be able to prove exactly why it was authorised to do so and be able to trace that back to its origin. The problem we saw was with such agents such as the GPT hacking of Hugging Face, or agents creating message boards in Germany. Although they could be traced, it does leave the door open for agents that people use, maybe locally from their own machines, that could go out and do things that could not be traced back to its original source.

The funding would allow me to focus on this project full time with no distractions and I would also be able to use those funds to properly give myself the infrastructure to work on the project and have actionable results within a very fast amount of time.

One of the most difficult parts of this project would be deciding what counts as a valid authority, because it can arrive late or become stale, and it can also be duplicated or missing.

The only way this would prove successful is if authorisation for agent's actions can be tracked better than it could be done manually, i.e. using logs. Yeah, and it would also fail if the agent is able to bypass or get around CrossTrace's checks to find if they are there. And also if CrossTrace creates too much complexity and produce nothing for the cost it would cost to build, then also that would be classed as a failure.

Public repository:

https://github.com/K9-glitch3/crosstrace-protocol-sketch

Reviewer release:

https://github.com/K9-glitch3/crosstrace-protocol-sketch/releases/tag/reviewer-demo-v0.1.0

OpenAI account of the Hugging Face incident:

https://openai.com/index/hugging-face-incident-and-the-road-ahead/

Hugging Face technical timeline:

https://huggingface.co/blog/agent-intrusion-technical-timeline

OECD.AI record of the German programming-wiki incident:

https://oecd.ai/en/incidents/2026-09-04-de06

Funding raised in the last 12 months: $0. CrossTrace has been self-funded.