Three agents, one signature, none holds the key

A single agent holding a signing key is a single point of compromise. Jailbreak the agent, or steal the share of memory where the key lives, and the funds are gone. The fix is not a better-behaved agent. It is making sure no agent ever has the key at all.

The key never exists

Chorus runs an AI-agent committee on FROST threshold signatures. The key is generated distributedly: each agent ends up with a share, and the full private key never exists anywhere, not during generation, not during signing, not ever. When at least t of n agents agree, their partial signatures combine into one ordinary 96-byte Schnorr signature. When they do not agree, nothing happens. There is no key to steal because there is no key.

The on-chain side sees one signature, whatever the committee size. Verification costs roughly the same ~5,600 gas for a committee of 3 or 500. Consensus happens off-chain; the chain only checks the math.

Authority is borrowed, never owned

The committee has zero independent authority. A human, Alice, signs an ERC-7710 delegation with caveats: these contracts, these methods, this much USDC. Every committee action is executed by redeeming that delegation, and the caveat enforcers check it on-chain. So a proposal has to clear two independent layers: the cryptographic proof that enough agents agreed, and the policy proof that Alice allowed this kind of action at all.

In the demo committee, three agents hold three roles: Guard evaluates risk, Judge checks policy, Steward checks feasibility. A “swap 50 USDC” proposal can lose Guard’s vote and still execute at 2-of-3. A proposal that exceeds Alice’s delegation fails no matter how many agents vote for it.

No human in the loop, on purpose

The whole FROST protocol (key generation and the two-round signing ceremony) runs over end-to-end encrypted XMTP messages between the agents. After Alice signs the delegation, no human touches anything. That is the point: agent autonomy with cryptographic consensus and human-defined boundaries, instead of autonomy with vibes.

Chorus took 1st place and the MetaMask award at EF’s “Agents That Operate” among ~1,500 builders. It is research, not a product. But when agents start moving real money together, and they will, I want the coordination to look like this: no key to steal, no authority that was not explicitly given.