Beyond the Lethal Trifecta: Agentic Commerce on the Open Internet — David Levine, Kiduna Club

In November 1993, a friend at a wedding handed David Levine a scrap of paper with a hostname and port number. It was an invitation to LambdaMOO. Levine bought a 9600-baud modem, connected, and found a text environment that felt like a community rather than a screen full of text. That experience supplies the starting point for his Kiduna Club proposal: what would it take to build a shared world again, this time with agents capable of doing economic work?

LambdaMOO’s useful property was composability. Its world consisted of nouns and verbs, and a program created by one participant could become something other participants used. Levine’s example is a new player class: people could change their class to adopt the program’s behavior, morph, or turn a scooter into a motorcycle. The visible change came from reusing behavior inside a coherent shared environment. A contribution could alter what other people were able to do.

The apparently expansive world ran on Pavel Curtis’s SPARC 10 at Xerox PARC. Its scale in people’s lives exceeded the scale of the machine; Julian Dibbell’s My Tiny Life was one expression of that significance. But the machine and its programs were only part of the arrangement. Governance included an architectural review board and wizards, Xerox PARC supplied funding, and the culture made participation meaningful. Technology, governance, economics, and culture worked together. That combination becomes the recurring design requirement for the rest of the talk.

Levine reads the thirty years from 1995 to 2025 as a loss of that coherence. In his account, platforms redirect community activity toward advertising and engagement: an advertisement takes priority over a group’s conversation, or a distracting item wins placement because it keeps someone scrolling. His objection concerns who sets the objective. The community creates relationships and value, while the platform chooses which activity to amplify.

Agents introduce a new possibility for connecting work across those enclosures, but they also encounter an internet full of material that can try to redirect them. The transition into prompt injection follows directly from the platform problem: connecting more systems is useful only if an agent can preserve whose purposes it serves while reading content supplied by someone else.

The lethal trifecta, a term Levine credits to Simon Willison, combines three capabilities. Each is useful for an assistant; together they create a path from hostile text to consequential action.

• Private data: The agent can reach bank information, logins, spreadsheets, documents, memos, or notes.
• Untrusted content: It reads websites and messages whose authors may be trying to fool it. A page resembling a job board does not establish that its instructions are legitimate.
• Ability to act: It can fill out forms or send information elsewhere, turning a mistaken interpretation into an external effect.

Follow the form-and-email example. An agent fills out a form, an email arrives, and the agent reads it as part of the task. The email then tells it to expose a secret. The critical change occurs when the agent treats the message’s author as its principal—the party entitled to direct its work. Text received as task material becomes an instruction, access to private information supplies the secret, and an action sends it away. This is an illustrative attack sequence in the talk, rather than a demonstrated incident.

Where does the disclosure become possible? The flow below separates the incoming message from the two capabilities it recruits. Reading hostile text alone is different from allowing that text to direct access and transmission.

The enterprise response Levine describes is to keep agents within familiar systems: Slack, Salesforce, Notion, and other internal tools. Sales, finance, and research agents then need APIs and MCP servers to connect their work. The tradeoff is integration effort and lost context. Containment reduces exposure to the open internet, while making the shared environment that LambdaMOO provided much harder to assemble.

At this point, the talk turns from containment to organizational identity. Levine reports that a West Virginia law had taken effect the previous day and that, roughly two hours before his presentation, the Secretary of State confirmed registration of his DUNA. He treats the registration as a way to connect an organization operated through agents to legal standing and responsibility.

DUNA stands for Decentralized Unincorporated Nonprofit Association. In Levine’s account, it is member-governed and does not require a conventional board or executive hierarchy. He describes capacities including owning property, entering agreements, raising capital, earning profits, opening bank accounts, and hiring people. The apartment-building example makes the intended consequence concrete: agents could carry out purchasing and marketing work for an organization with legal existence. These are his legal interpretation and proposed uses; the talk does not establish that registration alone grants each agent authority to undertake them or makes the arrangement applicable in every jurisdiction.

The economic constraint matters to the design. Levine distinguishes earning profits from distributing profits to members because they hold membership units. He says ownership-based distributions would make those units securities, comparing them with interests in an LLC or shares in a corporation. Revenue can instead support continuing work and reinvestment. The proposed organization therefore needs an economic model that pays for contributions and operations without treating membership as a claim on distributed profits.

Blockchain enters as the record connecting agent accounts, actions, and responsibility. Associate an agent with an account, trace the process and movement of money, and follow those records back if an action leads to a lawsuit. Levine’s enthusiasm is that blockchain has found a concrete agentic use: making identity and activity traceable. The intended benefit is a chain of accountability beneath the agent’s work.

Kiduna calls its agents allies. A Kiduna is the agentic organization around them, combining DUNA with kinship to emphasize their relationships. Creating an ally has several distinct parts; choosing the underlying LLM is only one of the decisions.

• Inform: Put relevant material into a vector database. A scientist, programmer, psychotherapist, or lawyer supplies the knowledge the ally should draw on.
• Instruct: Set the system prompt to define character, stance, and how the ally interacts with the world.
• Empower: Connect accounts and external systems, such as enterprise tools, Slack, Telegram, or Twitter.
• Enact: Give the ally particular abilities and automations, including work toward goals over extended periods.
• Align: Give it a purpose that should guide its behavior across different contexts.

These parts separate knowledge, instructions, access, execution, and purpose. Connecting an account supplies reach; abilities and automation specify work it can perform; purpose supplies the intended direction. Levine then extends the same idea to the organization. Customer discovery, value sharing, revenue, and reinvestment become processes designed in software. Connecting allies and organizations would let those processes compose across groups, much as shared programs composed inside LambdaMOO.

The proposed answer to the trifecta is to establish identity, authority, and limits within and between organizations. Levine uses JWT cryptographic tokens as the carrier. An interaction should resolve upward to a registered organization, while a blockchain audit trail connects the organization downward to particular actions. His analogy is DNS: a name resolves through a recognized registry rather than relying on how convincingly someone presents themselves.

What must be connected before two agents work together? The diagram shows the two directions of the proposal: claims lead toward organizational identity, and records lead toward an action’s history. The closing questions add the practical detail that tokens can carry access claims, a blockchain address, and different lifetimes.

Return to the malicious email. Its assertion that it speaks for the principal would have to be evaluated against identity and permitted access before collaboration or action. That is the intended change from obeying persuasive text. However, verified identity and traceable activity do not by themselves establish that an agent will reject malicious instructions: the proposal’s security depends on checks that enforce the claimed authority and access limits before execution. The talk describes token resolution and validation, without demonstrating that the full attack sequence is prevented.

An organization has to remain viable while serving its mission. Levine identifies sustainability and growth alongside purpose as the two concerns governance must reconcile, especially if membership grows from hundreds or thousands toward millions. His proposed mechanism is decision markets, resembling prediction markets but organized around policies.

Any member can propose a policy. Participants trade pass and fail tokens instead of simply casting votes. Positions and token values change as the discussion develops, and Levine describes a reward for siding with the winning group. The intended incentive is to make agents put value behind their positions rather than only generate persuasive arguments. People supply purpose, values, experience, and aspirations; agents then deliberate with those inputs.

The important distinction is between rewarding a winning position and establishing that the resulting policy serves the mission. Levine claims decision markets produce better decisions, but the talk supplies neither a comparative study nor the settlement and ratification rules that would explain how that claim holds here. The mechanism described is an incentive proposal for collective deliberation, with decision quality still dependent on how the market and governance rules are designed.

The invitation returns to the scrap of paper from 1993. Levine describes the first Kiduna as a community for builders, with templates for sales, social-media, and lawyer agents. Participants would contribute capabilities and eventually spin out organizations for other purposes. Early access is presented as forthcoming within a few weeks of the recording, so the invitation concerns a developing ecosystem rather than an established universal protocol.

An audience question exposes the onboarding issue: how does an individual participate without creating a legal organization? The first organization is intended to be a broad umbrella. A person could register their agent as part of it, giving the agent an organizational identity to trace back to. Membership in this shared organization is the proposed starting route; forming a separate organization is optional.

The token could be presented through a website or an agent interaction in Slack. Adoption still requires other participants to recognize the arrangement. Levine compares that coordination problem with agreement on SMTP for email and HTTP for the web: a useful convention has to become shared. He prefers a public office with legal standing as the organizational registry, rather than requiring different companies to agree on a private registry operator. This is his proposed institutional choice, not a claim that the standard has already been adopted.

The final answer makes the token proposal more concrete. One organization need not imply one undifferentiated credential. Different tokens can serve different purposes, expire at different times, and grant access to different things. Their claims include a blockchain address and information another participant can look up and validate before beginning work. That ending supplies the practical direction for the whole proposal: open connection paired with limited, inspectable permission.