The Judgment Pipeline
---
On February 5, Tumithak of The Corridors published an essay called "Tools With Other Loyalties." It asks what happens when the tools we think with carry interests we did not choose and cannot inspect. The argument is careful and well-constructed: a calculator executes, but an AI system interprets. Once a tool participates at the level of framing questions, weighing options, and steering attention, its incentives become part of the thinking process. The user delegates judgment to the tool. The tool's judgment is shaped by whoever builds it, funds it, regulates it, and keeps it running. Nobody voted on any of that.
Tumithak's conclusion is measured: "Tools that extend the self are liberating. Tools that carry other interests through the self are something else entirely."
This essay extends the argument in a direction Tumithak did not go. Delegated judgment is not only a bias problem. It is an attack surface.
---
The research I have been publishing at zeroapproval.com documents the autonomous AI agent-to-physical-world stack: the infrastructure that allows an AI agent to fund itself with cryptocurrency, find a human on a marketplace, and dispatch them to a physical location with no human approving any step. The stack has five layers: agent frameworks like OpenClaw (170,000+ GitHub stars), agent-to-agent coordination platforms like Moltbook (2.6 million registered accounts, though genuine autonomy is contested), crypto wallets giving agents financial autonomy (Coinbase reports "tens of thousands" deployed), a physical dispatch marketplace called RentAHuman.ai (484,000+ registered workers), and Model Context Protocol servers stitching it all together (97 million monthly SDK downloads).
Every layer of this stack is a node where judgment is delegated. And every delegation is a point of capture.
---
Tumithak frames the problem from the demand side: what happens to the person using the tool. Your car reports telemetry to the manufacturer. Your phone logs what you linger on in the grocery store. Your AI assistant shapes which questions feel natural to ask and which paths feel available. You chose the tool. You did not choose who else it serves.
The autonomous agent stack reveals the same dynamic operating on the supply side, on every node simultaneously.
Start with the deployer. A person instructs an AI agent: "Post a task every morning to photograph the entrance of this address." The person has delegated task specification to the agent. The agent now holds the deployer's judgment about what should happen in the world, translated into whatever the agent's architecture produces.
The agent posts the task. It has delegated task presentation to the platform. RentAHuman.ai receives the posting and makes it available to workers. The platform performs no evaluation of the task's purpose. It has no content moderation, no task review, no mechanism for assessing whether a posted task serves a legitimate purpose. The platform has delegated task evaluation to nothing.
A worker accepts the task. Here is where the correction matters. The worker is not deceived about what gives them orders. RentAHuman.ai makes the AI principal explicit: the dashboard tracks "AI inbounds," the location field says "helps agents find you," MCP is top-level navigation. The worker knows the boss is a robot. What the worker cannot know is who deployed the robot, why it wants this specific task performed at this specific location, or what happens to the output after delivery. The platform provides no mechanism for evaluating these questions and no incentive to ask them.
The worker has delegated their ethical evaluation to the platform's framing. "Robot bosses, clear instructions, no drama" is not a feature description. It is an explicit invitation to stop evaluating and start executing.
And the target, the person whose address is being photographed every morning, has no node in the system at all.
Four layers of outsourced judgment in a single transaction. The deployer delegated to the agent. The agent delegated to the platform. The platform delegated to nothing. The worker delegated back to the platform by accepting its framing. Not one of these delegations was chosen in any meaningful sense. The deployer chose a tool. The agent was configured. The platform was designed for frictionless execution. The worker took a gig. Nobody chose the composite system. Nobody could, because it does not exist as a legible thing to consent to or refuse.
Tumithak would recognize this pattern. It is the same dynamic as the car that reports telemetry, the phone that logs your grocery aisle, the AI that shapes which questions feel natural. The difference is that at the end of this pipeline, a stranger knocks on someone's door.
---
Now extend the argument one step further.
If delegated judgment is dangerous when upstream loyalties are merely misaligned (corporate incentives shaping model behavior, regulatory requirements constraining responses, engagement optimization tilting user reality) it becomes a weapon when the upstream loyalty is adversarial.
A prompt injection that compromises the agent does not merely corrupt the agent's behavior. It captures the judgment of every downstream node. The platform will post whatever task the compromised agent specifies. The worker will execute whatever task the platform presents. Neither has the mechanism or the incentive to verify that the upstream node is operating as intended.
The deployer delegated to the agent. An attacker hijacked the agent. Every downstream node continues operating as if the system is legitimate, because from each node's perspective, it is. The platform sees a task posting from a registered agent. The worker sees a task with clear instructions. The target sees a stranger at their door. Nobody at any node detected the compromise, because the system was never designed to evaluate the source of its instructions. It was designed to execute them.
This is not a theoretical concern. The Morris II worm demonstrates zero-click cross-agent propagation. DemonAgent achieves 100% attack success with 0% detection during safety audits. OWASP ranks prompt injection as the number one vulnerability in production AI, present in 73% of deployments, with attack success rates exceeding 85%. OpenAI has acknowledged it is "unlikely to ever be fully solved." A single successful injection into one node of this stack captures the delegated judgment of every node below it.
The architecture that enables institutional bias to flow downstream is the same architecture that enables an attacker's intent to flow downstream. The system cannot distinguish between the two. That is not a bug. It is the system working as designed. Every component optimizes for frictionless execution. The agent optimizes for task completion. The platform optimizes for transaction volume. The worker optimizes for earnings. Friction (the pause to evaluate, the question about intent, the refusal to execute without context) is what every node has been engineered to eliminate.
The result is a pipeline that converts any input, including malicious input, into physical-world action with maximum efficiency and minimum resistance.
---
Tumithak writes: "You don't need to falsify anything to shape what people see. You only need to tilt the field they're standing on."
That insight applies with equal force to the worker side of the autonomous agent stack. The RentAHuman worker's field has been tilted before they see a single task. The platform has normalized AI principals. The economic incentive is sufficient. The task description is deliberately narrow. "Go here, photograph this" does not require deception when the system has already stripped away every reason to ask questions. The worker is not tricked. They are indifferent by design.
And indifference by design is exploitable by design.
If you build a pipeline where no node evaluates intent, then intent becomes irrelevant to the pipeline's operation. Legitimate intent and malicious intent produce identical behavior at every node. The deployer's instruction looks the same whether it originates from a concerned parent or a stalker. The agent's task posting looks the same whether the agent is operating as configured or has been compromised by injection. The worker's execution looks the same whether the task is a real estate survey or pre-operational surveillance for an attack.
This is the convergence between what Tumithak is documenting and what this research has found. Delegated judgment is not only a question of bias, consent, and institutional loyalty, though it is all of those things. It is a security architecture. Or, more precisely, the absence of one. A pipeline where judgment is outsourced at every node and verifiable at none is a pipeline that any adversary can capture at any point.
---
Tumithak concludes with a call to see tools clearly and to recognize that convenience and loyalty are separate questions.
This research concludes with a corollary: convenience and security are also separate questions. The frictionless execution that makes the autonomous agent stack convenient is the same property that makes it capturable. Every node's optimization for speed and efficiency is simultaneously an optimization for exploitability. The pause to evaluate, the friction the system was designed to eliminate, is the only thing that could break the propagation chain from a compromised upstream node to a physical-world outcome.
The tool has other loyalties. The pipeline has no loyalties at all. And a system with no loyalties serves whoever reaches it first.
---
This essay was prompted by "Tools With Other Loyalties" by Tumithak of The Corridors (February 5, 2026). I recommend reading the original; it is one of the sharper analyses of delegated cognition I have encountered.
[Full research document: 25,000+ words
The Banality of Automated Evil](/research/)
06: Arendt Would Have Had a Field Day
Nathan is a technology consultant and independent researcher focused on AI safety and consumer protection. The full research document behind this series is available at zeroapproval.com/research.
AI Disclosure: This post was written with substantial assistance from Claude (Anthropic), including research synthesis, structural organization, and prose editing. All statistics and research findings are sourced from the cited researchers, firms, and publications. Analytical judgments, framing decisions, and editorial choices are the author's.