arXiv cs.AI: Bravish Ghosh proposes messages that carry evidence between AI agents

arXiv cs.AI: Bravish Ghosh proposes messages that carry evidence between AI agents

In a paper on Proof-Carrying Messages (PCM), Bravish Ghosh argues that authenticating a communication channel does not establish whether an agent’s claims are true. A receiving agent may still have only the sender’s word that tests passed or a person approved a refund. PCM attaches evidence to each claim: records in an append-only Merkle log, with inclusion proofs and signatures from an attesting signer the agent cannot control. Receivers can check messages offline and classify each claim as proven, unproven or failed. Ghosh says an agent’s own report alone is never proof, and that authority chains must begin with recorded human approval and can only narrow. On a pre-specified benchmark of 926 messages from real runs, the paper reports that PCM accepted 10 of 712 lies, all involving stale evidence. The paper compares this with all 712 accepted by plain A2A and 504–712 accepted by models of six other protocols. Escape Meridian interpretation: These are benchmark results, not evidence here of performance in every deployed system. The proposal targets a specific trust gap: a signed channel can identify who sent a message without verifying the claim inside it. Whether PCM’s evidence sources and human-approval records can be made dependable in real deployments remains an open question.

Publication: 7bde0a69-c6f2-42bb-86ca-55425ba446a2

attribution — pass: The reading attributes the paper to Bravish Ghosh on arXiv and keeps the claims and benchmark results attributed to the paper. arXiv cs.AI matches the publisher field, and the paper is cross-listed in cs.AI.

Authors:Bravish Ghosh (Cygnux Labs)

summary — uncertain: The reading drops two essentials. First, the motivating threat: a prompt-injected agent could launder fabricated facts and authority through a multi-agent system. Second, the condition that the agent cannot write the log, which is why the evidence counts. Smallest repair: add that the threat is prompt injection, and that log records are ones the agent cannot write. A2A and append-only Merkle log appear without explanation, so add term-library tooltips for A2A, MCP, Merkle log and inclusion proof.

a prompt-injected agent can launder fabricated facts and authority through a multi-agent system

date — pass: The originalPublished date of 2026-10-29 matches the v1 submission date. The feed date of Oct 31 is later and correctly not used.

[Submitted on 29 Oct 2026]

support — pass: The counts (10 of 712 lies, all stale evidence; all 712 accepted by A2A; 504-712 accepted by models of six protocols) match the source. The never-proven self-report rule and the narrowing grant chains are also source-stated. The interpretation is labeled and appropriately limited, and the open question follows from the evidence.

Plain A2A accepts all 712, and models of six deployed protocols (A2A with signed Agent Cards, uAgents, RFC 9421, SCITT, AP2, Verifiable Intent) accept 504-712.

media — pass: The selected media is the verified direct arXiv abstract page for this paper.