ZEUS X-Trust X3 Shield

Abstract

October 2026 This preprint reports ZEUS X-Trust X3 “Shield”: the X1 live-state authentication primitive applied to AI agents. Every security layer built for agents so far protects the environment from the agent and answers what an agent may do. X3 protects the agent from its environment — from injected instructions, from tampering with its configuration, from replacement by a foreign process, and from replay of its credentials. Each agent receives its own X-Trust instance, a sphere; the identity enrolled into it is a hash of the agent itself — system prompt, tool list, task and the agent’s own code — so that the agent is the password and there is nothing to steal. A gate outside the language model recomputes that hash, verifies the calling process from the connection, checks tool and target against the task limits and asks the sphere before every tool call. Only ACCEPT executes; every error, timeout or refusal is DENY. Seven development runs between 2 and 9 October 2026 on one workstation, CPU only, from two agents and nine attacks to eighteen agents in two clusters under four hours of continuous attack, with two agents sharing one core. The one figure is the same in every run: zero calls executed without a valid identity. In the largest run the driver recorded 468 attack passes, 3,874 attack calls, among 4,574 checks. A timing probe of 184 passes found a median difference of 0.0 ms between legitimate-looking and foreign requests; 60 races returned 120 of 120 DENY; 74 late replays of consumed one-time credentials returned 74 of 74 “not mine”; 110 re-enrollments of a running member left the other seventeen agents answering throughout. Reproducibility was measured before any agent was enrolled — 190 of 190 pairs bit-identical, no tolerance window — and 189 of 189 agent-hash readout snapshots over four hours were bit-identical to their first. One gap is reported with its pre- and post-measurement: a foreign process presenting a valid agent identifier was accepted by the first build in 0.56 s and, after caller identity was added, denied in 0.053 s. Two constructions were measured side by side: the sphere as a service beside the agent, and the sphere inside the agent’s own process. With the X1 campaigns, the ZEUS X-Trust program now stands at around 750,000 attack attempts without an unauthorized acceptance. Seven figures with their numerical sources and rendering scripts accompany the paper. X3 follows X1 directly, and this preprint is filed with the Pre-X2 preprint because the reason for that step is stated there: see the versioning note below. The name X2 is kept unused. Raw data of the X3 runs (87 GB on disk, 1.4 GB packed) is deposited in this record beside the paper with restricted access; a plain-text README lists the seven runs. Access is granted on request to Info@Trauth-Research.com. The proprietary substrate — architecture, code, weights, enrolled references and credentials — is outside every deposit. ________________________________ This preprint completes the ZEUS X-Trust X1 stage and establishes the experimental basis for X2. Two additional Pre-X2 campaigns comprise 60 million measured iterations and 249,000 non-original inputs, with zero unauthorized acceptances. The first campaign forwarded 150,000 attacks across 30 classes to a sealed instance. After reconstructing a row-addressing defect in the stored amplitude data, 148,500 attack responses remained correctly addressable for the class-geometry analysis. The second campaign evaluated 99,000 altered or independent inputs and 1,000 repetitions of the original credential through a SHA-512-only input path. Under this protocol, no edit-distance gradient toward the credential was detected in response magnitude. Across the wider X1 program, the rounded totals are around 725,000 attack attempts and 140 million measured iterations. The paper outlines X2 applications for autonomous agent swarms and military drone swarms. Its first planned X2 stage couples 32 X1 spheres to a main sphere for collective live-state membership, with a reserve sphere also proposed. These are X2 architectural plans; the experiments reported here concern X1. This work continues the expanded X1 validation (DOI: 10.5281/zenodo.22736928). Raw measurement files are retained separately and are intended for a separate restricted-access dataset record. Raw data available with request: https://doi.org/10.5281/zenodo.22737465 as soon as Zenodo has solved his traffic topics. Note on versioning for future preprints: why X3 follows Pre-X2 directly.The Pre-X2 preprint prepared a planned generation X2: a hardened sphere, an additional watchdog, and attack-class recognition from the live-state fingerprint. X2 itself was not started. The Pre-X2 results stand as published, but they also showed that detection (ACCEPT/DENY) and classification (which attack) are separate layers, and that the layer AI agents need first is detection bound to the identity of the agent. That is X3 „Shield“, which therefore follows Pre-X2 directly. Parts of the X2 plan live on inside X3: the hardened sphere is the X3 sphere, the watchdog became the integrity ping. Attack-class recognition is deferred; whether it returns as a layer on top of X3 depends on need. The name X2 is kept unused to avoid confusion in citations.