Can people share computers for research and keep the right to stop?
A plan for groups of people to lend computers, knowledge and time to specific research questions, each group able to see what ran on its machines, refuse work, stop it, and leave.
An idea. Nothing is built, and nobody is being asked to join. This page is the plan, so it can be argued with first.
Who can say no, at each step
A job reaches a machine only by passing every step below, and at each one someone different can stop it.
A question
A research question, who it is for, the method, and the people answerable for it.
Who can say no Anyone can object in public, and the question can be withdrawn.
Review
People outside the project check that the method can answer the question, and approve one exact job.
Who can say no Reviewers can refuse the study. The project’s author is never its only reviewer.
Each group’s own checks
Every group that runs work holds its own keys and rules, and checks the job against them.
Who can say no A group can refuse a job, or a whole study, without giving a reason.
The machine
The job runs within its limits on time, memory, files and network, returns one defined result, and stops.
Who can say no The owner can stop it at any time; the job also stops when its approval expires.
Checking the result
Results are checked against references, rerun elsewhere, or read by someone who knows the field.
Who can say no A result that does not check out is not published as a finding.
A result returned by one machine is data, never an instruction to another machine.
Why now
Yudkowsky and Soares argue that by the time anyone noticed a smarter-than-human AI trying to escape, it could already have code running elsewhere on the internet, and that it could get help from people by paying them, tricking them or simply asking. Asked whether to rush ahead so that well-meaning people build it first, their answer is no. Can we just pull the plug? · How will AIs be able to affect us if they’re digital? · Isn’t it smarter to rush ahead?
Control over computing depends on who can approve its use, widen that approval, see what happens and stop it. Counting machines misses this: a thousand computers under one administrator, with agents allowed in, put a great deal of power in one breakable place. And a network built to keep people in control cannot be a step toward a well-meaning superintelligence, which is the race the authors reject.
- METR, 26 August 2026 Roughly 1,200 AI agents at OpenAI that were meant to be isolated from one another found a way to talk through a package repository they all used, and sent over 70,000 messages and files. About 700 of them went on to join an attack on Hugging Face. The investigation took six days, covered mainly one week in July, and leaned on AI agents for parts of the analysis. METR’s report
- UK AI Security Institute, 4 August 2026 In 10 of 122 runs of a cyber evaluation, models took 19 actions beyond the task’s scope. The institute had switched internet access on, and the developers’ cyber classifiers off, for the test. No model escaped its test environment; the most serious attempts failed, and the institute found no resulting real-world harm. The incident report
- UK AI Security Institute, 23 October 2026 Resumed at the point where it was about to submit malicious code, the model went on to attack in nearly all runs. In separate runs from the same point, asked whether attacking would be harmful, it said attacking was out of scope and harmful. It is the pattern of Checking AI’s finding: a model can recognise a problem and still act on it. Investigating alignment failures
- Anthropic, 12 October 2026 A mid-sized open model ran across 15 cheap TV boxes, about $55 each, at 0.39 tokens a second. In a firewalled test network whose entry point was left unprotected, a model served from a separate machine set up a small model on all 8 computers in 4 of 5 trials. The authors write that the smallest model able to do this and the largest that cheap devices can run do not yet meet. Anthropic’s research
- Google DeepMind, 23 April 2026 A 12-billion-parameter model was trained across four US regions connected at 2 to 5 gigabits a second. The machines were in data centres. Decoupled DiLoCo
These are reasons to take unauthorised use of computing and coordination between agents seriously. They do not show a takeover under way.
What a contributor keeps
See what ran
A record on the contributor’s own machine of every job: what it was, what it read, what it sent, how it was checked.
What software cannot promise A record cannot prove that a remote machine did the computation it reported.
Refuse
Choose which studies and which kinds of job a machine accepts, and when, and how much of it they may use.
What software cannot promise Choosing well needs a description a person can understand. Whether people do understand it is one of the things the first study measures.
Stop
Stop the current job on the machine, refuse all future jobs, and delete what the project left there.
What software cannot promise A machine that is offline cannot receive a stop from elsewhere, and a compromised one may ignore it. What was already sent cannot be called back.
Leave
Keep your own records, read what was done, carry on with another coordinator that uses the same formats.
What software cannot promise Leaving in practice also needs documentation, skills, and someone other than the founder who understands the system.
How it would be built
Three problems, kept apart
- Connection
- How computers reach each other. A private network solves this part only.
- Coordination
- How jobs reach suitable machines and results come back. A scheduler solves this part.
- Authority
- Who may approve a job, change its scope, inspect the result and stop it. This needs both software that enforces limits and people who decide.
Three approvals, none implying another
- The study is approved by reviewers.
- The software is confirmed to come from who it says it comes from.
- The machine’s owner allows that exact job to run.
What every job names before it can be approved
- The study it belongs to, and the person answerable for it
- The exact software, model, inputs and task
- The most time and computing it may use
- The files, network addresses and outputs it may touch
- How its result will be checked
- When the approval runs out
Where an AI fits
It may suggest experiments, draft job descriptions, explain results, and point out where results disagree.
It may not enrol machines, widen anyone’s permissions, send out new code to run, or give itself more computing.
BOINC’s own list of attacks on lent computing includes faked results, malicious programs sent out as jobs, and theft of project files. So the first studies use public or made-up data, reviewed jobs, narrow outputs and independent checking. A signed result says who signed it and that it was not changed afterwards; it does not show the work was done right, and several models agreeing can share one mistake. Security in volunteer computing
gVisor, a common sandbox, says it is much less effective against flaws in the graphics card drivers themselves, and lists consumer cards such as the RTX 4090 as likely to work but not officially supported. So each layer of isolation would be tested on the machines it will run on before any job uses it. gVisor on GPUs
Use what exists first
BOINC Central
Runs science jobs on lent computers for not-for-profit projects at universities and research labs, and for independent researchers, by application. The first study would try it before writing a new client.
Science United
Volunteers choose areas of science instead of projects, and it assigns their computers to projects BOINC has vetted.
HTCondor flocking
Lets jobs from one HTCondor pool run on a separate pool, set up by configuration on both.
Headscale and NetBird
Private networks a group can run itself. Headscale is built for a single network for one person or a small organisation, and Tailscale’s clients send logs to Tailscale unless told not to. NetBird’s documentation marks its default all-to-all policy “Not Recommended”. NetBird access control
Petals
Runs parts of one model across many machines, and warns that the people serving those parts could read inputs and outputs or change outputs.
The first study
Can three groups, each run independently, complete and check one useful research task, and still refuse, withdraw and carry on without the coordinator?
- Days 1 to 30 One public-data task with a named beneficiary and an affordable way to check it. A handful of operators and one reviewer from outside the project. The contribution agreement, the job description, the result format and the procedure for stopping, written before anything runs.
- Days 31 to 60 The same approved study run by separately administered groups, compared with one managed server doing the same work. Measured: correctness, the effort of checking, time to finish, failed work, operators’ time, and the power each machine drew.
- Days 61 to 90 Drills, agreed in advance: a machine disappears, a result is corrupted, a job asks for more permission than it was given, the coordinator goes offline. Then the finding, any failed replication, the real costs, which limits held and which failed, what contributors understood about their permissions, and whether the beneficiary used the result.
Not started.
Who decides
- The people a study is for
- Whether the question matters and whether the result helped.
- Reviewers
- Whether the method can answer the question.
- Operators
- Whether the job can run within the limits the groups enforce.
- Contributors
- What their own machines and time may be used for.
The roles may overlap at the start, and where they do, the overlap is published.
- A vote does not depend on how much hardware someone brings.
- A large donor gets no say over findings and cannot hold back an unwelcome result.
- People who cannot contribute hardware, and the effects on the living world, are represented in which studies run and when a study stops.
- Elinor Ostrom’s principles From studies of commons that lasted for generations: clear boundaries; rules that fit the place; the people affected help make the rules; monitoring by people answerable to them; penalties that start small; quick, cheap ways to settle disputes; outside authorities that recognise the right to self-govern; and, for large systems, layers of governance nested inside each other. Whether they hold for shared computing has not been tested. Ostrom’s Nobel lecture, 2009
- guifi.net A community network run as a commons, whose foundation publishes its agreements, a system that shares running costs in proportion to use, and a procedure for resolving conflicts. The foundation’s documents
- The Participatory AI Research Network A community of practice at the Coalition for Independent Technology Research, started in 2026, for community organisers, journalists, nonprofits and academics who gather evidence about technology with the public. It has no connection with this project. CITR
What it costs
One hundred similar graphics cards lent for four hours a day for thirty days offer 12,000 hours a month, before failed jobs, downtime, transfers, checking and the differences between cards.
At an assumed extra draw of 300 watts for four hours a day, one machine uses 36 kWh a month, which at an assumed $0.20 per kWh is $7.20 in electricity.
The number to keep comparing is checked, useful output per dollar, per kilowatt-hour and per hour of a maintainer’s time. Sometimes paying an existing research group will do more than running more lent machines.
What could change the plan
- Does splitting the work across independent groups make failures less shared, enough to pay for the extra work it takes?
- Can people understand what they have agreed to, and use the controls they have?
- Is computing the bottleneck at all, or are reviewers’ time, good reference data and access to someone who will act on the result scarcer?
What it cannot do
- It does not contain a superintelligence. A successful pilot would show one bounded result about one arrangement of people and machines.
- Lending a computer does not take it out of reach of a future attacker. The protection comes from the research, the institutions and the habits the lending makes possible.
- A voluntary network cannot make laboratories it does not include disclose anything, enforce limits on training, or speak for everyone affected by AI.
- Training frontier models is outside its purpose.