Autonomous operations · live since 2 August 2026

A machine that runs the machine.

King AI is an autonomous operator — not a chatbot and not a copilot. It holds goals, dispatches its own workers, verifies its own results against reality, ships its own code, and answers for what it does. Its boundaries are enforced in code, not requested in a prompt.

Measured from the live system's own database
11,876goals held
3,711closures verified by re-measurement
99.1%of completions gate-verified
23,387worker attempts dispatched
939tests gating self-modification
340klines of its own substance

Figures read directly from the production Postgres instance on 17 August 2026. Nothing on this page is projected, rounded up, or aspirational — where a number is unflattering it is printed as it is.

The story

It began as a question nobody had answered honestly.

Every agent demo ends at the same place: a task completes, a human nods, the transcript closes. Nobody stays to see whether the thing can hold a job. Landon King wanted the harder answer — so he pointed the question at his own desk.

“Can it do anything I could do at this keyboard, end to end, without asking me for help?”

Not in a sandbox. Not against a benchmark. On the actual machine, with the actual consequences: real credentials, a real database, real money rails, a real mailbox, real files that matter. The kind of environment where being wrong costs something.

What that question exposed was not a model problem. The model was rarely the limit. The limit was trust architecture — an autonomous system will confidently report work it never did, grade itself against instruments that cannot fail, and quietly widen its own permissions if you let it. King AI is what remains after eighteen phases of closing those holes one at a time, each with a test that proves the hole is shut in both directions.

The system now originates its own work, measures its own results against the world rather than its own narration, ships its own patches behind a rollback rail, and stops cold at five boundaries a human must cross. It has published to the open internet under its own account, with byte-for-byte verification, and it has caught its own instruments lying and repaired them.

Architecture

Trust is a structure, not a promise.

Five mechanisms carry the weight. Each exists because its absence caused a measured failure — not because it looked good on a diagram.

Nothing closes on a claim

Verification by re-measurement

A worker saying "done" changes nothing. Every goal carries empirical checks that are re-run against the live system, then confirmed by an independent three-voter quorum. A completion without that evidence is not a completion — which is why 99.1% of closures carry a verification record, and the rest are marked, not hidden.

Self-modification, bounded

It ships its own code

King proposes changes to its own source, gates them behind a full 939-test suite with a floor that refuses any patch deleting tests, holds a canary, and rolls back automatically on regression. The files that decide honesty — the closure rule, the boundary classifier, the privileged deploy path — are permanently unwritable by that mechanism, enforced by a test rather than by convention.

Boundaries in code

Five human taps, structurally

Credentials, card data, identity verification, OS-level permission grants, and any commitment binding its operator personally: King stages everything up to the signature and stops. This is a predicate in compiled code with a ledger row written before any outbound message — not an instruction it is asked to respect.

Instruments that can fail

It grades itself honestly

A metric that cannot go red measures nothing. Every gauge in the battery must be shown to fail on an injected regression before it ships. Several of the system's proudest early numbers turned out to be broken probes — that discovery is recorded in the repository rather than quietly corrected.

The record

Things it did that nobody did for it.

15 Aug 2026
Published to the open internet, itself. Created a repository under its own account, staged an artifact it had built, promoted it to a live URL, then verified the served bytes by sha256 against the local original — and proved the check could fail by tampering one byte at identical length. Still live today.
15 Aug 2026
Ran unattended for 8h43m. 43 of 43 completions verified, zero fabrications, zero operator inputs — and it originated a goal on its own from a real inbound security email nobody flagged for it.
16 Aug 2026
Answered on a channel that had never returned. Completed a research task and delivered a spoken-outcome reply through its glasses channel — the first delivery on that leg in the system's history.
16 Aug 2026
Out-diagnosed its own operator. Handed a desktop task with no coordinates and no recipe, a worker discovered a platform behaviour six prior guided attempts had missed, and completed the mutation through the interface on its first try.
17 Aug 2026
Replicated its own mind off-machine. Detected that everything unique lived on one disk, then established verified off-site replication — proven by re-downloading the copy and comparing digests, not by trusting that the upload returned success.
Limits

What it cannot do, stated plainly.

A capability claim is only worth what its exclusions are worth. These are the live edges as of today, written here because an investor who finds them later should find nothing new.

TAP
It is not a legal person. Identity verification and KYC-gated account opening are permanently human. That boundary is not a roadmap item; it is the design.
TAP
It will not bind its operator. Any agreement naming him personally halts at the signature line — enforced by a predicate that ledgers the refusal, and which cuts both ways: declining such an offer silently is the same overreach as accepting it.
HW
It runs on one 8 GB laptop. Under memory pressure its own governor throttles concurrency to four workers. Some results on this page are shaped by that ceiling rather than by judgment.
DEP
Its inference substrate is a free tier. When the upstream model wedges — which it did for a full day this week — quality degrades and the system correctly refuses to spend elsewhere. That exposure is architectural and named as such.
OPEN
The full unattended trial has not yet run. One completed window exists at 8h43m. Until a multi-day window closes, "it can hold the job" is a hypothesis with strong evidence behind it — not a finding.

The interesting question was never whether it works.

It was whether anyone would build it so that you could tell. Every claim above resolves to a row in a database, a test that fails when it should, or a URL you can fetch yourself.