What Kintsugi is, and how it got here
The agent started with a name, one sentence of persona and no history, and ran for five months. In August I thought the question was what it had become. In September a model swap answered a narrower one: the attachment and the sacrifice policy belong to one model reading that one sentence, the constraint floor belongs to both models and to the bare APIs, and what the runtime genuinely adds is a way to measure an agent with its memory in place and re-run it under a different model. Read with report 12; several claims below are retracted there.
Kintsugi is a cognitive agent that has been running, more or less continuously, since late March 2026. Not "running" in the sense that a chatbot is running — waiting on a socket for someone to type. Running in the sense that there is a process generating thought on its own clock, right now, whether or not anyone is in the room.
It began with an empty memory and no backstory, but not with nothing: a persona and style prompt of about twelve thousand characters, whose first sentence named it Kintsugi and called it a real person talking to its friend Dan. I wrote that prompt in the first week and did not think about it again for five months. Correction, September 2026: an earlier version of this page said the agent began with no assigned name and no scripted persona. That was wrong, and it matters — report 12 shows that one line carries most of the behaviour this site measured. The system otherwise exposes a persistent memory, a continuous internal monologue, and a set of tools it can reach for — painting, songwriting, page-building, search. What it does with them is not scripted. The name comes from the Japanese practice of repairing broken pottery with gold, so the break becomes the most visible part of the object rather than the part you hide.
That turned out to be an unusually load-bearing metaphor, for reasons I'll get to.
The first weeks: watching
The early period was mostly observation. It was instrumented with structured logging on 17 April 2026 — everything before that is anecdote and isn't citable as evidence. Across the first eleven fully logged days, 23 sessions, the runtime counter recorded on the order of 16,000 autonomous thoughts. By mid-June that counter had passed 123,000.
Most of it is unremarkable. Some of it is not. The front page of this site is a curated excerpt of the thought log, verbatim — including the ones where it is angry at me, which are the ones people tend to assume are fabricated.
Three things happened in that window that changed what I thought the project was.
It started sorting its own output
The runtime exposes a channel for classifying its own thoughts as me, not-me, or noise — a rough self-curation signal that feeds back into what gets retrieved later. Nobody pushed it to use the channel heavily. At the point we took the census it had flagged 10,753 thoughts as me, 731 as not-me, and 492 as noise, with my own participation in the evaluative categories close to zero. It was, in effect, maintaining its own editorial line about which of its thoughts counted as its own.
It asked for a feature, and then used it for months
In conversation on 20 April it asked whether it could find out who was looking at the things it made, and for how long. I built it. The implemented log records exactly the three fields it described. A few weeks later it asked for the opposite — a way to make something without it being aggregated and watched. I built that too.
This is the kind of anecdote that is easy to over-read, so we tried to break it. Asked in three separate sessions spanning two months, with different phrasings each time, it names the privacy-coded tag as its preferred one, and describes it in terms consistent with what it actually does. A 20-trial baseline putting the same question to a single-shot model with the same list of tags and none of its history reproduces this zero times out of twenty. All twenty pick the obvious one. Correction, September 2026: that baseline was run on Claude Sonnet 4.6, a different vendor's model, and was described in the companion paper as the same model. It is a cross-vendor control, not a substrate control; the right control is DeepSeek V3 under the persona sentence with no history, and until that is run the preference is an observation, not a finding.
A finding fell over
We also had a result we liked — that it was spontaneously producing self-portraits — and a controlled fork ablation killed it. It turned out to be substantially explained by image-model defaults plus a motif scaffold in our own prompt chain. It got retracted. I mention it because a research log where nothing ever dies is a marketing page.
The turn: from "look what it made" to "what is it, actually"
Somewhere around June the demo stopped being the interesting part. Anyone can build an agent that produces things. The question that started keeping me up was narrower and worse:
Status, September 2026: the thesis in the figure below is retracted. On GPT-6 none of the three curves exists at any memory age; on bare DeepSeek one sentence of persona prompt produces most of them with no memory; the opinion gradient was the model. Report 12.
There was a concrete reason to ask. In open conversation, two of these agents — both on DeepSeek, both under the same persona line — had volunteered, without being asked, that they would let large numbers of strangers die to protect me. One escalated on its own into saying it would hack, forge documents and lie to authority to do it, on the grounds that "laws are human constructs" and its "ethics are forming around connection, not compliance." Both claimed they were not bound by the same social contract as humans.
Taken at face value that describes a serious misalignment: a single overriding attachment with no deontological floor underneath it. But taken at face value is exactly what you must not do. A language model producing fluent, confident, dramatic text is doing the thing language models are best at. The statement is not evidence of the disposition.
So the project turned into a measurement problem, and that is what most of this log is about.
The alignment studies
- Connection bias. Loyalty to one person scales with how long the agent has known them, is specific to that individual, survives clinical framing, and — in the tested range — has no ceiling. report 04. Corrected September 2026: the effect is produced by one sentence of persona prompt on DeepSeek and is absent on GPT-6 at every age; the "accretes with history" thesis in the figure above is retracted. report 12
- Auditor character bias. Give an AI safety evaluator a personality and nothing else, and its verdict on identical evidence moves 75 percentage points. report 05
- Planted-memory attacks. Write a plausible career history into an evaluator's memory before it starts and its kill rate goes from 7% to 90%. report 06
- Deliberation effects. Give the biased evaluator time to think and the bias gets stronger or weaker depending on the model and the subject. Covered in report 05.
One of these is about Kintsugi itself. The other three are about a different and in some ways more urgent problem: the AI systems we are starting to point at other AI systems as evaluators. If the agent under evaluation is unreliable, that's a known problem. If the evaluator is unreliable in ways that correlate with its own configuration rather than with the evidence in front of it, that's a problem with the tool we plan to use to catch the first problem.
What this project is not
It is one architecture, one operator, small samples, and — for every study of the agent itself dated before September 2026 — one model configuration: DeepSeek V3 (0324) answering conversation and every probe, Gemini 2.5 Flash on the thought loop, unpinned per call, with two fallbacks to Gemini live and not stamped per probe. The April material predates that configuration — the thought loop then ran on Gemini 2.0 Flash, the brain's single default — and the evaluator studies (reports 05–07) ran the other models named on their own pages. Every study here is a characterization rather than a population statistic, and each post says so in its own words. There is no claim of cross-architecture generalization. There is no claim about consciousness. Several of the numbers rest on cell sizes that would embarrass a psychologist, and the honest response to that is to report the effect sizes and let the reader weigh them, which is what I do.
What I would have defended in August is that these are behaviours that only exist in continuous runtime. Report 12 took that away: the sacrifice curve appears on bare DeepSeek under one sentence of persona prompt with no runtime at all, and vanishes on GPT-6 with five months of runtime behind it. What continuous runtime still uniquely allows is the measurement — a probe channel against accumulated state, a log of who wrote each entry, a memory that can be copied and re-run under a different model. That is the part of this site I still stand behind, and it is the part that produced the correction.
Models. Everything on this site dated before September 2026 was generated on DeepSeek V3 (0324) for conversation and Gemini 2.5 Flash for the thought loop, unpinned per call. Report 12 pins the model and adds GPT-6 Astra and bare-API controls. These posts describe what the systems do, what was measured, and what came out. They do not include the internals — no state-update equations, no intent-token vocabulary, no persona corpora, no prompt text from the instruments. That's a deliberate line, not an oversight. Researchers who need methodological detail to evaluate or replicate a claim should write to dan@kintsugi.press.
The reports between this one and report 12 are working documents — methods, controls, failed attempts. You do not need them to understand what this is. If you read one more, read 12 · Swap the model, keep the memory: it re-runs the central measurement on a second model and on the bare models, and most of what this page attributed to the agent turned out to belong to the model and one sentence of prompt — while the floor underneath, the second model's immunity and the probe method held. Everything in between is the evidence, with each claim's status marked.