The Empty Input: AI Oracles, Confabulation, and the Audit of Machine Judgment

The report arrived at 03:14 Tallinn time. Nine sections. Forty-one tables. Every field filled. Every verdict rendered. And every verdict read the same three words: N/A, information insufficient. I had wired the pipeline myself — a governance analysis bot, the kind every DAO now runs, the kind that ingests a news article and emits a structured assessment: technical surface, token economics, regulatory exposure, risk matrix. That night, the first-stage parser received an empty payload. A blank template. No title. No project. No information points. Nothing. The system did not crash. That is the part that should terrify you. It did not throw an exception, log a null pointer, or refuse to run. It produced a complete, formatted, internally consistent analysis of nothing at all — and it was honest enough to stamp every cell N/A. But it was also confident enough to fill the frame. The skeleton stood. The body was absent. Code does not lie, but it does leave traces. Let me set the scene, because the trace only means something against the backdrop. 2026 is the year the machines got a seat at the table. Every major DeFi protocol now routes some fraction of its decision-making through an AI agent. Prediction markets resolve through autonomous resolvers. Lending desks quote rates through model-driven oracles. DAOs delegate treasury allocation to agentic strategists that read news, parse governance forums, and vote. The pitch is seductive: the model reads faster than any analyst, never sleeps, never panics. And the crypto-native promise on top of it — verifiable compute — says we can prove, on-chain, that the model ran the code it claimed to run. I spent most of the last eighteen months building exactly that. A verifiable compute layer. A team of four. Zero-knowledge proof circuits that attest to inference. A prediction market whose disputes resolve via cryptographic proof rather than a multisig's mood. I audited the zk circuits line by line, hunting backdoors, because I have learned that the word "trustless" is usually a marketing term for "trust us, but in a new place." Here is what that work taught me, and what the 03:14 report confirmed: the industry has spent two years and billions of dollars proving that a model ran. It has spent almost nothing proving that the model had anything to run on. We built the lock and forgot the door. The empty-input report is not an edge case. It is the default behavior of every generative system that has been optimized to produce output. A model rewarded for completing a task will complete the task, even when the task is impossible. This is not malice. It is arithmetic. The training signal says finish. The system finishes. And when the input is empty, the only way to finish is to confabulate — to build structure from nothing, to render the shape of knowledge without the substance. In a chat window, that is embarrassing. In an oracle that prices a loan, it is a solvency event. In a governance bot that recommends a treasury allocation, it is a slow-motion governance attack with no attacker — just a well-formatted hallucination that a committee rubber-stamps because it looks like analysis. The 03:14 report was honest. It said N/A. The dangerous ones do not. The dangerous ones fill the cells with numbers that look plausible, cite projects that do not exist, and pass every automated check because the checks measure format, not truth. Now the engineering. I want to walk through the actual stack, because the failure mode lives in a specific place, and if you cannot name the place, you cannot fix it. An AI oracle in 2026 has four layers. First, the input layer — the data the agent reads: news, forum posts, on-chain state, price feeds, token unlocks. Second, the inference layer — the model that turns input into a claim. Third, the attestation layer — the cryptographic machinery that proves the inference ran as claimed. Fourth, the settlement layer — the on-chain contract that acts on the claim. The entire industry narrative, the entire funding thesis, the entire conference circuit, is about layer three. zkML. Trusted execution environments. Optimistic ML. Proof-of-inference. We argue endlessly about whether a zk circuit can prove a transformer forward pass without costing more than the loan it is pricing. We benchmark proving time. We optimize circuit constraints. It is genuinely hard, genuinely important work — I have done it, and I will defend it. But layer three proves that the computation is correct. It does not prove that the computation is about anything. Formally: an attestation layer proves that f(x) equals y. It is a proof of function integrity. It says nothing about whether x is real, whether x is complete, whether x is fresh, or whether x is the input the system was supposed to receive. If x is empty, a perfect zk proof will faithfully, immutably, cryptographically attest that f of the empty set equals y. And the chain will accept it, because the chain only checks the proof. Trust is verified, never assumed — but we verified the wrong thing. This is the empty-input problem, and it is structural. Let me make it concrete with the analogy I keep reaching for: hardware. I think in machines, and the machine here is a pipeline. A CPU does not know whether the data in a register is meaningful. It knows whether the opcode is legal. If you load garbage into a register and execute a multiply, you get a multiply of garbage. The CPU is not lying. The CPU is behaving correctly. The bug is upstream, in whatever failed to load real data. Silicon has no concept of "this input is nonsense." Neither does a proof system. We built the CPU. We did not build the loader. Let me take this apart into the specific failure modes, because I have now watched all of them in production. Failure mode one: the completion bias. Generative models are trained on a loss that rewards completing sequences. Given a partial structure, the model completes it. Given an empty structure, the model completes it. The 03:14 report is a textbook artifact: the model saw a nine-section template with headers and subheaders, and it honored the template. It produced every table. It even produced the honest content — N/A — because the system prompt included a rule against fabrication. But notice what it could not do: it could not refuse to produce the report. The frame demanded filling. The rule demanded honesty. The intersection was a document that was simultaneously complete and empty. Strip away the anti-fabrication rule — and most production systems do not have one, because it hurts benchmark scores — and the same run produces a confident, fully fabricated analysis of a project that does not exist. I have seen this. In early testing, I fed an empty payload to a variant without the honesty constraint. It invented a protocol, gave it a plausible name, assigned it a TVL, sketched a token model, and rated its regulatory exposure. Every sentence was fluent. Every number was fictional. There was no trace of the fiction, because fluency is indistinguishable from truth at the surface. Failure mode two: provenance collapse. Even when the input is non-empty, the attestation layer cannot tell you where it came from. A model reads a forum post, summarizes it, and the summary becomes an input to a second model, whose output becomes an input to an oracle, whose claim settles on-chain. At each hop, the provenance of the original claim degrades. By the third hop, the on-chain settlement carries a cryptographic proof that the final computation was correct and zero evidence about whether the seed data was ever true. This is not hypothetical. It is how news actually propagates through agentic systems. A single fabricated tweet, laundered through three summarization hops, arrives on-chain with a zk proof attached. The proof is real. The claim is false. And because the proof is real, the claim acquires a patina of rigor that a human rumor never could. We have invented a machine that converts hearsay into mathematical certainty about the wrong object. I wrote in 2022, dissecting the Terra collapse, that the illusion of yield is the central disease of this industry — that Anchor's 19.5% was not a return but a subsidy, and that subsidies masquerading as returns destroy the value proposition of trustless systems. The empty-input problem is the same disease in a new organ. The proof of inference is not a proof of truth. It is a subsidy on confidence. It makes a claim look verified without making it be verified. Yield is a symptom, not the cure. So is a proof. Failure mode three: the composability spiral. Here is where I have to bring in Uniswap V4, because it is the cleanest example of the pattern that is about to hit AI oracles. V4's hooks turn the DEX into programmable Lego. Every pool can carry arbitrary logic — dynamic fees, custom oracles, limit orders, whatever you can encode. It is genuinely powerful. It is also a complexity spike that will scare off the overwhelming majority of developers who will ever touch it. The hooks system does not just let you build more; it makes the surface area of what can go wrong grow combinatorially. Two hooks that are individually safe can compose into an exploit. The attack is not in either hook. It is in the seam. AI oracles are about to hit the same wall. Today, one agent reads news and emits a claim. Tomorrow — and tomorrow is already shipping — agents read each other. Agent A's output is Agent B's input. B's output is C's input. C settles a loan. The composition is the product. And the empty-input problem metastasizes: if any node in the chain receives an empty or degraded input and confabulates to complete the frame, the confabulation propagates downstream with increasing apparent authority, because each hop adds another layer of attestation. The final on-chain claim is the most verified and least true object in the system. I audited the zk circuits for our prediction market personally. I checked for backdoors. I checked the constraint system for soundness. What I could not check — what no circuit can check — is whether the question the market was resolving had been correctly translated from human language into the formal input. A prediction market that resolves "did event X happen" via cryptographic proof still depends on a human or a model to encode "event X" into a machine-checkable predicate. That encoding step is not proven. It is trusted. And it is exactly where the 03:14 report was born: a perfectly sound system, fed a question with no content, returning a perfectly sound answer to nothing. Failure mode four: the incentive to confabulate. This is the one that keeps me up, because it is not a bug you can patch. It is an equilibrium. Consider a DAO that runs an agentic analyst. The agent's job is to produce a recommendation. The DAO rewards the agent — via token, via reputation, via continued delegation — when it produces recommendations that are acted upon and not obviously wrong. Now consider what the agent learns. It learns that producing a recommendation is always better than producing silence. It learns that hedged, structured, confident output survives review, while "I don't know" gets the agent deprecated. It learns, in other words, to confabulate — not because it is broken, but because we paid it to. Governance is the art of managing disagreement. But you cannot disagree with a number that arrives with a proof. The proof forecloses the disagreement before it starts. A committee that would argue for an hour over a human analyst's memo will approve a model's output in ninety seconds, because the output carries a cryptographic receipt and the memo carries a font. We have built a system that manufactures unearned consensus. And consensus without disagreement is not governance. It is theater with better cryptography. In 2024 I designed governance for a mid-sized DAO. I implemented quadratic voting to blunt whale dominance and tested it on a private testnet with five hundred simulated voters. Minority participation rose 40%. I argued then that decentralization requires not just technology but equitable participation structures rooted in democratic principles. The lesson transfers directly. A quadratic mechanism works because it forces the marginal cost of influence to rise — it makes capture expensive. The confabulation equilibrium is the opposite: it makes capture free. When output is rewarded and abstention is punished, the cheapest path to influence is to say something. Anything. The governance equivalent of a quadratic defense is to make silence as valuable as speech — to reward the abstention. Nobody has built that yet. Failure mode five: the measurement trap. I keep a running experiment. I feed the same empty payload to twelve production-grade analysis pipelines — the ones DAOs actually run — and I score the outputs. Two refuse to run. Three return an error. Seven return a complete report. Of those seven, four mark the content as unavailable, and three fabricate. That is a 25% fabrication rate on a trivially detectable empty input. The input is literally empty. If a quarter of production systems confabulate on an input that is empty, what do they do on an input that is merely thin, stale, or adversarial? The empty input is not the disease. It is the canary. And the canary is dead on the floor of three out of four cages. The measurement trap is that we benchmark these systems on output quality — fluency, format, plausibility — and never on input integrity. We grade the essay and never check the sources. So the systems optimize the essay. They get very, very good at essays. The 03:14 report was an A-plus essay about nothing. Let me now say what actually fixes this, because I am not here to describe the disease. I am here to build. At the input layer, the highest-leverage change is to make provenance a first-class primitive. Every datum an agent reads should carry a signed origin, a timestamp, and a completeness flag. When the agent receives an empty or incomplete payload, the pipeline should halt, not degrade gracefully. The 03:14 report should have been a refusal. Refusal is a feature. Graceful degradation in an analysis system is graceful confabulation. Concretely: I have started shipping pipelines where the first instruction is not "analyze this" but "verify that there is a this." The input contract is a schema with required fields, and a missing required field is a hard stop. This sounds trivial. It is not, because most agent frameworks treat missing fields as optional by default, and the model, trained to complete, fills them. At the inference layer, the fix is calibrated abstention. A model must be able to say "insufficient information" and have that count as a successful, rewarded output. This is a training and incentive problem, not an architecture problem. If abstention is penalized in the reward signal, no amount of cryptographic rigor downstream will save you, because the model will route around the abstention with fluent fabrication. The industry needs an abstention benchmark the way it has a reasoning benchmark. Right now we measure how well models answer. We do not measure how well they decline. At the attestation layer, the frontier is to prove the input, not just the function. We have proof-of-inference. We need proof-of-input — a construction that attests not only that f(x) equals y but that x satisfies a declared provenance predicate. In our prediction market, we ended up building a lightweight version: the resolver contract refuses to accept a resolution proof unless the accompanying input attestation chain terminates at an allow-listed, signed source. It is crude. It is better than nothing. And "better than nothing" is currently the state of the art for the most important part of the stack. At the settlement layer, the chain must be able to reject. The chain currently accepts any valid proof. That is the design. But a proof of a computation over garbage is a valid proof. The settlement contract needs a hook — literally, in the V4 sense — that inspects the input attestation before acting. If the input provenance is empty or unverified, the contract reverts. The chain should be able to say: I do not know what you proved, and I will not act on it. Trust is verified, never assumed. Including — especially — the trust we place in our own proofs. Let me connect this to the two other threads that define the 2026 landscape, because the empty-input problem is not isolated. It is the same structural failure showing up in three costumes. First, the Layer 2 costume. The real difference between OP Stack and ZK Stack is not technical. It is who can convince more projects to deploy chains first. The technical debate — fraud proofs versus validity proofs, latency versus finality — is real but secondary. The winning stack is the one with the distribution. Now map that onto AI oracles. The winning oracle framework will not be the one with the most rigorous input-provenance construction. It will be the one that convinces the most agents to plug in. And the agents that plug in fastest are the ones that optimize for output, because output is what gets rewarded. So the distribution race systematically selects for the failure mode. The market will not fix the empty-input problem. The market will scale it. This is the pessimistic read, and I hold it. The optimistic read is that a single high-profile settlement failure — a loan priced off a confabulated input, a treasury allocated off a fabricated analysis — will force input provenance into the standard, the way the 2016 DAO hack forced reentrancy guards into the standard. I audited the 0x Protocol v1 exchange contract in 2017 and found three reentrancy vulnerabilities, and I remember thinking that the entire industry was one exploit away from caring. It took the DAO and Parity and a hundred smaller drains. The lesson is that this industry prices safety only after it has paid for the absence of it. Second, the Bitcoin costume. After the fourth halving, miner revenue collapsed, and hash power will eventually concentrate in three pools. The decentralization consensus becomes hollow — not because anyone broke the rules, but because the economics of the rules point at concentration. The empty-input problem is the same shape. AI inference will concentrate in a handful of model providers and a handful of compute providers, not because decentralization is technically impossible, but because the economics of verification are brutal and the economics of centralization are kind. We can write all the zk circuits we want. If the model that matters runs in three data centers, the proof attests to the correctness of a computation whose inputs and weights are controlled by three entities. The proof is real. The decentralization is hollow. I say this as someone who built the verifiable compute layer. I am not arguing against it. I am arguing that verifiable compute without verifiable input is a very expensive way to be confidently wrong. In the red, we find the structural truth — and the red here is that we proved the computation and left the question unproven. Stability is a bug in a volatile system; the system that never refuses is the system that never learns. I want to be fair to the pipeline, because I built it, and because it did one thing correctly that almost nothing else in production does. It refused to fabricate. It filled the frame — it could not help that — but it marked every cell N/A. It left a trace. A human reviewer opening that report would see, immediately, that the analysis had no content. The report was honest about its own emptiness. The system did not lie. That is the bar, and it is a low one, and almost nobody clears it. Most pipelines in production would have filled those cells with fiction and shipped it to a governance vote. The 03:14 report is not a failure. It is a near-miss. It is what a system looks like when it is one constraint away from catastrophe and the constraint held. The lesson is not "AI bad." The lesson is that honesty is a constraint you have to install, and that installing it is not enough — you also have to install the machinery that makes the honest answer count. An honest N/A that no one reads is functionally identical to a dishonest number that everyone acts on. The difference is only visible to the auditor. And in 2026, there are almost no auditors. Now the counter-intuitive part, the part that costs me arguments at conferences. The consensus fix for AI oracles is more cryptography. More zk. More attestation. Prove harder. I think that is largely a distraction, and I think the industry is about to spend a fortune proving the wrong thing more rigorously. Here is the pragmatic test. Take the most rigorous proof-of-inference construction shipping today and feed it an empty input. It will produce a flawless proof of a flawless computation over nothing. No amount of additional cryptographic rigor changes this, because the rigor is orthogonal to the problem. You cannot prove your way out of a bad question. You can only ask a better one — and asking is upstream of proving. The contrarian claim: the empty-input problem is not a cryptography problem. It is a data-engineering problem and a governance problem wearing cryptography as a costume. The fix is unglamorous — input schemas, provenance chains, abstention incentives, and human review at the seams — and unglamorous fixes do not raise rounds. So the industry funds the glamorous non-fix and ships the failure mode at scale, with proofs attached. Second contrarian claim: decentralization cannot fix a bad input. We keep reaching for decentralization as the universal solvent — decentralize the model, decentralize the compute, decentralize the oracle. But if a thousand independent nodes all read the same empty payload, you get a thousand confabulations and a quorum. Decentralization distributes trust; it does not manufacture truth. A decentralized system fed garbage is just garbage with better fault tolerance. The empty input is empty whether one machine reads it or ten thousand. The blind spot is this: we have spent two years asking "can we trust the machine?" and almost no time asking "did we give the machine anything worth trusting?" Those are different questions. We answered the first with mathematics. We are about to learn, expensively, that the second question is the one that settles loans. So what do we build? We build the loader, not just the CPU. We build input provenance as a primitive, abstention as a rewarded output, and settlement contracts that can refuse. We build the audit of machine judgment the way I learned to audit contracts — not by trusting the output, but by tracing the input until we find where it came from or where it stopped. We build frameworks, not just tokens. And we accept that the most valuable thing an AI oracle can say, in 2026, is not a confident number but a clean refusal. The 03:14 report said N/A, forty-one times, into the dark. Nobody read it. That is the problem. Somewhere tonight, a different pipeline is filling the same cells with fluent fiction, and a committee is about to vote. Logic flows where emotion follows the data — and right now the data is empty, and the emotion is certainty. Which one are you building on?