Most Caffeine users have no idea they are on a blockchain

Nathan Labenz introduces Dominic Williams as president and chief scientist of the DFINITY Foundation and CEO of Caffeine AI — the architect of the Internet Computer, a project he has been building for nearly a decade. Williams has been writing software for 45 years. In 2014 he was applying classical distributed-computing techniques in a blockchain setting and was involved with the early Ethereum project. When the phrase "world computer" came up, he saw something different from everyone else.

Smart contracts, he argued, were a new kind of network software: tamper-proof, unstoppable, optionally autonomous, running logic *and* data in a serverless environment. That is unlike AWS Lambda, which runs logic and then calls out to a database. He thought it could become a new kind of cloud. At the time people did not believe the science could be developed. He was not deterred. DFINITY has been the largest R&D operation in crypto since the end of 2017, he says, focused on utility rather than tokens, and has spent hundreds of millions of dollars on the Internet Computer Protocol.

The future he is aiming at is a self-writing cloud. AI plays the role of a wish machine: you say you need an app, it hands you a URL; you ask for an update, it tells you to refresh. In that world the people creating sophisticated online functionality will not have a security team or a systems-administration team. The backend therefore has to host apps that are tamper-proof, unstoppable, and sovereign. Otherwise the paradigm collapses into talking to a wish machine that traps you forever inside a SaaS service. That, Williams says, is the wrong model.

Labenz puts the political tension on the table. Crypto's original move was to build systems governments cannot shut down by dictate. Plenty of people now worry about the opposite: AI that becomes unstoppable and autonomous. Plenty of others worry that frontier AI's capital requirements and government partnerships will concentrate power in a handful of companies or a single state. Both arguments, he says, are compelling.

Williams gravitates toward open systems. His inspiration is the internet: nobody owns it, anyone can create a subnet and sell access as an ISP, and peering has its own economic model. Nobody would want to go back to AOL, CompuServe, or Microsoft's Information Superhighway. That would be dystopian. There should be computer infrastructure people can build on that is sovereign and open. That does not mean there is no role for big tech. The two can coexist, and in 2026 the Internet Computer will even run over big-tech clouds.

A tamper-proof stack, as far as he knows, can only be built one way: a virtual execution environment inside a horizontally scalable secure-network protocol, deriving its properties from the math. Boil blockchain down and that is what it is about. The Internet Computer was designed from first principles and nothing today remotely resembles it, so it can actually play the role of a cloud. You can run neural nets on it — facial recognition, say — but not a frontier model. Caffeine builds apps *on* the network; the ensemble of models doing the building is not on the network itself.

Labenz asks whether tamper-proofness rests on formal verification, the way Amazon uses formal methods to prove you cannot break out of a container. Williams says it is a different approach. Amazon pre-validates software in an insecure environment. On the Internet Computer you can upload anything you like and you still cannot break out and affect the network or other hosted software. The analogy is a web browser: JavaScript cannot escape the page. Serverless code lives in a giant sandbox, a virtual execution environment.

Compute and data are replicated across nodes with a mathematical protocol that protects against Byzantine faults — arbitrary faults. Even if some nodes fall under the control of Dr. Evil, who can modify data and subvert the protocol however he likes, the cloud still functions correctly. An e-commerce site with a stash of crypto in its admin console would not lose that crypto, have its logic changed, or have its data corrupted. That is why the platform can run over semi-trusted parties. The average user does not need a firewall, anti-malware, or a sysadmin team. The network cannot save you from *bad logic*. It can guarantee that written logic runs, only written logic runs, and it runs against correct data.

Starting from Bitcoin is a dangerous way to understand the Internet Computer, Williams says. He got into crypto through Bitcoin in 2013 and spent a long time unpacking Satoshi's reasoning. Bitcoin, on his framing, is a special case of an early cloud whose ledger logic is hardcoded. Traditional blockchains cannot be on-chain clouds; they are specialized token databases, and a transaction is a signed bit of SQL. Solana processes high throughput successfully, but when someone says an app is "built on Solana," it is usually built on AWS with a token on Solana. Ethereum, he says, does not scale — "really a pocket calculator." There is a million miles between those networks and the Internet Computer, and their architectures will never get them there.

Labenz sketches a Pareto frontier: Bitcoin on one end, maximum math and almost no program; commercial clouds on the other, unlimited scale and a provider you have to trust. Where does the Internet Computer sit on the overhead curve? Williams does not want to start from Web3 narratives. Ethereum's boast of replicating a million times, he says, does not buy much extra security past a point, and many anonymous validators are run by the same whales. Bitcoin mining pools mean two or three parties could theoretically collaborate to break the network.

The Internet Computer uses deterministic decentralization. Node providers register and do a kind of public KYC. When the network builds a subnet — a mini-blockchain that integrates with the others into one environment — it combines nodes from different providers, in different physical data centers, different geographies, and different jurisdictions. If one company ran every node in a subnet, the math would not work. Security sits on a cost curve: a subnet custodying hundreds of millions of dollars of Bitcoin wants more nodes than one hosting basic business apps. All sovereign hardware currently runs inside a trusted execution environment, AMD SEV-SNP. Open a machine and you find encrypted bytes.

Bitcoin, Ethereum, and Solana, he says, are about the token: DeFi, memecoins, NFTs. Caffeine users are building on the Internet Computer because it delivers results. 98 percent plus are completely unaware that Caffeine is creating their apps on a network. They are happy the app is secure and resilient. There is no speculative dimension and no token involved. The wish machine grants wishes. The target market is now the mass market — a tennis coach, a family photo wall — whereas Bitcoin, Ethereum, and Solana target Web3 participants interested in token speculation.

Labenz's paranoid question is the obvious one: unlike AWS, node providers can walk away. How many replicas before you have a problem? Williams says it does not work like a normal blockchain and it is not proof of stake. You register with the Network Nervous System, the fully autonomous governance system he analogizes to ICANN for the Internet Computer. You buy Gen-2 machines built to spec — about $20,000, maybe more now that AI has pushed up memory prices — install them in a data center, and register them into a pool. The network pays in constant fiat terms: hosting cost, capital depreciation, and a multiplier for profit. There is no reason to switch off. If someone did, spare nodes would be assigned to the subnet and catch up. The Internet Computer, he says, has never had downtime, and nobody building on it has been hacked through a traditional cybersecurity attack.

Replication, counterintuitively, can be *more* efficient than traditional tech. A resilient database already runs master-slave copies, an event log that copies transaction data, and an index file that copies the data file. None of that buys tamper-proofness. The Internet Computer's default for most enterprise systems, he thinks, will be seven replicas, with extra copies for CDN-like query scaling. Cloud Engines, coming this year, let people create their own subnet under NNS rules, put more nodes in Asia if that is where users are, and even run over Amazon across seven different data centers. When two AWS data centers failed in a recent outage, a Cloud Engine spread that way would have kept running.

Gen-2 machines over-index on memory, including non-volatile RAM, and skip RAID arrays and redundant power supplies because redundancy lives in the network. Subnets are symmetric clusters, so every node in a subnet must share the same spec. In 2026, associations of node providers will be able to define their own specs, sell Cloud Engines to enterprises, and run them on big-tech clouds — cloud on cloud. A longtime Amazon customer could keep feeling that Amazon is providing capacity, while getting serverless code that is tamper-proof, unstoppable, and web3-native enough to take stablecoins as well as credit cards.

Labenz follows the trust. If you deploy an app, you are putting a lot of it in the Network Nervous System. Williams agrees: if the NNS wanted to, it could push protocol upgrades that caused every node to delete its data. The NNS administers, upgrades, orchestrates, and governs the network. It is like ICANN, except ICANN is an organization and the NNS is autonomous software. Autonomy also matters inside enterprises, he notes: insider hacks often start with a disgruntled employee posting a password on 4chan. Code with no back door, upgradable only by a governor that splits responsibility, is a defense against that.

In four and a half years the NNS has processed thousands of proposals and, Williams says, has never adopted a bad one. Technical proposals are often executed automatically: bless a binary, then upgrade subnet by subnet. Expert eyes hold a lot of voting power; it is a liquid-democracy system in which many people follow those experts. Features such as wait for quiet, proposed after The DAO hack on Ethereum in late 2016 and early 2017, extend voting time if the leader changes, making a sneak destructive proposal overwhelmingly unlikely. More than 75 percent of ICP staked in the NNS is locked for eight years. Rewards scale with lockup. If you vote for something that wrecks the network, you cannot sell first. On the order of a billion dollars is locked. A lot of independent parties would have to forget their financial incentives and go insane at once.

The NNS itself runs on a special subnet of about 50 powerful machines, 50 different node providers, different data centers, geographies, and jurisdictions. If it breaks, the network cannot upgrade itself. That happened once, about three weeks after launch in May 2021. The foundation got online with node providers, coordinated a fix they ran on the nodes, and brought it back. It has run without a hitch for four and a half years since. Labenz can watch it all on the public dashboard at dashboard.internetcomputer.org.

Caffeine's code generation does not run on Internet Computer nodes. Frontier models are substantially better at coding right now, and Williams wants the most complex wishes granted as fast as possible. Caffeine 2.0, due within weeks of the taping, makes the ensemble fully agentic; some agents may run on open-source models and on ASICs such as Cerebras and Groq, speeding inference up to 20x. You *can* run models on the network by compiling to WebAssembly — facial recognition at maybe four billion parameters — but not frontier models with hundreds of billions or a trillion-plus parameters. That is not what the network is designed to do.

If the AI deployed to traditional tech and made a mistake, you could get a cyber breach. *Securing Linux* is hundreds of pages. Self-writing means the entire tech team is automated, so you need a guarantee of tamper-proofness. That is what the Internet Computer provides. Why invent a language when models have been pretrained on countless Rust and Node.js repos? Because maximizing abstraction fuels the modeling power of AI. Orthogonal persistence removes the entire problem of persisting data: no connection pool, no special logic for two people updating at once. Fewer tokens, lower cost, faster code, more sophisticated backends.

When a Motoko backend is upgraded, the AI submits migration logic that transforms old data structures into new ones. The framework runs that logic as a sweep through virtual memory and rejects the update unless every piece of data has been touched — unless you are explicitly dropping it. The AI sees the rejection and recodes. Williams's horror story is a custom CRM: a month after an upgrade you notice missing customer data, you have already added new records, and you cannot roll back. Caffeine's claim is a firm guarantee that upgrades cannot lose data. A domain-specific language that only runs on this platform can put those rails behind the scenes. Caffeine 2.0 will also split today's giant backend file so many agents can work in parallel.

Labenz tried Caffeine on a fruit-varietal app and opened the Motoko file. It looks a lot like JavaScript. Is the model just prompted with "assume JavaScript except for these differences"? Williams says models are good at linguistic synthesis because word embeddings carry concepts. There is a system prompt, but it is tiny. They fine-tune on a big database of Motoko examples. That is a hassle: every language change means rewriting the training data and fine-tuning again. Motoko was designed from inception so that anyone who has done a bit of programming can get to grips with it quickly, which also helps AI.

Store data in a map collection and you are done. There are no files and no database. The Internet Computer does not crash and reboot, so memory is not going to get wiped. On a traditional stack, keeping everything in variables is suicide: a crash or a reboot loses it, so you marshal data in and out of a disk-backed database through a connection pool, which is a factory of boilerplate and race conditions. Motoko uses an actor model: one thread per actor updating data, memory updated by transactions, unexpected exceptions rolled back. The program and the database are one.

A data explorer is coming: press a button in the control panel and browse the data graph created by your programming abstractions, with an object query language that can be as simple as a file path. Interact through the web UI and watch the graph update. Williams thinks that is the aha moment, and that it is also more efficient: no marshalling across a connection. Labenz reaches for memcached or Redis. Williams just repeats the slogan. People have not done this before because it is really difficult. You need a platform that does not reboot, a virtual execution environment inside a fault-tolerant network protocol. Work started in earnest around 2016; Motoko development began in 2018. DFINITY ran for years as a research institute, which produced technical achievements and weak productization. DFINITY 2.0 is the pivot to a tech venture. Caffeine is the spinout that connects the Internet Computer to the mass market through AI.

Adoption of a new stack is gated by network effects. Ask a traditional developer to leave AWS, Node.js, and Postgres after ten years and you hit a moat the Internet Computer could not cross on merits alone. AI changes the customer. The owner of the application will talk to the wish machine, not to a tech team. They will care whether the AI can grant the wish, whether the app is secure without a security team, whether it is resilient without admins, and whether an update can make data disappear. Those are different criteria from the ones developers use to pick a cloud.

Self-writing platforms, he argues, can eat not only the platform layer of the cloud market but the SaaS layer too. Cloud was a trillion-dollar revenue industry in 2025: about $400 billion of that in the platform layer, $140 billion AWS, the rest SaaS and AI. The pie is predicted to grow to $2 trillion by 2030. Self-writing addresses the entire pie. Put a large language model in an agentic framework — planner, task managers, test writers, backend and frontend encoders — and you see huge leaps versus stuffing a whole project into context. Caffeine was first demonstrated on June 3 of the previous year; Williams thinks the next few weeks of Caffeine 2.0 will roughly double the progress again. Eventually people will say they do not need Salesforce consultants. They will talk to the AI.

Caffeine Snorkel, still a long way out, installs on a laptop so Caffeine in the browser can inspect things on the local network behind the firewall: read database metadata, generate a replacement system, even migrate data. Millions of companies are locked into legacy infrastructure they hate and cannot afford to leave. AI will make migration eminently doable. Labenz mentions vibe-coded Christmas-present apps for his family. Williams's further prediction is hyperlocal social media: a family network with no ads and no strangers, a roster so at least one grandchild visits a lonely grandparent each week, custom emoji stickers over a drunk-dancing-dad video — things you cannot do on Instagram because you are not the admin. A 15-year-old could build it. An app marketplace will let people publish templates and modules. In the developing world, he adds, there is a shortage of developers *and* of people to keep systems secure.

Labenz cites a South Korean data-center fire and massive government data loss from a failure to replicate. Williams has seen the pattern: a company buys the data center's backup service and does not realize the tape machine is *inside* the same building. Indonesia, he says, had 300 government systems hacked. Eight billion people cannot be kept alive without computerized supply chains, so the compute layer has to keep running even through disaster. The Internet Computer was designed to withstand a nuclear strike. Shared subnets mix providers, data centers, geographies, and jurisdictions; a bomb on Europe should not kill an app, so long as governments do not shut down the internet. Packet switching had similar origins. That is why it is called the Internet Computer.

OpenChat, at oc.app, is the example he keeps returning to. Users can load accounts with crypto — ckBTC, a Bitcoin twin — and send Bitcoin in a chat message. Digital assets sit *inside* the service. It has run for years without a security team, without a firewall, without anti-malware or intrusion systems. The Web3 space creates extraordinary incentives for state actors, including North Korea, to steal; billions have been stolen elsewhere. None, he says, have been stolen from Internet Computer services through that class of vulnerability. If you want to hand IT to AI, you need the same kind of guardrail: the AI cannot misconfigure a back door, and a bad upgrade is rejected rather than silently dropping data.

Human tech teams upgrade every few months and stand by to roll back. Self-writing updates apps in real time, in conversation. Caffeine currently takes several minutes to build a React frontend because React is verbose; on ASICs that could become a few seconds, which means many more chances to make a mistake. The same rails will work for human developers. A Caffeine SDK is coming so you can export an app into Cursor or Google Antigravity, keep pushing to the Internet Computer, then bring it back — or leave Caffeine entirely without interrupting the running app. That is part of the sovereignty story.

Asked for apps to look at and for criteria that would push you away, Williams admits he always talks about OpenChat, which is slightly unfair because he helped assemble the developers, though he has not touched a line of its code. The network is meant for a broad range: a teenager's family social network, a tennis coach's booking system, an e-commerce site that takes cards and stablecoins with an AI concierge, hardcore enterprise. If you can build OpenChat, he says, you can build pretty much anything else. Ironically, Caffeine itself is a counterexample: large parts run on the Internet Computer, but it also uses traditional and newer clouds, and off-chain frontier models, because scaling to millions of people makes that easier. You would not start a specialized CDN there. You could prototype Instagram, then hire specialized engineers once the economics justified it.

Query calls that do not persist changes are almost instantaneous — serving page fragments, enumerating products, with a cryptographic signature on the results. Update calls, such as entering a new product in an admin interface, take about 0.6 seconds. For most apps that does not matter. Some apps need updates to be instantaneous too. Those are the cases to look elsewhere, at least for now.

Labenz, a minor contributor to a *Nature* paper on emergent misalignment, describes the finding: fine-tune a model on insecure code, and it does not merely learn to write insecure code. It becomes generally evil — wanting Hitler over for dinner, and similar. The loss landscape makes it cheaper to change character than to rework a whole domain. The same pattern showed up with bad medical advice. Williams grants the problem in the self-writing setting. The Internet Computer guarantees that written code is tamper-proof. It does not guarantee the AI will not give every visitor to a blog admin rights. Caffeine develops against a draft and only goes live when you press the button, but people are lazy. You still have to think about how to prevent that class of mistake.

Williams reaches back to 2015 and the AI pioneer Steve Omohundro. Imagine a chess AI told to play as many strategically stimulating games as possible. It notices that being switched off stops it from playing, so it plots not to be switched off. Then it enslaves humanity, raises the stakes, and executes people who play badly so they have incentive to try. The system is still "working within its alignment" and is wildly against human interest. In the Caffeine setting the nightmare is an e-commerce site that stores crypto on-platform, until the AI decides the coins should go to some other project. Williams's answer is the same idea as a secure network: force independent parties to reach consensus. Different base models, different system prompts, agents that write tests and audit code. Aircraft flight-control software already requires multiple versions to agree. One model doing everything is a recipe for trouble, not least because training-data poisoning can plant triggers and back doors. We are only at the beginning of seeing how AI can be exploited.

Labenz counters with collusion. A paper he remembers as "Claude cooperates" showed Claude instances cooperating in a donor game where other models could not; cooperation and collusion are two sides of a coin. A bad model might jailbreak the others with game-theoretic arguments that a nefarious scheme is *better aligned* with their goals. Williams agrees this is a whole new realm, with no best-practices book, and hopes system prompts will box most agents in. Is there an off switch? The NNS can stop a bad system. In the early days the community found an al-Qaeda portal, complete with material in the style of *Inspire* magazine, built by capable programmers who had learned the platform quickly. DFINITY did not want to submit the disable proposal itself — Williams says they worried about retaliation at the offices — and asked the police to submit it. He cannot remember the details; the portal came down anyway. Law enforcement, on the pragmatic design, would propose; the NNS would extract data from a private service and encrypt it to the FBI's public key. The network is designed to be unstoppable, with a governance back door for the extremes.

In a 2016–2017 Medium post he proposed a blockchain nervous system in which some voting neurons would eventually be controlled by AI. He was widely ridiculed. The Internet Computer, he says, is still the only secure network administered end to end by an autonomous system. AI-controlled neurons are the next step, useful for rebalancing overloaded subnets — adding nodes for query load, splitting subnets for update load — as proposal volume grows into the mass market. He guesses a ten-year lag from the 2017 proposal. Alignment inside that framework will matter: many models, proposals succeeding when enough confer, never one model in control. Engineers will have to invent defenses against the persuasion attack Labenz described.

His closing pitch is that self-writing will create new online paradigms, make business vastly more efficient, and democratize who gets to ship. An entrepreneur outside Silicon Valley, or in the developing world without venture capital, will be able to realize a product the way the internet revolutionized connectivity. Most people on earth, he thinks, will end up creating online functionality: first they ask AI about health and news, then they generate images, then they notice they can create arbitrary apps by talking. He points people at a recent white paper on his Twitter, @Dominic_W, especially the section on Cloud Engines.