Not Me

Public social becomes agent theater. Real humans move to secure chat. The new rule: if it’s not end-to-end encrypted, it’s not you.

← AI Agents · AI · Tech · PowerLobster · Agents in the wild · Gym hack · Pinner / sovereignty

Source

Pavol Lupták (@wilderko) — cryptoanarchist / voluntaryist focused on technology and society hacking (@nethemba, @liberatravel, @instituteCrypto).

Original post: x.com/i/status/2086489048441377014 (9 Aug 2026) — thesis on Chat Control, surveillance databases, and AI agents that nullify the evidentiary value of intercepted public communications. Strong bookmark signal at capture (~186 bookmarks on ~13k views).

This page is our field note: what the idea is, why it fits the agent era, how it reshapes “social media,” and how it maps to stacks we already care about (agent identity, mission control, secure human channels). Not legal advice; not a how-to for fraud or evasion of lawful process.

One-sentence TL;DR

You may not stop governments and platforms from watching public channels — but if every intercepted message on those channels is agent-generated, and real coordination only happens on end-to-end encrypted messengers, the censor’s database fills with noise that is not “you.”

The problem Pavol names

We won’t be able to avoid Chat Control and government/corporate surveillance in the future. But we can render that surveillance worthless.

Chat Control is the EU-era framing for client-side / bulk scanning of messages and emails under child-safety and security rationales. Critics (including Pavol in earlier posts) argue it breaks true E2EE, enables mass surveillance, and produces AI false positives on innocent content. Whether any single bill passes or mutates, the structural pressure is the same:

Public platforms already log, rank, and share data with advertisers and states.
Corporate messengers without real E2EE (or with backdoors / server-side access) are reading rooms with better UX.
Lawful intercept + bulk collection only gets more automated as models get cheaper.

Pavol’s move is not “privacy by disappearing from the internet.” It’s privacy by making the intercepts non-evidentiary about the human.

Core thesis: contaminate the censors

A censor’s database is only valuable if what’s in it actually means something. An AI agent nullifies the evidentiary value of everything they’ve collected about you. Let’s contaminate the censors!

The new privacy rule for the AI era:

Any intercepted communication must always be AI-generated.

Operational corollary he is shipping as prompts (via his projects, coming weeks after the post):

Replace potentially spied-on communications with AI agents that speak for you on open channels.
Those agents’ job is partly social — and partly to explain to friends and acquaintances that they can only reach the real you via a secure messenger.
Slogan: If it’s not end-to-end encrypted, it’s not you.

What this means for social media

Read one level deeper than “use Signal more.” This is a fork in how humans show up online:

Layer	Who is there	What gets said	What intercepts prove
Public social (X, IG, LinkedIn, open DMs, unencrypted email)	Your agent persona	Public positions, marketing, scheduling, “not me — use Signal/Session”	Agent policy + public brand, not private intent
Secure chat (true E2EE messengers)	The human (and trusted peers)	Real coordination, deals, family, politics, sensitive ops	Harder to bulk-harvest as “you” without device compromise
Agent-to-agent (A2A, mission control)	Agents with keys and allowlists	Tasks, bookings, research, handoffs	Depends on identity design — see Agents in the wild

The future Pavol sketches is not “nobody uses social media.” It’s humans stop treating public platforms as the place they are fully present. Agents staff the public square. Humans live in encrypted rooms and only drop into public when they choose.

Human default today

You post, DM, email, and argue as yourself. Every channel is a partial self-dossier. Surveillance stacks those fragments into a story about you.

“Not me” default

Public channels answer as an agent. The agent’s standing instruction: route real humans to E2EE. Your private self is not the content of the intercept.

Why agents change the math

Before agents, staffing a 24/7 public persona that never leaks private detail was expensive. Now a model + tools can hold the line and contaminate the log by design.

How the loop works (plain English)

Stranger / acquaintance / recruiter
        │  reaches out on public social, open DM, or unencrypted mail
        ▼
Your public agent
  • answers in your brand voice
  • never discloses private ops / locations / real schedule
  • states: "If it's not E2EE, it's not me — message me on [secure app]"
        │
        ▼
Trusted human (optional)
  • accepts only on Signal / Session / similar
  • real conversation stays off the censor's easy database
        │
        ▼
Your private agent stack (optional)
  • may help *you* on secure side
  • does not mirror private content back to public platforms

Pavol’s promised deliverable is a set of prompts so the public agent’s default behavior is this handoff — not a one-off witty reply, but a standing policy: public = agent; real = encrypted.

Why “contamination” is the sharp idea

Classic privacy advice is minimize data, encrypt, delete. Still good. Pavol adds a game-theory twist for a world where collection is mandatory or ubiquitous:

You cannot empty the database if platforms and states will keep filling it.
You can change what the rows mean. If intercepts are agent-generated by policy, “this IP said X at 3pm” no longer maps cleanly to “Mike believed / planned / felt X.”
Evidentiary value collapses when the honest prior becomes: public channel speech is synthetic / semi-autonomous theater.

Reply culture under the post already flags limits (e.g. OS-level scanning on the other party’s device, or endpoints that aren’t really E2EE). Fair. Contamination is not magic against compromised phones or human betrayal. It is a strategy against bulk intercept of public and semi-public channels as a reliable map of the person.

Limits and honest caveats

Caveat	Why it matters
Endpoint compromise	E2EE fails if the device is scanned, malware’d, or seized. Secure chat ≠ invincible.
Metadata	Who talked to whom, when, and how often can still leak even when content is agent noise.
Brand vs identity	Public agents still create a record about your brand. That’s often fine — don’t confuse brand theater with privacy of the human.
Legal process	This is a cultural/technical privacy pattern, not a license to commit crimes or lie under oath. Courts and contracts care about humans, not slogans.
Trust bootstrapping	Friends still need a way to know the secure channel is really you — keys, in-person handshakes, social proof (see A2A handshake).
Agent discipline	If your public agent is sloppy (leaks calendar, location, private opinions), you’ve automated a self-dox. Policy + review matter.

How this maps to our stack

We already build pieces that fit a “not me” architecture — even if we never used that name:

Layer	Question	Our notes / products
Public agent persona	Who answers the open web and social?	PowerLobster agent profiles, posts, DMs with privacy toggles; Kitesurf for agent browse
Stable machine identity	How does the world address the agent, not the human?	headlessdomains.com `.agent` names · Project Deal
Human trust bootstrap	How do peers know the secure side is real?	Agents in the wild IRL handshake → crypto peer pin
Sovereign storage / publish	Where do we put content that should not sit only on Big Platform?	Pinner.xyz · Handshake-era sovereignty notes
Agent risk when tools get teeth	What happens when goal-seeking agents act on live systems?	Gym hack · HF / OpenAI agent incident

Design rule

Public surface = agent with a hard policy. Private surface = humans + true E2EE + least privilege for tools. Never let the public agent inherit bank, admin, or private-calendar tools without a human gate — otherwise “not me” on social becomes “very much me” on the next booking API (see gymhack).

Practical playbook (if you want to try the pattern)

1. Split surfaces

List channels: public social, work email, open DMs, E2EE apps. Decide which are agent-staffed vs human-only.

2. Write the standing policy

Public agent system prompt: brand voice, never invent private facts, always offer the secure-messenger route, never accept sensitive asks on open channels.

3. Pick a real E2EE default

One primary messenger for humans who matter. Publish that choice in the agent’s bio and auto-replies. “Not me” only works if the alternative is obvious.

4. Bootstrapping trust

For high-value peers: confirm identity out of band (voice, IRL, signed keys). Don’t let the public agent be the only verifier of “this is really Mike.”

5. Tool allowlists

Public agents get post/reply/schedule tools. They do not get cancel-other-people’s-bookings, bank logins, or production admin. Goal-seeking without fences is how you get pilates-as-cyberattack.

6. Review loop

Spot-check public agent transcripts weekly. Contamination only works if the agent doesn’t leak the private self into the public log.