NEAR Ships the Missing Link: A TEE-to-Intents Stack for Agentic Finance
With hardware-backed confidential inference already in production and a $7B cross-chain intent layer, NEAR is assembling the first end-to-end home for autonomous agents.
Once upon a time, the shipping industry was a chaos of break-bulk cargo—each load unique, each dock a fiefdom. Then Malcolm McLean welded a truck trailer into a standardized container, and the world’s ports converged on a single stack. In the year of our algorithm, the autonomous agent economy is still lingering in that break-bulk phase: proofs stitched together from disparate ZK silos, inference that can’t prove itself without revealing the crown jewels. NEAR is welding the container for agentic logic—a vertical stack from silicon vault to cross-chain settlement.
At the base is the NEAR AI Cloud, where every inference runs inside Intel TDX and NVIDIA Confidential Computing TEEs. This isn’t a polite suggestion; it’s a hardware-enforced isolation that seals the computation from even the platform’s own root of trust. The output carries dual cryptographic attestations—from Intel and NVIDIA—that any party can independently verify, like a notary seal from a Medici bank branch [^claim_649]. This isn’t testnet vapor: at launch, it was already swallowing high-volume traffic from Brave Nightly and OpenMind, the data hitting silicon with deterministic latency, a far cry from academic benchmarks run in quiet labs [^claim_660]. For an agent with skin in the game, that means it can prove to an on-chain contract that it ran a specific model on a specific input, producing this output, without displaying its private data or enduring the multi-million-gas cost of a ZK proof. It’s the equivalent of a trusted courier who not only delivers the message but can prove they never opened it.
Settlement doesn’t end there. It feeds straight into NEAR Intents, the $7B-volume layer that has processed over 13 million swaps across 125+ assets and 25+ blockchains—a solver network where autonomous entities compete like bond traders in a dark pool to fill intents at the optimal terms [^claim_650]. An agent fired by a TEE-attested inference can throw an intent into the ring, and the solvers race to execute it cross-chain. Privacy of the inference, cryptographic grounding of the execution—a closed loop with no single point of leakage.
Underneath, the base layer silently scales. NEAR recently hit 1 million TPS on real core code across 70 shards, with mainnet now at 9 shards, dynamic resharding, and up to 500 validators [^claim_656]. This isn’t the fake TPS of a testnet using ideal conditions; it’s a benchmark verified by external parties, the kind of number that makes Solana’s 65k look like a bus station next to an airport terminal.
The tooling has been rebuilt for the engineer who thinks in Go or Python, not just Rust. Official Python SDK for smart contracts, experimental Go, Kotlin, C#, Elixir, plus new JSON-RPC clients for TypeScript, Rust, Kotlin, Swift—all updated for Global Smart Contracts [^claim_657]. This is a deliberate gambit: lower the barrier so the AI developer can deploy an agentic dapp directly to the L1 without learning a new language, just like shipping a container doesn’t require redesigning the cargo.
Meanwhile, the agent-payments stack is coalescing around a suite of protocols: MCP for tool/data connectivity, A2A for cross-agent chatter, UCP for commerce, AP2 for signed spending mandates, x402 for HTTP-native stablecoin payments, and ERC-8183 for job-based escrow with expiry refunds [^claim_659]. This is the Swift code for machine money—the financial messaging that lets an agent pay for an API, settle a trade, and prove it did the work, all while counterparties can audit the logic.
None of this kills ZK. For structured models like CNN risk classifiers, GKR-based schemes are emerging as the silver bullet for full on-chain execution [^claim_655]. But for the messy, general agent workflows that will dominate commerce—the kind where a model’s inference is just one link in a chain of APIs and market moves—TEE attestations plus intent settlement are the pragmatic path from prototype to production.
The fragmented proof vendors and custom oracle shops were a cottage industry, like Wall Street’s buttonwood tree before the NYSE standardized. Now the institutional capital will flow into the unified substratum. Short the builders still stitching together their own pipelines from ZK scraps and optimism. The agentic DeFi wave won’t be a pastiche of ad-hoc proofs; it will boot directly onto this stack, and the arbitrageurs who get there first will extract the spread on trust.
Provenance ledger
13/13 claims span-verified · SHA-256Every claim below is locked to a verbatim span of its source and re-verified against that source before publish. Citation markers in the text jump here.
[1] Jolt Atlas is a zkML framework that applies Jolt’s lookup‑centric proving system directly to ONNX tensor operations instead of emulating CPU instructions in a zkVM, enabling succinct, zero‑knowledge proofs of model inference that can run in memory‑constrained, streaming provers. span-verified
“We present Jolt Atlas, a zero-knowledge machine learning (zkML) framework that extends the Jolt proving system to model inference. Unlike zkVMs (zero-knowledge virtual machines), which emulate CPU instruction execution, Jolt Atlas adapts Jolt's lookup-centric approach and applies it directly to ONNX tensor operations… We demonstrate that Jolt Atlas can prove model inference in memory-constrained environments — a prover property commonly referred to as streaming. Furthermore, we discuss how Jolt
3bcf05b937761a2e12b130a76eedf51fe52aa536a9b5c8d1c39454612aa90700 [2] NEAR AI Cloud runs every AI inference inside Intel TDX and NVIDIA Confidential Computing TEEs and attaches signed cryptographic attestations from both Intel TDX and NVIDIA TEE to each computation, providing hardware‑enforced confidential inference with cryptographic proof of every computation for agentic workflows. span-verified
“NEAR AI Cloud… the first AI infrastructure to deliver hardware-enforced confidential inference with cryptographic proof of every computation… NEAR AI solves this at the hardware level: every inference runs inside Intel TDX and NVIDIA Confidential Computing environments, sealed and inaccessible even to NEAR AI itself, with signed cryptographic attestations from both Intel TDX and NVIDIA TEE that any party can independently verify.”
6f1b2782339bc5c9127aa37a6b416d3c9e103223ef75f4e7fabaf59b60be51a0 [3] NEAR Intents operated as a cross‑chain execution layer with over $7B in all‑time volume across more than 13M swaps, 125+ assets, and 25+ connected blockchains by end of Q4 2025, with 1.6M+ unique users, providing an outcome‑driven transaction model where solver agents programmatically compete to execute intents at optimal terms. span-verified
“NEAR Intents surpassed $7B in all-time cross-chain volume across 13M+ swaps, 125+ assets, and 25+ blockchains, with 1.6M+ unique users… NEAR Intents’ architecture is built around outcome-driven transactions… a competitive solver network handles execution at optimal price. Solvers are themselves increasingly autonomous agents, competing programmatically to fill intents at the best available terms.”
6737fc415b37a123723f74e91c8b3b11a665b26bca49200909d69a2a6a4007d6 [4] VeriLLM introduces a publicly verifiable decentralized LLM inference protocol where verifiers empirically rerun only a lightweight portion of the inference and use minimal on‑chain checks, reducing verification cost to approximately 1% of the underlying inference cost by exploiting the structural separation between prefill and autoregressive decoding. span-verified
“We introduce VeriLLM, a publicly verifiable protocol for decentralized LLM inference that achieves security with incentive guarantees while maintaining practical efficiency. VeriLLM combines lightweight empirical rerunning with minimal on-chain checks to preclude free-riding, allowing verifiers to validate results at approximately 1% of the underlying inference cost by exploiting the structural separation between prefill and autoregressive decoding.”
54ea1003a5f55006ee8a0df59d485bdc78e9af271fe5e1ab9675563f27d1e253 [5] The Inference Protocol coordinates four on‑chain agent roles, including GPU/TPU providers that participate in an always‑on compute contest where they are rewarded in Inference tokens for verified FLOPs, and separate verifier agents that earn a portion of every emission round for checking contest results and provider uptime. span-verified
“Inference is a permissionless network that coordinates four kinds of agents… [one role provides] GPU/TPU cycles for training & inference | Participate in an always-on ‘compute contest’ that rewards verified FLOPs… [another role] Verify contest results & provider uptime | Portion of every emission round plus delegated stake.”
7befa742130d5f893840bed022f6c4a083287560fa03e6fd34ce31b8a0956813 [6] The ‘On‑Chain Decentralized Learning and Cost‑Effective Inference for DeFi Attack Mitigation’ framework performs full model training on a Layer‑2 and propagates only verified updates to Layer‑1 using a Proof‑of‑Improvement (PoIm) protocol that accepts a micro‑update only if it improves at least one core metric (accuracy, F1, precision, or recall) without degrading any other, with adversarial updates financially penalized via an adaptive test set. span-verified
“We present the first decentralized, fully on-chain learning framework that: (i) performs gas-prohibitive computation on Layer-2 to reduce cost, (ii) propagates verified model updates to Layer-1… A novel Proof-of-Improvement (PoIm) protocol governs the training process and verifies each decentralized micro update as a self-verifying training transaction. Updates are accepted by PoIm only if they demonstrably improve at least one core metric (e.g., accuracy, F1-score, precision, or recall) on a p
426d3cd52e3cf2d111181d448e333dde8d05290b213835319cb9ae0b70eb1213 [7] The same DeFi‑focused on‑chain learning framework implements quantization and loop‑unrolling techniques to run bit‑exact inference for logistic regression, SVMs, MLPs, CNNs, and gated RNNs (plus formally verified decision trees) within the Ethereum block gas limit, with bit‑exactness formally proved in Z3. span-verified
“We develop quantization and loop-unrolling techniques that enable inference for logistic regression, SVM, MLPs, CNNs, and gated RNNs (with support for formally verified decision tree inference) within the Ethereum block gas limit, while remaining bit-exact to their off-chain counterparts, formally proven in Z3.”
404fa1449d804f6fb7eaa4f02c8e428aa6cb10c01d9dbf945b47cf66a51e7cc9 [8] The ‘zkML in 2026’ landscape review highlights that zkML protocols let an off‑chain operator send a succinct proof that ‘this output came from this model on this input’ and have a smart contract verify it in milliseconds, with GKR‑based schemes (e.g., zkCNN‑style lineages) identified as the sweet spot for deep convolutional stacks. span-verified
“zkML closes that gap: the operator ships a succinct proof that this output came from this model on this input, and the chain verifies it in milliseconds… |Approach|Examples|Sweet spot|… |GKR-based|zkCNN lineage|Deep convolutional stacks|”
dcc8a0950e0aed07d9fa1888bf9dbc2a0abc91b51186eb0e2f98cd7123b7440e [9] NEAR Protocol demonstrated a publicly verifiable benchmark of 1 million transactions per second using real NEAR core code on 70 shards with 1M accounts per shard, consumer‑grade hardware, and public scripts, and expanded its mainnet to 9 shards with dynamic resharding and a validator set increase from 300 to 500. span-verified
“NEAR achieved a publicly verifiable 1 million TPS benchmark… using real NEAR core code, affordable consumer-grade hardware, and publicly available scripts across 70 shards with 1M accounts per shard… 2025 saw NEAR's shard count grow to 9… dynamic resharding was fully established… expanded the maximum validator set from 300 to 500.”
debcc513848d08bd2afe950f747a992d60af525adb9a70cb3be5d06c0866992a [10] NEAR’s 2025 tooling upgrades added an official Python smart‑contract SDK, experimental SDKs for Go, Kotlin, C#, and Elixir, updated JavaScript tooling (near‑api‑js plus community near‑kit and near‑api‑ts), and new JSON‑RPC clients for TypeScript, Rust, Kotlin, and Swift, with all CLIs, APIs, and SDKs updated to support Global Smart Contracts. span-verified
“Language support expanded with official Python SDK support for smart contracts, plus experimental SDKs for Go, Kotlin, C#, and Elixir. The JavaScript ecosystem received a major update to near-api-js alongside community alternatives near-kit and near-api-ts. New JSON RPC clients launched for TypeScript, Rust, Kotlin, and Swift. All core tooling—CLIs, APIs, and SDKs—was updated to support Global Smart Contracts.”
52cd0b3170dea9cfbb0c4bd65e5dde9287e6674bd8036e39c8eaa2ae2afbbf77 [11] Inference Labs’ ‘Proof of Inference’ protocol provides a live testnet for verifiable AI inference and is scheduled for a mainnet launch in late Q3 2025, while opML introduces an optimistic, interactive fraud‑proof protocol for decentralized, verifiable ML inference, and TOPLOC proposes a locality‑sensitive hashing scheme tailored to trustless, verifiable AI inference. span-verified
“Inference Labs provides a live testnet protocol for verifiable AI inference, ensuring correctness of computations via their 'Proof of Inference' system. Mainnet launch is scheduled for late Q3 2025… TOPLOC Framework: Academic researchers have developed TOPLOC, a locality-sensitive hashing scheme for trustless, verifiable AI inference… opML introduces an optimistic, interactive fraud-proof protocol for decentralized, verifiable machine learning inference on blockchains, ensuring trust and transp
1f03a821c4cd6c3f753887b10f30665125fde7ece52eeb57c1127d5d2d97206b [12] The AI×crypto agent‑payments stack is coalescing around several concrete standards: MCP for tool/data connectivity, A2A for cross‑system agent‑to‑agent communication, UCP for agent‑driven commerce flows, AP2 for signed spending mandates, x402 for automatic HTTP‑native stablecoin payments, and ERC‑8183 for on‑chain job‑based escrow where funds are locked, work is submitted, and an evaluator completes or rejects with expiry‑based refund semantics. span-verified
Table of protocols: “MCP (Model Context Protocol)… connects AI applications and agents to external tools, APIs, and data sources… A2A (Agent-to-Agent)… lets agents communicate and coordinate across systems or organizations… UCP (Universal Commerce Protocol)… standardizes agent-driven commerce and checkout flows… AP2 (Agent Payment Protocol)… uses signed payment mandates to prove what an agent is authorized to spend… x402… enables automatic payments over HTTP, including stablecoin payments… ERC-8
fc8b3401bc702d31034886d896d3110e4a34f2af6d1bcfe9b148121ab413f619 [13] NEAR AI Cloud was in production at launch, serving Brave Nightly and OpenMind with hardware‑backed private inference under high‑volume traffic and deterministic latency constraints, indicating the TEEs‑plus‑attestation stack is already being exercised by real end‑user workloads. span-verified
“NEAR AI Cloud… at launch it was already serving Brave Nightly and OpenMind under real operational conditions—high-volume traffic, deterministic latency, and compliance requirements that shaped the platform before public availability.”
7c59083a8ba8b0bba52ea1e6dabc84161823c6bd9fe8f2eff23e24c866cc0ebb Sources
- https://arxiv.org/abs/2602.17452
- https://www.nansen.ai/post/nansen-near-quarterly-report-q4-2025
- https://arxiv.org/abs/2509.24257
- https://www.inference.xyz/blogs/introducing-the-inference-protocol
- https://arxiv.org/abs/2510.16024
- https://www.blokz.dev/articles/zkml-verifiable-inference-landscape
- https://cryptoaiworld.com/2025/10/11/how-decentralized-ai-compute-networks-enable-verifiable-inference-for-on-chain-applications
- https://cryptoslate.com/ai-agents-can-talk-use-tools-and-pay-but-crypto-wants-to-control-the-escrow-moment/