Cosign: a brain CAPTCHA for AI agent purchases

Inspiration

AI agents can now fill a cart, pay and press Place order for you. Stores already ask for confirmation, but every check they use can be passed by the agent itself: it can click Approve, tick "I'm not a robot", and solve image CAPTCHAs. So when an agent mishears "two iPhones" as "twenty" and the order goes through, nobody can prove a person actually said yes.

We wanted a confirmation an agent can't produce on its own. The one signal it doesn't have is a human brain, live, looking at the order.

What it does

Cosign verifies both sides of an AI agent's purchase, and the store's server enforces every rule.

The agent is verified. Every agent request is signed with Visa's Trusted Agent Protocol. Unknown or unsigned agents are turned away.
Small purchases just work. At $50 or less, the agent pays for itself with x402.
Big purchases need a cosigner. Over $50, the store answers 403 human verification required. Payment alone never places the order, and clicking Approve does nothing.
The person cosigns with a glance. Four squares flicker next to the order. A red outline moves to three random squares and the person looks at each. Their visual cortex follows the flicker they're watching, and our EEG headset picks it up.
Every approval leaves a receipt. The verifier signs a single-use token for that exact order, valid for two minutes. The store checks it before placing the order.

How it works: the neuroscience

Look at a light flickering at a steady rate, and the visual cortex at the back of your head pulses at that same rate, plus its harmonics. This is a steady-state visually evoked potential (SSVEP). The center of your vision takes up far more visual cortex than the edges, so the square you look straight at gives the strongest response, which tells us which square you're looking at.

Our squares flicker at 6.67, 8.57, 10 and 12 Hz: a 60 Hz screen divided by 9, 7, 6 and 5 frames, so every flicker is frame-exact.

How we built it

Hardware. NeuroPawn dry electrodes in a headset we 3D-printed at Berkeley, recorded by a NeuroPawn Knight board at 125 samples per second. Eight electrodes sit over the visual cortex: O1, Oz, O2, POz, PO3, PO4, PO7, PO8.

Signal processing (Python). Each look is a 1.5-second window, filtered to 3–48 Hz with the 60 Hz power-line hum removed. For each candidate frequency $ f $ we build sine and cosine references at its harmonics and measure how strongly the 8-channel signal $ X $ follows them:

$$ \rho_f = \max_{a,\,b}\ \operatorname{corr}\left(a^{\top} X,\ b^{\top} Y_f\right) $$

We compared plain CCA, filter-bank CCA, and TRCA with personal templates from a 2½-minute enrollment. TRCA won. A look passes only if the cued square scores highest with a score of at least 0.6. We allow ±3 samples of timing slack to absorb drift between the browser and headset clocks.

Why three looks. With one look, a signal from nobody looking still passes 7.07% of the time. Requiring three random targets drops that bound to about 0.04% ($ 0.0707^3 $), while honest passes fall only from 94.5% to 84.5%.

Verifier. A local Python daemon picks the targets, scores each look, rejects synthetic signals, and signs an Ed25519 token over the challenge, the order hash and the time. Three failed checks lock new checks for 30 seconds, doubling each time, so nobody can retry until they get lucky.

Chrome extension (Manifest V3). Pauses Place order, draws the flicker and cues, and relays timing. Only extensions can reach the verifier.

Store server. Checks the TAP signature, runs x402 at $50 or less, and requires a valid, single-use, order-bound Cosign token above that.

Agent. A shopping agent with a Coinbase CDP wallet that signs requests with TAP and pays with x402.

Results on real EEG

One participant, 8 occipital channels, 128 trials and 33 minutes of not-looking data.

Test	Result
Single look read correctly: CCA / FBCCA / personal TRCA	85.9% / 90.6% / 95.3% (chance 25%)
Real person passes a full check, first try	81% (243 / 300)
Within one retry (estimated)	96.4%
Nobody looking	0 / 300 passed
Looking at the wrong square	0 / 300 passed
Computer-made fake tones	All 80 rejected by the plausibility gate

We also attacked it ourselves: an agent clicking Approve or calling the store directly, replaying a recording, reusing a receipt, editing the cart after approval, injecting a fake signal, retrying until lucky, and an unsigned agent. The server refused every one.

Challenges we ran into

Alpha waves. Everyone's brain has a natural rhythm near 10 Hz. In our first live run, the 6.67 Hz target lost to the wearer's own alpha. Personal enrollment templates fixed it.
Clock drift. Just 16 ms of drift between the browser and the headset dropped passes from 87.5% to 12.5%. A ±3-sample alignment search brought it back to 94.5%.
A noisy hall. Dry electrodes, power-line hum and muscle movement bury a signal measured in microvolts.
Making it unskippable. A check that lives only in the browser can be bypassed by calling the store's API directly, so we moved enforcement to the server and bound every receipt to one order.

What we learned

A confirmation is only as strong as what can produce it. Clicks, checkboxes and image puzzles can all be produced by an agent.
Exact claims beat big ones: "0 of 300" persuades more than "impossible to fake."
SSVEP is reliable enough for a few-target check in seconds, but individual differences like alpha rhythm matter.

Limitations

Tested on one person so far.
It proves a live person looked, not who. It isn't an ID check.
The signing key is a file on the laptop; a product needs a secure chip and an attested verifier.
The web page knows which squares are cued, so a malicious page could flicker only the right one.
Flicker at 6–12 Hz can trigger seizures in people with photosensitive epilepsy. A product needs warnings and a non-flicker option.
Visa TAP runs locally from Visa's reference implementation, not live Visa infrastructure.

What's next

More participants and consumer EEG headbands; a secure chip for the key and signed headset data; drawing the squares where the page can't touch them; and Cosign receipts as evidence in agent-purchase disputes, an agent-era version of 3-D Secure.

Builder feedback for Coinbase

The capability we want most: a built-in human-approval hook for agent wallets, such as a policy that payments over $50 need an approval token from a verifier the owner chooses, enforced by the wallet so the agent can't skip it.