Microsoft Research has introduced Magnetar, a zero-knowledge virtual machine (zkVM) that lets compiled RISC-V programs produce a compact proof of their execution. The paper reports proofs that verify in 11–13 milliseconds on an M4 Max MacBook Pro; a separate Microsoft announcement suggests the approach could help audit AI-agent actions. The paper does not test an AI agent or a deployed auditing system.
A verifier checks the run without repeating it
A conventional program returns an output, but someone who did not run it may have to trust the operator or repeat the computation to check the result. A zkVM lets the operator send a short cryptographic proof with the output. A verifier checks that proof instead of running the workload again. When the zero-knowledge property is used, the proof can also keep private inputs hidden.
Magnetar targets RV64I, the 64-bit base instruction set in the open RISC-V architecture. A developer can compile a Rust, Go or C program with ordinary tools, then prove its execution on the virtual processor. The same processor model can handle many programs, avoiding a separate hand-built cryptographic circuit for each application. The paper says a Rust or Go implementation of the Ethereum Virtual Machine could run inside Magnetar, but it does not report a deployed system doing so.
Standard hashes anchor the security claim
The design bases its cryptographic security on standard hash functions such as SHA-256 or SHA-3. The paper says Magnetar needs no trusted setup and does not rely on elliptic-curve or lattice assumptions, special-purpose algebraic hashes, or a conjectured error-correcting-code proximity gap. Microsoft describes this as a post-quantum approach because the construction avoids assumptions that a sufficiently powerful quantum computer could break; this is a property of the design under its stated cryptographic assumptions, not a certification of an operating product.
The speed comparison comes from one laptop
On an M4 Max MacBook Pro using 12 performance cores and 128 GB of memory, the authors report proving 222-cycle executions at 7.2–8.7 million cycles per second. Proofs were about 600 KiB and took 11–13 milliseconds to verify. Across 15 application workloads, the paper reports geometric-mean proving-throughput advantages of about 39 times over SP1 Hypercube, 18 times over Jolt-Dory and 9.6 times over Jolt-Akita. These figures compare the systems as released; the paper lists different security targets for the baselines. Each result is the authors' median of three runs after a warm-up on the same machine, not an independent replication or a general claim that all programs run faster by those factors.
Auditing an AI agent remains a proposed use
Microsoft's announcement proposes that an AI agent could attach a proof showing that its actions followed a supplied policy. For that proof to mean anything, the program being proved would need to encode the relevant policy checks and cover the actions under review. A proof cannot by itself establish that the policy is appropriate or account for actions outside that computation. Magnetar's paper evaluates general software workloads, not policy compliance by AI agents, so the application remains to be demonstrated.
Sources
- Microsoft Research announcement, October 15, 2026
- Magnetar technical paper, October 5, 2026
- Illustration: Codasip Group, “RISC-V open instruction set architecture”, unchanged, under CC BY-SA 4.0. It shows implementation options for the RISC-V instruction set, not Magnetar's proof design.