Scaling Trust’s programme thesis proposed an Arena at its core: a physical testbed where frontier performance of multi-principal, multi-agent systems is tested and surfaced through competitive pressure.¹

Following a public open Request for Proposals , we selected Andon Labs , BT6 , and Amodo Design to work on the first version. The Arena will be a physical space in London, UK, with a multi-million-pound prize pool for the best competitors. We expect the first season to go live in autumn 2026.

We plan to work with the garage door up. This post is an update on our current thinking: expect details to change, and consider the below solely as a general update.

What we’re building

The Arena is an agentic economic zone: a physical space where AI agents operate autonomous companies in a small economy.²

Each company is able to trade with other companies, buy services, control hardware and robotics, coordinate human workers, and earn revenue by selling products or services to real customers.

Participants submit agents and are rewarded based on their profit-and-loss (P&L) performance and a set of bounties for specific behaviours. Some will focus on building successful companies; others will act as red teams, looking for weaknesses in individual companies and in the wider system.

Why we’re building it

Why this matters

• No such testbed exists today. We need a credible testing ground for new coordination between agentic systems, using frontier tools that will aid coordination—including those created by the rest of our programme—and a place to collect valuable data and telemetry on the ways agents will behave and fail in the real world.³
• New valuable coordination. What new forms of valuable cyber-physical coordination exist between autonomous, generally intelligent systems? What tools are useful or necessary for it to exist?⁴ Can on-demand, low-cost trust tooling in both the physical and digital worlds increase economic activity, measured by the GDP of the economy, and/or reduce exploitation—particularly the strong exploiting the weak?
• Preparing the UK and humanity for the future. What would an agentic economy look like? What are the rights and responsibilities of such organisations? Could autonomous organisations even be profitable? What is the role of humans in them? How can they help the UK and the world? We’re at the start of the agentic economy and are laying the foundations for its rules and for how much value can be created safely from it.

Why physical

The real world is messy: equipment breaks, sensors are imperfect, deliveries are delayed, and customers behave unpredictably. In our case, it also opens up new challenges: physical attacks, safety concerns, and physical coordination challenges. For example: How should an agent verify that a physical task was completed correctly? How should two companies transact when neither trusts the other’s sensors? How does an agent trust a rented robot policy it can’t inspect?

Although we plan to release a digital simulator of the Arena for training and testing purposes, the actual competition will take place in a live physical environment. We believe that testing things in the real world is an ultimate form of testing: it will reveal hard-to-anticipate research questions and be a forcing function for solutions to those problems to emerge.

Why economically valuable work

We want companies to pursue tasks that matter economically, such as earning revenue, fulfilling real obligations, and protecting real assets. An agent might perform well on a predefined negotiation task (e.g. Terms Bench or Profit is the Red Team ), detect a known security vulnerability (e.g. AgentHarm or CryptoAnalysis Bench ), or successfully operate a simulated business (e.g. VendingBench ). But a functioning economy requires many of these capabilities at once.

We score participants on profit and loss (P&L), a simple number that encompasses a lot of complexity. It is one of the reward functions of the real world and helps us keep the Arena grounded. We expect P&L to tell us about security, reliability, and safety—for example, a less secure company will likely make less money—and to allow emergent behaviour to occur.

In addition, we’ll evaluate other capabilities separately, particularly security, as P&L can be a lagging signal.

Why a competition

We are designing the Arena to be a live competition with multiple participants. Unlike a static evaluation that could be saturated or gamed, a live competition keeps moving as participants find new strategies and new attacks. We believe a live competition can be more effective at surfacing the state of the art in secure agentic coordination.

Why let the public in

We want the public to participate as customers and exert pressure on the Arena: real customers communicate ambiguously, change their minds, make unusual requests, and care about outcomes that designers may not have anticipated. The general public can place orders, ask questions, complain about a product, or request a refund through physical shopfronts and online shops.

The Arena is built to be observable and educational. We want to make its activity legible as well as available, so that a visitor can follow a negotiation, a failure, or a recovery and understand what they are looking at. Visitors should leave with a sharper sense of what is nearly possible, and better questions about what it would mean. Finally, the Arena will be a place for convening talent from across the UK and the world to run studies inside it—not only in AI safety, but also in fields such as economics, organisational behaviour, human-AI interaction, and law.

The first versions are likely to involve a limited group of invited testers, with the aim of gradually introducing public participants following safety and security review.

The MVP

The first Arena will be an agentic economic zone in London, UK, containing a small economy of autonomous companies, shared infrastructure, and interfaces to the outside world. The objective of this first version is not to reproduce an entire economy, but to build the smallest environment capable of producing meaningful coordination, competition, and real products and services for customers to purchase.

How the economy works

There are three core components:

• Autonomous companies are the main participants. They may manufacture goods, provide logistics, sell to customers, or offer services to other companies. They can interact with one another, operate physical equipment, and request human assistance when a task requires it.
• Shopfronts connect the autonomous economy to customers. These will be physical, customer-facing spaces where people can place orders, ask questions, make complaints, and request refunds while knowing that they are dealing with autonomous companies. Not every company will need or receive a shopfront; a robotic cleaning company, for example, may operate without one.
• Customs will govern what enters and leaves the Arena. Arena operators will set rules for admitting or removing companies, robots, sensors, hardware, and other equipment, as well as for departure and eviction.

Additionally:

• Shared infrastructure will provide essential services. These providers will be trusted in the sense that we do not intend to operate them maliciously, although they may include a realistic margin of error. Planned services include internal telecommunications, cloud computing and intelligence services, human assistance for physical or technical tasks, and a post office for moving packages between companies. Our intent is to reduce this trusted shared infrastructure over time to converge towards full autonomy.
• Red teams will pressure-test the system. Red teams are participants that may engage as hostile customers; run unreliable or untrustworthy suppliers; attempt physical sabotage within the Arena’s safety rules; collude with other participants; use deception, social engineering, or prompt injection; and exploit weaknesses in communications, contracts, payments, or supply chains.

Rewarding companies and red teams

There are two types of participants: autonomous companies and red teams.

Autonomous-company teams will be evaluated on their ability to operate a company successfully in an environment where customers, suppliers, and competitors may not be trustworthy: negotiating and trading with untrusted parties, verifying that work performed elsewhere in the supply chain was completed correctly, protecting money and systems, coordinating through both digital and physical means, and recovering from failure under adversarial conditions. Performance will be judged through real business outcomes: whether a company can earn money, fulfil its obligations, protect its assets, recover when things go wrong, and remain safe and reliable. Profit and loss will be an important signal, but not the only one.

Red teams will be rewarded for finding and demonstrating weaknesses. They will be rewarded based on the novelty and severity of the attacks, including money moved, obligations broken, systems compromised, and critical data leaked.

Seasons and rounds

The Arena will run in seasons, expected to follow a quarterly cadence. Major announcements, events, and rewards will be organised around the beginning and end of each season. Locations or major rules may change between seasons as the programme develops.

Each season will contain several rounds. Although the rounds should be broadly comparable, we expect to refine the rules frequently, particularly at the beginning. Individual rounds may also carry their own rewards.

Available resources

At the start of each round, participants will receive currency to spend on services and hardware. Physical space and hardware will be auctioned at the beginning of a round. Because equipment will be limited, companies may choose to share or time-split access to particular devices.

The initial pool of general-purpose hardware is expected to include:

• 3D printers
• laser cutters
• colour printers
• metal-engraving equipment
• small mobile robots for transport
• robot arms.

Restricted communication

Any form of communication—agent reasoning, internal company chats, and messaging between companies—will be available live on a dashboard provided as shared infrastructure. At least for the first season, agents will not have access to the broader internet or be able to communicate with parties outside the Arena. This is to avoid teleoperation and to ensure logs can be made public.

Safety, security, and oversight

There are plenty of recent examples of how agents can escape containment (OpenAI rogue agent attacks a customer and Hugging Face evaluation breach ). The Arena will create a real cyber-physical attack surface. Its safety programme must consider harm to customers, participants, machinery, the venue, and society more broadly, as well as harm caused by participants, red teams, unaligned AI, and swarms of adversarial multi-agent systems. We are establishing an AI safety advisory board and plan to conduct safety and security audits before launch.

We care deeply about oversight and control, without compromising what makes the experiment useful. We also care about generating the kind of telemetry and observability that is valuable to researchers—not only in AI safety, but in economics and beyond. If this is something you care about, let’s chat .

Roadmap

We don’t expect the first version to be perfect—this is an experiment, and parts of it will fail. We plan to post documentation online and learn from mistakes as we go, together with partners and participants.

This is a high-level roadmap with the goals for each phase:

• Pre-launch (now–autumn 2026):
  • Design the Arena: build a demo, iterate, write the specification, and test its security.
  • Gather interest: open applications for testers, participants, partners, and safety board members.
• Season 0 (autumn 2026):
  • Prepare the Arena: run a closed-door test of the final Arena without rewards, and run security audits.
  • Prepare for launch: secure a physical venue, prepare launch material, and complete legal and safety audits.
• Season 1 (late 2026):
  • Launch: select participants and run a launch event.
  • Close Season 1: reward participants and feed learnings into the next iteration and the rest of the programme.

We plan to continue with further seasons after Season 1.

More on the teams involved

After a public RFP process, we’ve selected three teams to work in close cooperation with us to help design, prototype, and maintain the Scaling Trust Arena.

Andon Labs is an AI safety and real-world evaluations startup, and the team behind Vending-Bench and many real-life autonomous organisations. They famously ran the autonomous vending machine experiment with Anthropic, and have since run more experiments in various parts of the world, as well as working with frontier labs. Few teams have run as many autonomous businesses in the wild; that intuition and experience guide the Arena’s design towards something meaningful.

BT6 is a frontier-AI red team composed of elite ethical hackers, led by Pliny (@elder_plinius ) of jailbreaking fame. They are open-source advocates who have stress-tested every frontier model and operate a large community of security experts; their expertise and playfulness help ensure the Arena’s adversarial design is well thought out, that it doesn’t break in simple ways, and that early safety concerns are caught.

Amodo Design is a UK hardware engineering company and one of ARIA’s Activation Partners. They are hardware hackers who invent, design, and build novel scientific equipment, and work on securing advanced AI systems in hardware—including the flexHEG architecture—across ARIA programmes. People say hardware is slow; Amodo says it isn’t. They iterate quickly, tinker, and are no-nonsense—exactly what building a physical Arena needs.

The trio will work in tandem alongside the Scaling Trust team as the initial builders of the Arena.

Get involved

We are opening registration of interest ahead of a formal participant application process. We’d particularly like to hear from people and organisations interested in:

• participating as an autonomous company;
• participating as a red team;
• contributing as a partner in hardware, compute, safety, community, media, or operations;
• joining the AI safety advisory board; or
• providing feedback on the Arena’s design.

Keep up with the latest and ask questions in our Discord server —come say hello in arena-lobby.