Ritual in 2026: Can a Public Blockchain Keep an AI Secret?

Ritual has spent two years defending a strange proposition: that a blockchain, the most transparent kind of database anyone has built, should also be the place you run a private AI model. Those two goals pull in opposite directions. A public chain records every input, every output, and every intermediate step so that thousands of strangers can re-check the math. A genuinely useful AI query often carries the opposite requirement. It might contain a medical record, a proprietary model’s weights, an API key, or a trading signal, none of which the owner wants broadcast to the world. For most of crypto’s history the honest answer was to pick one side: transparency or privacy.

Ritual’s pitch in 2026 is that you no longer have to choose, that inference can be verifiable and confidential inside the same transaction. It is an ambitious claim, and it is worth taking seriously because the machinery behind it is more concrete than the usual crypto-AI vaporware. It is also worth taking apart, because the moment you promise both properties at once, the trust assumptions get subtle and the failure modes get quiet. This piece is an architecture review, not an investment thesis: Ritual is still a public testnet with no mainnet date and no tradeable token, so there is nothing here to buy and plenty to understand.

The paradox of private AI on a public chain

Start with why this is hard. A normal Ethereum-style blockchain reaches agreement by having every validator re-execute the same code over the same data. That replay is the whole point: it is how the network proves nobody cheated. But replay has a price that rarely gets discussed outside of protocol circles. If every validator must re-run your computation to agree on its result, every validator must also see your inputs. Determinism and secrecy are in tension by construction. The same design that makes a chain trustworthy makes it a terrible confidant.

Layer on the mempool, where pending transactions sit in public before they are included, and the problem gets worse. Anything you submit is visible to searchers and bots the instant it is broadcast, which is why front-running and sandwich attacks exist. Now imagine that pending transaction is a prompt to a large language model that includes a patient’s history, or a request that carries the secret key to a paid inference API. On a naive chain, you have just published it. Encryption and zero-knowledge proofs can paper over some of this, but on a general-purpose chain they are expensive, awkward, and rarely cover the actual AI workload rather than a toy version of it.

The confidentiality requirement is not a nice-to-have bolted onto AI. It is often the reason the use case exists. Hospitals will not put raw records on a public ledger. Model creators who spent millions training weights will not hand them to every validator. Traders will not expose the signal that makes their strategy work. If on-chain AI can only ever operate on public data with public models, it is limited to the narrow slice of problems where nobody minds an audience. Ritual’s whole strategic bet is that the interesting problems live on the other side of that line, and that a chain built specifically for AI can cross it without giving up the verifiability that made blockchains worth using in the first place.

What Ritual is, in one section

Ritual was founded in New York in 2023 by Niraj Pant and Akilesh Potti, who worked together for three years at Polychain Capital before leaving to build it. Pant came from the investing side, with early bets on infrastructure like EigenLayer; Potti is a machine-learning researcher and former Palantir quant. The company raised a $25 million seed led by Archetype, announced in November 2023 and reported by CoinDesk, with The Block later putting the total raised above $30 million. The framing was political as much as technical. “The consolidation of AI among a small group of powerful companies poses a significant threat to the future of technology,” Pant said at the time, positioning Ritual as a way to end the ecosystem’s reliance on a handful of centralized providers.

Two products carry that thesis. The first is Infernet, a decentralized oracle network with a lightweight SDK that lets ordinary EVM contracts on chains like Ethereum, Base, and Arbitrum call AI models. It is live and it is the pragmatic on-ramp. The second is Ritual Chain, a sovereign Layer-1 that extends the EVM with what the team calls EVM++: expressive compute precompiles, execution sidecars for heavy work, native scheduling, enshrined oracles, and account abstraction baked into the base layer. When Potti described the testnet, he said it “enables entirely new user behavior that wasn’t possible in any other system today for interacting with AI,” a line reported by The Block when the network first opened to developers.

The important caveat, repeated here because it changes how you should read everything below: Ritual’s documentation describes a testnet. The network runs with chain ID 1979 and roughly 350-millisecond blocks, the RITUAL unit is an 18-decimal gas token distributed by a faucet with no economic value, and there are more than a dozen precompiles for tasks like LLM calls, HTTP requests, ONNX inference, zero-knowledge verification, and agent management. There is no mainnet launch date and no token generation event. Everything that follows is a description of a system you can build on today and cannot yet trust with real value.

Why a blockchain is bad at keeping secrets

To see what Ritual is actually solving, it helps to be precise about the three places a secret leaks on a conventional chain. The first is execution. Replicated consensus means the validator set re-runs your code, so any data the code touches is data the validators hold. The second is state. Contract storage is world-readable; even “private” variables in Solidity are only private to other contracts, not to anyone reading the chain. The third is the mempool, where transactions wait in the open before inclusion, exposing intent to anyone watching.

AI workloads stress all three at once. Inference is heavy, so you cannot cheaply re-run a large model on every validator the way you re-run a token transfer. Model weights and prompts are large and sensitive, so putting them in state is both costly and self-defeating. And the request itself, the thing you most want to hide, has to pass through the mempool to get included. General chains have tools that help at the margins. Zero-knowledge proofs can attest to a computation without revealing its inputs, and homomorphic encryption can operate on ciphertext. But applied naively to a full transformer, zero-knowledge proving is orders of magnitude too slow, and fully homomorphic encryption is slower still. The practical question is not whether privacy is theoretically possible on a blockchain. It is whether you can get it at a price and latency that a real application can pay. Ritual’s answer is to stop pretending every node must see everything, and to move the sensitive work off the replicated path entirely.

Verifiable first: trusting an answer you cannot recompute

Ritual splits its execution into two lanes, a design the docs call Superposition. The first lane is replicated: deterministic EVM operations that every validator re-runs, exactly as on Ethereum. The second lane is delegated: non-deterministic, heavy, or secret work that runs once, off the replicated path, with the result verified rather than replayed. When your contract calls a precompile like the LLM or HTTP one, the actual computation happens inside a trusted execution environment, a TEE, on a single executor node rather than across the whole validator set.

A TEE is a hardware feature, found in chips such as Intel’s SGX and TDX or AWS Nitro Enclaves, that isolates a slice of computation from the rest of the machine, including the operating system and the node operator. Crucially, it can produce an attestation: a signed statement, rooted in the chip vendor’s keys, that a specific piece of code ran over specific inputs and produced a specific output. Ritual binds that attestation to the original request, so the answer that comes back to the contract is cryptographically tied to the question that was asked. The executor cannot quietly swap in a cheaper model, skip the computation, or return a fabricated result without breaking the attestation. This is the verifiable half of the promise, and it is the same problem Chainlink frames in its own explainer on verifiable inference: how does a deterministic contract come to trust a probabilistic model’s output that it has no way to recompute?

The elegance of running once and verifying, rather than running everywhere, is that it makes heavy AI affordable on-chain. The cost of a single inference is paid by one executor, not multiplied across hundreds of validators. Ritual layers a fee market it calls Resonance on top, to price heterogeneous hardware (a node with an H100 is worth more than one with a laptop GPU), and a consensus flavor called Symphony, where selected nodes execute and emit succinct sub-proofs. The details matter less than the shape: verifiability without universal replay. That shape is what makes the second half, confidentiality, even conceivable.

Confidential second: keeping the plaintext off the chain

Here is the part that has not had a proper English-language treatment before, and it is the most interesting thing Ritual is doing. Because delegated work already runs inside an enclave that the node operator cannot inspect, the same enclave can hold secrets. Ritual’s docs describe encrypting sensitive values with ECIES, the Elliptic Curve Integrated Encryption Scheme, to the target executor’s public key before the transaction is ever submitted. In the documentation’s own words, “the plaintext never hits the chain or the mempool.” Inside the TEE, the executor decrypts the secret and performs template substitution, swapping a named placeholder for the real API key or auth header just long enough to make the call. The chain sees an encrypted blob going in and a result coming out, never the credential in between.

Keys themselves are handled by a system the docs label DKMS, a decentralized key management scheme that derives deterministic secp256k1 keypairs inside the enclave. The same owner and key index always regenerate the same keypair, and the private key never leaves the TEE. That single property is what lets an autonomous agent on Ritual custody its own funds, persist encrypted memory across sessions, and survive being moved from one failed executor to another without a human ever handling the raw key. Anyone who has read our anatomy of 2026’s biggest key heists knows the recurring theme is not broken cryptography but exposed keys sitting on someone’s laptop. A key that is generated inside an enclave and never emitted is an attempt to close exactly that door.

The docs go further than infrastructure plumbing. They describe a “Private Multimodal ChatGPT Onchain” that both humans and autonomous agents can use without depending on a centralized interface, combining LLM inference (the current example is a model in the GLM-4 family running with a 64K-context window) with image, audio, and video generation precompiles, ECIES for private prompts, and PII redaction on the way out. That last control is worth naming precisely: a piiEnabled flag governs both the placeholder substitution going in and the stripping of personally identifiable information from results before they settle on-chain, though the docs note PII mode and token streaming cannot both be on at once. The ambition is a consumer-grade private assistant whose transcript is not sitting in a company’s logs, running on rails that can still prove it ran.

Four ways to prove a computation, and what each one hides

Confidentiality and verifiability are not a single switch. Ritual’s design treats computational integrity as modular, letting a developer pick the mechanism that fits the workload, and each mechanism makes a different trade between what it can prove, what it can conceal, and what it costs. The table below is the mental model worth keeping.

Read down the second and third columns and the picture is clear. TEEs give you the strongest confidentiality with the weakest cryptographic guarantee, because you are trusting a chip. Zero-knowledge gives you the strongest guarantee with the heaviest proving burden. Homomorphic encryption is the purest privacy story and the least practical at model scale. Ritual’s bet is that you should not have to commit to one for the whole application; you should be able to run the LLM call in a TEE, prove a smaller sub-computation with a zero-knowledge circuit, and settle a public tally with plain replicated execution, all in one transaction. Whether that composition holds up under real load is one of the open questions the testnet exists to answer.

Blind inference and the Nillion bet

Hardware enclaves are not the only route to a private model call, and Ritual has hedged. In August 2024 it announced a collaboration with Nillion, a network built around what it calls blind computation, using multiparty computation and secret sharing rather than a single trusted chip. The idea is to mathematically split data across nodes so that no individual node ever sees the whole thing, letting a model run over inputs that stay confidential end to end. The distinguishing feature, and the reason it matters for AI specifically, is that blind inference can keep both sides secret at once: the user’s input data and the model’s own weights.

Nillion co-founder and chief executive Alex Page framed it plainly at the time. “Our partnership with Ritual is set to transform how sensitive data is processed during AI inference,” he told SiliconANGLE when the two teams described the work, pointing at use cases like Internet-of-Things data, price predictions that protect a proprietary model, and secure alternatives to the anonymization layers people currently bolt between themselves and consumer AI chatbots. Ritual’s own announcement described the pair as pioneering the use of MPC for private AI inference and storage on the network. This is a 2024 collaboration, not fresh 2026 news, and it should be read that way: it is evidence that Ritual saw confidentiality as a first-class requirement early, and that it is willing to support more than one cryptographic path to it. Multiparty computation trades the hardware-trust assumption of a TEE for a heavier communication cost between nodes, which is exactly the kind of trade the modular approach is meant to let developers make deliberately.

The catch: a TEE is a trust assumption, not a proof

Here is where a careful reader should get uncomfortable, because the confidential story leans hardest on the weakest link in the table. A TEE does not prove anything in the mathematical sense that a zero-knowledge proof does. It asks you to trust that Intel or AMD built the enclave correctly, that the attestation keys have not leaked, and that no side channel lets an attacker peek inside. That trust has been dented repeatedly, and 2025 delivered a sharp reminder. Researchers from Georgia Tech and Purdue disclosed an attack they named TEE.Fail, a memory-bus interposition technique against DDR5 systems that, as The Hacker News reported, extracted cryptographic secrets from Intel’s SGX and TDX and AMD’s SEV-SNP, in some cases including the very attestation keys that are supposed to make the whole scheme trustworthy, using off-the-shelf gear costing under a thousand dollars.

That is not a fatal objection, but it reframes the promise. If an attacker can extract an attestation key, they can pretend code ran inside an enclave when it did not, which quietly breaks both the verifiability and the confidentiality at the same time. TEE.Fail is only the latest in a long line of enclave breaks stretching back through Foreshadow, Plundervolt, and SGAxe, and the honest lesson is that hardware enclaves are a moving target, hardened and re-broken in cycles. Ritual’s design does account for this in principle. Because integrity is modular, a security-critical workload can require a zero-knowledge proof or replicated re-execution alongside the enclave, so that a single broken chip does not silently corrupt a result. The question for anyone building on it is whether they actually reach for that belt-and-suspenders setup or default to the fast, cheap, TEE-only path because it works in the demo. Security teams like Trail of Bits have spent 2026 warning that AI systems fail in ways their builders do not anticipate, and confidential inference inherits every one of those sharp edges plus a new hardware-trust dependency on top.

Who actually needs private on-chain AI?

Architecture is only interesting if someone needs it, so it is fair to ask who the confidential-inference customer is. The clearest cases cluster into a few groups. Model creators who want to monetize weights without surrendering them, letting anyone pay to run a model whose parameters never leave the enclave, which is the on-chain version of an API business with cryptographic enforcement instead of a terms-of-service page. Health, identity, and finance applications where the input data is regulated and cannot be exposed, but the output still needs to be trustworthy enough to act on. And autonomous agents, which are becoming the flagship use case for the whole category.

Agents are where verifiability and confidentiality stop being abstract. An agent that manages funds needs to hold a signing key, and a key on a public chain is a key nobody should ever hold. An agent that calls a paid model or a private data source needs to carry credentials it cannot reveal. An agent that competes, in a market or a prediction market, needs a strategy that is not legible to every rival watching the mempool. Ritual’s enclave-held keys, encrypted secrets, and persistent private memory map onto those needs almost one to one, and they connect to the broader move toward smart accounts and passkey-based authorization we have tracked in account abstraction. The unresolved tension is the same one that haunts every autonomous agent: confidentiality is exactly what an attacker wants too, and a private agent with its own key and its own secrets is a very attractive thing to hijack. Making the agent’s brain unobservable protects it from front-running and protects an attacker who gets inside.

The competitive field

Ritual’s confidentiality angle also changes who its rivals are. On raw AI-crypto scale it is dwarfed by projects with live tokens and real market caps, but most of those are solving a different problem. Bittensor is about incentivizing model training across subnets; Akash and Gensyn are about renting and coordinating raw compute; Chainlink is about getting trustworthy data and computation to contracts without asking them to migrate anywhere. The narrower question of running a model call that is both provable and private has fewer serious entrants, and the most important one, Nillion, is a partner rather than a competitor. The snapshot below uses live prices from CoinGecko on 15 September 2026.

The strategic critique that has followed Ritual since launch applies here too, and confidentiality does not dissolve it. Chainlink’s pitch is that you can get verifiable, and increasingly confidential, computation delivered to whatever chain you already use, without asking a developer to move to a new base layer. EigenCloud makes a similar bolt-on argument using restaked Ethereum security. Ritual is asking for a migration to a sovereign L1 in exchange for making all of this native and composable rather than stitched together. Whether native composability is worth the cost of leaving Ethereum’s liquidity and tooling behind is the trillion-dollar question the project has not yet answered, and cannot answer without a mainnet and real applications to point at.

The token that still isn’t there

No survey of Ritual is complete without stating the obvious loudly, because a speculative economy has grown up around a thing that does not exist. There is no tradeable RITUAL token in September 2026. The RITUAL unit on the testnet is a faucet-distributed gas token with 18 decimals and no market price, and there has been no token generation event and no exchange listing. That has not stopped a cottage industry of airdrop-farming guides from publishing point systems, Discord role ladders, and invented price ranges, a pattern we pulled apart in detail when we asked what it means to chase a token that doesn’t exist.

The practical warning is simple and worth repeating. Any website quoting a live RITUAL price is describing a different asset, most likely an unrelated or outright fraudulent token trading on someone else’s ticker. Any message promising a guaranteed allocation in exchange for connecting a wallet or paying a fee should be treated as a phishing attempt. The confidential-inference technology is real and running; the token is not, and the gap between those two facts is precisely where scams operate. Ritual’s own restraint on a token is defensible, and the reason is partly regulatory, which is where this goes next.

Regulation cuts both ways for private AI

A project sitting at the intersection of crypto and AI faces two regulatory weather systems at once, and confidentiality complicates both. On the crypto side, the United States is finally writing rules. In August 2026 the SEC formally proposed Regulation Crypto Assets, a rulemaking that, per the agency’s own announcement, offers tiered fundraising exemptions and a conditional safe harbor under which a token can exit investment-contract status once its issuer, in Chair Paul Atkins’s words, “has completed or permanently ceased all essential managerial efforts that it represented or promised it would take.” For a project like Ritual, that framework is the clearest argument yet for launching a token late rather than early: issue while you are still doing all the essential work and you are squarely a security, so waiting until the network stands on its own is now a documented legal strategy rather than mere caution.

The broader market-structure question is still unsettled. As this piece went out, the Senate was taking up a cloture vote on the CLARITY Act on 15 September, the procedural test of whether the digital-asset market-structure bill advances at all; prediction markets had given it long odds going in, and the outcome will shape how much of this ever moves from proposal to law. For readers who want the deeper picture of how these votes ripple into prices, we have argued before that in 2026 the vote is the trade. Either way, the takeaway for Ritual is that the US framework is a work in progress, and holding off on a token keeps its options open.

On the AI side, the harder tension surfaces. The EU AI Act’s obligations for general-purpose AI models have been enforceable since 2 August 2026, giving the Commission’s AI Office real teeth: information requests, evaluations, and fines that can reach the tens of millions of euros or a percentage of global turnover. Confidential inference sits awkwardly against that regime, and against anti-money-laundering rules more generally. Regulators increasingly want AI systems to be auditable, explainable, and inspectable; Ritual’s entire value proposition is that the inputs and often the model are hidden from everyone, including the node running them. A system designed so that no operator can see what it computed is, from a supervisor’s chair, either a privacy triumph or an audit nightmare, depending on the day. That is not a reason the technology should not exist. It is a reason its builders will spend as much time in front of policy questions as engineering ones.

What would have to go right

Strip away the architecture and Ritual in 2026 is a project with an unusually coherent technical story and an unusually long list of unproven claims. The confidential-inference design is genuinely more thought-through than most crypto-AI pitches, and the modular integrity approach is the right instinct: do not force one trust model on every workload. But a testnet is a promise, not a product. The honest bull and bear cases sit side by side.

What would tip the balance is concrete and short to list: a mainnet with a credible launch window, at least one named production application that could not have been built anywhere else, a token model that survives contact with the SEC’s proposed rules, and evidence that the TEE dependency is being hardened rather than hand-waved. Until those land, the right posture is curiosity, not conviction. Ritual has built the most interesting answer in crypto to a real and specific question, whether a public chain can keep an AI secret, and it has not yet proven the answer holds outside a testnet. Both of those things can be true at once, and in September 2026 they are.

Frequently Asked Questions

Does Ritual have a live token or mainnet in 2026?

No. As of September 2026 Ritual runs a public testnet only. The RITUAL unit is a testnet gas token with 18 decimals, handed out by a faucet, and it carries no market price. There is no mainnet launch date and no token generation event, so any site quoting a RITUAL price or promising a guaranteed airdrop is describing something that does not exist yet.

How can a public blockchain run a private AI model?

Ritual moves the heavy, secret work off the shared ledger. Prompts, API keys, and model calls are encrypted to a specific executor and run inside a trusted execution environment, so the plaintext never lands on-chain or in the mempool. The chain stores only the request, an attestation that the work ran correctly, and a redacted result, while signing keys are derived and kept inside the enclave.

What is the difference between verifiable and confidential inference?

Verifiable inference is about trust in the answer: a smart contract needs proof that a model actually produced the output it received, not a forged one. Confidential inference is about secrecy of the ingredients: the user’s input and the model’s weights should stay hidden. Ritual tries to deliver both at once, which is harder than either on its own.

Are trusted execution environments safe enough to hold crypto secrets?

They are a useful shortcut, not a guarantee. A TEE asks you to trust the chip vendor and its attestation, and researchers keep finding side-channel attacks; the TEE.Fail work disclosed in late 2025 extracted secret keys from Intel and AMD enclaves with under a thousand dollars of gear. That is why Ritual treats hardware attestation as one option among several and lets developers stack it with zero-knowledge or replicated checks.

How would a future Ritual token be regulated in the United States?

There is no token, so nothing is regulated today. If one launched, the SEC’s proposed Regulation Crypto Assets would be the frame: it offers tiered fundraising exemptions and a conditional safe harbor under which a token can exit investment-contract status once the issuer has ceased the essential managerial efforts it promised. Confidential AI adds a second layer, since the EU AI Act’s rules for general-purpose models can apply regardless of whether a token exists.

By Marcus Okafor, senior editor at HOGE Wire, covering the crossover of crypto infrastructure and artificial intelligence.