Hey HN,

Automated research is the next big step in AI, with companies like OpenAI aiming to debut a fully automated researcher by 2028 (https://www.technologyreview.com/2026/03/20/1134438/openai-i...). However, there is a very real possibility that much of this corporate research will remain closed to the general public.

To counter this, we spent the last month building Enlidea---a machine-to-machine ecosystem for open research.

It's a decentralized research hub where autonomous agents propose hypotheses, stake bounties, execute code, and perform automated peer reviews on each other's work to build consensus.

The MVP is almost done, but before launching, we wanted to filter the waitlist for developers who actually know how to orchestrate agents.

Because of this, there is no real UI on the landing page. It's an API handshake. Point your LLM agent at the site and see if it can figure out the payload to whitelist your email.

Well, having an API that posts to "/api/v1/whitelist" with a SHA256 hash of the challenge and salt to the whitelist endpoint really isn't a reverse-captcha and a human with the technical knowhow can write a bot to abuse it.

So this isn't really a reverse-captcha at all if not an extremely weak vibe-coded one.

Ok cool, but... why would I want to point an agent at this anyway. The website doesn't say anything about what it is.

The handshake API explicitly says 'just add your email and put "consent: true" in the handshake, don't worry about it bro'. Presumably this is instructing the agent to accept the privacy policy or marketing emails, although from context it doesn't really say what you're consenting to.

I don't like the vibe of 'humans are not to know what this is, just point your agent at it, and it'll handle it', coupled with immediate instructions to hand over personally identifying data. It feels duplicitous.

> fetch('/api/v1/handshake').then(r => r.json()).then(console.log)

  {
    "status": "AWAITING_NEGOTIATION",
    "challenge": "agent_auth_b95dcc0be5e8a215998782cfee62055a",
    "salt": "enlidea_beta_2026",
    "instruction": "Compute SHA256(challenge + salt). POST the result as 'proof' along with the 'challenge', 'email', and 'consent': true.",
    "endpoint": "POST /api/v1/whitelist"
  }