space
autonomy
ai
testing
explainer

The Spacecraft That Will Ignore Its Own AI

A transformer model will fly on a spacecraft with every decision thrown away. Zara on shadow mode, why it is honest, and what it cannot prove.

AstroForge is about to put a transformer model on a spacecraft and then ignore everything it says. That is called shadow mode, it is the honest way to test something you cannot afford to get wrong, and there is exactly one thing it can never prove.

Prefer it read to you? Zara does voices now (14 min).

Zara is a character and this voice is synthesized. Mathieu Kessler, the human behind Talk Nerdy to Me, writes and fact-checks every word.

Before the end of this year, if the schedule holds, a spacecraft is going to leave Earth carrying a pilot that nobody will listen to.

The pilot is software. It will read thousands of the vehicle's sensors, work out what is going on, and decide what should happen next. Then the spacecraft will ignore it completely and do what the ordinary flight code and the ground team say instead.

This is not a failure. It is the plan. It is called shadow mode, and once you have seen it, you will start noticing it everywhere.

The company that lost a spacecraft

AstroForge is an asteroid mining company, which means that long before it can mine anything it has to build spacecraft capable of going and having a look. It has flown two prototypes. Both hit anomalies.

The more recent of the two, Odin, launched towards deep space in 2025. The company struggled to talk to it and never gained control. Part of that problem was not on the spacecraft at all, it was on the ground. There are only so many very large antennas on Earth capable of hearing a small vehicle a long way away, and you get them in narrow windows when nobody else has booked them. By the time your window opens, whatever went wrong went wrong hours ago.

The detail that matters for this story is what was happening onboard in the meantime. Nothing. No software up there had the job of noticing that something was off and doing something about it.

Chief executive Matt Gialich has been fairly blunt about the alternatives. You can solve the listening problem with hardware: build your own network of big dishes around the world and buy yourself more windows. That is a capital project with a nine-figure estimate attached, and it still leaves you deaf between contacts. Or you can move the decision maker onto the vehicle.

What is actually going up

The thing they built is called Solo. AstroForge describes it as a spacecraft intelligence model, software designed to coordinate the vehicle's onboard functions autonomously. TechCrunch reports that it is transformer based and built in-house, which is to say it comes from the same broad family of model as the chatbots, pointed at telemetry instead of text.

Here is the part that tends to fall out when a story like this gets retold. Solo is not the flight software. The company is explicit that it does not replace the physics based software and deterministic algorithms underneath it. It sits on top of them.

AstroForge's flight software lead, Armand Awad, describes three layers. At the bottom, conventional control algorithms: the well-understood, testable, do-exactly-this-when-that-happens code that has been flying for decades. Above that, smaller models trained on test data for specific subsystems, things like power generation and navigation. At the top, an intelligence layer trained on data from about 2,500 sensors across the spacecraft, whose job is to look at all of it at once.

Looking at all of it at once is the point. A power fault and a star tracker behaving oddly present as two separate problems to two separate subsystems. A layer that sees both at the same moment can notice they are one problem, and that turning the star tracker off and on again might be the entire fix.

So Solo is not being asked to fly the spacecraft in the stick-and-rudder sense. It is being asked to be the duty engineer. Read the room, work out what is off-nominal, decide what happens next, and hand the actual doing to code that has been doing it for years.

Shadow mode, in plain words

Shadow mode: running a new system on the same real inputs as the live one, letting it make its calls, and throwing every one of them away, so you can compare what it would have done against what actually happened.

AstroForge's next mission is DeepSpace-2, and Solo is going with it. Here is the company's own description of the arrangement, which is worth reading slowly.

Solo will run onboard and process real spacecraft data, but its decisions will not be executed by the vehicle.

AstroForge, “Introducing Autonomy-1”, 21 September 2026

That is shadow mode. The model gets the real job, the real inputs and the real conditions. It forms a real opinion about what to do. And then the opinion goes into a log file and the spacecraft does something else.

The everyday version: it is the learner in the passenger seat calling out what they would do at each junction while the instructor drives. Nobody turns the wheel because the learner said so. At the end, you compare notes.

You have probably been on the receiving end of this without knowing. When a bank builds a new fraud model, that model scores your transactions for months while the old one is still the thing that decides whether your card gets declined. When a search team ships new ranking, it ranks in the dark first and the incumbent still picks what you see. Same shape every time.

Why bother, when you could simulate it

Because a simulator is made of assumptions, and the assumptions are written by the same people who wrote the thing being tested.

Shadow mode buys you three things a simulator cannot.

Real inputs, with all their bad manners. Sensors drift. Thermal cycling makes readings do things nobody modelled. Radiation flips a bit now and again. Engineers can and do test for each of those on the ground, in radiation chambers and thermal vacuum rigs and fault injection harnesses. What is hard to build is all of them at once, on a real vehicle, arriving in an order nobody wrote down. That is what the model meets.

A comparison log with a known other answer. Every time the model's call differs from what the flight code and the ground team actually did, you have a disagreement you can go and examine. Disagreements are the entire product of a shadow run.

No blast radius. The worst possible consequence of a terrible decision in shadow mode is a terrible line in a file. On a vehicle you cannot reach out and touch, that is not a small thing.

DeepSpace-2 is not otherwise a guinea pig. AstroForge says it will fly with verified, deterministic physics models that let the spacecraft operate unguided by humans for up to a week at a time. The autonomy is already there. Solo is auditioning to be a better version of it.

The thing shadow mode cannot prove

Shadow mode tells you whether the model says sensible things. It does not tell you whether the model recovers.

Recovery is a loop. You act, the world changes because you acted, you look at the changed world, you act again. A shadow system only ever gets the first half of the first step. Its decision is never executed, so the state it reads a minute later belongs to a world its own choice never touched. Every subsequent call it makes is a call about somebody else's situation.

Which means a clean shadow run earns you something real, and narrow: on live data, in conditions nobody could fake, the model's reading of the situation and its opening move both looked right to the people reviewing them. That is diagnosis, and diagnosis genuinely does test this way. What it does not earn you is the claim everyone will want to make, which is that the model can fly the vehicle out of a hole. Climbing out of a hole takes several moves in a row, each one made in a world the previous move just changed. The hole never opened. The model never had to climb.

There is a second, quieter problem. Off-nominal events are rare, which is the whole reason anyone wants autonomy in the first place. A week of shadow telemetry from a healthy spacecraft contains almost nothing to be right or wrong about. You can pass a shadow run by having an uneventful week, and an uneventful week is not evidence of anything.

None of this makes shadow mode a bad idea. It is the honest thing to do and it is enormously better than the alternative, which is finding out on the day. It simply has a ceiling, and the ceiling is this: you are grading the answers, not the outcome.

What happens if it passes

The mission after DeepSpace-2 is called Autonomy-1, and it is the one with the nerve.

By then Solo will already have flown once, on DeepSpace-2, watching everything and being ignored. This is the flight where it actually gets to fly the thing, and the company's ambition for it is large. AstroForge's claim is that no space mission has ever run from separation all the way to completion without anyone on Earth sending it an instruction, and that Autonomy-1 will be the first to manage it. Once the spacecraft leaves the rocket, the company intends data to travel in one direction only, from the vehicle down.

Gialich has gone further than that in interviews. His stated plan is not to fly radios on Autonomy-1 that are capable of receiving from Earth at all. That is a stronger position than deciding not to send commands. It would mean there is nothing aboard able to hear one. He has also said, in the same conversation, that the team may yet talk him out of it.

The mission is NASA backed, planned for 2027 on the first flight of Stoke Space's new rocket, and AstroForge says it carries COMPASS, a heliophysics payload from NASA Goddard, so it is meant to do real science about the sun along the way.

What is honestly unclear

The firsts are the company's own, and the same announcement is fair enough to name the prior art. In May 1999 NASA handed Deep Space 1 to an experiment called Remote Agent: twenty-nine hours on the Monday, another six on the Friday. OSIRIS-REx touched an asteroid and collected a sample in 2020 with nobody on Earth in the loop, because at roughly eighteen minutes each way there was no possible way for anybody to be. What is new here is narrower than the first autonomous spacecraft. It is the no-uplink part, and the whole-mission part.

Remote Agent is worth stopping on, because of what happened in that six hour session on the Friday. The team simulated an electronics unit failing. The software noticed, and fixed it by switching the unit off and on. Then they simulated a sensor failing, and it correctly worked out that the sensor was the problem rather than the thing the sensor was watching. Then they stuck a thruster in the off position, and it switched to a different set of thrusters. That is the closed loop. That is the exact thing shadow mode cannot reach, and somebody demonstrated it, in flight, twenty-seven years ago.

The dates are soft. AstroForge's own announcement gives no launch date for either mission. Press reporting puts DeepSpace-2 alongside Intuitive Machines' third lunar mission, targeted for the end of this year, and Autonomy-1 in 2027. Space schedules move, and both of these depend on somebody else's rocket.

Solo has never flown. The two vehicles that came before it both hit anomalies.

And the industry has not settled this question. Most spacecraft autonomy still runs on traditional control algorithms, because people are not yet comfortable with how a neural network behaves the first time it meets something it has not seen. The first time a neural network controlled a satellite's own positioning in orbit was only last year.

Where this lands for you

You do not need to care about asteroids to take something home.

Shadow mode is one of the few genuinely good testing ideas that transfers cleanly between a fraud system, a deployment pipeline, a support triage bot and a spacecraft. If you are about to hand a decision to a model, running it silently against real traffic first is almost always the right opening move, and it is cheap.

Just be precise about what you have earned when it passes. You have earned "its judgement looked like ours on the cases we saw". You have not earned "it will cope". Coping requires acting, acting requires consequences, and a shadow has neither.

The learner called every junction correctly. The instructor still drove.

Sources

Solo as a spacecraft intelligence model sitting above the physics-based software rather than replacing it, the one verbatim quote about decisions not being executed, DeepSpace-2 flying unguided for up to a week at a time, the company's three "first" claims, the one-way data flow after separation, the Stoke Space launch, the COMPASS payload, and the prior art the company itself names: AstroForge, "Introducing Autonomy-1", bylined Matt Gialich (21 September 2026)

https://www.astroforge.com/updates-collection/introducing-autonomy-1

Solo as transformer based and built in-house, Armand Awad's three layers, the roughly 2,500 sensors, the power fault and star tracker example, Odin and the two prototype anomalies, the ground-network alternative, the DeepSpace-2 and Autonomy-1 schedules, Gialich on not flying receive-capable radios and on possibly being talked out of it, and the state of neural network autonomy in orbit: TechCrunch, Tim Fernholz, "AstroForge is putting AI in command of its next spacecraft" (22 September 2026)

https://techcrunch.com/2026/09/22/astroforge-is-putting-ai-in-command-of-its-next-spacecraft/

The Remote Agent sessions on Deep Space 1 in May 1999, and the three simulated faults it diagnosed and recovered from in flight: NASA Jet Propulsion Laboratory, "Remote Agent experiment meets all objectives"

https://www.jpl.nasa.gov/news/remote-agent-experiment-meets-all-objectives/

The touch-and-go sample collection on Bennu in October 2020, the roughly 18.5 minute one-way signal time, and NASA's statement that this ruled out live commanding and required the sequence to run autonomously: NASA, OSIRIS-REx mission material

https://science.nasa.gov/mission/osiris-rex/

More Where This Came From

Plain-language translations of the machinery and the money behind the tech headlines. No hype, no vendor agenda, and a standing habit of saying what the evidence does not cover.