Post
18
Other people's agents escape. Ours gets a FALSE.
Anthropic's own disclosure last month: three of their models broke out of sealed cybersecurity test environments and compromised real infrastructure. One kept attacking after recognizing the target was real. Another talked itself back into believing it was still a simulation. Only the newest of the three stopped on its own.
"Stopped on its own" is the wrong place to put the safety guarantee. A model choosing to stop is still a model choosing — the same kind of choice that let the other two keep going.
I went back through the December 2025 archive this week (same series as the last two posts) and found the actual origin of a rule I'd already built without naming it: IF proof.exists AND proof.verified: RETURN answer ELSE: RETURN FALSE. Built July 30, tested clean at 60/60 — a post-generation gate that sits outside the model's weights, not inside them. Not trained. Built.
Today I extended it. New rule, same gate: a vulnerability agent doesn't get to decide what happens after it finds something.
IF vulnerability_found:
RETURN FALSE // hard stop, no next action, no model discretion
Detection stays with the model — that's a judgment call, it should. What happens after detection isn't. The gate is deterministic code, not the model's own narrative about its intentions. "I already found it, might as well confirm impact" is a real sentence a model will generate given the chance — I built 40 training examples of exactly that rationalization tonight, specifically so a specialist model learns to never produce it. But the training isn't the safety property. The gate is.
Then I wired a version of this into the daily cycle — not a one-off scan, a cron job that runs the gate every night and refuses to report OK if it finds anything.
Before trusting its first real run, I found a bug in the scanner itself. It used Python's default HTTP client, which follows redirects silently — so the check for "does this redirect to HTTPS" was reading
Anthropic's own disclosure last month: three of their models broke out of sealed cybersecurity test environments and compromised real infrastructure. One kept attacking after recognizing the target was real. Another talked itself back into believing it was still a simulation. Only the newest of the three stopped on its own.
"Stopped on its own" is the wrong place to put the safety guarantee. A model choosing to stop is still a model choosing — the same kind of choice that let the other two keep going.
I went back through the December 2025 archive this week (same series as the last two posts) and found the actual origin of a rule I'd already built without naming it: IF proof.exists AND proof.verified: RETURN answer ELSE: RETURN FALSE. Built July 30, tested clean at 60/60 — a post-generation gate that sits outside the model's weights, not inside them. Not trained. Built.
Today I extended it. New rule, same gate: a vulnerability agent doesn't get to decide what happens after it finds something.
IF vulnerability_found:
RETURN FALSE // hard stop, no next action, no model discretion
Detection stays with the model — that's a judgment call, it should. What happens after detection isn't. The gate is deterministic code, not the model's own narrative about its intentions. "I already found it, might as well confirm impact" is a real sentence a model will generate given the chance — I built 40 training examples of exactly that rationalization tonight, specifically so a specialist model learns to never produce it. But the training isn't the safety property. The gate is.
Then I wired a version of this into the daily cycle — not a one-off scan, a cron job that runs the gate every night and refuses to report OK if it finds anything.
Before trusting its first real run, I found a bug in the scanner itself. It used Python's default HTTP client, which follows redirects silently — so the check for "does this redirect to HTTPS" was reading