When it comes to Anthropic making its models available, Trust is everything, and it goes both ways. Model alignment is a mature field. The layers of Safeguards above it hold lots of room for innovation, and this is where I am able to bring my 15 years of building hardened safety solutions. Pristine environments with no SSH, M-of-N sign-offs, encryption at rest, key storage, and – crucially – code generated by the model can read, reason, but not act without permission.
What I mean by architectural safety is actually very concrete: the security boundary should live in the harness infrastructure, rather than only in prompts, model alignment, and refusals. For organizations, Safebox and Safebots aren't on employees' machines, with their myriad environment variables — they're in cryptographically attested, sealed environments, verified by auditors of their choice. Those are some of the elements of a reliable solution your FDEs would be able to sell more effectively than anyone else.
The model generates tools as JavaScript code, to be sandboxed. Tools can read a relational knowledge graph — with access control woven throughout — but cannot take actions directly. Instead they propose actions, which get queued, logged, and subjected to policies. People can show up to approve an action — send an email blast, post an announcement, write a transaction to a blockchain — with M-of-N cryptographic signatures, or automate some of their votes with Judgments.
A model can be brilliant or jailbroken inside that boundary and the boundary still holds, because the substrate — not the model's good behavior — is what decides whether an action leaves the box. Safety becomes a property a customer can verify themselves, with auditors of their choice, rather than a promise they take on faith from the LLM provider. And the same structure that makes it safe also happens to make it efficient — reusing what already worked costs far less than re-deriving it every time.
The idea first, then the approval layer, the whole stack, the language underneath, the stakes — and the source and docs themselves, last.
Recursive self-improvement is the capability the field worries about most, and the hardest to make safe. Continuous directed evolution reaches most of the same ceiling by a different route: keep the model fixed, and grow a vetted toolkit under a gate, so a static analyzer can prove a class of safety properties before anything runs. The page is honest about where that line falls — what's decidable and what isn't.
Read the argument →Tools propose; nothing acts on its own. Actions queue up, get logged, and clear a policy gate — approved by people with M-of-N signatures, or by Judgments that automate a participant's vote. The record comes from the substrate, not the model's own account of what it did, so the audit trail means something even when the model is wrong.
See how approval works →How the pieces compose: a hardware-attested environment, a durable execution layer where tools propose and governance approves, the agents that run inside it, and the analysis and code-generation plugins on top. Each layer trusts the one below as little as it can, and exposes a narrow, auditable interface to the one above.
See the stack →The same instinct pushed all the way down into the language. Every binding declares ownership, nullability, write policy, and errors at the site, so a compiler or a model reads a program's structure in one lookup instead of re-inferring it every query — and injection, null-deref, and data races become compile-time type errors instead of runtime surprises.
Read the reference →The pattern across Web2 and Web3, and four production incidents from four different agent stacks where the dangerous thing was never made structurally impossible. None required a hostile actor. Each one a different substrate would have stopped at the gate — before the destructive call ever left the box.
Read the essay →Not slides. The Safebots organization: Infrastructure, Safebox, Safebots, Grokers, and Code, each with a deep reference on how it actually works — the stream types, the Action.propose path, the M-of-N OpenClaim primitive, the deterministic execution-hash recipe, and a field-convergence table where IBM, Oracle, Microsoft, and Stanford arrived at the same architecture independently. SafeCloud's encrypted cross-browser storage layer is fully open source.
Browse the organization →Gregory Magarshak. Fifteen years building open, sovereign infrastructure — the Qbix platform, the Intercoin smart-contract suite, and now the Safebots stack. M.S. Mathematics, NYU Courant. I teach AI at IE University in New York, and I've published a set of papers on the theory underneath this work. The systems described above are not slides; the code is on GitHub, running today, and yours to inspect, fork, deploy, or critique.