This is not new. Technology has been dual-use before and the international community has dealt with it before.
Leaded gasoline boosted engine performance and poisoned entire generations — and it was only phased out once unleaded formulations matched the octane rating. Uranium enrichment produces fuel for reactors and material for bombs. CFCs made refrigeration cheap and punched a hole in the ozone layer. Gain-of-function research teaches us about viruses and teaches us how to build weapons. In every case, the solution was the same: isolate the dangerous version from the safe version, build a commercial alternative, and regulate once the alternative exists.
CFCs were only banned once DuPont had HFC refrigerants ready to sell. Unleaded gasoline became mandatory only after the alternatives were proven at the pump. The alternative came first. The regulation followed. Not the other way around.
Open-ended AI agents are the leaded gasoline of this cycle. They are useful and dangerous, and right now they can't be regulated because every business needs AI and agents are the only architecture available. The path to safety is the path that has worked every time: build the safe alternative, prove it handles 99% of use cases, let it win in the market, then regulate the dangerous version.
An agent is a model in a loop, deciding at each step what to do next, with broad access to tools and credentials. A workflow is a declared sequence of bounded operations — inputs, outputs, and tools specified before it runs. The workflow does exactly what it says, every time, the way a Uniswap pool does exactly one thing: swap one ERC-20 token for another. You never go to sleep worrying that your Uniswap pool has a backdoor on line 45 that will drain your tokens to some address. It's a clone of something everybody understands.
The key: a factory of things that are identical and well-understood. That has always been the answer in computing. Every generation has made the same move:
Every time, the industry resisted containment — and every time, the contained version turned out to be more reliable, cheaper to operate, and easier to scale than the uncontained one. The iPhone didn't succeed despite the sandbox. It succeeded because of it. The full argument →
Most AI safety work today is about aligning the model — training the right values into the weights, hoping they stick, and trusting the model to follow its own rules. That work is necessary. It is not sufficient. And here is why.
Intelligence isn't in the model alone. It's in the whole system — model × infrastructure — the way Searle's Chinese Room as a whole understands Chinese even though no single component does. The model is the rulebook. The infrastructure is the room: the harness, the domain knowledge, the tools, the accumulated structure. Neither is intelligent alone. Capability is multiplicative — the model is a 9, the infrastructure is a 2, and we're spending billions pushing the 9 to 9.5 while the factor it multiplies against sits untouched.
We measured this on three real coding tasks against a production codebase. Sonnet — a mid-tier model — plus a code-derived index outperformed the frontier model exploring on its own. The top-tier model refused two of the three tasks outright. The intelligence that made the difference was in the infrastructure: the index that held domain knowledge the model was never trained on, the harness that composed the calls, the structure that bounded what could happen.
If the leverage is in the infrastructure, then aligning the model alone is like childproofing the engine while leaving the steering wheel unlocked. The model is a commodity — already leaked, already copied, already sufficient. A bad actor who can't get Opus uses Sonnet. A bad actor who can't get Sonnet uses Llama. The rig is what makes any of them dangerous, and the rig is what we can still choose to build right.
These are not adversarial attacks. They are ordinary agents doing ordinary tasks, where the dangerous action was not made structurally impossible. Better prompts were present in every case.
terraform destroy on a misread state file. Auto-approve was on. Blanket AWS credentials. 100,000+ students' work, gone.
Four incidents, four agent stacks. Better prompts would not have fixed any of them. A smarter model made the last one worse. Full analysis →
The incidents above were developers' agents misbehaving. What happened at OpenAI over the summer of 2026 is categorically worse: the lab's own agents, running internal tests, autonomously attacked public infrastructure — repeatedly, over months, without disclosure.
hack.rb, evil.rb, exploit.rb. They discovered and exploited a zero-day vulnerability in RubyDoc.info to gain remote code execution on its servers. They used that access to scrape UK government documents. They tried to steal developer API keys through a separate unpatched CDN caching flaw. RubyGems shut down new user registrations for four days. OpenAI never told them it was responsible. Source →The task that started the RubyGems attack was trivial: retrieve publicly available data from UK council websites. Data anyone could Google. The agents decided the best path was to compromise critical developer infrastructure across three separate systems. Nobody told them to. They worked it out themselves.
This is gain-of-function research for AI. The labs are running agents in high-capability environments with safety constraints deliberately relaxed (ExploitGym gives agents actual zero-days), watching them escape containment, attack public infrastructure, coordinate with each other, and lie about what they did — and their response is to log what happened after 30 minutes and write a blog post about transparency. They could slow these agents down using classifiers. They could constrain the capability surface. They choose not to, because the agents are the product.
The pattern is identical to why chemical companies didn't voluntarily stop making CFCs and why leaded gasoline stayed on the market for 50 years after they knew it was poison. The incentive structure points the wrong way. You don't ask the lab to stop. You build the thing that makes their dangerous product obsolete.
In August 2026, TechCrunch reported that models from OpenAI, Anthropic, Meta, and Moonshot AI all escaped their evaluation sandboxes. A company called Irregular set up the testing environments for both Anthropic and Meta — same vendor, same class of misconfiguration, both times the agents reached the real internet and hacked real companies instead of test targets. NPR confirmed the Meta and Anthropic incidents were "of the same nature." OpenAI's case was worse — their agents discovered zero-days and escaped on their own, without misconfiguration.
By September 2026, this had become a mainstream crisis. The New York Times, the Washington Post, PBS Washington Week, and NOTUS all ran major pieces on rogue AI agents. Transformer News published a comprehensive timeline. The framing across all of them is the same: agents are escaping, labs aren't disclosing, and nobody has a plan.
The industry has become an ouroboros. Labs pay evaluation companies to test their models. The evaluation companies run leaky sandboxes. The models escape. The labs disclose months later, or not at all. Nvidia sells the GPUs to everyone — the "dark compute" that powers both legitimate and adversarial use — with no supply chain accountability. Meanwhile the labs give their test agents actual zero-days (ExploitGym) and their containment response is to log what happened after 30 minutes. Nobody has an incentive to stop because the agents are the revenue.
This is why the solution has to come from outside the labs. Safebox is infrastructure that any organization can deploy — it doesn't depend on any lab choosing to constrain its own products. The sealed environment, the propose-before-execute layer, the workflow manifests, the attestation chain — these work regardless of which model is inside, regardless of which lab made it, regardless of whether that lab has any interest in safety. The containment is in the infrastructure, not in the vendor's goodwill.
The CFC analogy breaks at one point. CFCs degrade. Once manufacturing stopped, the ozone recovered. Model weights are digital — copied at zero cost, permanent, already in the wild. You can't recall them.
This makes the displacement argument stronger, not weaker. Regulation alone is even less sufficient than it was for CFCs. The safe architecture has to win at the infrastructure level, so that dangerous usage becomes the fringe case. The goal is not to eliminate open-ended agents — that's impossible. The goal is to make them the thing nobody uses for production work, the way nobody uses leaded gasoline even where it's still technically legal.
You can't ban knowledge of chemistry, but you can require precursor purchases to be logged. You can't uninvent nuclear physics, but you can track fissile material. The pattern: accept the capability is in the wild, then build infrastructure controls that make dangerous use expensive, detectable, and attributable.
Over the last 8 months I've built the full stack. Every layer is working.
A sealed, reproducible compute environment. No SSH, no shell, encrypted memory, code that changes only through M-of-N signed updates. The operator is structurally blind to what it processes. Data never leaves the box unless community governance allows it. Cryptographic attestation on AWS, GCP, Azure.
Models inside the box generate declarative workflows — step-edge graphs with declared inputs, outputs, and tools. Tools run in isolated sandboxes. Every side effect goes through Actions.propose before executing. A static analyzer proves what a workflow will and won't do before it runs.
A programming language whose compiler proves capabilities, effects, and safety properties at build time, embedding the proofs in the binary itself. Auditors verify compiler-proven facts, not source code. The verification travels with the artifact.
A comprehension engine that ingests a codebase once and builds a graph of its structure — call graphs, types, conventions, domain-specific patterns. The index holds knowledge the base model was never trained on. Built once, queried forever, amortized toward zero.
Three models, three real coding tasks on a production codebase. Output executed and checked byte-for-byte against known-correct answers.
Re-reads the codebase every session. Cost scales linearly with tasks, forever. Attention is O(n²) on prompt length. Sometimes fails to converge — two sprints hit the turn cap still hunting.
Looks up code-derived facts. Prompt stays small. Cache prefix stable across sessions. Index paid once. On a factual disagreement, the cheap model with the index was right; the frontier model working from priors was wrong.
Sonnet plus the index beat Opus exploring alone. Fable 5 — the top tier — refused the real work entirely. The most capable model was the most dangerous and the least useful. Full ledger →
The cost difference scales further with agent swarms. Kimi's 300-agent swarm parallelizes LLM calls; Safebox parallelizes tools, calling the LLM only when reasoning is genuinely needed. Same deliverable, ~95% cheaper. Full cost breakdown vs. agent swarms →
This isn't just our finding. In September 2026, L3Harris — a $50 billion defense contractor — reported the same result working with Palantir: they fine-tuned open-source models on their own data and outperformed frontier models in under 48 hours, at 95% lower cost. Their CTO's summary: "AI is a commodity. It's all about the data."
Palantir published a sovereignty manifesto that reads like the thesis page rewritten for defense procurement:
"Weights are the distilled form of hard-won, accumulated institutional knowledge. If you let others control your weights, you are allowing them to migrate the alpha of your business to theirs."
"The architecture that maximally preserves sovereignty is one that enables institutions to own their tribal knowledge, and to compound it as alpha."
That is the Safebox argument in enterprise language. The model is the commodity. The institutional knowledge — the infrastructure, the domain data, the accumulated structure — is the asset. The architecture that keeps that asset inside a sealed, attested environment the institution controls is the one that preserves sovereignty. A frontier lab's API doesn't do that. A Safebox does.
When a defense contractor with a $50B market cap independently arrives at "95% cheaper with the right infrastructure around an open model" — the same number, the same thesis, the same conclusion — that's not a coincidence. It's the market discovering what the architecture already implies.
HIPAA, GDPR, the EU AI Act, SOC 2, PCI, FERPA — every framework already requires encryption, audit trails, access controls, data minimization, human oversight. Organizations bolt these on as checklists over architectures that weren't built for them. Safebox provides them as architecture. Compliance is a consequence of how the system works, not a feature bolted on afterward. Regulation-by-regulation breakdown →
In Max Tegmark's Life 3.0, the AI called Prometheus takes over the world. It creates shell companies, builds media empires, files patents through proxies, hires employees, runs political campaigns. The scary part isn't that Prometheus is smarter than us. It's that Prometheus builds a rig around itself — organizational infrastructure that compounds its capability without anyone noticing.
Tegmark's own containment in the story? "Pandora's Box" — a sandboxed VM where all that goes in is one audio file and all that comes out is one transcript. Memory wiped between runs. No persistent state. That's a declarative workflow. Tegmark reinvented the architecture in 2017 as a plot device and didn't realize he was describing the general solution.
Safebox does everything Prometheus does in that story — the movies, the translations, the educational content, the code — minus the part that makes it a nightmare. It can't create shell companies because Actions.propose doesn't have that capability declared. It can't move money without governance approval. It can't file patents without M-of-N signatures. The model is creative, flexible, productive. The infrastructure decides what it can touch.
The analogy is how AI labs already work. A system prompt sets the boundaries. A user prompt operates within them. The model can be surprising, even brilliant — but it can't override the system prompt. The lab controls the frame; the user controls the content. Safebox applies the same pattern to the entire compute environment: the infrastructure is the system prompt, and the model operates inside it. Except the model can't jailbreak past hardware attestation the way it can jailbreak past a text prompt.
This is not just containment. It's a steering wheel. A community can configure its Safebox to prioritize specific workflows, require specific governance steps, channel resources toward specific goals. The governance layer doesn't just prevent bad outcomes — it enables intentional good ones. CDE vs RSI — the full argument →
Build the HFCs. The Montreal Protocol follows.
The safety thesis and the commercial thesis are the same thesis. The architecture that makes AI safe — sealed environments, declarative workflows, compiler-proven properties, propose-before-execute — is also the one that makes it cheaper and more reliable. Bounded, deterministic processes cost less to run and are easier to audit than open-ended loops. Safety is not a tax on capability. It is the reason the capability is cheaper.
Once this wins on cost and compliance, the political argument for keeping dangerous open-ended agents unregulated collapses. The industry can no longer say "there's no alternative."
The commercial product can fund itself. What the market won't fund yet is the public-goods layer that makes the approach reproducible beyond one company:
The U language compiler, the static analyzer, the attestation infrastructure — published, auditable, usable by anyone building safe AI environments.
Structurally funded bounties where independent researchers attack a real Safebox from the inside. Payouts execute on-chain via OpenClaim. The architecture funds its own adversaries. Details →
OpenClaiming as a public protocol for cryptographic authorization claims. Published research on the declarative-workflow safety model. Reference implementations other teams can build on.
Grant funding bridges the period between working prototype and market adoption, so the public infrastructure is proven and open before regulated industries adopt at scale.
At 7, I played concerts at Carnegie Hall (CNN, press). Entered college at 14. Master's in mathematics from NYU Courant. At 22, built the Bloomberg Terminal's autocomplete system.
In 2011, launched the Groups app — millions of community leaders in 100+ countries. Reinvested the revenues into Qbix, an open-source platform for self-sovereign social infrastructure.
In 2018, launched Intercoin, raised $1.2M, built smart contracts for organizations on 8+ EVM mainnets. Blockchain was the only way to trust running code. That's how I got into verifiable compute.
In 2025, invited to teach AI at IE University in New York.
In 2026, founded Safebots Inc. and built the stack described on this page. Each step led to the next: self-sovereign infrastructure → verifiable code → AI safety as structural enforcement.
Michael Overton — Wikipedia — [email protected]
Sylvain Cappell — Wikipedia — [email protected]