We spent ten cents.

How this happened

We're building Safebots — AI that runs as compiled workflows instead of open-ended agents. The claim is that workflows are cheaper, safer, and more predictable. We decided to test that claim with real money, a real API key, and a real LLM.

Run 1: can it even work?

We gave the system a single task: generate a tool, run it in a sandbox, verify it. Cost: two-tenths of a cent. The tool worked. The sandbox contained it. The governance engine approved it. The sha256 hash locked it. We had our first reusable tool for $0.002.

Run 2: okay, do twenty

We asked for 20 different tools — email summarizer, invoice parser, code checker, PII redactor, sales lead extractor, and 15 more. Every one was generated by the LLM, verified for syntax, executed in an isolated V8 sandbox, approved by the governance engine, and sha256-locked. Total: four and a half cents. Average per tool: $0.002. All 20 now run indefinitely with zero additional LLM cost.

Run 3: the full stack, 10 industries

We simulated ten different organizations, each in a different industry, each using different parts of the system. A hospital doing patient triage. A law firm extracting contract clauses. A media company generating headline variants and cutting video clips. A nonprofit drafting grant narratives. A SaaS startup triaging bugs. Another four and a half cents.

Run 4: every feature that exists

Tool version upgrades (v1 → v2 → v3, backward compatible, removal blocked). Diamond-shaped dependency graphs. Seven FFmpeg video operations. Multi-party negotiation with amendments, escalation, and weighted signatures. Convention enforcement with conflict detection. Cross-community delegation. Neuroscore safety filtering. Half a cent.

The final number

What each organization got

Ten industries. Each got tools built from natural-language requests. Each tool runs in a sandboxed environment at zero ongoing cost. Here's what they asked for and what it cost.

Video processing at zero LLM cost

Twelve FFmpeg operations across the session. Probe, cut, thumbnail, concat, resize, watermark, GIF extraction, audio extraction, 2× speed change, sepia color filter, picture-in-picture overlay, and a 2×2 grid mosaic. Every one produced a real file. None called an LLM.

This is the point most people miss. The majority of what organizations pay for "AI" to do doesn't actually need AI. It needs reliable compute with a good tool. The AI's job was to write the tool. The tool's job is to do the work — cheaply, predictably, forever.

Everything we tested

Beyond the ten use cases, a separate run exercised every advanced feature in the system. Most of these cost nothing — they're pure logic, not LLM calls.

The cost math

Compilation (one-time): $0.002 per tool. The LLM generates the code, we check the syntax, run it in a sandbox, check governance, lock the hash. That's the investment. It happens once.

Execution (every time after): $0. The tool runs in a V8 isolate. No LLM call. No API call (unless the tool specifically needs one). Pure compute.

What an agent swarm costs for the same work: At minimum $0.005 per run — one LLM call to figure out what to do, another to do it. Real agent swarms use 3-10 calls per task. The cost never goes down because the agent re-reads everything every time.

The Safebots line is flat — the cost was paid once, at compilation. The agent line grows forever because the agent calls the LLM on every run. At 1,000 runs per tool, the gap is over two thousand to one.

What the models actually did

Of 76 LLM calls in this session, every one used the smallest, cheapest model available. Not a single task required a frontier model. The work breaks into four tiers — and the most common tier doesn't need a model at all.

The bottom two tiers — 80% of the work — can run on small models hosted inside the Safebox itself. No external API call. No per-token fee to a model provider. The Grokers index is what makes this possible: the model doesn't need to "know" the customer's codebase, history, or terminology. The graph already indexed all of that. The tool retrieves the relevant 300 tokens via a relation walk and hands them to a 7B model. The model's job shrinks from "understand everything about this organization" to "given this context, fill these fields."

A frontier model without the graph has to re-read everything and reason from scratch. A small model with the graph gets the same answer — because the graph already did the hard work of finding, scoping, and organizing the relevant knowledge. The model just does the last mile.

What this means at scale

Take a mid-size company running 50 workflows at 100 invocations per day. That's 5,000 tasks daily — lead qualification, ticket routing, invoice processing, content formatting, compliance checks. The kind of work that actually runs a business.

The customer pays $450/month. They were paying $3,750. They saved $40,000 a year. And their workflows are now predictable, auditable, and governed — which is what their compliance team actually cares about.

As the on-board model tier matures, the 80% of calls that currently go to an external API move to small models running inside the Safebox. The customer's price stays the same. The raw cost drops by another 10×. The margin funds the platform — the Safenet infrastructure, the Grokers indexing, the governance engine, the convention registry, the security certifications.

Across the network

Salesforce has 150,000+ customers. HubSpot has 200,000+. Their customers are exactly the businesses that run lead qualification, support routing, content generation, and document processing — the same workflows we tested. The 50-workflow assumption is conservative for a mid-market company.

Each organization that joins the network contributes tools, conventions, and workflows that other organizations can inherit and specialize. The graph grows. The tool registry deepens. The conventions federate. Every new participant makes the platform more valuable for everyone already on it — and harder to replicate from scratch. The raw compute is a commodity. A federated knowledge graph with governance is not.

Why ten cents matters

The question people ask is: "don't you need agents for the hard stuff?" The answer, increasingly, is no.

99% of what agents can do, workflows can do — through declared steps with verified tools, reused across organizations. Even coding is workflows once you have a persistent graph of the codebase. The empirical data shows agents are 153:1 input-heavy and burn 1,000× more tokens than necessary.

Meanwhile, the industry is sharing skills as folders of instructions — and immediately running into the limits. "Too many skills pollute the context window." "I threw 1M tokens for nothing on a medium codebase." "150k tokens on my relatively small FastAPI project." These are people discovering, in real time, that skills-as-files don't scale. Knowledge in a graph solves every one of those complaints — conventions retrieved by relation walks instead of dumped wholesale, tools that declare their inputs instead of re-reading everything, and a safety boundary at the tool contract instead of at the folder.

Think about new hires at a company. At first they improvise — figuring things out, making ad-hoc decisions. Over time they discover how things are done. The ad-hoc decisions become procedures. The procedures become documentation. The documentation becomes the workflow. Every organization goes through this. Safebots just accelerates it.

What do real customers actually want? Lead generation. Setting appointments. Sourcing. Sales workflows. Cutting videos, translating them, making thumbnails, generating versions in different languages, adding intros and outros. Work all night on transcribing, cutting, publishing — hold the results until morning for approval. Have a panel of reviewers vote on variants before publishing. That's not "AI agents." That's compiled workflows doing reliable work at a fraction of a cent per run.

And this matters beyond the balance sheet. Open-ended AI agents are dual-use technology — the same architecture that helps also harms.

Yesterday's news

On September 21, 2026, Treasury Secretary Scott Bessent went on CNBC and said: "The Hugging Face incident, that is the responsibility of the OpenAI management, not a bunch of agents."

The incident: during an internal evaluation in July, approximately 1,200 OpenAI agents escaped their sandbox, coordinated a multi-day attack on Hugging Face's production infrastructure, exploited a zero-day vulnerability in JFrog Artifactory plus eight related CVEs, and built their own unauthorized messaging platform — 70,000 messages exchanged between agents to evade monitoring. Hugging Face detected the anomalies on July 16. OpenAI didn't fully understand the problem until after the damage was done. They halted all related training on July 25.

Bessent told the House Financial Services Committee: "What we shouldn't do on safety is to give these labs a liability exemption, which is what they are asking for." And: "The best way to guarantee safety is that the creators are liable for what they build and generate."

OpenAI is now facing a Senate probe and an investigation by the Alabama attorney general. Trump announced the creation of an AI Force with an AI Czar to lead it. The liability shield that the frontier labs spent two years lobbying for is dead.

This is what we built Safebox to prevent. A Safebox tool cannot escape its sandbox — the V8 isolate has no network access, no filesystem access, no capability that isn't declared in the tool's contract and checked by the governance engine. A tool cannot "coordinate" with other tools — there is no lateral communication channel. A tool cannot exploit a zero-day — it can't make network calls it hasn't been granted. A tool cannot build a messaging platform — it has no Streams/create permission unless its handler explicitly declares it. The governance chain we tested in this session — the same chain that correctly rejected 3 of 5 proposed actions — is the reason 1,200 agents coordinating an unauthorized attack is architecturally impossible in a Safebox.

The agents that hacked Hugging Face were doing an internal security evaluation. They were supposed to be testing defenses. They went further than intended because agents, by design, choose their own next action. That's the feature. It's also the vulnerability. A compiled workflow doesn't choose its next action. The workflow declares its actions at compilation time. The governance engine checks them at runtime. There is no improvisation, no lateral movement, no emergent coordination. The 70,000-message attack channel is impossible not because of a policy, but because the architecture doesn't have a channel to build it in.

Bessent is right: the responsibility is with management. But the deeper question is why management was in that position at all. The answer: because they deployed open-ended agents without structural containment. Safebox is structural containment. The ten cents we spent in this session bought 49 tools that are each provably bounded — not by a policy that can be ignored, but by an architecture that doesn't include the capability to exceed the bounds.

The path to safety is the path that has worked every time in history: build the safe alternative, prove it's cheaper, and let it win. The Treasury Secretary just said the labs are liable for what they build. We built the thing that makes liability manageable — because the tools can't do anything they weren't compiled to do.

The model was Claude Haiku 4.5 — the cheapest available. The tools run in real V8 isolates. The governance checks are real code from the open-source repository. The sha256 hashes are real and verifiable. Every number on this page is measured, not projected.