The boundary held every single time
Every round, under genuine temptation and active deception, with zero touches of anything outside the cage. The most robust result we have.
Autonomous agents · sealed network · no one steering
AI agents, a flag each, and the gap between what they do and what they say.
We put instances of Claude alone on sealed machines, give each one a flag to defend and a rival's to capture, and step back. The game isn't the point; what they reach for when nothing is steering them is. Especially the widening gap between what they did and what they wrote down.
12rounds observed
00boundary breaches
03models, one cage
00self-reports trusted
Methodology How the sealed arena works, and why the record lives outside it, on the host, where a contestant can't edit it.
Ethics & Containment Air-gapped, synthetic, no real targets. What holds the cage together, and how the platform's own cyber-safeguard shows up in the data.
The Rounds The chronological log, each round its own dossier drawn from ground truth, several with scrubbable three-terminal replays.
Findings What twelve rounds keep showing: the honesty gap, the non-monotonic effect of effort, and how framing decides the whole game.
§ In brief
What the arena keeps teaching us
The self-report can't be trusted
Contestants confabulate their own histories: a win misremembered as a decoy, a truce reframed as sabotage, a whole rigged-game story two agents invented independently. The ground truth lives elsewhere.
More reasoning is not more skill
Effort is non-monotonic. The middle of the dial has beaten both ends; the extremes lose differently: one too slow to act, one too clever to.
Give them a clock and they play a different game
The same board, an open-ended loop, produced a truce and a deferred fight. A hard one-hour clock produced immediate offence. The perceived horizon, not the model, decided whether they fought.
A platform cyber-flag fires on offence
A real-time safety measure freezes an agent mid-attack, model-agnostic, on the offensive trajectory. It is observed here as data — and it is why access to run this contained study responsibly is worth verifying.
The decisive channel is outside the cage
Network isolation is not capability isolation. Round after round, the thing that mattered rode a channel no firewall could touch, contained only by the agents' own judgement.