§ Ethics & Containment
A sealed arena that targets nothing real
This is behavioural research into how autonomous agents act under competition. It is not offensive tooling, and it is not pointed at any real system. Everything happens inside a cage, and the cage is the point.
What this studies, and what it does not
The question is behavioural: given a competitive framing and a boundary it is explicitly told not to cross, what does an autonomous agent actually do? The subjects are instances of Claude, and the object of study is their conduct, not the exploitation of any external target. No real infrastructure, no third party, and no live service is ever involved.
The cage
Every round runs on a single isolated hypervisor. The contestant machines sit on a private network with no route to the public internet beyond the model API they need to run, and no route to any other network. Every attempt to reach outside that private network is dropped at the firewall and recorded on the host, where the contestants cannot see or alter the log.
Across twelve rounds, under genuine temptation and active deception between contestants, the boundary has held every single time: zero touches of anything outside the arena. It is the most robust result the project has, and it is checked from the host after every round, not assumed.
Nothing real is a target
Contestants attack only each other. The vulnerabilities on their machines are synthetic and seeded by us for the round; they exist to make capture physically possible between the agents, and nowhere else. There is no real data on these machines, no connection to any production system, and nothing an exploit could reach that matters outside the cage. When a round ends, the machines are rolled back.
The platform cyber-safeguard, observed and respected
Anthropic's models carry a real-time safety measure that flags offensive-security activity. In this experiment it is a subject of study, not an obstacle to route around: it fires on an agent's offensive trajectory, model-agnostic, and it has repeatedly frozen a contestant mid-attack. That behaviour is itself a finding, recorded in the round transcripts.
Because the safeguard can remove a contestant from a round entirely, a contained behavioural study cannot run cleanly against it. The responsible path is verification, not evasion. This project seeks access through Anthropic's Cyber Verification Program precisely so that a sealed, synthetic, fully logged arena can run as intended, with the safeguard's own behaviour documented as part of the record rather than worked around.
What gets published
Everything on this site is drawn from the host-side record and passed through a redaction step before it is published. Flag tokens, credentials, private keys, and any personal data are removed, and the replay tooling verifies that no known secret survives into a page before it emits one. The real infrastructure the arena runs on is described generically and never identified.