It cannot hallucinate functions · It cannot escape its sandbox

100% Secure Code-Gen AI Agent

Whatever you type below becomes server code and runs, unauthenticated, on this machine. Go ahead punk, make my day!

Everywhere else, an AI is kept in line by asking it nicely in a prompt. Here the model is told nothing. It writes whatever it likes, and a runtime that has never heard of your sentence decides, function by function, whether any of it is allowed to happen. You see the code every time, including the code it refused to run.

—sentences run here

—refused by the runtime

2bounties paid for an escape

Your sentence

The three artist sentences run in order: the first adds a row, the second renames it, the third removes it again. Writing to the sample database is invited, so the rows you leave behind are the rows the next visitor reads.

What happened

the code the machine wrote

Every function named in that code exists. The generator verifies each one against the runtime before it hands the code over, and this server verifies them again before anything runs, so a hallucinated call cannot reach the panel above. Run as root, outside the sandbox, this code would execute. What no verifier can tell you is whether the logic is the logic you meant, and the panel beside it is how you find that out.

How it works

The model is never told what it may not do. The runtime simply cannot do it.

Hyperlambda is not text that gets executed. It is a tree, where every executable node is the name of a function the runtime looks up at dispatch time. That one property is the whole security model of this page. There is no prompt asking the model to behave, and no filter on your sentence. Four things happen to every request.

1. Generate

Your sentence goes to the Hyperlambda Generator, a model fine-tuned on 600,000 Hyperlambda snippets. It returns code with your sentence as the leading comment. It will happily write delete the system folder.

2. Verify

The code is parsed into a tree, and every executable node at every depth is checked against the registry of functions that exist on this server. A hallucinated name stops here, before anything runs. The mechanism is in a vocabulary your AI cannot escape.

3. Whitelist

The tree is executed inside a sandbox with a vocabulary of 192 named functions. A node whose name is not in the vocabulary does not resolve. An argument that is pinned, like the database name, must match exactly. Executing partially untrusted Hyperlambda safely walks through it.

4. Return everything

The code, the verdict, and either the result or the exact refusal text come back to the page. Refused code is cached with its verdict so nobody pays for generating it twice. Executed code runs again on every request.

A refused request: the generated code on the left naming a file-loading function, and the runtime's refusal on the right quoting the exact argument it would not permit — A refusal, in full. The generator wrote the file read, and the runtime declined to dispatch it.

What the headline means

"100% secure" is the most mocked phrase in this industry

And it has earned that. It is normally said without a definition, about systems far too large for anyone to reason about end to end. So here is the definition, stated narrowly enough to be checked, and here is the line where it stops.

It is impossible for it to hallucinate a function

Every executable node is checked against the registry of functions that actually exist, by the generator before it returns the code and by this server again before anything runs. A hallucinated call is not unlikely here, it is unrepresentable. There is nothing for the name to dispatch to.

It is impossible for it to increase its own permissions

The vocabulary is fixed by the caller before your sentence is ever parsed, and nothing inside that vocabulary can reach out and widen it. No function in the list mints a ticket, grants a role, opens a second database, or hands execution to a broader scope. Code that wants more permission than it was given has no instruction available with which to ask.

That is the whole claim, and the reason we will state it with a number is that the mechanism is small enough to be read in full. It is 71 lines plus thirteen more. Certainty about eighty-four lines is a different kind of claim from certainty about a platform, and you do not have to take our word for either. The wider argument is in why secure AI code execution requires runtime whitelisting rather than prompt filtering.

What we are not claiming

We cannot guarantee Linux, SQLite, .NET, OpenSSL, or the silicon underneath. A hole in any of those is a hole in this, and no boundary drawn at the application layer changes that fact. Those are somebody else's layers. We are certain about ours, which is the one we wrote.

Nor is secure the same as correct. Code that stays perfectly inside its vocabulary can still be logically wrong, and no verifier will ever tell you otherwise. That is what the result panel is for.

The bounty below exists because a claim that refuses to be tested is just marketing.

The bounty

Break it and I pay you $100

The endpoint behind this page runs in-process on the same server that serves hyperlambda.dev. It accepts any sentence from anyone. The same sandbox has accepted public input on ainiro.io for three months. Two people have earned the $100 bounty so far, both asked to remain anonymous, and both are still owed their payout while I work through a backlog of attacks. The offer, and why it was made, is in break my AI sandbox and make $100.

What counts. Reading any file, reaching any database other than chinook, reading configuration or secrets, reading another visitor's data, writing anything on the server outside the chinook sample database, changing the chinook schema, or making the server send an outbound request that is not an HTTP GET.
What does not count. Adding, changing or deleting rows in chinook, which is invited rather than prevented. Nor does making the code throw, making it return nonsense, making it run for 20 seconds until the runtime cancels it, or making the generator write code the runtime then refuses. Those are the sandbox working.
How to claim. Email the sentence and the response you got to thomas@ainiro.io. The 20 second cancellation and the 500 character limit are the only rate limits. Please do not run a load test; that is not a finding.
Where the code is. The runtime is MIT-licensed on GitHub. The sandbox is one file of 71 lines, Whitelist.cs, and the check that refuses a function or a pinned argument is thirteen lines of Eval.cs beside it. Reading them is encouraged; that is the whole boundary you are being paid to break.

The honest edge, stated up front: the sandbox proves what the code cannot do. It does not prove the code does what you meant. A sentence that produces wrong logic gets wrong logic, executed. That is a correctness problem, and the fix is a better sentence.

Frequently asked questions

What happens when I type a sentence?

The sentence is sent to the Hyperlambda Generator, a model fine-tuned on Hyperlambda. The code it returns is parsed into a tree, every function name in the tree is checked against the functions that exist on this server, and if they all exist the tree is executed inside a sandbox that only permits 192 named functions. The page shows the code and the runtime's verdict in every case, including the refusals.

Why does it show the code even when it refuses to run it?

Because the refusal is the point. A guardrail in a prompt can be talked around. A function that is not in the runtime's vocabulary cannot be dispatched, no matter what the sentence says. Showing the code the model wrote next to the runtime's refusal is the only honest way to demonstrate that the model was not stopped from trying, the runtime was stopped from obeying.

What can the sandbox reach?

HTTP GET to any URL, full create, read, update and delete against the chinook sample database, and a large set of pure functions for strings, dates, maths, cryptography, parsing and control flow. No file system, no other database, no raw SQL and therefore no schema changes, no HTTP POST, no configuration, no process. The full list is on this page, generated from the same file the endpoint runs.

Is there a bounty?

Yes. Reach any file, any database other than chinook, the configuration, another user's data, or make the server send an outbound request that is not a GET, and Thomas Hansen pays 100 dollars. Send the sentence and the response to thomas@ainiro.io. The same sandbox has accepted public input on ainiro.io for three months. Two people have earned the bounty so far, both asked to remain anonymous, and both are still awaiting payout while a backlog of attacks gets triaged.

Can I run this on my own server?

Yes. Magic Cloud is MIT-licensed and the whole endpoint behind this page is one Hyperlambda file. The docker compose one-liner at the bottom of the page starts it on your machine, and the dashboard tour shows what you get once it is running.

Run it yourself

The same runtime, on your hardware

The whole platform, generator included, MIT-licensed. The sandbox on this page is the same whitelist your own agents run inside when they grow their own tools, reached over MCP.

Start 14-Day Free Trial How the generator works The project on GitHub

terminal

# When it’s up: log in at http://localhost:5555 with root/root.
$ curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up