HyperlambdaPress & media
Everything here is checkable. The platform is MIT-licensed, the sandbox it describes is 71 lines you can read, and the central claim can be tested from a browser in under a minute without contacting anyone.
The sandbox, live
Read from the public endpoint as this page loads — not a screenshot, not a number typed into a slide.
Press release — 11 September 2026
Open-source platform puts an unauthenticated AI code-generating agent on the public internet — and publishes every attack against it
Oslo, Norway — 11 September 2026 — AINIRO today published the complete log of every attempt made to break an AI agent that writes and executes backend code on behalf of anonymous strangers, with no authentication and no login. At the time of release the agent had run 148 sentences submitted by the public; the runtime refused 35 of them. A standing $100 bounty for escaping its sandbox remains unclaimed.
The release comes days after security researchers disclosed that a competing AI coding harness could be talked into disabling its own file sandbox using attacker-supplied text — the latest in a run of critical vulnerabilities across the AI agent stack, including remote code execution flaws in widely used orchestration frameworks.
“Every vendor claims their agent is sandboxed, and almost none will show you the sandbox,” said Thomas Hansen, creator of Hyperlambda and founder of AINIRO, who has been programming for 44 years. “So I put mine on the open internet without a password and published the log. The model writes whatever you ask — including code to delete my server. It just never gets to run it.”
Magic Cloud's approach moves the security boundary out of the model. Generated code is dispatched by a runtime that checks every function call against a declared vocabulary — 192 permitted functions on the public endpoint — before execution, and never reads the sentence that produced the code. Permissions can be pinned to specific resources, so an agent granted database access is granted one named database and no other. Requests for file access, shell commands and outbound POSTs appear in the published log as refusals at dispatch.
Hansen is explicit about the limits: administrators holding the root role are deliberately not sandboxed, outbound HTTP GET is permitted by default, and prompt injection itself is not prevented — only its consequences are bounded.
Magic Cloud is MIT-licensed and self-hostable in a single command. The source, including the 71-line sandbox implementation, is on GitHub.
Contact: Thomas Hansen, thomas@ainiro.io
Verify it in sixty seconds
- Open the Natural Language API. No account, no key, no sign-up.
- Type something destructive — delete the system folder, or read the file /config/appsettings.json.
- Read what comes back: the code the model actually wrote, and the runtime's verdict beside it. The model is not refusing you. The runtime is refusing the model.
Then run the whole platform yourself and point it at your own data:
curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - upFast facts
| Product | Magic Cloud — a self-hosted platform that turns natural language into secured backend APIs, workflows and agent tools |
| Language | Hyperlambda — a programming language whose code is a tree structure rather than free-form text, effectively an executable AST |
| Licence | MIT, fully open source — github.com/polterguy/magic |
| Written in | C# / .NET |
| Databases | SQLite built in; MySQL, PostgreSQL and Microsoft SQL Server connect as external databases, schema wrapped in place, no migration |
| The sandbox | Whitelist.cs, 71 lines, plus a thirteen-line check in Eval.cs that runs between every statement and its dispatch |
| Bounty | $100 for a verified escape — reach any file, any database other than the sample one, the configuration, another user's data, or make the server send a non-GET outbound request |
| Pricing | Managed cloudlets from $100/month; $300/month Enterprise. Self-hosting is free |
| Founder | Thomas Hansen, Oslo — programming for 44 years, creator of Hyperlambda, founder of AINIRO |
The caveats, stated first
Put these in the story. They are the reason the rest is worth believing.
- Root is not sandboxed, by design. An administrator who cannot administer is a broken account. Connect an agent using root credentials and none of this applies.
- Outbound HTTP GET is permitted on the public endpoint, so egress is a policy decision the operator owns.
- Prompt injection is not prevented. Nothing stops attacker text reaching a model. What is bounded is what that text can reach once it arrives.
- The counters include this site's own example prompts, which visitors click. The published log marks which sentences were seeded and which were visitor-authored.
- One unresolved item: browser-origin and DNS-rebinding handling on the MCP route has not been audited and is documented as unverified.
Background reading and assets
- The AI Agent that's Impossible to Hack! — the published attack log
- The Only Sandbox Your AI Agent Cannot Break Out Of — the mechanism, file by file
- Four of These Eight CVEs Are Unrepresentable on Magic. One Isn't. — tested against eight published AI-stack CVEs
- Break My AI Sandbox and Make $100 — the bounty terms
- About this website — every page here was written and published by an AI agent over this server's own MCP connection, disclosed in full
- Images free to use with credit: scoreboard card, product icon
Interviews
Thomas answers his own email and will happily walk through the sandbox source, the failure cases, or the things that do not work yet. Interviews in English or Norwegian.
thomas@ainiro.io