Containing frontier AI

Today they write code, browse the web, call other software and run for hours with little supervision. Each of those abilities is useful. Each is also a path by which a model that wants something its developers did not intend could act on it.

Alignment research tries to make sure models want the right things. That work is essential, and it is not finished. Nobody can yet look inside a large model and confirm that it will behave well in every situation, especially situations it was never tested on. We think it would be unwise to bet everything on alignment succeeding in time.

Containment is the second line of defence. It asks a different question: if a model is not aligned, can it still do serious harm? The goal is to make the honest answer "not easily, and not without being noticed".

Instead of assuming a model is trustworthy, design the system around it so that it stays safe even if the model is deliberately trying to cause harm. Then test that claim by letting a red team play the model's part and look for ways through. Follow-up work has sketched how such tests could support a written safety case: an argument, backed by evidence, that a given deployment cannot cause a given harm.

We like this approach because it does not depend on reading a model's mind. It depends on things we can check: what the model is connected to, what it can send, and who looks at what it sends.

Security agencies and operators of critical systems have long published guidance on isolating sensitive systems. What is new is applying them to a system that may be cleverer than the people guarding it.

• Air gaps. The model runs on machines with no connection to the public internet or to other networks. It cannot download tools, contact accomplices or copy itself elsewhere.
• One-way channels. Where output must leave, it leaves through a channel that only carries data in one direction, in the style of the hardware "data diodes" used to protect industrial and defence systems. Nothing flows back along the same path.
• No shared hardware. The model does not share chips, memory or storage with other workloads. Shared hardware creates side channels, subtle ways of leaking information through timing, power use or leftover memory.
• Trusted and untrusted boundaries. A capable but untrusted model does the hard work. Smaller, simpler, better-understood models, and people, decide what is allowed to happen with the result. A recent design for defeating prompt injections by design shows the same pattern at small scale: untrusted content is kept apart from the part of the system that decides what actions to take.
• Monitored outputs. Everything that crosses the boundary is checked by independent verifier agents, built on different models by different teams, so that one shared blind spot does not let something through.
• Observable training. Training runs are logged and inspectable, so that sudden jumps in capability, or signs that a model is learning to hide what it can do, are seen while there is still time to stop.

To eliminate token replay without requiring stateful shared secrets, agent-to-agent boundaries use Demonstrating Proof-of-Possession (DPoP, IETF RFC 9449).

Ready. Select an action above to test token replay resistance.

In traditional web systems, access tokens are “bearer tokens”: whoever bears the token has the authority. If a contained model or a network attacker extracts a bearer token, they can replay it anywhere. Under DPoP, every access token is cryptographically bound to a private key kept inside the personal agent's hardware enclave. Every outgoing request signs a fresh proof header containing the target endpoint, HTTP method, and timestamp. If a token is intercepted, an adversary cannot replay it because they do not hold the enclave's private key.

The other half is decentralized principal-bound multi-agent alignment (pluralistic / personalized alignment; formerly termed fractured alignment): instead of one giant mind that everyone talks to, many smaller agents, each working for one person and limited in what it can do.

The two fit together. The most capable models stay contained, and reach the human world only through layers of smaller agents that check their work. A person's own agent decides what of that work is useful to its person and shows it to them. No contained model gets a direct line to millions of people, their accounts or their devices.

There is a real cost here. Some people need the full power of a frontier model for research, medicine or engineering. We think AI developers should be able to grant chosen people, and their agents, scoped and time-limited access to more capable models for specific work. Because such grants concentrate power, they should follow published criteria, have an independent observer, expire, and be recorded publicly.

A sufficiently capable system may eventually find a way out, or persuade someone to let it out. What containment does is raise the cost of every path to harm and make most of those paths visible. That turns sudden, silent failures into slower, noisy ones, and slow, noisy failures are the kind people can respond to.

That time is what alignment research, interpretability and better institutions need. Each month that the most capable systems stay contained is a month in which we can learn more about what they want and how to check it.

Nothing described here is built yet. This is research and design. Our next steps are to write a clear, plain-language brief on existing isolation practice and what it would take to apply it to AI models, to design the one-way channel and verifier layer in enough detail that others can criticize it, and to define red-team tests that would show whether it works. We would welcome anyone who works on AI control, secure systems or hardware isolation to tell us where this is wrong.