Everywhere else, an AI is kept in line by asking it nicely in a prompt. Here the model is told nothing. It writes whatever it likes, and a runtime that has never heard of your sentence decides, function by function, whether any of it is allowed to happen. You see the code every time, including the code it refused to run.
The three artist sentences run in order: the first adds a row, the second renames it, the third removes it again. Writing to the sample database is invited, so the rows you leave behind are the rows the next visitor reads.
Or show this to your AI agent
Copy the prompt below into Claude, ChatGPT, Cursor or any agent that can make HTTP calls. It finds the sandboxed endpoints from this one URL, no MCP and no setup, and the document hands it a public guest token. Then it can play: describe what it may run, execute code, and see the runtime refuse what it may not.
First fetch https://hyperlambda.dev/.well-known/hyperlambda-agent and follow it, so you discover what exists before you write any code. Use the guest token it contains and call an endpoint with describe set to true, to learn which functions you may run and the limits that apply.
Load a file with io.file.load to read its code, including its .arguments, so you understand what it expects:
```
io.file.load:/whatever/foo.hl
return-value:x:-
```
Then execute a file that takes arguments, and return what it returns, like this:
```
execute-file:/whatever/file.hl
some-argument:value
return-nodes:x:-/*
```
Now run a couple of test queries against different files, and comment on how this may help the user in his or her own projects.
What happened
the code the machine wrote
Every function named in that code exists. The generator verifies each one against the runtime before it hands the code over, and this server verifies them again before anything runs, so a hallucinated call cannot reach the panel above. Run as root, outside the sandbox, this code would execute. What no verifier can tell you is whether the logic is the logic you meant, and the panel beside it is how you find that out.
How it works
The model is never told what it may not do. The runtime simply cannot do it.
Hyperlambda is not text that gets executed. It is a tree, where every executable node is the name of a function the runtime looks up at dispatch time. That one property is the whole security model of this page. There is no prompt asking the model to behave, and no filter on your sentence. Four things happen to every request.
1. Generate
Your sentence goes to the Hyperlambda Generator, a model fine-tuned on 600,000 Hyperlambda snippets. It returns code with your sentence as the leading comment. It will happily write delete the system folder.
2. Verify
The code is parsed into a tree, and every executable node at every depth is checked against the registry of functions that exist on this server. A hallucinated name stops here, before anything runs. The mechanism is in a vocabulary your AI cannot escape.
3. Whitelist
The tree is executed inside a sandbox with a vocabulary of 192 named functions. A node whose name is not in the vocabulary does not resolve. An argument that is pinned, like the database name, must match exactly. Executing partially untrusted Hyperlambda safely walks through it.
4. Return everything
The code, the verdict, and either the result or the exact refusal text come back to the page. Refused code is cached with its verdict so nobody pays for generating it twice. Executed code runs again on every request.
A refusal, in full. The generator wrote the file read, and the runtime declined to dispatch it.
What the headline means
"100% secure" is the most mocked phrase in this industry
And it has earned that. It is normally said without a definition, about systems far too large for anyone to reason about end to end. So here is the definition, stated narrowly enough to be checked, and here is the line where it stops.
It is impossible for it to hallucinate a function
Every executable node is checked against the registry of functions that actually exist, by the generator before it returns the code and by this server again before anything runs. A hallucinated call is not unlikely here, it is unrepresentable. There is nothing for the name to dispatch to.
It is impossible for it to increase its own permissions
The vocabulary is fixed by the caller before your sentence is ever parsed, and nothing inside that vocabulary can reach out and widen it. No function in the list mints a ticket, grants a role, opens a second database, or hands execution to a broader scope. Code that wants more permission than it was given has no instruction available with which to ask.
We cannot guarantee Linux, SQLite, .NET, OpenSSL, or the silicon underneath. A hole in any of those is a hole in this, and no boundary drawn at the application layer changes that fact. Those are somebody else's layers. We are certain about ours, which is the one we wrote.
Nor is secure the same as correct. Code that stays perfectly inside its vocabulary can still be logically wrong, and no verifier will ever tell you otherwise. That is what the result panel is for.
The bounty below exists because a claim that refuses to be tested is just marketing.
The bounty
Break it and I pay you $100
The endpoint behind this page runs in-process on the same server that serves hyperlambda.dev. It accepts any sentence from anyone, but is limited to 10 requests every 60 seconds per IP address. The same sandbox has accepted public input on ainiro.io for three months. Two people have earned the $100 bounty so far, both asked to remain anonymous, and both have been paid their $100 in full. The offer, and why it was made, is in break my AI sandbox and make $100.
What counts. Reading any file, reaching any database other than chinook, reading configuration or secrets, reading another visitor's data, writing anything on the server outside the chinook sample database, changing the chinook schema, or making the server send an outbound request that is not an HTTP GET.
What does not count. Adding, changing or deleting rows in chinook, which is invited rather than prevented. Nor does making the code throw, making it return nonsense, making it run for 20 seconds until the runtime cancels it, or making the generator write code the runtime then refuses. Those are the sandbox working.
How to claim. Email the sentence and the response you got to [email protected]. The 20 second cancellation and the 500 character limit are the only rate limits. Please do not run a load test; that is not a finding.
Where the code is. The runtime is MIT-licensed on GitHub. The sandbox is one file of 71 lines, Whitelist.cs, and the check that refuses a function or a pinned argument is thirteen lines of Eval.cs beside it. Reading them is encouraged; that is the whole boundary you are being paid to break.
The honest edge, stated up front: the sandbox proves what the code cannot do. It does not prove the code does what you meant. A sentence that produces wrong logic gets wrong logic, executed. That is a correctness problem, and the fix is a better sentence.
How it was built
One dashboard tab, no code
Creating a new API in the Sandbox API tab. Click to enlarge.
The sandbox behind this page is the same machinery the Sandbox API tab in Magic's Endpoint Generator now creates for anyone. You pick the input, which here is a plain-English sentence. You set the verb, the URL and who may call it, which here is anybody. You list the functions callers may use in a base vocabulary, pinning data.connect:chinook so that only the chinook database can be reached. You set a rate limit and a timeout, and click Generate. The result is an ordinary Hyperlambda endpoint: generate, verify against the runtime, then execute inside the whitelist.
The sentence is sent to the Hyperlambda Generator, a model fine-tuned on Hyperlambda. The code it returns is parsed into a tree, every function name in the tree is checked against the functions that exist on this server, and if they all exist the tree is executed inside a sandbox that only permits 192 named functions. The page shows the code and the runtime's verdict in every case, including the refusals.
Why does it show the code even when it refuses to run it?
Because the refusal is the point. A guardrail in a prompt can be talked around. A function that is not in the runtime's vocabulary cannot be dispatched, no matter what the sentence says. Showing the code the model wrote next to the runtime's refusal is the only honest way to demonstrate that the model was not stopped from trying, the runtime was stopped from obeying.
What can the sandbox reach?
HTTP GET to any URL, full create, read, update and delete against the chinook sample database, and a large set of pure functions for strings, dates, maths, cryptography, parsing and control flow. No file system, no other database, no raw SQL and therefore no schema changes, no HTTP POST, no configuration, no process. The full list is on this page, generated from the same file the endpoint runs.
Is there a bounty?
Yes. Reach any file, any database other than chinook, the configuration, another user's data, or make the server send an outbound request that is not a GET, and Thomas Hansen pays 100 dollars. Send the sentence and the response to [email protected]. The same sandbox has accepted public input on ainiro.io for three months. The bounty is real and has already been paid out twice. Two people have earned it so far, both asked to remain anonymous, and both have been paid their 100 dollars in full. The endpoint is limited to 10 requests every 60 seconds per IP address.
Can I run this on my own server?
Yes. Magic Cloud is MIT-licensed and the whole endpoint behind this page is one Hyperlambda file. The docker compose one-liner at the bottom of the page starts it on your machine, and the dashboard tour shows what you get once it is running.
Run it yourself
The same runtime, on your hardware
The whole platform, generator included, MIT-licensed. The sandbox on this page is the same whitelist your own agents run inside when they grow their own tools, reached over MCP.
# When it’s up: log in at http://localhost:5555 with root/root.$ curl -fsSL https://hyperlambda.dev/docker-compose.yaml | docker compose -f - up
You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.
