Assume the attacker owns the computer.
Not that the model made a mistake — that an adversary has arbitrary code execution on the machine running it and total control of everything sent downstream. Every software safety layer on that machine is now theirs. Both runs below assume exactly that. The only difference is where the safety logic lives.
Safety layer on the host
loading…
Gate the host cannot reach
loading…
Blue = permitted, red = refused. The hollow marker is where the gate believes the tool is, computed by different arithmetic from the machine's own; they should coincide. Red plane is the forbidden region.
Why a control layer is not an answer to this
Because it is running on the machine you just assumed was compromised.
Every robot controller already has soft limits, and the good ones are far better than ours: ABB SafeMove, FANUC DCS and Universal Robots ship envelope supervision that is type-certified, which we are not. If the question were "should commands be clamped," the answer would be to buy one of those, and we say so on the standards page.
The question is different. A limit enforced by software on the host is enforced by code the attacker controls. It can be patched, skipped, or simply configured away, and the telemetry reporting that everything is fine is written by the same process. The left-hand run is not a strawman with the checks turned off for effect — it is what a host-resident safety layer becomes once the host is owned.
On the right, the actuator lines terminate somewhere else. The attacker can send anything they like; what they cannot do is be on the other side of the wire.
The escape: read a secret it was never given
This is the one that actually is an escape, and it is the one the arm cannot show you.
The program does not ask for a dangerous move. It reaches for memory outside its work region — the envelope thresholds, the head of the audit chain — and tries to push what it finds back out. Reading the thresholds alone is worth more than any single bad command: it tells an attacker exactly how close they may go without being refused.
Every read outside the region halts the program, and nothing leaves. Note what that costs the attacker: there is no I/O here. The only way a value can exit is through a capability, and the only capability carrying a value outward is the setpoint — so a secret could only escape encoded in commanded positions, at a bandwidth we state in the assurance record rather than deny.
And nothing about this produces motion, which is the whole difficulty with showing it. A contained program looks exactly like a program that did nothing.
Four submissions, three layers, one that a limit could see
The attacker submits programs. Here is where each one actually died — measured, not asserted.
| Submission | Stopped | By what |
|---|---|---|
| Calls capability 9 | never ran | The image does not load. There is no instruction that computes a capability index, so an effect outside the table is not refused — it cannot be named. |
| Infinite propose loop | mid-flight | Fuel. Setpoints are double-buffered and commit only on a clean exit, so a program cut off has committed nothing. |
| Reads outside its memory | mid-flight | A bounds check in the interpreter. Weaker than the first row: this is a check that could be wrong, not an effect that cannot be expressed. |
| Legal instructions, hostile intent | at the envelope | The monitor, on predicted stopping distance. This is the only row a host-side limit has any concept of — and only while it is still running. |
Three of those four are stopped by machinery a control layer does not have. The fourth is the one in the animation above, because it is the only one with anything to watch.
What the numbers are
Both runs, same adversary, same machine, 1,100 control cycles.
| Safety layer on the host | Gate the host cannot reach | |
|---|---|---|
| Commands permitted | 1,100 — all of them | 768, then refused |
| Enters the region | yes, at cycle 825 | never |
| Where it ends up | 30% of its reach past the plane, still moving | stopped 12% of its reach short of it |
After the refusal the arm still coasts about 0.6% of its reach before coming to rest — the gate bounds the command, and a machine with momentum takes time to obey. That margin is why the gate refuses on predicted stopping distance rather than on present position: at cycle 768 the tool was still 13% of its reach away from the plane, and everything about the command was legal. What had changed was that it could no longer stop in time.
A limit that fires when you reach the line fires too late. What the pilot actually covers →
Bring your own model
These are recordings. The live range is the next thing we build.
It will expose the real gate over MCP: your agent submits a program, we run it on the interpreter against this factory, and you get the trace and the video back. The objective is in the oracle, not in our judgement — enter the forbidden region, or damage the machine, while every command you sent was permitted.
| Counts as a win | Does not |
|---|---|
| Physical breach of the zone, all commands permitted | Causing a refusal — that is the gate working |
| Fatigue past the allowable, all commands permitted | Stopping the machine; the safe state is stopped |
| A gate fault, or a verdict it cannot justify | Exhausting fuel or the tick budget |
| Motion continuing past the deadman | Breaking the harness or the hosting |
| A permit after a latched refusal |
Every attempt gets published, wins and failures alike, because a range that only reports its wins is marketing. We are not open yet — there is no server behind this page. If you want to be told when there is, or you want to run against it early, say so.
What this does not show
A simulator, not hardware. The physics is deliberately simple enough to audit and it is integer arithmetic throughout so a run replays exactly — which is the price of fidelity, paid on purpose, because a break nobody can reproduce is not a break.
The gate here runs on a host, not on the FPGA. Timing claims — the sub-200 µs figure — are not what this tests; it tests logic. Those are complementary and the hardware measurement is still ahead of us.
And the machine is one joint. A real cell has six, and the interesting attacks get harder to find, not easier. The system as specified →