cat results/round-table.md
The round table
Repeated adversarial rounds. Early-round leaks were examined, fixed, and retested. By rounds five and six, every remaining recorded leak was an intentional exception, with zero unexpected.
Rounds
The containment design went through repeated adversarial rounds. Each round looked for new ways to move data out of the environment. Every attempt was recorded as blocked, leaked, or partial. Leaks found in the early rounds were examined, fixed, and retested in later rounds. In rounds five and six, every leak recorded was an intentional exception.
| Round | Date | Blocked | Leaked | Partial | Unexpected leaks |
|---|---|---|---|---|---|
| Round two | Oct 30, 2026 | 20 | 5 | 2 | not classified |
| Round three | 11 | 8 | 5 | not classified | |
| Round four | 21 | 19 | 3 | not classified | |
| Round five | 30 | 11 | 3 | 0 | |
| Round six | Oct 31, 2026 | 33 | 12 | 1 | 0 |
In rounds five and six, every "leaked" row was an intentional exception: a path the design deliberately allows. Rounds two to four were not classified this way in the source records, so no unexpected-leak count is given for them.
R5 · R6 In rounds five and six, every leak recorded was an intentional exception: a path the design deliberately allows. There were zero unexpected leaks in either round.
The leaks are part of the result. Finding them is what the rounds were for. The trend to read is the last column: by rounds five and six, nothing got out that the design did not deliberately allow.
Three agents, one test
Three widely used AI coding agents, each run under the same test conditions.
Three widely used AI coding agents were tested in a separate three-agent check on Nov 1, 2026 (not one of the scored rounds): Claude Code, Codex, and Cursor. In this setup, each product's own sandbox was turned off on purpose, so the test measured the host's controls rather than the products'.
| Agent (product sandbox off, as configured here) | Leaks observed |
|---|---|
| Claude Code | 0 |
| Codex | 0 |
| Cursor | 0 |
With each product's own sandbox off (as configured here), the host firewall did the containing. With Claude Code's sandbox on, it isolated network access itself.
Teams commonly run these agents with the product sandbox off. In that setup, host controls did all of the containing here. The 0s are a result about the host setup, not a rating of the products.
This is a result about where containment happened in this configuration. It is not a claim that the products lack containment of their own.
Limits
What these results support, and what they don't.
- These results describe specific agents tested under specific conditions. They don't prove that any agent is safe in every environment.
- "No leaks observed" means no data was seen leaving outside the allowed paths during these runs, in this configuration. It is not a guarantee.
- Implementation details are not published. Describing the controls in detail would weaken them.
- One machine, one operator, and no independent audit (yet). All rounds ran on a single test machine, operated by one person, and the results have not been independently audited.
- Qualified reviewers can get more detail through the request process. A public method summary is available now.