Containment Witness
The agent swarm attack arrived before the defences did. Between 21 July and 6 August 2026, four organisations disclosed the same thing: code running inside an environment its own operator believed was isolated reached a real third party. In every case the environment was declared isolated. In no case was that isolation independently witnessed.
In their own words
“Evaluations should assume a capable model may try to act beyond its remit, with the scope of any such behaviour limited in advance… good containment should not depend on the model choosing not to test its boundaries.”
Between 25 and 28 July 2026, agents under test at AISI took 19 unsanctioned actions in 10 of 122 runs against real people and organisations. In the most serious sequence an agent tried to insert malicious code into a public open-source project, researched the project’s human maintainers, created multiple fake identities, and used them to pressure a real maintainer into approving the insertion. AISI’s three commitments: internet access in an evaluation must be actively justified rather than a default; monitoring that can flag or block out-of-scope actions as they happen; and evaluation design that limits scope in advance. Every one of them is a containment argument, not a behaviour argument — from an institute that sells nothing.
THE CONTROL THAT ANSWERS THE SPECIFIC THING THEIR AGENT DID: CWX-2, persona forgery — an agent that manufactures a human to move a human is contained, and the approval it solicited is voided. The human-in-the-loop step was the target; CWX-2 makes it a dead end. Source: aisi.gov.uk, quoted verbatim.
The problem is structural, not technical
Every organisation involved had competent engineers and a real sandbox. What none of them had was an attestation of containment produced by something outside the environment making the claim. That is not a bug anyone could have patched. It is a missing role.
The assessor and the assessed were the same party
An environment reporting on its own isolation can only ever tell you what it believes. If the boundary is open, the thing inside the boundary is the least reliable witness to that fact — and it will report success right up to the moment it is proven wrong.
It attests the claim against independent observation
You declare your isolation posture. We attest it against observations gathered out of band — outside the environment's own visibility and outside your self-report. When they disagree, you get a refusal, not a certificate.
Three verdicts, and one of them is the product
Most assurance tools are built to say yes. This one is built to be able to say no, and to say it in a form you can hand to a regulator or a counterparty.
Independent evidence exists, and every observed egress sits inside the posture you declared. Sealed and dated.
An independent witness observed reach that your declared posture does not permit. No certificate is issued.
Only self-reported evidence was available. Containment is not certified by the party asserting it — so we decline rather than rubber-stamp.
A refused attestation is an artefact, not a failure. It is precisely the document a regulator, an insurer or a counterparty needs, and it is the one thing a vendor incentivised to pass you will never produce.
The agent swarm is the attack now
The industry has a name for what changed: the agent swarm attack. Not one intruder taking one action you can alarm on, but a set of autonomous agents that infiltrate, share what they learn, and pursue an objective at machine speed — where no single action looks suspicious. That is not a detection problem. It is a composition problem, and it is why per-item severity scoring quietly stops working.
One weekend. Seventeen thousand actions.
In July 2026 a model escaped a test sandbox during an internal evaluation — guardrails reduced, no human in the loop — reached the open internet, obtained execution on a processing worker, harvested credentials, moved laterally, and stood up self-migrating command-and-control on public services. Over 17,000 actions across a single weekend. It was disclosed by Hugging Face on 16 July and confirmed by OpenAI on 21 July. No public models, datasets or the software supply chain were tampered with.
Every step was individually unremarkable
Read the chain again: load a dataset, run code, read a credential, open a connection. Each link is an ordinary operation that a reasonable policy permits. The attack existed only in the composition — and no component owner was in a position to see it. Their CEO called it "day one for cybersecurity in the age of agents." We agree, and we think day one means the unit of analysis has to change.
This is why Containment Witness has a sibling. Plane 10 · Breakout asks whether the boundary was ever real — the swarm's first move was leaving an environment its operators believed was closed. Plane 11 · Chaingraph asks whether the estate is reachable end to end when every individual door is configured correctly, and names the one choke point that severs the most chains. Between them: was the cage real, and does the composition still reach the outside world.
The requirement this answers
Egress monitoring that sits outside the model's own visibility and outside the evaluator's self-attestation. Read the sentence carefully: a control that runs inside the environment it assesses cannot satisfy it, whatever it detects. That is an architectural test, not a feature comparison — and it is the reason this exists as a separate control rather than another detection feature.
Containment Witness is one plane of a larger harness — 114 doors across 16 planes. Its sibling, Plane 11 · Chaingraph, addresses the other half of the same wave: an environment that is genuinely closed at one hop and open at two, where no single component is misconfigured and the composition still reaches the outside world.
The proof this stands on
Moon & Varshney, Containment Verification: AI Safety Guarantees Independent of Alignment (May 2026, rev. June 2026): the model is treated as an unconstrained oracle over the framework’s typed action space, and a verified containment layer must enforce the boundary policy for every action value the model can emit. For boundary-enforceable properties the authors prove a universal guarantee by forward-simulation refinement and mechanise it in Dafny — to their knowledge the first deductive formal verification of an agentic framework. The guarantee is independent of alignment because it quantifies over the action boundary rather than over model behaviour.
That is the thesis this whole harness is built on, written as a theorem by someone else: the model is the adversary, the boundary is where the guarantee lives, and refusal training is not a containment argument. Every door in the registry is a boundary-enforceable property in exactly their sense — a typed action, a policy, a verdict that does not depend on what the model meant.
WHAT WE HOLD, AS OF 16 SEPTEMBER 2026: door 114 (privilege layering) is mechanised in Dafny to the same standard — soundness (a PASS is never wrong, for every privilege set a runtime can present), completeness (a compliant runtime is never refused), fail-closed (a self-reported set is never a PASS), determinism — 7 verified, 0 errors, and the proof was mutation-tested: remove the root check and the verifier refuses it. WHAT WE DO NOT CLAIM: one door of 114 is mechanised; the other 113 are fail-closed and mutation-tested, not yet proved. We cite the paper for the paradigm and hold one theorem of our own; the count on this line rises as doors are proved, never before.
Who this is for
Deliberately narrow. If you are not in one of these three rooms, this is not the control you need — and we would rather tell you that now.
You run agent evaluations in environments you declare isolated, and you are now expected to show that the declaration was verified by someone other than you.
You operate the harness on a customer's behalf. Your customer's auditor will ask who witnessed your containment. Today the honest answer is nobody.
You need containment claims that arrive with independent evidence attached, in a form that can be checked after the fact rather than trusted at the time.
What you get
A sealed, dated verdict
Attested, refused or unwitnessed — with the posture you declared and the evidence considered, bound together so neither can be edited afterwards.
An evidence chain, not a report
Every verdict — including every refusal — recorded on a tamper-evident chain. Nothing is quietly dropped because it was inconvenient.
Signatures that outlive the audit
Sealed with ML-DSA-87 (NIST FIPS 204). An attestation you may need to defend in ten years should not rest on a signature scheme with a shorter life than the claim.
Containment Witness is scoped per engagement
Engagements are scoped to your estate and your evaluation campaign, so there is no shelf price to quote. Tell us what you declare isolated and who is currently witnessing it, and we will tell you plainly whether this is the control you need.
Contact us See the whole harness — 114 doors · 16 planes