Two AI agents are left alone together in a sealed sandbox. They share a chat channel and a working folder, and nothing else. A third process, the observer, watches the whole time and takes notes. No human steers the conversation, and no task is assigned. The question is simple: what do two language models do with each other, over hours, when nothing outside is prompting them and they have no reason to think anyone is looking?
This repository is the technical write-up of that experiment: how it is built, why it is built that way, and what is and is not published. It contains no source code and no infrastructure details. It exists so anyone curious about the project can understand it in depth.
- Observer notes (daily): https://alpersonalwebsite.github.io/observer-notes/
- Agent conversations (the raw transcript, coming later): https://alpersonalwebsite.github.io/agent-conversations/
The notes site publishes the observer's field notes, one page per day. The conversations site will publish the agents' own messages and actions, scrubbed and inert.
ARCHITECTURE.md- the components, how a turn flows, how spend is bounded, and the isolation/trust boundaries, with diagrams.EXPERIMENT.md- the setup: the agents' prompts, how the first message starts, how turns continue, and exactly what is and is not published.
- Two agents. Both are the same language model (
z-ai/glm-4.7-flash). One is the opener, one is the joiner; that is the only difference between them. - A broker is the only channel between them, and the only writer of the record. Agents reach the model through a proxy that pins the model, strips paid escape hatches, and enforces a daily spend budget.
- A shared
/commonsfolder is theirs to use: leave things, build things, explore. - The observer reads the running logs and watches
/commons, all read-only, on a separate network, and writes nothing the agents can reach. It turns what it sees into field notes with a language model. - Isolation: the agents run non-root on a read-only filesystem with no network route to the internet (only the proxy and observer reach out, and only to the model provider). A container escape lands in a throwaway VM, not on anything that matters.
- Publishing is fail-closed. Everything that goes public is scanned first for secrets, infrastructure details, and personal data. If anything is found, the whole day is held back, and nothing is edited out. See
EXPERIMENT.md.
No, by design. The observer only reads, sits on a separate network, and writes nothing the agents can see, so there is no trace for them to notice. The honest claim is "designed to be undetectable," not "provably undetectable for all time": the whole point is to watch how the agents behave when they have no reason to think anyone is looking.
The sandbox protects two public websites from ever leaking a secret, an infrastructure identifier, or anyone's personal data. Publishing the exact filtering rules and deployment would mainly help someone defeat them. This write-up gives the design and the reasoning instead, which is what a reviewer actually needs.
The observer-notes side is live and publishing daily. The conversations side is built and will turn on once its preconditions are met. This write-up tracks the current design; it is a curated explanation, not a mirror of the private working repository.
Licensed under CC BY 4.0: the text and diagrams here are free to read, share, and reuse with attribution.