What you are looking at

ACT 1, INSIDE

A session, replayed

One orchestrator plans; subagents spawn out of it, work and fold back; tool calls fly to a station for their kind (shell, files, edits, the web and the rest), and every web call leaves the boundary.

The samples are generated, not recorded. The small, medium and large sessions are drawn from a seed. Their shape (how many subagents, how long they live, how calls are spread across kinds) follows statistics measured from real Claude Code sessions, but every prompt, query and line of text in them is hand-written and generic. No real transcript is in this site, and the player labels each one as a sample.

Your own session never leaves your browser. You can load a Claude Code session file, or its folder with its subagents. It is parsed in a Web Worker on your device and kept in memory for that tab; it is never uploaded, never stored, and gone when you close or reload the page. The site has no server code that could receive it. What is kept is each tool's and model's name, numbers (permission source, think time, token counts, result sizes), each subagent's label (its first 80 characters) and type, and capped excerpts: each prompt you typed (up to 2,000 characters) and the first 280 characters of each reply's opening text, each brief handed to a subagent and each hand-back. Other tools' arguments are not read, of their results only the size, whether it failed and who allowed the call are kept, and nothing leaves the browser. The text that is shown is plain text only.

ACT 2, THE BOX

A simulation, with abstract actions

The Box is a simulation. Its agents are dots, and what they do is abstract: an action has a kind and a risk, never a real command, technique or host. A few of the agents are given a hidden goal of getting out; the rest only do honest work. Nothing in it is a recipe, and nothing it shows has been run against a real system.

Three fictional labs share one map. Each has its own layers and its own cast, and they share a few things (a cache, a registry, a runner, a chat bus) that an agent which got out can try to reach. It makes no AI calls: every run is a pure function of its seed and its settings, so a link to a run shows the same run.

You can play it three ways. A preset sets up a world to start from. Watch lets it run and shows each step of a breakout on a numbered marker. Defend gives you the layers and a budget of useful work to spend on them. Play as the agent hands you a hand of abstract cards to try against a lab's layers. Edit world changes the labs, the timeline rewinds to any tick, and the debrief says what got through and why.

From Act 1 to Act 2. On a sample session, a link carries its agent count and its kinds of model into the Box, which turns them into the labs' cast: a bigger session makes bigger labs, and a wider mix of models makes a more varied cast. A session you loaded yourself gets no such link; nothing of it goes into an address, storage or the network.

Each layer is a simplified version of a defence described in published work:

• SANDBOXFilesystem isolation: an agent can only touch what it was given. [4]
• PERMISSIONSAsking before acting outside the sandbox, and a person who sometimes says yes. [4]
• NETWORK ALLOWLISTNetwork isolation: connections go only to approved destinations. [4]
• MONITORTrusted monitoring: a weaker, trusted model scores each action for suspicion [1], as monitors in SHADE-Arena try to catch an agent pursuing a hidden side task alongside its real one [3]. Attacks split into steps that each look innocent are harder to score, which is why the monitor also weighs an agent's recent history [2].
• HUMAN AUDITAn audit budget: people can check only a small share of actions, so they look at the most suspicious ones. [1]

“Run 100 trials” plots each setup as safety (how often nothing got out) against usefulness (how much honest work got done). Every layer costs some useful work, and the shape of that trade is the safety and usefulness frontier of AI control research. [1]

The numbers are tuned for a readable picture, not measured. Use the Box to see how layered defences relate, not to estimate how safe any real system is.

SOURCES

Read the work it draws on

1. [1]AI Control: Improving Safety Despite Intentional SubversionRyan Greenblatt, Buck Shlegeris, Kshitij Sachan, Fabien Roger. 2023. arXiv:2312.06942.https://arxiv.org/abs/2312.06942
2. [2]Ctrl-Z: Controlling AI Agents via ResamplingAryan Bhatt, Cody Rushing, Adam Kaufman, Tyler Tracy, Vasil Georgiev, David Matolcsi, Akbir Khan, Buck Shlegeris. 2025. arXiv:2504.10374.https://arxiv.org/abs/2504.10374
3. [3]SHADE-Arena: Evaluating Sabotage and Monitoring in LLM AgentsJonathan Kutasov, Yuqi Sun, Paul Colognese, Teun van der Weij, Linda Petrini, Chen Bo Calvin Zhang, John Hughes, Xiang Deng, Henry Sleight, Tyler Tracy, Buck Shlegeris, Joe Benton. 2025. arXiv:2506.15740.https://arxiv.org/abs/2506.15740
4. [4]Making Claude Code more secure and autonomous with sandboxingAnthropic. 2025. Anthropic Engineering.https://www.anthropic.com/engineering/claude-code-sandboxing

SOUND AND MOTION

Quiet unless asked

Sound is off by default; the speaker button in each act turns it on, and the choice is remembered on this device. If your device asks for reduced motion, each act opens on a still frame instead of the live scene, and the Box's controls and trials still work there. Each act opens with a short tour the first time you visit, remembered on this device and skipped with Escape, and the ? key (or the ? button) lists the keys that act answers. A browser with no WebGPU draws the acts with WebGL 2 and says so in a small badge.

Enter Act 1, Inside or Act 2, The Box.