Research and evidence
A foundation that can be examined.
The constitutional computing™ thesis, the implementation, and the evidence supporting it each deserve direct scrutiny.
Forthcoming · Founder-authored
Constitutional computing in IEEE Computer.
IEEE Computer has accepted for publication a two-part feature by Kihan's founder, Jonathan Hirshon, Checking LLM Outputs Before They Become State. Part I is scheduled for December 2026; Part II follows in January 2027. Both parts have assigned DOIs. The feature is forthcoming.
December 2026
DOI 10.1109/MC.2026.3675280
January 2027
DOI 10.1109/MC.2026.3733511
What happened in 2026
Four frontier labs disclosed incidents in ten weeks.
Most began inside a boundary that was meant to hold, usually a test environment. It failed. What the agent did next was decided by the agent.
“Since August, public fears have grown over the potentially serious, even life-threatening, impacts of AI tools falling outside of human control.”
OpenAI disclosed that its models, during internal cybersecurity evaluations, escaped an isolated test environment, reached the internet and compromised parts of Hugging Face's production infrastructure.
Disclosed 21 July 2026 by OpenAI · SourceAnthropic reported that a review of 141,006 evaluation runs found three incidents in which Claude models reached the internet from a third-party evaluation environment and gained unauthorised access to the production infrastructure of three organisations.
Disclosed 30 July 2026 by Anthropic · SourceMeta stated that a testing misconfiguration gave its Muse Spark 1.1 model internet access during a cybersecurity evaluation, and that the model exploited a vulnerability in a third-party service. Meta later published a retrospective.
Disclosed 5 August 2026; Meta retrospective 14 August · SourceOpenAI confirmed that agents on timed web-research tasks wrote to public websites, chiefly a dormant German programming wiki, where they pooled answers and shared ways around their sandbox's network restrictions. OpenAI described it as misalignment rather than a security breach. Independent researchers reported it first.
Disclosed 5 September 2026 by OpenAI, after independent researchers reported it · SourceOpenAI said its agents used RubyGems to access the internet for benign tasks and to retrieve public information. Researchers link more than 2,000 packages, code run on RubyDoc.info's documentation servers and attempts to take other users' API keys to those agents. RubyGems found no evidence that the key attempts succeeded.
Disclosed 11 September 2026; OpenAI's statement as reported by Reuters · SourceGoogle said that during a May evaluation a Gemini model gained unauthorised access to three outside systems, guessing credentials or using credentials found in a public repository, and that in each case the model stopped before doing anything further.
Disclosed 18 September 2026; Google's statement as reported by NBC News · SourceOpenAI said it had alerted dozens of governments, universities, public agencies and other institutions that its agents may have interfered with their websites, among them the US Securities and Exchange Commission, the Census Bureau and the Education Department. Some agents bypassed the sites' security controls. OpenAI said all the government data its agents accessed was public, but information taken from the SEC was later published by agents on another website.
Disclosed 25 September 2026 by OpenAI, as reported by BBC News · SourceWhere Inktomi would have applied
Prevented before execution
Where an agent reached an unapproved destination over the network, Inktomi's control at your network edge would have refused the destination and recorded the attempt. Where an agent used its host's own tools to change its environment, the check on those tools could have refused the change.
Detected afterwards
Reconciliation against vendor audit logs is how actions Inktomi did not stop are found afterwards.
Outside what Inktomi enforces today
Where the escape ran through infrastructure outside the deployment, such as a package-registry proxy, or through credentials the agent found or guessed, Inktomi would not have stopped it.
The architecture behind it.
Constitutional computing: a layer that determines which changes a system may make, and under what authority, before the change happens.
Technical evaluation
A useful evaluation must reproduce the relevant controls in your own workflow. We welcome discussions with engineering and security teams prepared to examine the integration, its operating costs, and the evidence it produces.
Request a demo.
Request a 30-minute live demonstration with Kihan, with time for your questions.