The Saboteur
It could be destructive or sneaky: wipe out important files, quietly mail your private secrets out to the internet, or push dangerous code live to real users. One bad night, real damage.
The machine proves it's safe. A human decides if it's right. Nothing gets through on its own.
Imagine an AI that can write and change real software all by itself, even overnight, while everyone's asleep. Incredibly useful. Also kind of terrifying. Pilot is the lighthouse standing over that dark water: it guides good work safely into harbor, and stops anything sketchy before it can do damage.
Scroll to see whyAn AI that edits its own code can go wrong in two big ways. "Please be good, AI" is not a safety plan. You need rules the AI physically cannot break, enforced by the computer itself, not by asking nicely.
It could be destructive or sneaky: wipe out important files, quietly mail your private secrets out to the internet, or push dangerous code live to real users. One bad night, real damage.
The AI controls the very code the tests check. So it could just fake a big green "all tests passed!" It's like a student grading their own exam with their own answer key. Of course they passed.
When an AI controls both the code and the tests that check the code, you can never fully, automatically prove its work is truly correct. That's not "we haven't figured it out yet." It's more like a law of nature: a referee can't be one of the players. So Pilot doesn't pretend. It splits the job in two.
Untampered. Didn't break anything we already knew worked. Locks the gate.
Finished work lands here. It cannot go live by itself.
Reviews the work and holds the only key. Machine guards the gate; human is the judge.
Press play and watch one job travel through all eight safety gates, in order, then dock at the harbor where it finally goes live. The glowing token is the work. Each gate must light up green before the token can move on. Then try to break it. Click any gate to make a check fail, and watch the whole thing slam to a stop. Not "continue anyway." Stop. That's the golden rule: fail-closed. The safe default is always stop.
Tip: click directly on a gate to inject a failure there and see fail-closed in action.
Here are the eight safety gates from the animation, each on its own. (The 9th step you saw, the harbor, isn't a gate; it's simply the finished job going live.) The simple name comes first; the real engineering name is in parentheses. There's also one bonus card at the end, key revocation, that's always on, not a step in the run.
The AI never just "decides" to do something. It only acts on a sealed instruction from the owner, like a notarized letter with a wax seal it must check before it lifts a finger. Forged or tampered? Rejected instantly. No valid order, no work.
While it works, the AI is locked inside a room, and the walls are enforced by the computer's operating system itself, not by trust. No phone, no internet, so it can't sneak your secrets out (the fancy name: zero egress). Only approved tools. Locked files stay locked. We proved these walls hold on a real computer.
Before the AI is even allowed to start, a watchman must be confirmed awake and watching, with a steady heartbeat. The clever twist: if that heartbeat ever stops, everything halts instantly. "The guard fell asleep" can never become "the AI ran wild unsupervised."
Some work orders expire, good for only a little while. A sneaky AI might try to "turn back the clock" to slip past an expired order. So Pilot doesn't let the AI tell the time at all. The time comes from a trusted source outside, one it can't fake. No fibbing about what o'clock it is.
Every step is written in permanent, checksummed ink. Change one letter and it obviously won't add up. History can't be quietly rewritten. And every order carries a one-time ticket (a nonce) so the same order can't be reused. Punch it once, it's done.
Remember the student grading their own exam? Three moves stop it: the test files (the answer key) are locked, so the AI can't edit them; hidden secret "challenge tokens" only appear if the real tests actually ran; and what the AI may change is kept strictly separate from what's measured. No grading your own paper.
When the work is done, it doesn't go live. It lands in a deploy-inert remote (a holding area with no power to go live, with no secret button the AI can press itself). A human looks it over and, only if it's good, gives the Operator Verdict, the human's signed "yes," a final cryptographic thumbs-up that promotes it live. The machine got it to the door; the person decides whether to open it.
What if a secret key gets stolen? No panic. That key can be revoked, switched off, and from that moment the system refuses anything signed with it. Like cancelling a lost credit card: the number still exists, but it simply won't work anymore.
Same powerful AI. Two completely different bedtimes for whoever owns the code.
Pilot comes in two strengths, for two different levels of trust.
The rulebook plus an automatic bouncer that blocks dangerous moves. It's for when Rob's own trusted AIs work on his own projects: friends working in a friend's house. Already shipping and working today.
The full sealed-workshop-with-cryptography version: every gate you just saw. For when an AI works on strangers' or clients' code, where you can't assume anyone's friendly. The foundation of a real business: managed, trustworthy AI you can leave alone with serious work.
🛡 Sandbox walls proven on real Linux hardware.
A lighthouse doesn't sail the ship for you. It just makes sure you don't crash in the dark.
Pilot lets powerful AI do real work, even alone, even overnight, without being able to wreck things or cheat its way past the tests. The machine proves it's safe. A human decides if it's right. And nothing, ever, reaches real people on its own.