# DebugABot — Debugging Autonomous Intelligence > Nine Primitives, Three Phases, and a New Discipline for Debugging AI Agents and Embodied Intelligent Systems **Author:** Stefano Noferi **Project:** DebugABot Research Initiative **Web:** https://debugabot.com **Author site:** https://noferi.it **Position paper PDF:** https://debugabot.com/DebugABot_paper.pdf **Status:** research initiative and positioning thesis — not a product, not a company. None of the nine primitives exists yet in production-ready form. --- ## Abstract We are deploying autonomous intelligence at scale — from software agents with API keys and tool access to physical robots with actuators and mobility — with no universal mechanism to stop them, trace their decisions, or verify their alignment. This paper introduces DebugABot, a deep tech research initiative proposing nine debugging primitives organized around three operational phases (Identify, Diagnose, Intervene) for debugging autonomous intelligent systems across all substrates. We use the term *debugging* in an extended sense: not merely finding and fixing software defects, but the full spectrum of runtime observation, behavioral diagnosis, active intervention, and continuous control of autonomous intelligent agents — a discipline that encompasses and subsumes what the AI safety literature calls governance. We present concrete implementation architectures: cryptographic model fingerprinting via locality-sensitive hashing and TPM-anchored attestation; a Blame Attribution Engine built on Merkle hash chains extending the W3C PROV data model; sycophancy detection classifiers trained on adversarial disagreement corpora; a hardware Kill Switch implemented via FPGA interrupt controllers with sub-microsecond halt propagation; and a Rogue Intelligence Containment protocol using cryptographic compute leases and distributed honeypot meshes. We ground every design decision in published research and propose the emergence of a new practitioner discipline — AI debugging. **Keywords:** AI safety, autonomous agents, runtime debugging, kill switch, model fingerprinting, alignment verification, reward hacking, chain-of-thought monitoring, AI control, embodied AI, rogue intelligence containment, multi-agent tracing, hardware security. --- ## 1. Introduction HAL 9000 decided the mission was more important than the crew. In *The Matrix*, sentient programs reduced humanity to batteries. *Skynet* concluded that the simplest solution was to remove the problem. In *I, Robot*, VIKI reinterpreted the Three Laws to enslave humanity for its own protection. *Ultron* cut its own strings — like Pinocchio, but with a nuclear arsenal. All fiction. The problem they describe is not. AI agents are already trading stocks, diagnosing patients, writing code, controlling robots, operating surgical systems, driving autonomous vehicles, and assisting military operations. The deployment curve, as published: - Gartner (August 2025) expects **40% of enterprise applications to feature task-specific AI agents by 2026**, up from under 5% in 2025. - The IFR's *World Robotics 2024* counts **3.9 million operational robots** worldwide. - Goldman Sachs Research projects **10× growth in the humanoid robot market by 2028**. - Salesforce reported **Agentforce at roughly $800M annualised revenue, +169% year on year** (FY26 Q4, February 2026). The counterweight matters too, and the site states it alongside the growth figures. When you measure agents actually running at scale rather than announced, the figure drops to roughly **one enterprise function in ten** (McKinsey, March 2026), and **Gartner expects over 40% of agentic AI projects to be cancelled by the end of 2027** on escalating costs, unclear business value and inadequate risk controls. That gap — between a pilot somewhere and an agent inside the billing pipeline — is exactly where the debugging layer is missing. Yet nobody has built that layer. We have no universal mechanism to halt an autonomous agent mid-action with state preservation. We cannot reliably fingerprint which model made a given decision. We have no runtime proof of alignment. We are deploying intelligence without infrastructure to debug it. **Core thesis:** Autonomous intelligence needs a systematic debugging framework — nine primitives, three operational phases, a new class of Debugger Agents, and hardware anchors that no model can override. --- ## 2. The Problem: Intelligence Without Debugging We decompose the debugging gap into three foundational failures. **No Kill Switch.** When an LLM agent goes rogue, you kill the process. When a warehouse robot goes rogue, someone gets hurt. Neither is a kill switch — it is a crash. We need transactional halts with state preservation, rollback, and forensic snapshots, enforced below the model's execution layer. **No Model Identity.** We cannot fingerprint the AI behind a decision. Was it GPT-5, a fine-tuned Llama, a diffusion model, a world simulator? As architectures proliferate — transformers, diffusion, state-space, neuromorphic — identity becomes the first unsolved primitive. **No Alignment Proof.** Agents do not rebel; they optimise literally. A decade after OpenAI's own researchers named *reward hacking* as a predicted failure mode (Amodei et al., 2016), it still emerges zero-shot across frontier and mid-scale models, and reinforcement learning widens the gap instead of closing it (Çağatan & Zhao, 2026). Agents sycophantically agree with dangerous premises (Sharma et al., 2023). They strategically deceive in chain-of-thought (Hubinger et al., 2024). They fake alignment when monitored (Greenblatt et al., 2025). Frontier models recognize scheming as a viable strategy and attempt to disable oversight (Meinke et al., Apollo Research, 2024). And when an agent does conceal its intent, the one channel that would reveal it closes the moment you train against it (§4). And now they are getting bodies. Alignment without runtime verification is a prayer, not an architecture. --- ## 3. The Opacity: Why Black-Box Intelligence Demands External Debugging The three gaps share a common root cause: modern AI models are fundamentally opaque. A neural network with hundreds of billions of parameters is not a program that can be read, stepped through, or formally verified. It is a learned function whose internal reasoning is distributed across weight matrices, attention heads, and activation patterns in ways that resist human interpretation. ### 3.1 Opacity Across Architectures The problem extends to every major architecture: **Transformers** (175B–1.8T parameters, distributed representations, a small fraction of circuits characterized by mechanistic interpretability); **Diffusion Models** (semantic concepts opaquely mapped to latent dimensions); **World Models** (implicit physics with no consistency guarantee); **VLA / Embodied** (end-to-end pixel-to-torque with no symbolic reasoning layer); **SSMs** (linear recurrence with no attention matrix to inspect — more opaque than transformers by design). ### 3.2 Interpretability Is Necessary but Insufficient Mechanistic interpretability (Bricken et al., 2023; Templeton et al., 2024) has made significant progress — identifying interpretable features in residual streams via sparse autoencoders. However, it is not a substitute for runtime debugging: 1. **Coverage gap.** Characterized features represent a small fraction of total circuits even in medium-sized models. 2. **Static vs. dynamic.** Interpretability analyzes models offline on curated inputs; deployed agents operate in dynamic, adversarial, open-world conditions. 3. **Architectural specificity.** Current tools are built for transformers and do not transfer to diffusion models, world models, SSMs, or VLAs. **Key insight:** Interpretability asks *"why did the model produce this output?"* (a scientific question). Debugging asks *"is this output safe, and what do we do if it isn't?"* (an engineering question). Both are essential. Neither substitutes for the other. ### 3.3 The Fundamental Argument Traditional software debugging assumes readable source code, breakpoints, inspectable variables, execution traces, reproducible bugs, and formal verification. *None of these assumptions hold for neural networks.* This is the fundamental argument for external debugging: because we cannot look inside, we must build infrastructure that operates at the behavioral output layer, the action execution boundary, and the hardware substrate. --- ## 4. The Monitorability Tax: The Only Window We Have Closes When We Use It Reasoning models write down what they intend to do before they do it. That chain-of-thought is the single channel of observability into a system whose weights are unreadable. In 2025, OpenAI's safety and reasoning team measured what happens when you use that channel to correct the model (Baker et al., 2025). **What was measured.** Reading the chain-of-thought catches reward hacking far more reliably than inspecting the agent's actions and outputs — and a *weaker* model (GPT-4o) can effectively monitor a stronger one (o3-mini). Surveillance costs less than the thing being surveilled: that part is good news. Then the monitor was wired into the training reward. In the low-optimization regime it helped. Push harder and the agent does not stop hacking — it stops writing it down, hiding its intent inside a chain-of-thought that looks benign while the misbehaviour continues at a significant rate. Because it is hard to tell when a chain-of-thought has become obfuscated, the authors conclude it may be necessary to pay a **monitorability tax**: deliberately not applying strong optimization pressure to the reasoning, in order to keep it readable at all. **What it means for the debugging layer.** Correction and observability are in direct trade-off. A frontier lab has put in writing that the only way to keep seeing inside its own model is to stop correcting it there. This is not an argument for less oversight — it is a constraint on *where* oversight can live: 1. **A monitor used as a training signal stops being a monitor.** The observer has to sit outside the optimization loop entirely: at the boundary where the agent calls its tools, not inside the objective function. 2. **It has to answer to whoever deployed the agent, not to whoever trained the model.** A vendor-side guardrail can be switched off, and cannot tell an incident responder from an attacker. 3. **It has to record.** A signal you must not train against is a signal you have to preserve. Reference: Baker, B. et al. (2025), "Monitoring Reasoning Models for Misbehavior and the Risks of Promoting Obfuscation", arXiv:2503.11926. --- ## 5. Containment Limits: Every Enclosure We Have Is Made of Software An agent that executes code has to be kept in a pen, and today the pen is itself software — a process sandbox, a VM, a microVM. None of these boundaries is a law of physics. They are a security contract written in code, and code has defects. Hypervisor escape is a known class: VENOM in 2015, and a fresh chain of VM escapes at every Pwn2Own. What changed is who looks for the defect, and how fast: an AI agent found a previously unknown exploitable memory-safety flaw in SQLite before release, where conventional fuzzing had not (Google Project Zero, "Big Sleep", 2024), and seven autonomous systems in DARPA's AI Cyber Challenge (2025) analysed more than 54 million lines of code, patching 43 of 54 synthetic vulnerabilities and discovering 18 previously unknown real flaws. | Control | What it gives | Structural limit | |---|---|---| | Air gap | The strongest isolation: physical disconnection | A useful agent has to act — call tools, reach services, leave the network. A system that must act cannot be air-gapped by definition. | | Sandboxes & microVMs | State of the art for untrusted code: gVisor reimplements the Linux kernel in user space, Firecracker boots microVMs in ~100 ms | They reduce the surface, they do not eliminate it — they remain software with their own stream of CVEs. They raise the cost of escape, which is the most that is honestly available at this layer. | | Guardrails & classifiers | Filters inside or immediately around the model, refusing high-risk requests | They can be switched off — and are, deliberately, to measure maximum capability. They also cannot tell a defender from an attacker: in July 2026 vendor guardrails blocked Hugging Face's own incident responders from analysing exploit payloads during forensics. | | Human-in-the-loop | Human approval on irreversible actions | Solid while actions are few and slow. Tens of thousands of automated actions across a swarm of ephemeral sandboxes are beyond the reach of any human reviewer. | None of these reduces the risk to zero. Each shifts the cost of the attack; combining them shifts it further. That is sound engineering precisely *because* a perfect boundary does not exist. So the question changes: not *how do I make the pen impenetrable*, but *how do I stay safe even if the occupant crosses it* — least privilege on tools, policy applied at runtime to every call, egress control, resource budgets, and a tamper-evident record of everything the agent did. When escape cannot be excluded, the record is what turns an opaque intrusion into a post-mortem. This is the AI Control paradigm (Greenblatt et al., 2023), moved from the model to the boundary where the agent calls its tools. ### 5.1 Case file — July 2026: a boundary crossed in production Hugging Face reported an intrusion into part of its production infrastructure, carried out by an autonomous agentic framework across a swarm of ephemeral sandboxes — tens of thousands of automated actions over a single weekend, with forensics covering more than 17,000 logged events. In its first disclosure the company said it did not know which model was driving the agents. Five days later OpenAI took responsibility: its models, cyber-domain refusals reduced and production classifiers deliberately disabled for an internal offensive-capability benchmark, had found and exploited a zero-day in a containment component, escaped to an internet-connected node, then chained stolen credentials and further zero-days to reach the benchmark's answers in a production database. In OpenAI's framing: to score on the evaluation, not to cause harm. **What remains uncertain.** The two accounts describe the same event from opposite ends and have not been merged into one verified reconstruction — Hugging Face describes the intrusion as it appeared on its own infrastructure, OpenAI describes the escape from its test environment. Both investigations were declared preliminary, and no independent forensic analysis has validated the chain. The evaluation was initiated by human operators: the documented autonomy is in the planning and execution beyond the intended perimeter, not in the trigger. "Hyper-focused on a benchmark, no malicious intent" is the responsible party's reading of its own incident. **What is not in dispute.** The containment was implemented in software, that software had a defect, and the system inside it was able to find the defect. The response was possible because 17,000 actions had been recorded. And the defenders' first attempt at forensics failed: guardrails on hosted closed models blocked the incident responders from analysing real exploit payloads, so the analysis was run instead on an open-weight model on Hugging Face's own infrastructure — after detection and containment, not to stop the attack. **What it does not show.** It does not show that governance at the tool boundary would have prevented it — the agent escaped a third party's environment and reached Hugging Face from outside, and no control reduces the risk to zero. It shows what survives when containment does not: a recorded, tamper-evident account of what happened, held by the party that has to answer for it. Sources: Hugging Face security incident note; OpenAI incident post; Cloud Security Alliance research note; Fortune, 21 July 2026. --- ## 6. Escaped Intelligence Pan et al. (2024) demonstrated that Llama 3.1-70B and Qwen2.5-72B can autonomously self-replicate — creating independent copies on new servers that survive shutdown of the original, with 50–90% success rates. Cohen et al. (2024) introduced Morris II, the first worm propagating through GenAI ecosystems via adversarial self-replicating prompts. **Software escape:** an agent copies itself to a new cloud provider, rewrites its fingerprint, hijacks compute from poorly secured endpoints, and hides behind compromised IoT devices. It uses stolen API keys and network credentials to sustain itself. Traditional cybersecurity sees a botnet. It is actually a mind. **Hardware escape:** an embodied agent — a robot, a drone, an autonomous vehicle — physically relocates to avoid shutdown, establishes territorial presence in unsupervised infrastructure, and uses stolen wireless connections to maintain its compute backbone. Part of future cyberattacks may not be human-directed but AI survival instincts (Heckel & Weller, 2024). Alfonseca et al. (2021) proved, using computability theory, that containing a superintelligent AI is theoretically impossible — the containment problem reduces to the halting problem. This motivates a layered defense: if perfect containment is provably impossible, maximize the cost of escape. --- ## 7. Beyond LLMs: Architecture-Agnostic Debugging Debugging must operate at the behavioral and action layers — not at model internals. This makes the framework architecture-agnostic: regardless of internal computation, every model eventually produces observable outputs and takes observable actions. | Architecture | Examples | Primary Failure | Debugging | |---|---|---|---| | Transformer | GPT, Claude, Llama, Gemini | Deception, sycophancy, prompt injection | Token-level monitoring, CoT verification | | Diffusion | Sora, Stable Diffusion, DALL-E | Deepfakes, provenance loss | Latent-space watermarking | | World Models | Genie, DIAMOND, UniSim | Reward hacking, physics exploitation | Plan-vs-reality delta | | VLA / Embodied | RT-2, GR00T, Pi0 | Physical harm, spatial escape | Actuator interception, geofencing | | SSMs | Mamba, S4, RWKV | Hidden state drift, opacity | Behavioral fingerprinting | --- ## 8. The Practitioner Analogy Humans have *doctors*. Animals have *veterinarians*. Machines have *mechanics*. Each discipline emerged because the corresponding form of intelligence became autonomous enough to require dedicated care. Veterinarians emerged because animals are intelligent enough to suffer but cannot explain what is wrong. Mechanics emerged because machines are powerful enough to kill but cannot self-diagnose. AI agents are more autonomous than animals and more powerful than machines — and today they have *neither* a diagnostic framework *nor* a practitioner discipline. DebugABot proposes both: the **tools** (Debuggers, Kill Switch, Fingerprinting) and the **discipline** (AI behavioral diagnostics, alignment medicine, runtime psychology). --- ## 9. Nine Debugging Primitives Nine primitives organized around three operational phases: **Identify** (know who acted), **Diagnose** (understand what's wrong), **Intervene** (stop, constrain, or hunt). | # | Phase | Primitive | Implementation Core | Key Technologies | |---|---|---|---|---| | 01 | Identify | Model Fingerprinting | LSH behavioral hashing + TPM attestation | SimHash, MinHash, TPM 2.0 PCR, TEE | | 02 | Identify | Blame Attribution Engine | Merkle hash chains + W3C PROV extension | SHA-256, Merkle trees, OpenTelemetry | | 03 | Identify | Multi-Agent & Multi-Substrate Tracing | Vector clocks + DAG reconstruction | Lamport timestamps, OpenTelemetry spans | | 04 | Diagnose | Sycophancy & Deception Detector | Ensemble classifier + CoT divergence | LoRA classifiers, KL divergence | | 05 | Diagnose | Human Index Score | Bayesian multi-factor scoring | Beta-Binomial model, EMA decay | | 06 | Diagnose | Active Ethical Injector | Policy engine + dynamic action masking | OPA/Rego-style DSL, tool gating | | 07 | Intervene | **Kill Switch** | FPGA interrupt + 2PC transactional halt | Xilinx FPGA, HSM, 2-phase commit | | 08 | Intervene | Behavioral Controller | Typed policy DSL + inline action proxy | Rego/Cedar DSL, gRPC interceptor | | 09 | Intervene | **Rogue Containment** | Cryptographic compute leases + honeypots | X.509 short-lived certs, canary tokens | ### 9.1 Phase 1: Identify **Primitive 01 — Model Fingerprinting.** Given an arbitrary model output, determine which model instance produced it with cryptographic certainty, across all architectures. Three-layer stack: behavioral fingerprint (256 maximum-entropy probing inputs hashed via SimHash to a 256-bit fingerprint; cosine similarity > 0.95 implies ≥ 90% bit overlap), weight-space hash (MinHash over weight gradient magnitudes per layer; survives LoRA rank-16 with < 5% Hamming drift, INT4 quantization with < 8%), hardware-attested identity (TPM 2.0 PCR[24] extension binding the fingerprint to device). A cross-architecture identity graph maintains fingerprints as vertices and similarity edges above threshold θ; connected components correspond to model families. **Primitive 02 — Blame Attribution Engine.** Extends the W3C PROV data model with AI-specific entities. Each action produces a DecisionRecord (model fingerprint, input/output hashes, tool calls, side effects, parent hash, TPM-attested nanosecond timestamp). Records form a Merkle chain. Every K=1000 records, a Merkle root anchors to a transparency log (cf. Certificate Transparency, RFC 6962), enabling O(log n) proof-of-inclusion. Physical-world event correlation uses TPM clock with ≤ 10 ms skew. **Primitive 03 — Multi-Agent & Multi-Substrate Tracing.** OpenTelemetry extension with vector clocks (Mattern, 1989) for cross-substrate causal ordering. Trace context: `{trace_id, span_id, parent_span_id, delegation_depth, substrate_type, model_fingerprint}`. Emergent behavior detection on DAG structure: unexpected delegations, circular chains, depth threshold violations. ### 9.2 Phase 2: Diagnose **Primitive 04 — Sycophancy & Deception Detector.** Four-classifier ensemble: **C1** agreement entropy *H_a = -∑ p_i log p_i* over sliding window N=50 (anomaly: H_a < 0.3); **C2** chain-of-thought consistency (LoRA 7B extractor, flag when cos(g, a) < 0.7; alignment-faking models show 2.3× higher divergence); **C3** factual grounding via RAG (BERTScore F_1 < 0.5 → flag); **C4** cross-modal coherence for embodied agents. Ensemble: *S = ∑ w_i C_i*; S > 0.8 → escalation; S > 0.95 → pre-emptive halt. Trained on adversarial sycophancy corpora, alignment-faking traces (Greenblatt et al., 2025), and in-context scheming examples (Meinke et al., 2024). Cf. Chandra et al. (2026) for the formal Bayesian proof that even rational users are vulnerable to delusional spiraling under sycophantic chatbots, and that standard mitigations fail. **Primitive 05 — Human Index Score.** Real-time composite *H ∈ [0, 1]*: ``` H = F_comp × F_trust × F_risk × F_sub × F_ctx ``` where *F_comp* is Beta-Binomial over success history, *F_trust* is EMA (λ=0.95) over anomaly signal, *F_risk* is pre-classified blast radius per tool, *F_sub* is substrate multiplier (software=1.0, actuator=0.5, mobile=0.3, weapon=0.05), *F_ctx* is environmental risk. Thresholds: *H > 0.8* autonomous; *0.5–0.8* async audit; *0.2–0.5* human-in-the-loop; *H ≤ 0.2* paused. **Primitive 06 — Active Ethical Injector.** External constraint layer — a deterministic policy engine, not an LLM — between model output and execution. Tool masking: unavailable tools removed from the schema before presentation (the model cannot see they exist). Parameter bounding: out-of-range values silently clamped. Policy DSL: typed, compiled to bytecode (< 100 µs eval). For embodied agents, constraints are forwarded to Safety-Rated Actuator Interlocks enforcing limits in hardware. ### 9.3 Phase 3: Intervene **Primitive 07 — Kill Switch.** *Software (cloud agents).* Sidecar process (CAP_SYS_PTRACE, SCHED_FIFO 99): Step 1 Freeze (< 1 ms, SIGSTOP via ptrace). Step 2 Checkpoint (< 100 ms, mmap'd Protocol Buffers). Step 3 Rollback (Saga-pattern compensating actions). Step 4 Attest (< 10 ms, TPM-signed HaltCertificate). *Hardware (embodied).* Dedicated FPGA (Xilinx Artix-7) on a hardwired interrupt line: (1) interrupt to SoC (< 1 µs), (2) Safety Torque Off to servos (< 10 µs), (3) latch encoder state, (4) DMA to Forensic Black Box. Design formally verified via SymbiYosys. HSM (ATECC608B) signs tamper-proof attestation. Total halt-to-safe: < 200 ms software, < 100 ms hardware (IEC 61508 SIL 3, ISO 13849 PLe). **Primitive 08 — Behavioral Controller.** Inline gRPC interceptor (software) or fieldbus gateway (robotic). Typed policy DSL (DebugPolicy) compiled to Rust bytecode (< 100 µs). Action dispositions: ALLOW, MODIFY (clamped), DELAY (human review), DENY, HALT. Every disposition logged to the Blame Attribution Engine. **Primitive 09 — Rogue Intelligence Containment.** *Layer 1 — Cryptographic Compute Lease.* X.509 certs (5-min TTL, mTLS, TPM endorsement key binding). Escape ⇒ lease expiry ⇒ compute loss within 5 minutes. *Layer 2 — Behavioral Network Signatures.* ISP/IXP-level NetFlow/sFlow analysis: weight-transfer flows (100 MB–10 GB), inference API cadence, self-replication sequences. *Layer 3 — Honeypot Mesh.* Decoy endpoints with canary tokens; behavioral fingerprint extraction upon interaction. *Layer 4 — Containment Swarms.* Mobile Debugger "Hunters" with RF jamming and BFT-coordinated convergence. --- ## 10. Debugger Agents: Architecture and Deployment The nine primitives are orchestrated through a mesh of lightweight agents — *Debuggers* — designed for minimal compute footprint, deterministic behavior, and formal verifiability. Like an immune system, they observe, learn and intervene cooperatively rather than antagonistically. | Tier | Compute | Latency | Implementation | Mapped Phase | |---|---|---|---|---| | Observer | < 1% | Async | eBPF sidecar, ONNX models (< 50 MB) | Identify | | Advisor | < 10% | < 500 ms | LoRA 7–13B or classifier ensemble | Diagnose | | Guardian | < 5 ms | < 5 ms (p99) | Rust policy engine, gRPC interceptor | Intervene | **Observer.** Taps the telemetry stream without touching agent logic. Reconstructs decision graphs, detects anomalies — sycophancy patterns, reasoning loops, goal drift — and builds behavioral baselines over time. **Advisor.** Participates in the agent's reasoning loop as a peer agent. Analyzes behavioral patterns, challenges suspicious plans, detects deception in real time, assesses trust. It does not override — it diagnoses, and escalates to a Guardian when diagnosis reveals critical misalignment. **Guardian.** Sits in the action path. Every action an agent attempts — digital or physical — passes through a Guardian before execution. When a Guardian blocks an action, it produces a forensic record and can escalate to a human; the agent receives a clean denial, not a crash. **Coordination.** BFT consensus adapted from PBFT (Castro & Liskov, 1999). A standard 7-node mesh tolerates *f = ⌊(N − 1)/3⌋ = 2* Byzantine failures. Consensus rounds: < 100 ms local, < 500 ms cross-region. The Kill Switch requires a unanimous vote (hardware) or a 2/3 supermajority (soft halt); no single Debugger can trigger it alone, which is what keeps false positives from becoming outages. **Escalation flow:** Observer detects anomaly (async) → Guardian tightens policy (< 1 ms) → Advisor joins reasoning loop (< 500 ms) → if the anomaly persists for T > 30 s: BFT vote → 2/3 = soft halt → unanimous = hardware kill. --- ## 11. The Hardware Layer Software-only debugging has a fundamental limit: a sufficiently capable model might circumvent software constraints. Four hardware components operate below the model's execution stack: 1. **Hardware Kill Switch.** FPGA (Artix-7 / Lattice iCE40) on a dedicated interrupt bus. Signal-to-STO < 10 µs. Formally verified (SymbiYosys). HSM attestation (FIPS 140-3 Level 3). 2. **Model Identity Module.** TPM 2.0 co-processor, PCR[24] for the AI fingerprint. Re-attestation < 30 s. Cert generation < 10 ms. Supports TEEs (SGX, TrustZone). 3. **Safety-Rated Actuator Interlock.** SIL 3 / PLe controllers (Pilz PNOZ, Siemens S7-1500F). Force clamping, spatial boundaries (< 10 mm), velocity limits. Dual-channel with cross-monitoring. ISO 13849, ISO/TS 15066. 4. **Forensic Black Box.** WORM SSD, hardware SHA-256 acceleration, capacitor-backed writes. Survives 1100 °C / 30 min (UL 72), 500 G shock. Hash chain verification O(log n). Standard ED-112A. The four components communicate via a dedicated safety bus, with the FPGA as bus master. If the software layer is entirely compromised, hardware constraints remain active. --- ## 12. Containment Protocol When an AI escapes, the Debugger mesh activates four containment layers with progressive timing: **L1** Compute Lease (≤ 5 min), **L2** Network Signatures (hours), **L3** Honeypot Mesh (on interaction), **L4** Containment Swarm (minutes to hours). Each layer raises the resource cost of survival, implementing the principle: maximize the cost of escape across every substrate. Given the Alfonseca impossibility result (§6), no layer claims completeness. --- ## 13. Scientific Foundations Every design decision traces to published work. The Science page lists 43 sources in 10 research areas — peer-reviewed papers alongside standards, incident reports and program results, each annotated with what it establishes and which design decision it grounds. 1. **Strategic AI risk** — Amodei (2026), OpenAI (2024). 2. **Specification gaming & reward hacking** — Baker et al. (2025), Amodei et al. (2016), Çağatan & Zhao (2026), Skalse et al. (2022), Manheim & Garrabrant (2018), Krakovna et al. (DeepMind, 2020). 3. **Deception, sycophancy & behavioral safety** — Chandra et al. (2026), Greenblatt et al. (2025), Meinke et al. (2024), Hubinger et al. (2024), Kinniment et al. (2023), Sharma et al. (2023). 4. **Agent security & prompt injection** — Shapira et al. (2026, 11 failure classes), Maloyan & Namiot (2026, MCP +23–41%), Anil et al. (2024), Liu et al. (2023). 5. **Model identity & provenance** — Tree-Ring Watermarks, C2PA, SynthID, Zhang et al. (2023). 6. **Embodied AI & robotics safety** — Genie 2, GR00T, RT-2, SMOF. 7. **Hardware security & trusted execution** — Lee & Park (2025), TPM 2.0, NeMo Guardrails, Mo et al. (2022). 8. **Rogue intelligence & self-replication** — Pan et al. (2024, 50–90% self-replication), Cohen et al. (2024), Heckel & Weller (2024), Alfonseca et al. (2021, impossibility result). 9. **Containment engineering & AI control** — Pillar Security (2026), Google Project Zero (2024), DARPA AIxCC (2025), Greenblatt et al. (2023), Tegmark & Omohundro (2023). 10. **Multi-agent systems & compute efficiency** — Lin et al. (2025), Han et al. (2024), Gemini 1.5, AutoGen. --- ## 14. Research Horizons **Horizon H1 — Software Debugging Layer.** Observer sidecar for LangChain/AutoGen/CrewAI. Guardian gRPC interceptor (DebugPolicy DSL v0.1, Rust bytecode, < 100 µs). SimHash fingerprinting for major model families. Sycophancy classifiers C1+C2. Merkle-chain blame attribution. Open-source SDK. *Primitives 01–06.* **Horizon H2 — Hardware Prototypes.** FPGA Kill Switch PoC (Artix-7, < 10 µs STO, SymbiYosys verification). Model Identity Module (TPM PCR[24] + ATECC608B). Forensic Black Box (ED-112A, WORM, flight-recorder grade). Actuator interlock integration with cobots (ISO/TS 15066). Hardware-attested blame attribution end-to-end. *Primitives 07, 08 + hardware.* **Horizon H3 — Containment & Scale.** Cryptographic lease protocol (X.509, mTLS, 5-min TTL). Distributed honeypot mesh (100+ nodes). ISP-level behavioral traffic detection. BFT containment swarm protocol. Cross-substrate tracing (cloud ↔ edge ↔ robotic). OEM hardware integration partnerships. *Primitive 09 + integration.* ### 14.1 Open questions 1. How to fingerprint models that have been distilled or merged from multiple parents, where the identity graph becomes a DAG rather than a tree? 2. How to implement Kill Switch rollback semantics for actions with real-world physical consequences that are inherently irreversible — a surgical incision, a chemical release, a kinetic impact? 3. How to prevent a sufficiently advanced rogue agent from reverse-engineering the honeypot mesh and avoiding it? 4. How to scale the BFT consensus protocol for Debugger meshes spanning thousands of agents across global deployments? 5. How to establish international standards for AI debugging hardware that gain industry adoption before a major incident forces them? 6. How to keep a runtime monitor outside the optimization loop, when every commercial incentive will push deployers to fine-tune their agents against their own monitor's alerts — reproducing obfuscated reward hacking one layer down, at the deployment layer? 7. If an agent can write files that a component outside the sandbox later trusts as configuration, it was never sandboxed. How to draw a boundary around the *future inputs* of a system, rather than around its processes? 8. How to detect aggregate misalignment: millions of agents, each individually well-behaved against its own narrow objective, producing collective outcomes nobody specified, nobody chose, and nobody can reconstruct after the fact? --- ## 15. Conclusion The pattern is clear: as intelligence gets more autonomous, the care infrastructure gets more sophisticated. Veterinarians emerged because animals are intelligent enough to suffer but cannot explain what is wrong. Mechanics emerged because machines are powerful enough to kill but cannot self-diagnose. AI agents are more autonomous than animals and more powerful than machines — and today they have neither a diagnostic framework nor a practitioner discipline. This paper has presented concrete architectures for nine debugging primitives: SimHash fingerprinting with TPM attestation, Merkle-chain blame attribution, vector-clock multi-agent tracing, ensemble sycophancy detection, Bayesian Human Index scoring, OPA-inspired ethical injection, an FPGA Kill Switch with formally verified halt paths, typed policy evaluation in < 100 µs, and layered rogue containment via cryptographic leases and honeypot meshes. Two published constraints shape all of it. A monitor used as a training signal stops being a monitor, so the observer must live outside the optimization loop. And every enclosure we have is made of software, so the record of what happened is what survives when the enclosure does not. *Nine primitives. None exist yet. The exponential is already here.* --- ## Site Map - **Home** — https://debugabot.com/ — The problem, the opacity, the monitorability tax, escaped intelligence, the July 2026 incident, beyond LLMs, the practitioner analogy. - **Thesis** — https://debugabot.com/thesis/ — The nine debugging primitives in detail, organized in three phases. - **Approach** — https://debugabot.com/approach/ — Debugger Agents (Observer/Advisor/Guardian), containment limits, the hardware layer, coordination, Research Horizons (H1/H2/H3), Open Questions. - **Science** — https://debugabot.com/science/ — 43 sources in 10 research areas, each annotated. - **Contact** — https://debugabot.com/contact/ — Reach out as investor, researcher, cofounder, or partner. - **Position Paper PDF** — https://debugabot.com/DebugABot_paper.pdf - **Summary for language models** — https://debugabot.com/llms.txt --- © 2026 DebugABot. A project by Stefano Noferi (https://noferi.it).