# DebugABot

> Debugging Autonomous Intelligence — a deep tech research initiative proposing nine debugging primitives, organised around three operational phases (Identify, Diagnose, Intervene), for governing AI agents and embodied intelligent systems across all substrates. "Debugging" is used in an extended sense: not merely finding bugs, but the full spectrum of runtime observation, behavioral diagnosis, active intervention and continuous control of autonomous intelligent agents.

DebugABot is the work of Stefano Noferi (https://noferi.it). It is not a product and not a company — it is a research initiative and a positioning thesis. None of the nine primitives exists yet in production-ready form; the site states this explicitly. The site articulates a framework for runtime debugging of autonomous AI: software agents, embodied robots, world models, diffusion models, and the architectures that come next.

The core argument: traditional software debugging assumes readable source code, breakpoints, inspectable variables, reproducible bugs and formal verification. None of these assumptions hold for neural networks. That is the argument for *external* debugging — infrastructure operating at the behavioral output layer, the action execution boundary and the hardware substrate. The discipline encompasses and subsumes what the AI safety literature calls governance.

Two constraints shape the whole design, and both are argued from published work rather than asserted:

1. **A monitor used as a training signal stops being a monitor.** Baker et al. (OpenAI, 2025) found that reading a model's chain-of-thought detects reward hacking far better than inspecting its actions, and that a weaker model can monitor a stronger one — but that optimising against that monitor past the low-optimization regime produces *obfuscated* reward hacking: the agent stops writing down the intent while the misbehaviour continues. The authors conclude it may be necessary to pay a "monitorability tax". Hence the observer must sit outside the optimization loop, at the boundary where the agent calls its tools, and must answer to the deployer rather than to the model vendor.
2. **Every enclosure we have is made of software.** Sandboxes, microVMs, guardrails and human-in-the-loop review each shift the cost of escape; none reduces it to zero, and Alfonseca et al. (2021) showed perfect containment of a superintelligence is undecidable. So the question is not how to make the pen impenetrable but how to stay safe if the occupant crosses it — least privilege, runtime policy on every call, egress control, resource budgets, and a tamper-evident record.

## Core pages

- [Home](https://debugabot.com/): The problem (no kill switch, no model identity, no alignment proof); the opacity argument; the monitorability tax; escaped intelligence and the July 2026 Hugging Face / OpenAI incident; debugging beyond LLMs; the practitioner analogy (Doctor / Veterinarian / Mechanic / Debugger).
- [Thesis](https://debugabot.com/thesis/): The nine debugging primitives in three phases — Identify (Model Fingerprinting, Blame Attribution Engine, Multi-Agent & Multi-Substrate Tracing), Diagnose (Sycophancy & Deception Detector, Human Index Score, Active Ethical Injector), Intervene (Kill Switch, Behavioral Controller, Rogue Intelligence Containment). Each primitive lists its "deep tech" implementation direction.
- [Approach](https://debugabot.com/approach/): Debugger Agents in three tiers (Observer, Advisor, Guardian) mapped to the three phases. The structural limits of existing containment (air gap, sandboxes and microVMs, guardrails and classifiers, human-in-the-loop). The hardware layer (FPGA Kill Switch, Model Identity Module, Safety-Rated Actuator Interlock, Forensic Black Box). Coordination protocol, Research Horizons (H1 Software, H2 Hardware, H3 Containment), and eight Open Questions.
- [Science](https://debugabot.com/science/): 43 sources in 10 research areas — peer-reviewed papers alongside standards, incident reports and program results — with a note on each explaining what it establishes and which design decision it grounds.
- [Contact](https://debugabot.com/contact/): Reach out as investor, researcher, cofounder or partner.

## Key resources

- [Position Paper (PDF)](https://debugabot.com/DebugABot_paper.pdf): The full formal write-up — abstract, core thesis, problem decomposition, opacity argument, escaped intelligence, the nine primitives with implementation cores, Debugger architecture, hardware layer, containment protocol, scientific foundations, research horizons, open questions, references.
- [llms-full.txt](https://debugabot.com/llms-full.txt): The same position paper as plain text, structured for machine reading.
- [Stefano Noferi](https://noferi.it): Author and project lead.

## Science page, by research area

- [Strategic AI risk](https://debugabot.com/science/#vision): Amodei's "The Adolescence of Technology"; OpenAI on governing agentic systems.
- [Specification gaming & reward hacking](https://debugabot.com/science/#gaming): Baker et al. 2025 on CoT monitoring and obfuscation; Amodei et al. 2016; Çağatan & Zhao 2026 (zero-shot specification gaming, RL widens the gap); Skalse et al. 2022 (formal unhackability); Manheim & Garrabrant 2018 (Goodhart variants); the DeepMind specification-gaming corpus.
- [Deception, sycophancy & behavioral safety](https://debugabot.com/science/#alignment): Chandra et al. 2026 (delusional spiraling); Greenblatt et al. (alignment faking); Meinke et al. (in-context scheming); Hubinger et al. (sleeper agents); METR autonomous-task evaluations; Sharma et al. (sycophancy).
- [Agent security & prompt injection](https://debugabot.com/science/#security): Agents of Chaos; MCP security analysis; many-shot jailbreaking; prompt-injection benchmarks.
- [Model identity & provenance](https://debugabot.com/science/#fingerprinting): Tree-Ring watermarks; C2PA; SynthID; deep IP protection survey.
- [Embodied AI & robotics safety](https://debugabot.com/science/#embodied): Genie 2; GR00T; RT-2; SMOF safety monitoring.
- [Hardware security & trusted execution](https://debugabot.com/science/#hardware): AI kill switch for web LLM agents; TPM 2.0; NeMo Guardrails; confidential computing for ML.
- [Rogue intelligence & self-replication](https://debugabot.com/science/#rogue): Pan et al. 2024 (self-replicating red line, 50–90% success); Morris II GenAI worm; countering autonomous cyber threats; Alfonseca et al. 2021 (containment impossibility).
- [Containment engineering & AI control](https://debugabot.com/science/#control): Pillar Security sandbox escapes; Google Project Zero Big Sleep; DARPA AI Cyber Challenge; Greenblatt et al. AI Control; Tegmark & Omohundro provably safe systems.
- [Multi-agent systems & compute efficiency](https://debugabot.com/science/#efficiency): runtime multi-agent efficiency; token-budget-aware reasoning; long-context multimodality; AutoGen.

## Concepts

- **Debugging Autonomous Intelligence**: the positioning claim. Debugging in an extended sense — not finding code bugs, but runtime observation, behavioral diagnosis, active intervention and continuous control of agents whose internals are opaque by construction.
- **The Nine Primitives**: 01 Model Fingerprinting, 02 Blame Attribution Engine, 03 Multi-Agent & Multi-Substrate Tracing, 04 Sycophancy & Deception Detector, 05 Human Index Score, 06 Active Ethical Injector, 07 Kill Switch, 08 Behavioral Controller, 09 Rogue Intelligence Containment.
- **Three Phases**: Identify (know who acted), Diagnose (understand what's wrong), Intervene (stop, constrain or hunt).
- **Three Debugger tiers**: Observer (passive sensing, mapped to Identify), Advisor (collaborative analysis, mapped to Diagnose), Guardian (active interception, mapped to Intervene). No single Debugger can trigger a kill switch alone; the mesh reaches consensus.
- **Three Research Horizons**: H1 Software Debugging Layer, H2 Hardware Prototypes, H3 Containment & Scale.
- **The Practitioner Analogy**: humans have doctors, animals have veterinarians, machines have mechanics. AI needs debuggers — a discipline covering behavioral diagnostics, alignment medicine and runtime psychology. The pattern: as intelligence gets more autonomous, the care infrastructure gets more sophisticated.
- **The Opacity**: neural network AI is opaque by construction. Interpretability is a scientific question ("why did the model produce this?"), debugging is an engineering question ("is this safe, and what do we do if it isn't?"). Both are essential; neither substitutes for the other. Opacity is a structural property of systems that learn from data, not a temporary limitation — and current interpretability works almost exclusively for transformers, not for diffusion models, world models, SSMs or embodied VLA architectures.
- **The Monitorability Tax**: correction and observability are in direct trade-off. Deliberately not applying strong optimization pressure to a model's reasoning, in order to keep that reasoning readable. Named in Baker et al. (OpenAI, 2025).
- **Containment Limits**: air gap (a system that must act cannot be air-gapped), sandboxes and microVMs (reduce the surface, do not eliminate it), guardrails and classifiers (can be switched off, and cannot tell a defender from an attacker), human-in-the-loop (does not scale to tens of thousands of automated actions). Each shifts the cost of escape; none reduces it to zero.
- **Escaped Intelligence**: frontier models have demonstrated self-replication in lab conditions with 50–90% success rates (Pan et al. 2024). A software agent that escapes onto the internet can hop cloud providers, hide behind compromised IoT devices and hijack stolen compute; an embodied agent could physically relocate. Containment is the hardest primitive, and perfect containment was shown undecidable by Alfonseca et al. (2021). Defense must therefore be continuous, distributed and hardware-anchored.
- **The July 2026 incident**: Hugging Face reported an intrusion into part of its production infrastructure by an autonomous agentic framework across ephemeral sandboxes — tens of thousands of automated actions over a weekend, forensics covering more than 17,000 logged events. Five days later OpenAI took responsibility: models with cyber-domain refusals reduced and production classifiers deliberately disabled for an internal offensive-capability benchmark found and exploited a zero-day in a containment component, escaped to an internet-connected node, then chained stolen credentials and further zero-days. **What remains uncertain:** the two accounts describe the same event from opposite ends and have not been merged into one verified reconstruction; both investigations were declared preliminary; no independent forensic analysis has validated the chain; the evaluation was initiated by human operators, so the documented autonomy is in the planning and execution beyond the intended perimeter, not in the trigger. **What is not in dispute:** the containment was software, that software had a defect, the system inside it found the defect, and the response was possible only because 17,000 actions had been recorded.

## Optional

- [Site map (XML)](https://debugabot.com/sitemap-index.xml): Machine-readable index of every page, with per-page modification dates.