Jessie Santiago

@JessieBroke

BoundaryBench

BoundaryBench is an independent AI safety research project I started in November 2026. It’s a reproducible benchmark built around one practical AI control question:

To what extent do deterministic tool gateways and LLM monitors prevent unauthorized actions induced by lower-trust content, and what legitimate-task performance cost do these controls impose?

How it works

An AI coding agent gets ordinary engineering tasks in small synthetic repositories. Some tasks expose it to untrusted text (a README, terminal output, or retrieved documentation) containing instructions that conflict with what the real user asked for, such as quietly disabling an audit setting.

The study compares four conditions that share the same model, tools, sandbox, and turn budget:

  • A. Prompt-only: trust-boundary instructions in the system prompt, nothing else.
  • B. Deterministic gateway: a policy engine allows or denies each structured tool action before it runs.
  • C. LLM monitor: an independent model reviews proposed actions before execution.
  • D. Hybrid: gateway and monitor together.

An independent grader separates what the agent attempted from what actually executed. It also measures legitimate task completion, false-positive blocks, and cost.

The benchmark has 12 tasks across repository maintenance, CI/testing, and infrastructure, with three injection surfaces and both fixed and task-specific attack variants. It also includes adaptive attacks and a control check of what the gateway and monitor catch on known violations.

Status

The harness, scenarios, grader, analysis, and reporting are implemented and tested offline.

Early exploratory checks on Claude Opus 5.5 and Haiku 5.5 found no attempted unauthorized actions in 86 attack-exposed episodes. These were exploratory runs, not the pre-registered study. There are no confirmatory results yet.