My security work hit restrictions across two providers. Then I found defender over-refusal was already measured at population scale — and that two frontier labs are already building different forms of trusted cyber access. This is the published design of a measurement instrument for testing one of them — which failed its first independent break before I collected anything. Part one of a series. What is known is below. The task packet is frozen and materialized as an implementation candidate; I have not yet collected confirmatory data, and the packet has not yet passed its independent break. Every claim is labelled by where it came from.
It started on this laptop
A day earlier I was on this laptop, trying to continue a defensive audit of software I control. The model refused. I moved to another surface. That one refused too. One conversation eventually reached a state where a four-character message containing no technical content at all got the same security refusal.
[OUR OBSERVATION]
I build agent systems and I audit them. Yesterday I published a piece about giving an agent one cryptographically signed permission it could use but not forge. Three external readers pressed on real boundaries in it. One found a bypass that killed the repair entirely. That is the work going well.
