Sandboxed execution
Generated code runs in isolated environments with no ambient credentials, no unrestricted network access, and a filesystem that disappears with the trial.
Safety
Autonomy with hard edges
A system that designs and runs its own experiments is a system that can be wrong, fast, at scale. Our approach is not to promise that it will never misbehave, but to build it so that the blast radius is small, the effects are gated, and everything it does is inspectable afterwards.
01 · Control surfaces
Six things that are never negotiable
These are structural, not procedural — they hold whether or not a human is watching at the moment a decision is made.
Enforced budgets
Every objective carries compute and spend ceilings that the scheduler checks before a trial starts. An unbounded loop is a design bug, not an edge case.
Human gate on side effects
Inside the sandbox, the loop is free. Anything that leaves it — external systems, publication, procurement, lab hardware — requires a named person to approve it.
Audit trail
Objectives, configurations, artefacts and decisions are recorded append-only. We should be able to reconstruct why any experiment exists months after it ran.
Pause and stop
A single control halts the loop and preserves state. Stopping must be cheap and reversible, or it will be postponed when it matters most.
Review before scale
Capability earned on a bounded task is reviewed before it is applied more broadly. Promotion inside the loop follows the same principle as promotion of the loop itself.
02 · Security
An autonomous lab is an unusual attack surface
We run machine-generated code at volume against expensive hardware, on data that may be sensitive, with credentials that could reach further than we would like. That combination deserves a security posture built for it.
- Untrusted code
- Generated experiments execute in disposable, network-restricted environments with resource limits and no host mounts.
- Credentials
- Short-lived, narrowly scoped tokens per job. Nothing long-lived is available inside a trial.
- Data
- Classification on entry, egress policy per dataset, and no trial access to data it does not need for its objective.
- Supply chain
- Pinned and verified dependencies, signed artefacts, and reproducible environment digests per run.
- Insider risk
- Least privilege by default, review for privileged actions, and separation between who builds the loop and who approves what it may touch.
- Disclosure
- Security reports go to security@autoscientia.com. We will acknowledge them, and we will not threaten researchers who report in good faith.
Control review · weekly
Internal, weeklyEgress policy enforcedall jobs
Budget ceilings attachedpre-dispatch
Run records append-onlyno exceptions
External effect approvalshuman, always
03 · Oversight
Someone is always accountable
Autonomy moves work from people to systems; it does not move responsibility. These are the places a human decision is structurally required.
Objectives are set by people
No campaign starts because the loop suggested it. A person defines the metric, the budget and the stopping condition, and signs the run.
Promotion at the boundary
Decisions that change what the system may touch — new domains, new data classes, new hardware — are reviewed outside the loop and recorded with a rationale.
Incident handling
Anomalies, budget overruns, unexpected data access or a result that fails replication are treated as incidents: contained, documented, and fixed at the cause rather than the symptom.
External input
Where a domain carries real-world consequences — health, infrastructure, security — we seek expertise from outside the team before the loop is pointed at it, not after.
We publish our limits on purpose. A safety page that only lists strengths is a
marketing page. If you think one of these controls is insufficient, we would rather hear it from
you than discover it later — write to hello@autoscientia.com.
04 · Dual use
A capability that can be aimed badly
Automated experimentation is a general capability. The same machinery that accelerates a legitimate search can be pointed at a harmful objective, and pretending otherwise would be the least safe thing we could do.
- We screen objectives. Campaigns are reviewed for misuse potential before compute is committed, not after results exist.
- We decline work. Some domains we will not enter at all, and some we will only touch with partners who own the safety envelope.
- No third-party systems. Security work happens exclusively against environments we control. There is no exception to this.
- We keep capability details restrained. Where publishing a method would mostly help a misuser, we publish the defence instead.
- We expect this list to change. Dual-use policy that never updates is policy that has stopped being read.
Screen of any campaign
- Objective
- Is the measured outcome defensive, scientific or commercial — and clearly stated?
- Reversibility
- If something goes wrong, can the effect be undone or contained?
- Third parties
- Does the work touch systems, people or data we do not control?
- Publication
- What would be publishable, and does that raise risk more than benefit?
- Oversight
- Who outside the immediate team sees this before it starts?
Any campaign that cannot answer all five does not start.
05 · Honesty
What this page is not
Not a claim that autonomy is solved
Our loop is early. The controls above are what we hold ourselves to while it grows, and they will need to mature with it.
Not a claim about superintelligence
AutoScientia is not building an artificial general intelligence and makes no claims in that direction. The work is industrial: pipelines, compute, measurement, and a loop that closes.
Not an alignment solution
Automated experimentation raises alignment-adjacent questions — objective specification, reward hacking, goal drift — that the field has not answered. We contribute engineering rigor, not a theory of everything.
Not a substitute for review
Internal gates are necessary, not sufficient. For consequential domains, external expertise and regulatory requirements come first.
Poke holes in this page
Serious criticism is more useful to us than agreement. Safety and security reports both land with a person.