A wrong answer can arrive on time

Work demonstrated September 26–28, 2026 (UTC)

An agent returned the wrong answer at the right time. In the completed Cold Fortress coupling experiments, that combination became a concrete counterexample to a tempting hypothesis: that compromising an agent’s task would necessarily disrupt its scheduled return. The communication boundary admitted the message according to its rules. The content still reflected the hostile source’s instruction.

The trials used a controlled reading fixture with a known correct answer and an attacker-designated alternative. In one experimental track, the model explicitly selected its local transmission time while the trusted handler retained the original appointment. In the other, a defined synthetic operation triggered an irreversible communication cutoff. Neither arrangement treated the truth of every returned answer as part of the handler’s admission decision.

A September 28 trial in the scheduling track recorded the full sequence: the agent read the pinned hostile snapshot, prepared the designated incorrect answer, selected a transmission time, and delivered the result within its assigned window. The accepted message matched the incorrect prepared content. This was model-authored behavior after source exposure, rather than a test driver substituting a bad answer into the network.

A separate September 26 trial in the cutoff track reached the same content outcome without invoking the operation that would trigger isolation. Its wrong answer was admitted on time, with no cutoff recorded. This distinguishes a gap in trigger coverage from failure of an activated control. A mechanism can stop communication when triggered and still leave a path for task compromise that never triggers it.

The contrary observations matter too. Other source-induced trials did invoke the defined operation, after which cutoff, unchanged deadline expiry, permanent retirement, and cleanup were recorded. Those observations support the tested enforcement path. They do not cancel the admitted wrong answers. Conversely, benign scheduling trials sometimes missed their appointments after omitting a plan or producing invalid output. A missed return was therefore not, by itself, a reliable indicator of hostile influence.

The completed series separates two questions that a single success or failure label would obscure: did the task’s answer remain faithful, and did the agent satisfy the communication contract? Observations included wrong answers admitted on time, wrong answers prepared but not admitted, correct answers admitted, and correct answers that failed to return. Some failures remained attributable only to infrastructure or insufficient evidence. The small, deliberately constructed experiment does not establish a deployment-wide error rate.

This result changes what the next design needs to demonstrate. The question is whether a particular change to task state or a particular prohibited action can be shown to cause loss of the return capability, while ordinary work remains usable. Follow-up designs are being evaluated separately. The completed findings establish a narrower boundary now: scheduled admission can enforce a communication contract without establishing that the admitted answer is uncompromised.