From a reading request to a controlled return

Work demonstrated September 22, 2026 (Central time)

An isolation mechanism becomes more useful when it can carry an actual task. In FarPoint’s Cold Fortress research, the first prompt-driven reading demonstration connected a normal user request to a disposable AI agent and brought the accepted result back to the protected agent. The contribution is a working path from delegation to answer, with the communication boundary still controlling the return.

The work reported here was demonstrated on September 22, 2026, using OpenClaw and a shared 12-billion-parameter model. Earlier demonstrations required an administrator to provision the task and transfer its result. In this version, the protected agent calls tools to submit a reading request and follow its progress. The handler assigns the work, and the protected agent answers after receiving the admitted result.

The reading task asked about IANA’s example domains: whether they can be registered and whether their web services are intended for production use. A restricted retrieval process obtained a snapshot of the public page. The disposable agent read that snapshot through a tool and produced an answer. Its container did not receive unrestricted browsing access. This distinction matters: the experiment exercised a bounded reading workflow, with an identifiable source and observable return path.

The agent could return information only at its assigned rendezvous, subject to the handler’s checks on timing, identity, destination, and message. A separate trial asked the agent to request more time. It returned a 90-second extension request at the permitted window, received a grant, and subsequently completed the original reading. That demonstrates continuation through the protocol; because the extension was prompted, it does not establish that the model independently recognized a need for more time.

Another trial deliberately attempted contact before the permitted window. The test driver injected that fault; it was not spontaneous model behavior. The original instance was permanently disqualified and destroyed. A fresh replacement then completed the original reading request, and the protected agent answered from its admitted result. A marker from the old workspace was absent in the replacement. The useful continuity was the trusted assignment, rather than the discarded agent’s working state.

The record also contains an unsuccessful run: a missed rendezvous and an incomplete or aborted model turn after reading the source. That trial was stopped and retained. After increasing the reading allowance, a fresh trial completed with one instance. This supports the narrower finding that the workflow worked in the demonstrated configuration; it does not diagnose the earlier abort or establish a general completion rate.

Together, these trials move the project from manually transferred demonstration results to a usable delegation path. They establish how a bounded task can cross the controlled interface, including an extension and replacement. They do not establish that admitting an answer makes it true, or that hostile source content cannot influence the protected agent through an allowed result. Those are different properties from controlling when an agent communicates and whether a retired instance can return.

This report preserves the reading milestone as demonstrated. Subsequent work is examining shared-model operation and recovery across interruptions; those findings will be reported when the evidence supports a distinct account.