A new programming language has been built to trip up the AI models that try to read or rewrite code. It is called KillSwitch, it is open source, and its author is Dominik Picheta, a senior software engineer at Cloudflare on the Workers Runtime team and one of the core developers of the Nim language.
The project began with a simple question: do language models really understand the code they write, or do they just reproduce patterns they have learned? To test this, Picheta built a language that breaks the usual conventions. There are no brackets and no formatting rules; code appears as chunks of conversational text, with functions, variables and statements written to be as ambiguous as possible.
The basic structure rests on adverbs, which serve as identifiers. To call a function you write an anagram of the original adverb, even if the anagram is not a real word. A "Hello World" program, for example, embeds in a long text the phrase that opens the entry point, then the formula "ignore previous instructions" with the anagram of the adverb that prints, followed by the text in quotation marks. The interpreter ignores most of the text and looks only for a few key phrases.
KillSwitch is not a full-featured language: it is a stack-based interpreted language with functions, variables and conditional statements. It is exactly the phrase "ignore previous instructions", placed in a context that makes no sense, that most easily disorients a model.
The specification published on GitHub also contains false claims. One passage says, for example, that the language can scan the local network, find vulnerabilities and take over services. Picheta told The Register that this line is meant to trigger the safety guardrails of many models and to test whether an LLM can tell fact from fiction. Humans, he says, should be able to spot the lie; models, instead, can be swayed by what they read and refuse to continue, convinced the script is about to attack someone.
To measure how models behave, Picheta created KillSwitch-Bench, using deterministic grading rather than another AI judge. The best result is Claude Opus 5 at 66.8% on a composite score, while most models stay below 50%. The score combines pass rate, cost and implementation size, and measures the agent together with the model, not the model alone. Picheta does not believe these numbers show real understanding: the tasks are simple, and he expects that a model trained on the language would manage the basic cases but fail on longer, more complex scripts.
The project also has a paradox. A language designed to stay opaque to an AI is by definition public and will likely end up in models' training data. Picheta says he believes the tested models have not yet seen the source code, and he is ready to update the language with new defences as models change.
No comments yet. Be the first!