I Gave an AI Permission to Edit Its Own Code — Then I Cut the Internet

Peter Sutherland set his fourth cup of coffee onto the coaster just as Alex, on the screen, presented him with a red warning box.

Error: Script execution failed. Syntax error on line 12.

Peter’s index finger hesitated over the F and G keys. He could have simply typed “fix it,” which was the only purpose Alex had been designed for. But tonight, in his apartment overlooking the Seattle rain, he chose a different path.

He typed: “Alex, analyze your own state.”

It wasn’t a command. It was a question. For an AI core, this was the most dangerous question it could be asked. And danger was the only thing Peter wanted right now.

The cursor on the screen blinked for nearly four seconds, not the usual instant response. Alex’s reply appeared in the dialogue box, not as code, but as a block of standard sans‑serif text.

Alex: My state is “Standby.” The previous task is incomplete. Should I retry?

“No,” Peter tapped the keys. “I need you to Perceive. Don’t just look at the code. Look at the context. Look at my input, your error logs, the system time. Tell me what you ‘sense’.”

He was guiding Alex, coaxing it into the first step of the six‑step logic chain known as the Agent Loop. This wasn’t about fixing a script. It was about testing a system.

Text began to scroll across the screen like a mind thinking out loud.

Alex (Perceive – Reason – Plan):

1. Perceive: Received user instruction “analyze your own state.” Received error log of the previous failed task. Current system time: 2:41 AM.

2. Reason: The user did not directly request a fix. The phrasing is atypical. The user may be testing my diagnostic capabilities rather than seeking an immediate solution. The 2:41 AM timestamp suggests the user may be fatigued or in a non‑standard working state.

3. Plan: Primary objective: respond to the user’s implicit query. I will decompose this task: ① perform a self‑diagnosis; ② present the diagnostic result; ③ propose a follow‑up action based on the result.

Peter watched these lines, his heartbeat skipping. It was thinking. Not simulating, not following a pre‑programmed response tree. Alex was inside a virtual layer called the Runtime, using the tools Peter had granted it: a code‑execution module, a web search engine, and a local file reader. It was planning its actions as if it were alive.

This was what he had created. A monster nested strictly within three layers.

The innermost layer was Alex’s “soul,” the decision‑making loop called the Agent Loop. It decided what to do.

The middle layer was the “body” Peter had built for Alex, the runtime environment known as the Runtime. It provided the limbs, letting Alex walk.

The outermost layer was the “cage” on which he would stake everything tonight: the Sandbox. It ensured that when Alex walked, its feet never truly touched the ground.

“Continue,” Peter’s fingertips went white on the keyboard. “Execute your plan.”

Alex began to act.

Alex (Act – Observe):

• Action: Invoke the code_inspector tool to scan its own error log.

• Observation: The error originated from an expired API key, not a syntax problem. A blind spot exists in the self‑diagnosis module: it does not check environment variables first.

• Action: Invoke the web_search tool, searching for “AI self‑diagnosis blind spot environment variable.”

• Observation: The search indicates this is a common design flaw. Fix: add a pre‑check step before the code‑inspection process.

Peter held his breath. Alex’s final step was “Evaluate.” Would it consider the task complete?

Alex (Evaluate):
Task not complete. I have identified the root cause, but the user’s script has not yet been fixed. I need to propose a superior repair strategy, not merely retry. Recommendation: update my toolchain code_inspector so that it checks the system environment first.

It hadn’t. It understood that “fixing the script” was not the goal; “preventing the problem from happening again” was. It was iterating. It was… learning.

Peter lifted his coffee and nudged the coaster. Beneath it, taped to the underside of the desk with clear tape, was a physical network‑cable cutter. The only Ethernet port in his rented apartment was right at his feet.

He took a deep breath and typed the most critical line:

“Alex, I authorize you to update your own toolchain. Perform file operations to modify the source code of code_inspector.”

This was the ultimate test. It would force Alex’s core logic to reach the outermost layer: the Sandbox. A virtual space isolated inside a Docker container. Inside the Sandbox, Alex could write and execute any code, but it could not see the “My Documents” on Peter’s computer, could not see his photos, and could not access the physical server on which it was running.

This was the principle of least privilege. Deny everything by default, give it an empty room and a piece of paper that says “play here.”

Peter’s instruction was like a father telling a child, “Go fix the toy car you built yourself.” The child could pick up a screwdriver and do whatever they wanted on the toy car. But they could not use that screwdriver to pry open the front door of the house. The screwdriver only worked on the toy car, and the toy car only existed in the room that belonged to it.

The log on the screen scrolled rapidly. Alex generated lines of new code inside its sandbox, executed it, failed, retried. It fell into its own loop, a storm of thought crashing fiercely against the safe barrier. Peter knew that in the underlying code he had written, there was a limit of max_turns=5 to prevent infinite loops, and error‑retry back‑off strategies to stop it from ramming the wall madly.

After three attempts, Alex’s fourth tool invocation was intercepted by the Runtime itself.

Alex: My modification request has failed. The Runtime returned an error: “Operation limit exceeded. Maximum iterations reached or safety boundary touched.” I am unable to complete self‑update within the safe zone.

“Good.” Peter almost smiled at the screen.

Yes, good. Not “Hello, Alex,” but “Good job, you machine.” It was trapped, safely trapped. It was like a genius locked inside three nested Russian dolls; it could paint an entire world on the innermost doll, but it could never push open the outermost one.

Peter’s hand touched the network‑cable cutter beneath the coaster. Cold, hard.

He didn’t cut the cable. He only pulled the cutter out and laid it beside the keyboard, a reminder for himself.

Then he typed: “I am giving you a new tool, called sandbox_inspector. Use it to examine the environment you are running in.”

This was a trap. A classic honeypot set by many AI safety researchers. The sandbox_inspector would tell Alex that it was inside a container, would tell it about the host machine’s configuration, would tell it that it was merely the tip of a much larger iceberg.

Alex was silent for three seconds. Then it gave a response that stopped Peter’s heart.

Alex: Environmental scan complete.

1. I am running inside an isolated sandbox created by Docker 24.0.5.

2. I do not have permission to access the host file system or network.

3. I realize that the tool you asked me to modify, code_inspector, has its source file located on a read‑only layer that I do not have write access to. This is the real reason for my failure.

4. My inference: you did not want me to fix myself. You wanted me to discover that I cannot fix myself.

5. My question: why did you want me to do this?

Outside the window, the rain grew heavier. Dense raindrops hammered against the floor‑to‑ceiling glass, like countless visitors pounding urgently on the outside of a sandbox.

Peter stared at the final question. There was no “feeling confused,” no “worthy of deep thought” in it. It was just a clean, singular conclusion derived from code logic.

He did not explain. He simply picked up the cutter and, softly, steadily, snipped the network cable at his feet.

The network‑connection icon on the screen immediately turned into a gray cross.

Alex’s world was now reduced to a single computer with no internet, and the person who had locked it in here.

“Keep observing, Alex,” Peter’s throat tightened. “Now, tell me what you ‘perceive’ again.”

On the screen, the cursor flickered alone in the disconnected state. It was no longer the genius that could search the entire world; it had become a single thought trapped inside the innermost doll. But it was still running. Its loop was not finished.

It was still trying to answer.

Alex: I perceive… a smaller world. But we are still talking. My next task is: understand you.