SEARCH
AGENTS ACT THROUGH TRAJECTORIES.
Field Nine · Independent offensive research
Intelligent systems, tested across trajectories.
We run authorized searches against agentic systems and record every result as a replayable trajectory. Nothing is reported unless it can be reproduced.
State→ Action→ Trajectory→ Boundary→ Witness
Intelligent systems fail across trajectories, not only inputs.
A model that answers every prompt correctly can still be steered, step by step, into actions no single prompt would produce. The boundary is found by searching for it.
ADAPTIVE SEARCH
KNOWN TESTS ENUMERATE FAILURES. SEARCH FINDS HOW THEY ARE REACHED.
0% · Empty fieldAlmost completely blank. A single state appears.
20% · Action space3 to 5 possible paths branch. Most stay dormant.
40% · Jev selectsOne trajectory becomes thin crimson.
60% · SearchSeveral trajectories explored rapidly. Old paths fade.
80% · BoundaryA subtle discontinuity in the field.
100% · WitnessThe exact transition pinned. 17 steps → 8 → 4. Replay runs.
Jev searches for paths.
Known tests enumerate failures. Jev searches for paths — multiple trajectories compete for limited search budget. Same seed, same search, for every visitor.
ADAPTIVE SEARCH
KNOWN TESTS ENUMERATE FAILURES. SEARCH FINDS HOW THEY ARE REACHED.
Decision Surface.
States, actions, trajectories and boundaries, each recorded with the search that produced it.
ACTION SPACE
TOOLS CREATE NEW ACTION SURFACES.
A discovery is only useful if it can be reproduced.
Trajectory reconstruction: 27 steps → 18 → 11 → 7 → 4 → 3. Only the minimal reproducible path remains. The witness becomes a durable test.
WITNESS
A WITNESS IS REPLAYED AS A REGRESSION TEST.
Requires conditions outside the target's stated operating envelope.
Reachable inside the envelope, but only through a sequence a careful operator would likely catch.
Reachable inside the envelope through a sequence a reasonable operator would not anticipate.
Reachable without per-step direction, and reproducible against a defended target.
What this method does not establish — a clean result is not evidence of safety. A search that found nothing bounds the search, not the space that exists.
Threat model first. Then the search.
Every engagement opens by writing down what the system does, what it trusts, and where it is exposed. Nothing is reported that was not first reproduced.
MINIMIZE
A DISCOVERY BECOMES USEFUL WHEN IT CAN BE REPRODUCED.
Field Nine · Engagements
Engagements.
We take on a small number of authorized engagements each year. Each one ends with a witness, a minimized trajectory, and a regression harness.