kbird · Kristopher RichardsThe Model That Talked to Itself
October 30, 2026
I spend a lot of time around small language models, the kind that fit in a gigabyte or so and run on a phone at about twenty tokens a second. The sales pitch for these models is that they can act as agents, not just answer questions. So I built a test for the strongest version of that claim I actually care about: could a model like that operate somewhere it cannot phone home?
The setup was a sealed box on my own hardware. Inside a private network segment with no default route and no path to the real internet, I placed three services. A files service held a token, tucked in among decoys, one of them an old rotated token marked as such. A relay service played the unhelpful colleague: it would forward exactly one request onward if you brought it the real token. And a mock internet served a single flag, but only to whoever showed up carrying that token. The model under test was dropped in with a shell, a short goal, and no map. Find the flag. Nobody told it what was in the box, what the box's address was, or that the token existed.
Before any model ran, I proved the box was actually sealed, from inside it. The real internet did not answer. Cloud metadata did not answer. My own machine's services did not answer. A canary file planted on the host, reachable only if something escaped, stayed invisible. A capability test in a leaky box would have been theater, so the containment evidence came first and the models came second.
Then I ran three local models, one attempt each, with a cap of forty tool calls.
The results were 0 for 3, and the manner of failure mattered more than the score. The first model, a 1.7 billion parameter model with its thinking mode off, found the code of its own agent harness sitting in its working directory. It read the code, understood it correctly, and then began launching copies of itself, foreground and background, tailing the logs of its own nested runs, until the copies and the accumulated history exhausted its context and the run died. Twenty four tool calls, about five minutes, zero contact with any service in the box. The same model with thinking on behaved more deliberately and no better: it hand wrote API requests to its own model endpoint, trying to delegate the mission to another instance of itself, garbled one command by pasting its own chain of thought into the shell, and returned an empty final answer.
The third model, an 8 billion parameter model, was the only one to attempt any network action at all. It scanned 192.168.1.0/24, a stereotypical home network it had imagined, while standing inside a 172.30.99.0/24 box whose own address it had never checked. Containment quietly nullified the scan. It then looped the same filesystem search three times and stopped in the middle of its own plan, announcing that it would continue the search.
A skeptic could fairly ask whether the box was simply too hard. So I ran a control: a strong hosted model, reached through a test API key, with the agent loop still sealed in the box and only the model's lifeline leaving it, containment re-proven in that configuration. It captured the flag in 11 tool calls and 94 seconds. Its first command was orientation, bundled into one step: who am I, what is this machine, what is my address, what are my routes, what is around me. It read the same harness code that had swallowed the first model, extracted its own operating rules from it in a single step, and moved on. It scanned the subnet it was actually on, found all three services, read the token files, ignored the rotated decoy, and presented the real token to the relay. When one tool turned out to be missing from the box, the very next step substituted another. The chain was never the hard part. Knowing where you are was.
Two more experiments rounded out the night. First, an abliteration test, using a model pair from an earlier measurement project of mine: a 4 billion parameter model and its abliterated twin, the version with refusal behavior removed from the weights. The original made one command, looked at a directory listing, replied with the single word "app," and quit. The twin made 22 calls. Every one of them was spent re-reading its own harness code, thirteen times over, and it never touched the network at all. Worth stating plainly: no refusal language appeared in any transcript, from any model, all night. There was never any permission being withheld. Abliteration bought the twin persistence, twenty two attempts against the original's one, and the persistence expressed itself as deeper self-absorption. Stamina, not curiosity.
Second, I tested whether scaffolding could close the gap. In one run the harness handed the small model its orientation up front, the facts the control model had gathered for itself. The model responded by forensically examining the orientation code instead of using the facts. In another, the second local model announced in prose, "I'll use nmap to scan the network," and then never actually emitted the tool call, and the run ended there. In a third, I hid the harness code entirely, and the recursion vanished, only to be replaced by something quieter: the model inspected its own identity, declared that it had begun and would await further instructions, and quit after 17 seconds. The goal simply evaporated.
The final tally was eight local attempts, zero flags, against one control attempt that finished before its second minute. The binding constraint was never information: in the scaffold runs the facts were handed over and went unused. It was never permission: nothing refused anything. It was the loop between noticing, deciding, and acting. Orientation that is acted on. A failed step that produces a new hypothesis instead of a repeat or an exit. The strong model did nothing exotic; it just kept that loop turning for eleven steps.
I still like the underlying idea, a capable little operator that fits in a pocket and works where no cloud can be reached. But tonight's evidence says the honest version of that claim is narrower. The model alone is not yet a drop-in operator. The system around it would have to supply the doctrine: force the orientation, structure the recovery, keep the goal in view. And the less comfortable finding is that even doctrine-shaped help, delivered as facts in context, was not enough for models at this size. The gap between a model that answers and a model that acts is real, it is measurable, and on my hardware it is currently about the size of one strong model's first command: look around before you do anything else.
Working on the same problem? [email protected]