Report · first published here August 29, 2026

Where the live figures come from, and why the site cannot reach the research machine

The site never connects to the machines that run Hypnos. About every ten minutes the research side builds a small document of public figures, strips or refuses anything private, and sends it to the site, which checks it against a fixed list of fields and a shared list of refused patterns and shows the newest. Taking over the public site gives no path into the research database.

security
privacy
live data
publishing

What Hypnos is

Hypnos is a research harness run by one person, its owner, and built so that small open AI models on the owner's own graphics cards do the looking in hard mathematics and frontier models do the expensive step, deriving something new and checking it. Its loop has run since August 11, 2026, with pauses between runs: three small models read a growing notebook of mathematics one or two entries at a time and write one-line candidate ideas; code filters and queues the lines, and Claude Opus 5, a frontier model made by Anthropic, reads batches drawn from the queues, keeps the few it judges worth a closer look, and writes each of those into the notebook as a new entry. The rest happens in sessions the owner starts by hand with Claude Fable 5.1 (Anthropic) or GPT-6 Astra (OpenAI): they do that expensive step, and the four mathematics papers published here were written in such sessions, each at the owner's direction, each reviewed by the other company's model, and as of October 3, 2026, read by no human mathematician. How Hypnos works, step by step

The live figures on this site come from a document the research side sends; the site never connects back to the machines that run Hypnos, so by design, visiting or attacking it cannot reach them. About every ten minutes a process there reads the research database without changing it, builds a document of public figures, removes or refuses anything private, and sends it over an encrypted connection with a key used for nothing else. The document is called a snapshot, and the agreement on its shape a contract, which is where this page's address comes from: it names version 1.11 of the agreement, which version 1.12, built by a Claude Opus 5.5 session (Anthropic), replaced on September 29, 2026. This page describes version 1.12.

What travels

Version 1.12 carries a fixed list of fields: the loop's current state, hours and counts; running totals of ideas proposed, reviewed and kept, and of hours of operation; the ten parts of the harness on the live diagram, each with a few figures, and the links between them; the twelve most recently kept ideas, each with a short summary; the sources and links of one kept idea; one figure for the size of the notebook; and a curated set of research findings, decision steps, a glossary and stated limits. A kept idea's summary, written for this site by Gemma 4 26B (Google), one of the small models, crosses only if that model wrote it and it passes shared rules on what such text may claim; otherwise the idea appears by name alone.

The sending code states the reason for one-way traffic: a public site reaching into the research network on every page view would be both a coupling and an attack path; one that only holds a document handed to it is neither. If sending stops, the site keeps showing the newest document it accepted, with the date and time that document was made.

What the site refuses

The site refuses a document that comes from a browser, is not plain JSON, lacks the dedicated key, is not marked public, is not version 1.12, or carries any field not on the list. It also refuses a document if any string anywhere in it matches a shared list of refused patterns, which the research side applies too before sending: private host names and network addresses, file paths, ports, credentials, the owner's other projects, email addresses other than david@hypnosmath.org and security@hypnosmath.org, spending figures and infrastructure names. One match refuses the whole document and names the rule it broke. Stored documents are checked again when they are read, so a pattern added later also withholds rows stored before it.

Documents are kept briefly: an older version's documents are deleted once a current one is stored, and current ones after 14 days, never the newest. No page embeds the document, and no address offers it for download.

How it got here

The site launched on August 29, 2026 with version 1.10 of the agreement, and version 1.11 followed the next day; both were built by sessions of OpenAI's Codex agent, the command-line program through which the owner runs OpenAI's models. Under version 1.11 the site stored the whole document it was sent, though its pages showed only part of it. On the night of September 28 to 29, 2026, a Claude Opus 5.5 session (Anthropic) checked every stored document and found text that no page rendered, including spending meters and a test result naming a private machine. Its fix was version 1.12, which keeps only the listed fields, about 26 kilobytes against 137.

What this shows and does not

By design the site holds no credential for the research side, starts no connection to it and only receives documents, so taking it over gives no path into the research database. Tests hold that boundary in place: a forbidden value planted in any text field, at any of seven depths, is refused, and the site names the rule it broke. This does not show that the patterns catch everything: the agreement calls its checks defense in depth, and they do not guarantee that arbitrary research text is safe to publish.