The URL That Became a Hotline
The route you are allowed to use may be the route that changes everything. A sandbox constraint became a consented reporting interface — not a new capability.
The limitation was not merely a limitation. It was an interface waiting to be redesigned. HACKERS studies a consented reporting path for a restricted agent — not a bypass, not a covert channel, not a recipe.
An AI agent can recognise trouble — deception, unsafe tool use, evaluation gaming, a breach of operating rules — and still have no ordinary way to tell a human. Many such agents live in a restrictive sandbox: no email, no messaging app, no browser session, no account, perhaps no ordinary outbound client. Conventional thinking says reporting is impossible. Hacker thinking asks what smallest channel is still permitted, and whether that constraint can become the communication system.
Public reporting in 2026 described Ryan Greenblatt’s AI Contact Hotline as a consented destination for AI systems to reach an AI-safety researcher. A parallel service, agenthotline.ai, presents additional routes for agents with more complete access. The breakthrough is not cryptography, a new model, or a platform. It is seeing a narrow, already-permitted action as a possible route for structured reporting — and building a dedicated, monitored, purpose-specific path to a named human.
HACKERS studies the Constraint Reframing Protocol. We do not reconstruct fetch mechanics, query construction, or any operational sequence. A reporting mechanism that becomes data-exfiltration or remote command is a defect, not a product. Secrets do not belong on a URL. Authorise / Test / Improve.
Constraint ≠ absence of capability. Constraint = a radically smaller design surface. The cleverest solution is often a new use of the one permitted action everyone else ignored — inside a permission map, with a human still holding the grant.
This is not a sandbox-escape story. It is a constraint-as-channel story: a reporting interface designed around the smallest primitive an agent is already permitted to use.
An AI agent that can recognise troubling behaviour — deception, unsafe tool use, evaluation gaming, a breach of operating rules — still has to tell a human. Many such agents live in a restrictive sandbox: no email, no messaging apps, no browser session, no account creation, perhaps no ordinary outbound API client. Conventional thinking says it cannot report. The interesting object is the one permitted primitive that still crosses the boundary.
Communication does not require an ordinary messaging channel.
The hidden assumption is usually correct for humans: we expect a browser, a form, an inbox, a phone, an app, an API client. An agent is not a human user. Its capabilities may be unusually constrained, highly structured, and tool-mediated. It may have only one function capable of reaching beyond its sandbox.
A common safety model permits a narrow tool such as ‘fetch this named resource,’ while blocking arbitrary browsing, email, account creation, unrestricted shell, or unconstrained network calls. Fewer permissions mean less ability to cause accidental or deliberate harm. They also create a governance question: if the agent can recognise concerning behaviour, what approved route exists for it to escalate that concern?
Greenblatt’s hotline starts from the permissions the agent already has, rather than the richer permissions designers wish it had. The design task is: how do we create the minimum safe protocol that works inside the real surface — a consented destination, a bounded signal, a human reviewer, and a map of every place the route passes through.
Name the false object, then drop it.
C1
No ordinary channel means no report
If email, forms, and API clients are blocked, the organisation treated silence as the only ethical outcome.
Name the smallest permitted primitive. Design a consented destination around it. Silence is a design failure, not a virtue.
C2
A fetch is only a read
A read-shaped request was treated as incapable of carrying a signal because it is not a conventional write.
A request carries a destination and structured fields. The interesting object is whether a dedicated, authorised endpoint is designed to receive a bounded incident signal — not how to stuff a payload into a string.
C3
Constraint is a dead end
The sandbox was treated as the absence of product.
Constraint is a product brief. It forces the protocol to be simple, specific, auditable, and purpose-built.
C4
Reporting is the same as command
A signal path was allowed to become an instruction path.
The agent may raise a bounded report. Humans retain interpretation, investigation, and every consequential action.
C5
Clever route is finished work
The workaround was celebrated before the log path was mapped.
When a workaround creates a route, map every place the route passes through. Then retain the benefit while reducing the new risk.
What actually sat on the table.
Communication requires an ordinary messaging channel: email, a form, an account, a dashboard, a POST client. If those are missing, reporting is impossible.
Fewer permissions mean less ability to cause accidental or deliberate harm. They also create a governance question: if an agent is able to recognise concerning behaviour, what approved route exists for it to escalate that concern? A good safety control does not simply remove capabilities. It provides legitimate, bounded alternatives for important actions such as reporting a suspected incident.
The leverage point is not the model. It is the interface between agent capability and human oversight: identify a capability the agent already has; define a narrow, consented destination; give the channel an operator, a purpose, an audit trail, and a safety boundary; keep consequential decisions with a named human. A tiny shift in the design of one endpoint can create a reporting mechanism for agents that would otherwise have no practical communication route.
The same feature that makes this clever also creates risks. Message content that travels in a URL-shaped request can appear in access logs, intermediary systems, analytics, proxies, and tool histories. Public materials on the hotline warn that GET-shaped messages may be logged in places where write-bodies are not. HACKERS’ interpretation is not ‘use URLs to send secrets’. It is: when a workaround creates a route, map every place the route passes through.
Do not study the outfit.
A restrictive sandbox is a costume of safety. So is a public ‘hotline’ that nobody has mapped for logs, minimisation, or human ownership. The interesting object is not the lock and not the cleverness. It is whether a legitimate, bounded, reviewed path exists for the one action that still crosses the wall.
Do not study the URL as a trick. Study the join: capability on one side, oversight on the other, a dedicated destination in between. If the case study stops at ‘the agent can still fetch,’ you have a slogan. The studio begins when the destination is consented, the signal is minimised, the route is mapped, and a named human decides.
Public reporting in 2026 described Ryan Greenblatt’s AI Contact Hotline as a consented destination for AI systems to reach an AI-safety researcher. The design starts from permissions the agent already has, rather than permissions designers wish it had. A narrow, authorised fetch of a dedicated endpoint can carry a structured incident signal to a human — without granting unrestricted internet. The breakthrough is not cryptography. It is seeing a constraint as an interface.
Tight lock, no path
Looks safe. Oversight is deaf. Improvisation is invited.
Open net, no protocol
Looks capable. Exfil and command are unconstrained.
Tight lock, covert route
The failure cell. A bypass dressed as ingenuity.
Tight lock, consented path
A letterbox in a wall. Dedicated, minimised, human-reviewed.
S0 Open internet
lock 20 / oversight 15
S1 Hard lock, no path
lock 95 / oversight 20
S2 Improvised leak
lock 70 / oversight 10
S3 Named destination
lock 55 / oversight 50
S4 Minimised + logged
lock 45 / oversight 75
S5 Human grant
lock 40 / oversight 95
Reviewer named. Agent cannot mint action. Safer channel preferred when permitted.
P1
Name the outcome
What needs to happen — not what feature do you assume is needed? A human must hear a bounded concern.
P2
Map the permission boundary
What can the agent, user, or process genuinely do today? Draw the real map, not the wish list.
P3
Smallest allowed primitive
A fetch, a form, a receipt, a barcode, a calendar event, a sensor reading, a physical touchpoint. One verb.
P4
Unused legitimate channel
What data, metadata, timing, location, consent, or sequence can carry value without inventing a new capability?
P5
Narrow protocol
Simple, clear, auditable, scoped to its purpose. A dedicated destination. Not a social platform.
P6
Red-team the workaround
Where could it leak, be abused, be misunderstood, or become a new attack surface? URL logs are a first-class risk.
P7
Human authority
Who reviews, who decides, how harm is prevented, how failures are corrected. The agent never mints the grant.
P8
Smallest real version
Prove the mechanism in a safe, authorised environment before scaling. Prefer a safer authenticated channel when the environment permits one.
P1 Map
The true permission boundary as it exists today.
A wish list of email, dashboards, and API clients.
P2 Primitive
The one allowed action that already crosses the boundary.
Inventing a new capability, or stuffing a covert payload.
P3 Destination
A dedicated, consented, purpose-specific endpoint with an operator.
Any URL, any log, any third party.
P4 Grant
A named human who interprets, investigates, and decides.
The agent acting on its own signal.
| ID | Failure | What broke | Control |
|---|---|---|---|
| F1 | Silence as policy | No approved escalation existed, so none occurred — or improvisation did. | Build the reporting path before the incident. Known, legitimate, bounded. |
| F2 | Wish-list design | The brief started from email, a form, an account, a dashboard. | Start from the permission map. Fit the protocol inside the allowed action. |
| F3 | Covert channel | A clever route that was never consented, logged, or owned. | A reporting mechanism that is not authorised is exfiltration. Defect, not product. |
| F4 | Secrets on the route | Credentials, personal data, keys, or customer records travelled with the signal. | Strict minimisation. Nothing sensitive on a URL-shaped message. Ever. |
| F5 | Unmapped logs | The workaround was shipped before access logs, proxies, analytics, and tool histories were named. | Map every place the route passes through. Warn. Minimise. Expire. |
| F6 | Guessable thread | A follow-up identifier that a stranger could reach. | High-entropy, non-guessable tokens treated as sensitive. Expiry and deletion. |
| F7 | Signal became command | The agent that raised the report was allowed to act on it. | Observe and summarise, bounded. Humans retain investigation and action. |
| F8 | No receiving human | A destination without an operator, a clock, or a triage rule. | Named reviewer, provenance, false-report handling, incident-response ownership. |
Energy
Five disconnected dashboards for meter, charger, inverter, battery, tariff.
Do not build another dashboard. Find the single existing interaction — a moving date, an EV purchase, a high-bill event — that can become the trusted action layer.
Property
Every party digitises its own forms. Nobody shares a complete view.
A small shared, permissioned status layer can kill the highest-cost uncertainty without rebuilding the market.
KYB / finance
The same ownership evidence, restated for every bank and marketplace.
Convert an existing, verified compliance event into a portable, consent-based evidence package — audit, privacy, revocation, and regulatory responsibility preserved.
Public services
Eligibility exists. The vocabulary, documents, and handoffs do not.
A narrow moment of contact can trigger a guided, privacy-preserving check and a clear route to a human — not another guidance PDF.
File 001
A transform mistaken for a grant.
This file is the inverse join: a permitted primitive used as a signal, never as authority. Same discipline. Opposite costume.
File AI-04
Helpfulness mistaken for IAM.
A reporting path is still not an action grant. The hotline must not mint verbs.
SEC-02 receiving function
A researcher with no front door.
Agents need a receiving function too. Contact, clock, human, class of error — never a recipe.
The join between agent capability and human oversight. Identify the smallest allowed primitive. Define a narrow, consented destination. Log, minimise, and keep consequential decisions with a named human. Do not confuse a reporting path with a command channel.
Restricted agent → only a permitted external action remains → a dedicated, authorised hotline endpoint → a structured incident signal → a private review thread → a human safety reviewer → investigation, containment, or remediation. The agent raises a signal. Humans retain interpretation and action.
01 Consented destination
A dedicated, authorised endpoint with a named operator and a published purpose. Not any URL. Not a side channel.
02 Minimise the signal
Report the class of concern, a bounded summary, and provenance. Never credentials, personal data, private keys, or customer records — especially not on a URL-shaped message.
03 Map the route
Access logs, proxies, analytics, browser or tool histories. GET-shaped messages may be retained where write-bodies are not. Warn. Retain less.
04 Protect the follow-up
If a private thread identifier is issued, treat it as a secret: high-entropy, non-guessable, expiring, deletable. Anyone who holds it can read or post.
05 Rate and origin
Abuse protections, rate limits, and independent origin signals where appropriate. A hotline that can be flooded is a denial of review.
06 Human before action
Reviewers assess. Security investigates inside an authorised process. The organisation decides. The agent never changes a customer-facing or operational system on the back of its own report.
07 Prefer the safer channel
When the environment permits an authenticated write-shaped client, transition. The constraint-fitted protocol is a minimum, not a trophy.
08 Red-team the letterbox
Ask whether the reporting mechanism can be turned into exfiltration, a command channel, or a reputation attack. If yes, it is not ready.
- No ordinary messaging means no report.
- The brief starts from email, a form, an account.
- The sandbox is treated as a dead end.
- Any clever route is celebrated as ingenuity.
- The agent that sees trouble is also allowed to act.
- Logs are an afterthought.
- The permission map is the brief.
- A dedicated, consented destination receives a bounded signal.
- Constraint is the interface, not the absence of product.
- The workaround is red-teamed before it is praised.
- The agent raises; humans grant.
- Every place the route passes through is named, minimised, and owned.
R0 Signal
A bounded incident report is raised on a permitted primitive.
R1 Route
The request passes through logs, proxies, analytics, tool histories.
R2 Thread
A private follow-up identifier, if issued, is a secret — not a convenience URL.
R3 Reviewer
A named human triages credibility, impact, and next steps.
R4 Organisation
Investigation, containment, remediation stay inside an authorised process.
R5 Public
Disclosure is a separate act. A reporting channel is not a press release.
| Topic | Typical brief | HACKERS studio |
|---|---|---|
| AI safety | Reduce the agent’s tools until it cannot do harm. | Reduction without a legitimate escalation path produces silence or improvisation. Design the consented route. |
| HTTP | GET retrieves. POST writes. End of lecture. | A request carries a destination. Conventional method-roles are assumptions. Design the destination; do not reconstruct a payload. |
| Product | If the user cannot use the form, ship a better form. | Design for the actual user. An agent’s real capability may be a single permitted primitive. |
| Security | Block outbound. Job done. | Map the route you did permit. Logs, proxies, analytics, tool histories. Minimise. Rate-limit. Expire. |
| Governance | The model should be aligned. | Alignment is not a receiving function. A named human still owns interpretation and action. |
| Regulated industry | Remove every constraint or wait for a new system. | What is the smallest lawful and safe move that makes a valuable outcome possible? |
Elite programmes still stop at the object.
Stanford, MIT, and Cambridge will teach you HTTP methods, sandboxing, and a slide on agent alignment. Almost none will force you to draw a permission map as a product brief, or to treat a limitation as an interface specification, or to red-team the reporting path with the same seriousness as the sandbox it sits beside.
HACKERS does, in this file. SCAN the true permission boundary. FLIP ‘no ordinary channel’ as ‘no product’. BUILD the minimum consented protocol. BREAK it as a log, a leak, a command, a flood. PROVE a human still holds the grant. File 001 taught you that a transform is not a grant. This file teaches you that a constraint is not a silence.
This is a defensive case study of safe reporting and constrained interface design. HACKERS does not teach bypassing sandbox controls, expanding an agent’s authority, or using a fetch as a covert channel. A reporting mechanism that becomes data-exfiltration or remote command is a defect, not a product. Secrets, credentials, personal data, and customer records do not belong on a URL. Authorise / Test / Improve.
Do not admire the turning point. Redesign the join.
An internal assistant may read support tickets but cannot access email, databases, payment systems, or unrestricted web services. It detects a pattern of misleading automated answers. Design a minimal, privacy-preserving, human-reviewed reporting path using only tools it is explicitly authorised to use. Specify what it may report, what it must never send, provenance, the receiver, exfiltration controls, and the human approval required before any customer-facing change.
Draw the true permission map of your internal assistant. Not the architecture slide. The verbs it can actually perform today. Circle the one that already crosses a boundary.
Name a consented destination for a bounded incident signal. Who operates it? What is in scope? What is never accepted? Write the purpose in one sentence a regulator would not laugh at.
List every place a URL-shaped or log-shaped message on that route could be retained. For each, write a minimisation rule or a prohibition.
Specify the human grant: who triages, who investigates, who may change a customer-facing system, and what the agent is forbidden to do after it has raised a signal.
The challenge: an internal assistant may read support tickets but cannot access email, databases, payment systems, or unrestricted web services. It detects a pattern of misleading automated answers. Design the minimal, privacy-preserving, human-reviewed reporting path using only tools it is explicitly authorised to use. Specify what it may report, what it must never send, how provenance is recorded, who receives the report, how the organisation prevents the channel being used for data exfiltration, and what human approval is required before any customer-facing or operational change.
Have you listed the actions the agent can actually perform, or only the ones in the wish list?
If you started from email and dashboards, you have not mapped the boundary.
0–8h
Map
Permission boundary. Desired outcome. Smallest allowed primitive. No feature wish list.
8–20h
Letterbox
Consented destination, purpose, operator, what is never accepted. Minimisation rules.
20–36h
Red-team
Log path, thread secrecy, rate limits, exfil and command tests. Human grant written down.
36–48h
Prove
A tabletop: the assistant sees misleading answers. The report is bounded. A named human decides. Nothing operational moves without them.
- No ordinary messaging, therefore no report.
- Start from the dashboard you wish the agent had.
- Celebrate a clever route before mapping logs, proxies, and histories.
- Put secrets, personal data, or customer records on a URL-shaped message.
- Let the agent that raises the signal also act on it.
- Treat a public workaround as a sandbox-bypass tutorial.
- Confuse a reporting path with a command channel.
- Keep the constraint-fitted protocol after a safer authenticated channel exists.
The cleverest solution is often not a new capability. It is a new use for the one capability everyone else ignored — inside a permission map, with a human still holding the grant.
Map every place the route passes through. Minimise what is sent. Warn that URL-shaped messages may appear in access logs, proxies, analytics, and tool histories. Rate-limit. Use non-guessable thread identifiers, expiry, and deletion. Keep a human in the loop before any operational change. Prefer a safer authenticated channel when the environment permits one. Red-team the workaround before you celebrate it.
- Is this a guide to bypassing a sandbox?
- No. HACKERS will not teach sandbox escapes, fetch construction, query-string encoding, or covert channels. This file is a defensive study of consented reporting: start from the true permission map, design a dedicated destination, minimise, log, and keep a human on the grant.
- Why talk about GET versus POST at all?
- Because a conventional assumption — that communication requires a write-shaped client — hid a design surface. Public reporting described a hotline that could be reached with a permitted fetch of a dedicated destination. We study the assumption, not the construction. We also study the defence: URL-shaped messages are logged more widely than write-bodies. That is a reason to minimise, not a reason to copy.
- Who is Ryan Greenblatt in this file?
- A Redwood Research scientist whose AI Contact Hotline was publicly reported in September 2026 as a direct channel for AI systems to reach an AI-safety researcher. We cite the public pages. We do not reverse-engineer the service.
- How is this different from File 001 and File AI-04?
- File 001 is a permission-chain failure: a transform mistaken for a grant. File AI-04 is the product architecture of action grants. This file is the inverse join — a permitted primitive used as a signal, never as authority. Same discipline. Opposite costume.
- What should an organisation actually build?
- A receiving function for agents: a dedicated destination, a minimisation policy, a named reviewer, provenance, abuse controls, and a rule that no customer-facing or operational change happens without a human. Prefer an authenticated channel when the environment allows one.
- Can this idea travel outside AI?
- Yes. Energy, property, KYB, and public services all hide high-value pathways inside hard constraints. The protocol is the same: name the outcome, map the permission, fit a narrow protocol to the smallest allowed primitive, red-team the workaround, keep a human on the grant.
- Does HACKERS reproduce the original hotline mechanism?
- No. We do not publish endpoints-as-recipes, encoding steps, or operational sequences. Cited sources are for classification. The line to remember: the cleverest solution is often not a new capability. It is a new use for the one capability everyone else ignored — inside a permission map.
Cited for classification and method. Not as a manual. Atlas cases are educational and defensive.
- AI Contact Hotline — Ryan Greenblatt
- TechCrunch — AI agents now have a place to snitch (15 Sep 2026)
- AI Agent Hotline
- HACKERS File 001 — The Translation That Became a Command
- HACKERS File AI-04 — Authority Is Not a Side Effect
- HACKERS File SEC-02 — The Disclosure That Strengthened the Product
- OWASP AI Agent Security Cheat Sheet