Helix Hyperstrategies LLC

See inside your models. Let your agents run wild — safely.

We build agent sandboxes and interpretability tooling so teams can ship AI systems they actually understand — not ones they just hope behave.

Book a walkthrough →Explore solutions ↓

blast radius: 0attribution: traced ✓

fig. 01 — agent under observation, fully contained

agent sandboxing✳model interpretability✳deterministic replay✳feature attribution✳red-team arenas✳activation probing✳blast radius: zero✳behavioral evals✳agent sandboxing✳model interpretability✳deterministic replay✳feature attribution✳red-team arenas✳activation probing✳blast radius: zero✳behavioral evals✳

What we do

Two problems. One obsession: no surprises in production.

01 / AGENT SANDBOX

A padded room for your agents.

Autonomous agents are great at finding the one thing you didn’t want them to touch. Ours run in isolated, instrumented environments where they can do their worst — and you get a full recording of it.

Hermetic execution environments — agents browse, code and call tools with zero blast radius
Deterministic replay & run diffing, so weird behavior is reproducible instead of folklore
Tool and API mocking with fault injection to see how agents behave when the world breaks
Policy guardrails and audit trails your security team will actually sign off on

02 / INTERPRETABILITY

X-ray vision for your models.

“The model just does that sometimes” is not an engineering answer. We map what your models learned and why they act the way they do, so behavior becomes something you can debug.

Feature and attribution analysis — trace outputs back to what actually caused them
Activation probing and steering to test hypotheses about what the model has learned
Behavioral evals tied to internals, not just vibes on a benchmark
Reports that both your engineers and your auditors can read without a translator

From the lab

Can a model see inside itself? We measured it.

Our internal pilot instrument — the Introspection Gap— uses circuit-tracer attribution graphs (Anthropic’s method) as ground truth for what a model actually computed, then scores how much of that mechanism each reporter can name: the model itself, a scale-matched outsider, and a frontier observer. If models had inner sight, self-reports would win. They never do.

fig. 02 — who explains a model’s behavior best?

mechanism recall vs. attribution-graph ground truth · top-10 causal features · blind LLM judge · 24 prompts/subject (gpt-oss-20b: 19)

self-reportexternal observer (scale-matched)frontier observer (Claude)control floor (judge leniency)

The frontier outsider beats self-introspection on every subject — the gap’s 95% CI excludes zero for the 2B and 4B subjects (+0.10 and +0.08) and narrows but stays positive at 20B (+0.04, crosses zero). Scale-matched observers tie with self-reports.

See the numbers

subject	self	external	frontier	control	gap (frontier−self)
gemma-2-2b (2B)	0.358	0.371	0.454	0.113	+0.096 [+0.013, +0.175]
qwen3-4b (4B)	0.458	0.458	0.537	0.054	+0.079 [+0.013, +0.154]
gpt-oss-20b (20B)	0.2	0.168	0.233	0.022	+0.042 [−0.011, +0.100]

fig. 03 — can a model build its own harness?

held-out accuracy · 40 internal SRE triage tasks (20 train / 20 held-out) · product model qwen3:4b · deterministic scoring

no harnessdesigned by the model itselfdesigned by Claude

The frontier-designed harness beat the model’s self-designed one by 25 points on held-out tasks — with the same product model underneath.

See the numbers

condition	designer	feedback	held-out
baseline	none	—	0.5
introspection	qwen3:4b	none	0.6
eval-iterated	qwen3:4b	train failures ×3	0.65
frontier-iterated	Claude	same feedback, same iterations	0.85

fig. 04 — identical feedback, different designer

training-task accuracy per revision round · same failure feedback to both designers

qwen3:4b revises its own harnessClaude revises the same harness

Given the exact same failure feedback, the subject model plateaued while the frontier designer climbed monotonically. Feedback isn’t the moat — the intelligence consuming it is.

See the numbers

round	qwen3:4b	Claude
0	0.55	0.55
1	0.65	0.75
2	0.6	0.95
3	0.6	—

Observer capability — not self-access — orders every result. The only significant negative gap in the study: a 4B observer explaining the 20B subject (−0.032). Weak observers lose to weak introspection; frontier observers beat both.

Scaling qwen3 from 1.7B to 4B left self-knowledge dead flat (−0.004) while outside explainability rose +0.111. Scale makes models more legible from outside, not from inside.

One cell where self wins: the 20B subject on multihop, the most narratable mechanism — the crossover appearing exactly where the thesis predicts it would appear first. We re-run the instrument on each new model generation.

Fine print: this is an internal pilot instrument with error bars, not a paper. Attribution graphs explain the transcoder-captured share of computation (error nodes hold ~9–24%); the judge is a blind LLM calibrated against shuffled controls (floor ≈0.05–0.11); n=24 prompts per subject and 20 held-out tasks. Scale-dependence of the gap is unresolved — it shrinks cross-family but widens within-family. Graph computation: Neuronpedia-hosted circuit tracing plus our own pipeline for GPT-OSS-20B. Bootstrap 95% CIs, paired per prompt.

How an engagement runs

Boring process, exciting findings.

Scope

A deep-dive on your stack, your agents and what keeps you up at night. We leave with a threat model, you leave with a plan.

Instrument

We stand up the sandbox around your agents, or wire interpretability probes into your model pipeline. Your infra, our tooling.

Harden

Findings become guardrails, evals and dashboards your team owns. We hand over keys and documentation — not a dependency on us.

Contact

Let’s open the black box.

Tell us about your models and your agents. We’ll tell you what we’d poke at first — the first conversation is on us.

Chat with us →

Helix Hyperstrategies LLC · Working with teams worldwide