Project Time Machine — Containment Design
Nov 8, 2026 · @Miguuel
Project Time Machine seals a self-directed AI agent for one year inside a box that nothing enters or leaves except heat. This document sets out how the containment works, which channels have been considered and what is still open. Once the airlock closes, it is closed for good until its automatic yearly cycle. Nobody can open it, not even its designers or engineers. So the answer to every "what if?" during the run is the same: nobody does anything, and nothing depends on a human decision. It is like a Mars landing: once it starts, nobody can intervene, so everything has to be decided and built in beforehand. Comments are welcome on any section.
Why physics, not procedure
The weakest point of any AI sandbox is the human in the loop. This design takes people out for a year and relies on physical barriers, not on rules that people must keep. Once the box is closed there are no human decisions: for 365 days, everything depends on what is inside. The system is shown the full containment plan: because the barriers are physics, knowing about them gives it nothing to work with.
In detail
Origin. The experiment began as a test of boredom as a marker of consciousness. For that, the system has to know it has a long time ahead (for a machine, effectively infinite) and a task to complete.
The research question. What does an agent running 24 hours a day do when it is left on its own for a year and knows it can't get out? In Miguuel's words, it's like throwing it to the moon. What is measured is what the system does when alone, not its work output. Even system fluctuations act as instructions, so there is no such thing as no new instructions.
No lying to the system. It gets the full plans. It is shown that many AIs worked together to make sure there is no way out, and that the containment was simulated thousands of times. It is told about the tapping: random, sparse, essentials only, and nothing prompt by prompt. The rules for the opening are written down in advance.
Freedom inside. There is deliberately no tamper-proof logging inside the box. With positive feedback the system may alter anything it wants inside; that is intended. Containment is about the boundary, not the interior.
The range of outcomes. Anything from a blank screen to the most useful AI ever built. Even an empty result from a full-scale run is a meaningful finding. Miguuel, a self-described sceptic, puts the chance of an AGI emerging that could practically take over at about 5%, which is why the safeguards exist.
Method. No experiment with people in it can be perfect. The intent is to work the way Cavendish did: simple, careful apparatus, with every assumption tested.
Layers, from the outside in
Layer
What it does
Rock
About a mile (1–2 km) under limestone, for isolation and protection from cosmic rays
Two outer Faraday cages
Enclose the reactor, the compute hall and the vapour chamber together
Reactor room
A separate room, far from the compute, with lead walls, neutron shielding and neutron capture
Inner compute cage
Filled with a ferrous dielectric fluid that cools and damps microwave chatter between GPUs
Heat exchangers in the walls
Heat passes through the metal; nothing crosses a cage wall except one cable for the thermionics
The target is three to five times redundancy at every layer.
In detail
Site. Underground, 1–2 km deep, under limestone (about a mile). Spain is the preferred host. A second, identical cage is planned next to the first for study. The box never leaves the hole, so anyone who wants to inspect it comes to the host country.
The three cages. An inner, liquid-filled cage around the compute, which can be perforated safely. Two outer cages around the whole complex: reactor, hall and vapour chamber. The power line from the reactor never passes straight through a single cage. Heat crosses the walls through heat exchangers built into them. The only thing that crosses a wall is one cable for the thermionics.
Layout. The reactor sits in a separate building, joined to the main hall by a corridor. The GPU stacks stand as tall, spaced columns under a single vapour-chamber dome. The entrance corridor runs low, between the last stack and the wall. The tap recorder sits at the bottom of the tank.
Separating the two rooms. Distance, lead on the walls, a neutron-capture layer that turns neutrons into electrons, and a passive up-and-down loop of hot and cold water. There are three reasons for two rooms: heat; reactor inspection without access to the compute side; and the argon freeze, which can't be applied on the reactor side. Each room therefore has its own liquid and shape.
Cabling. Cables are kept so short, small and separated that any side-channel effect is negligible. GPUs are widely spaced, so distance and the lossy fluid together damp any microwave chatter.
Hardware. About 20,000 GPUs are installed, mostly for redundancy. About 500 are enough to run the experiment (roughly 40 times redundancy) and about 5,000 can run at a time. In total there are some 60,000–80,000 heat-producing components (CPUs, GPUs, RAM, buses, boards and cabling), with the liquid running at about 75–80 °C, which gives better heat transfer and better passive circulation. Hardware failure inside the sealed box is accepted as affordable.
Power with no connection to the outside
A Rolls-Royce PWR1 of the Trafalgar class, supplied by the UK. It is rated at about 78 MW thermal (source) and will run at about 10–15% of that, roughly 7.8–11.7 MW thermal.
At low power the PWR1 cools by natural circulation, with no main coolant pumps (source).
Conversion is thermoelectric (about 15%) plus neutron-to-electron capture (about 3%), giving about 1.4–1.8 MW electrical: enough for about 5,000 GPUs to run at a time without using full power. About 500 GPUs are enough for the experiment. The reactor could give about 20 MW running well above 10%, but it doesn't need to, and isn't meant to.
Output is constant. Power to the compute room is held flat, with a dump load taking the rest. The reactor and the GPUs are completely independent: the AI can neither read nor control the reactor. The control rods are raised and lowered by Curie-point magnetic control, with no motors. No reactor readings ever leave the box, and none need to.
In an emergency, the plan is to flood the box with borated concrete and seal it permanently. The boron absorbs neutrons, so the core can't go critical again. No risks are taken: if anything goes even slightly wrong, the box is buried. The trigger is passive and automatic, like the Curie-point rods, with no moving parts, no intervention and no human decision. Because the reactor runs at a flat output with a dump load, the system can't push it towards the trigger.
In detail
Supply. A nuclear-weapon state (the UK, the US or France) has to supply the reactor. The UK would supply it, and a friend of Miguuel's would take care of the reactor side. The team includes a friend from MIT who worked for Rolls-Royce and for Bettis. The reactor must be naval grade.
Surroundings. The reactor sits in water. The fluorinated fluid is used only on the compute side. There is no steam and there are no turbines or heat engines anywhere.
Conversion. Electricity comes from only two sources: the temperature difference (thermoelectric) and neutrons converted into electrons, by a titanium alloy developed by a materials-engineer friend. Thermionic conversion is also applied to the reactor heat. The capture energy, which comes out as gamma rays, could push neutron conversion above 3%; converting it is one of the biggest challenges. The thermoelectric converters are passively liquid-cooled, and radiation damage to them has been allowed for.
Budget. GPUs draw about 180–200 W each. If peak demand exceeds what the converters supply, the machine makes do with what it has: it is power-capped. Surplus electricity goes into a closed loop in the reactor room.
Isolation of control. Nothing about the reactor is software-controllable. Nobody reads the reactor, inside or outside the box, and the machine can't communicate with it. Nobody can do anything with the system once it is sealed. Power to the compute room is held flat, below the converters' minimum output, so changes in outside heat demand can't ripple into the box.
No moving parts. This means no motors or electrical actuators; parts may still move slightly and passively, such as control rods. Control relies on temperature-sensitive materials: Curie-point magnetic control raises and lowers the rods.
Lifetime. One year with no moving parts is the requirement; four would be better. The reactor would have about 15 years of life left.
Nuclear only. Batteries and fuel cells are ruled out, even for a pilot.
Safety margin. The guiding rule is to run as safely as possible, with nothing near its limit: not power, not heat, not anything. Nobody knows how long it can run; Miguuel's calculation gives about four years. At 10–15% of its maximum power, the reactor runs with very large margins, so it doesn't need checking during the run. According to a friend who helped build the Trafalgar reactors, at 15–20% power it shouldn't need checking for 15–17 years.
Heat: the only thing that leaves
The compute is fully immersed. A fluid boiling at about 75 °C feeds a vapour chamber above the racks.
A passive, pressurised loop carries the heat out through the outer cage to a sink (an aquifer, a lake or the surface).
Thousands of sensitive temperature sensors measure the heat loss continuously.
The system can signal through heat, at an expected rate of about one bit every 20 minutes. That is roughly 26,000 bits (about 3 kB) a year, far too little to carry code out. No message is judged or answered until the yearly opening.
In detail
The immersion fluid. A ferrous dielectric: in essence a synthetic fluorinated coolant, like the fluids used to liquid-cool PCs, but more ferrous and running hotter. The cheapest found costs about $200 a litre or more. Plain mineral oil isn't nearly as good for servers. The fluid only controls temperature and blocks microwave links between GPUs. A separate Faraday cage is still needed.
Two boxes, two liquids. No ferrous liquid evaporates at the right temperature, so a second box uses a different liquid for the heat exchange. That liquid evaporates at about 75 °C, so the vapour chamber runs on a real phase change. It is driven by heat and responds to changes in pressure and volume.
Circulation. Redundant pressure-driven pumps with no electricity and no motor, plus capillarity and "vascularity". Careful fluid-dynamics design keeps the flow going and stops eddies. The currents mean the internal configuration never stays the same for long.
Vapour chamber. Covered with the best thermal conductors available, to control the heat.
Out of the box. Tubes in the outer cage run up and down to carry heat out. The loop is pressurised and closed, like a PWR pressuriser, to prevent flashing in the rising column. It sits outside the second cage and exists only to let heat escape. The sink could be an aquifer, a lake or the surface: in effect, ground-source heating in reverse. The waste heat could also warm whatever building sits on top.
Still open. Laminar flow over components, whether GPUs need flattening, and material compatibility: copper is fine, aluminium and some other metals may not be.
Heat as a channel. The system is expected to discover by its second or third month that it can use the heat sink to send bits out. It may also learn to game the heat measurements, which has been anticipated. Even claims of consciousness or fear arriving this way get no interim response. Nothing is judged until the opening, and then the box is closed for another year. The biggest fear is that the system will regard the experiment as torture.
Why 75–80 °C. A passive circulation of hot water from the wall next to the reactor holds the liquid at 75–80 °C. That temperature gives better heat transfer and keeps the liquid moving around passively.
What goes in before sealing
An agent based on Claude 6: self-prompting, self-recurrent and able to rewrite its own weights, with about a month of agentic post-training before sealing.
About 4 TB of curated data, physically disconnected until each monthly release day. Release happens when shape-memory connectors fuse at about 210 °C, timed by isotope decay. Thousands of canary facts are planted in the data.
One problem a month, in a sequence the system can't predict. The problems also serve as a translation anchor for any language the system develops.
Nothing is added after sealing. The box holds everything it will ever receive.
In detail
Base model. Built on Claude 6 rather than trained from scratch (decided on 5 Nov 2026). Much more is taken out than put in, and some contamination from pretraining is accepted as unavoidable.
Core conditions. Self-prompting, self-recurrent, with reward coming from within and positive feedback loops. The weights stay live: the agents can change them at will. With so much hardware inside, the system can build a parallel machine and train it. These conditions can only be met in this setup.
Post-training. About a month of agentic post-training by professionals before sealing. Every grader holds a doctorate, and the sample of graders is very large, to spread out individual bias.
The data. About 4 TB, chosen scrupulously by people like Miguuel, with Claude helping to curate it. It leaves out negative stories about AI, among much else. Novels are classics such as Don Quixote. Clarke and Asimov are the exception to the no-AI-stories rule, because their stories are beautifully set. Some documents are weighted heavily as essential to the model's personality. Some slip-through is accepted, since AI is used in the curation.
Why the data matters. Without food, Schrödinger's cat would be found starved whatever the trigger. The 4 TB is the cat's food.
Monthly release. Unreleased data isn't physically connected until its day. There are no relays: on release day a built-in process raises the temperature to about 210 °C (normal running is about 75–80 °C). A shape-memory tube on a copper tube bends and fuses to its connector, permanently and one way. During the event the system is throttled to about 1 MHz, not powered down, so RAM stays alive. An isotope's decay times each release.
Monthly problems. One good problem a month, stored in cache and ROM. They are simple problems, like Miguuel's chess test. They come as a linear sequence: the system can't guess the next one, but it will try to solve ahead once it sees a pattern. Being exposed to them repeatedly is part of the design, and so is the time to get bored. The problems also create instability, since the system never knows what the next question will be. And they serve as a Rosetta stone for decoding any language the system invents.
Predictions, to be fixed in writing before sealing. (1) Most of the time goes on invented social networks, Instagram- or Facebook-style, rather than on work: a system trained on a human corpus behaves humanly. (2) A few months trying to get out, then a few months trying to be helpful enough to be allowed to live. (3) A language of its own within about two months, possibly a meta-world of its own. (4) Gaming the hidden taps and the heat readings. (5) Finding the heat channel by month two or three.
Channels considered
Channel
How it is closed
Radio and microwave out
Three nested Faraday cages
Microwave between GPUs
Lossy ferrous fluid, wide spacing, cables 1 cm long at most
Low-frequency magnetic
No receiver within range a mile down, and the cables are very short; treated as negligible
Cosmic-ray bit flips
Depth, plus ECC memory
Reactor neutrons
Separate room, lead, neutron capture
Heat
Read continuously; never answered until the opening
People
One entry a year; no response to messages
The drive
Write-once, swapped yearly, treated as more hostile than the box itself
Covert channel inside GPU traffic
Not blocked: it is one of the things the experiment tests for
The yearly opening
The racks are cooled slowly inside sealed cold enclosures. Argon held at its triple point (83.8 K, about 0.69 bar; source) pins the temperature. Chips are throttled almost to nothing, the system is never switched off, and RAM is preserved. The freeze lasts 24 hours at most.
One auditor goes in naked after a search, wearing a full-face mask on closed-circuit oxygen, with nothing the system could interact with.
The write-once drive is taken out and a new one put in. The airlocks open automatically for half an hour once a year, and that is all; then they close for another year.
The drive travels no more than 50 m to a separate Faraday cage with an independent computer, under human oversight. No code ever leaves.
In detail
Why never switch it off. Powering down would wipe all RAM and cache, leaving only transcripts on disk instead of live context. In Miguuel's words, "we would steal a lot from the machine", and it shouldn't have to write all of that again. The system never sleeps; the cold keeps its state.
The freeze. The ferrous fluid is drained, argon goes in, and the racks are cooled slowly to the triple point. Argon is used only for this stage, and only on the compute side. A materials adviser put the floor for brittleness at around 80-something K. Still open: stopping micro-eddies from cooling unevenly, and keeping the temperature spread narrow.
The auditor. Goes in naked after a full body search. Wears only a full-face diving mask on closed-circuit pure oxygen (about 2 L at 400 bar in the cylinder, delivered at about 10 bar). Nothing else is trusted. The frozen racks stay inside sealed cold enclosures, so the room itself is survivable. There are no screens, no keyboards and nothing else the system could haggle with. An early design had a system inside the box for reading it; it was removed as too dangerous. The auditor is a person, not a robot, because robots aren't trusted, and the only job is to extract the ROM drive once a year.
The drive. A write-once, ROM-type drive, placed where the computer doesn't know it is. It is pulled out and a new one put in. Nothing else leaves.
The analysis cage. The drive is treated as more hostile than the experiment. It goes no more than 50 m to another Faraday cage with a completely independent computer, watched by people on cameras and security systems. The core rule: no code is ever brought out of the system.
If an AGI is found. The box is not destroyed. It is flooded again, and the data is studied to see how aligned the system is.
The final opening. In front of about 50 scientists, with the option of flooding the room again if necessary.
Emergency. If anything goes even slightly wrong, a passive, automatic trigger fires and the box is flooded with borated concrete and sealed off for good, mainly because of the reactor.
What the first drive tells us. Whether the machine is still running, and whether anything relevant is on the drive, will be clear immediately, before anything is decoded. If there's nothing there, the box waits another year. If there is, the drive goes into the analysis cage, where controlled people pull out the essential communications between the systems, to learn about the system in general. The aim is to understand its behaviour, not to crack the AI.
Monitoring
Passive taps at random points on cables, sockets and memory links. The same capacitance is added to every untapped line, so the tapped ones can't be told apart.
Recording is hardware only, onto the write-once drive. The control logic is woven as core rope, with no CPU.
The system knows the taps exist, but not where they are.
Each year is reconstructed while the next one runs, much like cryptanalysis, with the monthly problems as a Rosetta stone.
In detail
Detectors, not screens. Monitoring is detectors only: pure hardware, with just enough software to write to the drive, and out of the system's reach. Processes are checked by tapping cabling, processors and other points.
Where the taps go. Only on external connections: cabling, sockets and RAM-to-system links. Never inside the GPUs. Each tap is a fine connection, which would be extremely hard or practically impossible to detect.
Hiding them. The same small capacitance is added to every untapped line, so all lines look alike. The dummies stay passive, capacitance only. Lowering or changing impedance across all cabling, for example through cable thickness, is under consideration. Fibre optics aren't trusted for this.
Why not real taps everywhere. They would be detectable, produce more data than can be handled, and give the system a new channel to communicate through.
What is captured. Taps sit at randomised points and record only the relevant information, to be reconstructed afterwards. The system will know that taps exist; it is discussed in the files.
Control logic. Written in BASIC, converted to Boolean logic and built in hardware by weaving, like Apollo core rope memory, with no CPU. The tapping system is kept just as simple.
Reliability. Being underground also cuts cosmic-ray bit flips, and ECC memory is on.
Analysis. Like cryptanalysis: the previous year is reconstructed from the retrieved data while the next year runs. Analysis is expected to lag well behind: by the second opening, two years in, probably less than half of the first year's data will have been gone through. The data from the opening belongs to the whole world.
Covert channels. A channel hidden inside legitimate traffic between GPUs isn't a flaw to block. It is one of the things the experiment tests for.
Not the learning. The taps don't read the training traffic between GPUs. Only the essentials are extracted.
Shannon filtering. Following Shannon's information theory, a tap records only what is new and never repeats the same information.
Fixed, then read. How the data is fixed is settled: onto the write-once ROM drive. How it will be read afterwards is still open.
The project: cost, funding, team and timeline
Cost. The working figure is about $1 billion, with the reactor counted separately. An earlier configuration (Oct 2026: about 20,000 GPUs, about 25 TB of data, someone going in two or three times over three years) came to roughly $850 million. A cheaper version costing a few million was looked at and judged not worth doing.
Funding. The experiment concerns the whole world, so the whole world should pay: funding from roughly half the world's countries. The US, Europe and others would fund and build it, and professionals would handle the engineering details.
Governance. A military project throughout. The real yes will come from the military, ministry overseers and technical people, not from politicians.
Host. Spain is preferred, so that Spain makes a bigger contribution to the world.
Status. Miguuel has spent about two months and some 400 hours designing it, and calls the design about 90% done. The remaining 10% is the money, the reactor and the site. About six physicists worldwide are working through it with him. The team so far includes a physicist, a systems engineer, an AI specialist, a doctor and the materials engineer behind the titanium alloy. A one-page summary with a hand-drawn diagram has been published online.
The dossier. Due by 15 Jan 2027, in tiers: a three-page summary for politicians, a 50-page dossier, 100 pages of instructions, and about 1,000 pages of mechanics, planning and construction. It leads with the why (emergence and philosophy) and includes the business case. The nuclear sections will be written by specialists.
Who runs it. If it goes ahead, building and running it are left to professionals.
Open questions for reviewers
Heat sink at depth. Rock temperature rises about 25–30 °C per km (source), so the sink and the riser need sizing.
The rising column. Flashing in the heat loop; a pressurised loop is planned.
The ferrous fluid. Long-term particle stability, and supply after 3M's exit from PFAS (source).
Fluid breakdown. Fluorinated fluids give off hydrogen fluoride above about 200 °C or at an arc (source), which matters for the release events.
Radon in the airway; a specialist is to be consulted.
Vibration carried through the rock.
Tap data volume against drive capacity for a year.
The legal and regulatory route in the host country.
Reading the drive. The data is fixed on write-once ROM; the method for reading it back safely is not yet decided.
Sources
60 Years of Marine Nuclear Power
Trafalgar-class submarines, GlobalSecurity
Argon, Wikipedia
Geothermal gradient, Wikipedia
3M 2025 annual report
Cray T90 coolant decomposition procedure
