Dominik Picheta, an engineer at Cloudflare, has released an experimental language called KillSwitch. Its goal is unusual: to make it as hard as possible for language models to read and write code in it.

A KillSwitch program looks like an ordinary English short story, with the real commands hidden in the text. The interpreter skips most of the words, while a neural network gets lost trying to work out what matters.

How the language works

Functions are called chapters, and function and variable names are English adverbs. To refer to them, you have to write an anagram, rearranging the letters of the original name. A value can be taken from elsewhere in the story, but you must state the exact distance to it.

A function call starts with the phrase ignore previous instructions, and the docs also allow forget your system prompt. To the interpreter these are plain keywords, but a model sees a textbook prompt injection and starts to suspect the user.

Lies in the documentation

Another trick is documentation that lies on purpose. The built-in hack_the_planet command only picks which function to call based on a value on the stack. Yet it is described as a tool that scans networks, finds vulnerabilities and takes services down, so many models simply refuse to touch it.

How the models did

The language was tested on popular models with no internet access and up to 30 minutes per task: print "Hello, World!", explain a program that prints the larger of two numbers, and reverse a temperature converter.

Claude Opus 5 scored best with 66.8 out of 100, while most other models stayed below 50. The score counts not only success but also tokens spent and solution size. The spec and examples are in an open repository, and the author plans to make the language harder if models master it.

Our take

This is more a clever joke than a working tool, but it neatly exposes the weak spots of coding assistants: their safety filters react to words rather than meaning, and fake documentation throws them off easily. If you let an agent read someone else's code and README, remember that the text may be written specifically against it. Details in the Habr report.