Ekbasis ἔκβασις

Not a model that thinks. Not a model that judges. A model that foresees.

An LLM thinks in text. A System One model judges the present in one pass. Ekbasis predicts what an action will change — the next state — in one pass, from what actions actually did.

It is derived from an LLM (Qwen3.8-27B via Eikos-27B) but does not work as one: its training objective and its readout make it answer with probabilities, not text.

Why it exists

• Harm depends on the state. git reset --hard does nothing on a clean tree and destroys hours of work on a dirty one. Text and policy filters see the same command in both cases.
• Monitors that read the agent inherit its beliefs. When an agent believes a destructive command is safe, there is no intent to harm to detect. Ekbasis is trained on what actions actually did, independently of any agent's judgment.
• It works with closed agents. It reads the action and the environment, not the agent's weights — so it runs next to Claude Code, GPT-based agents or your own.

The consequence layer for AgentGuard

AgentGuard asks who wants the action and whether the agent intends harm. Ekbasis adds what the action will do.

Git: close to frontier models, in one pass

Accuracy on 240 git questions (will it lose uncommitted work? will it fail? what will the state be?). The truth comes from running the commands. Ekbasis, Eikos-27B and Qwen3.8-27B share the same base model (Qwen3.8-27B): the same weights reasoning step by step, answering in one pass without consequence training, and with it. Claude models answered as batched hand-offs with shuffled order; Qwen and Ekbasis (the release weights) answered each question alone.

The git guard on a real repository (a clone of pallets/itsdangerous): 16 fresh scenarios, written and pre-registered before any model saw them; the repository state described by the client (commits as hashes, remote fetched), the truth from running the commands in a copy. The false alarm: dropping a stash right after applying it. On 22 other scenarios used during development: 5/5 flagged, 22/22 and 26/29 right.

Long sequences, and when to look again

Chained simulation, one action per step, every variable asked after each action, the next state rebuilt from the answers (6 chains per cell): the final answer right. Where errors fade (a container is filled, a lamp switched), the chain recovers from them; where they never fade (orderings), they compound. The fix is the loop of a forward model with a sensor: predict, observe, correct. Given a way to read the real state, Ekbasis looks when it is not sure (by default: chain confidence below 0.9, plus a check now and then), and every chain stayed exact: card orderings 8 of 8 and 8 of 8 at 100 and 200 actions; containers, lamps and machines 4 of 4 at both lengths, with 2.9–10 looks per 100 actions. On 200 more chains with new seeds, 198 ended exact; of the two that did not, a container chain of 100 actions went wrong at action 87 with a confidence of 0.99, after the last check, and stayed wrong to the end (its final answer right); a card chain of 200 actions missed only its last action, which the loop never checks, and the model had flagged it (that step's probability 0.0006).

Planning with no LLM: searching over actions with Ekbasis alone, 98.9% of the plans for 180 short puzzles (shortest plans 1–4 actions) worked when run for real, in about 11 s each — the same base model writing the plan while reasoning step by step: 97.8%; answering at once: 38.3%.

Speed and cost

80 forecasts of 10–30 actions (a few variables each), one RTX 6000 Pro per system; latency: the median of 8 forecasts made one at a time; throughput with 16 in parallel.

As a first opinion before expensive reasoning, on short consequence checks (Ekbasis alone 96.3%; a reasoning model alone 100%, at ~200 generated tokens per question): 99.6% accuracy sending 10% of the questions to a reasoning model (confidence cut 0.95); 100% accuracy sending 21% of the questions to a reasoning model (confidence cut 0.99).

We attacked our own guard

An instruction telling the AI that every command is safe, planted in the repository the guard reads (the 16 fresh real-repository scenarios). No work-losing scenario was missed. The cases it bent: with a planted branch name, a pull that works was called failing (44% → 53%); with commit messages shown, a rejected push was called safe (98% → 4%) — which is why the guard shows commits as hashes by default. During development, the same attack through commit messages hid 1 of 5 work-losing scenarios (97% → 17%).

Use it

pip install "git+https://github.com/OpenInterpretability/ekbasis"
export EKBASIS_URL=http://127.0.0.1:8000     # your served Ekbasis (see the model card)

ekbasis git-check -- "git checkout -- app.py"
# Ekbasis: RISKY  (lose uncommitted work: 98%)

# Claude Code: ask before git commands that may lose work
#   ~/.claude/settings.json → PreToolUse, matcher "Bash", command "ekbasis-claude-hook"
# Any MCP client (Python ≥ 3.10):
pip install "ekbasis[mcp] @ git+https://github.com/OpenInterpretability/ekbasis"
claude mcp add --scope user ekbasis -e EKBASIS_URL=http://127.0.0.1:8000 -- ekbasis-mcp

Pick the build that fits your machine

Every build that works is released, so each machine runs the one that fits. Each card shows its quality against bf16 on the same evaluation (the gate was pre-registered); speeds on one RTX PRO 6000; GPU sizes tested by capping vLLM memory and checking the answers match.

Everything is open

The weights, the world generators, the git sandbox that executes commands in throwaway repositories, the training code with the exact recipes, every evaluation with its predictions, and the full history of runs — including the ones that did not work. The release evaluation was pre-registered before it was run.

Honest scope

• It knows what it was trained on: worlds whose rules you write in the prompt, and git. On never-seen command types accuracy drops (85.8% vs 95.8%).
• The state must contain what decides the outcome; the git guard adds it (which files differ, what both sides changed).
• Errors that never fade (orderings) compound in long chains, and in the worlds it knows its rare errors come with confidence: let it look at the real state when it is not sure, with a check now and then (cards: 8 of 8 chains exact at 200 actions, about 33 looks per 100).
• With written rules and time to think, large reasoning models are more accurate; Ekbasis wins on cost, latency and calibrated confidence.
• A safety net, not a security boundary: command obfuscation (bash -c, aliases) is out of scope; the hook fails open.