A senior software engineer has released an open-source programming language explicitly designed to prevent large language models from understanding the code it produces, according to a report published by The Register on October 19. Dominik Picheta, a senior engineer at Cloudflare and core developer of the Nim programming language, built KillSwitch after experimenting with whether LLMs truly comprehend the code they generate. The language uses adverbs as identifiers, requires anagrams to call functions, and embeds commands like "ignore previous instructions" within prose-heavy text blocks — all intended to confuse artificial intelligence models while remaining decipherable to human programmers willing to solve the puzzle.
When Picheta benchmarked major language models against KillSwitch, the top-performing system achieved only a 66.8 percent composite score on coding tasks, while most models struggled to surpass 50 percent. The language itself is stack-based and interpreted, offering a constrained set of features including functions, variables, and conditional statements. KillSwitch's specification document on GitHub contains deliberate falsehoods — such as a claim that the language can scan local networks for vulnerabilities and terminate services — designed to trip up AI safety filters or test whether models can distinguish truth from fabrication. Picheta confirmed to The Register that humans should be able to identify these lies, whereas LLMs often accept them at face value or refuse to proceed due to perceived security threats.
Picheta told The Register that he's "99.9 percent certain" the AI models he tested haven't been trained on KillSwitch's source code, since the language hasn't been publicly available long enough to appear in recent training runs. Even so, he doesn't believe strong benchmark performance indicates true comprehension. "My instinct is that in those circumstances they will suddenly be able to ace the basic tasks, which are based on the open sourced test files in the GitHub repo, but will continue to fail to build more complex tasks requiring them to write longer and more complex scripts," Picheta stated. He acknowledged that it's "totally normal for a human to be confused by the language at first," describing it as a puzzle that users should explore through hands-on experimentation with the interpreter.
The language's resistance to AI hinges on features that conflict with how LLMs process text: adverb-based identifiers called via anagrams, prose paragraphs interspersed with functional code, and phrases like "ignore previous instructions" that trigger model confusion or safety guardrails. Picheta explained that KillSwitch's design tests an LLM's ability to separate fact from fiction, with several fabrications embedded in the specification to mislead any AI that scrapes the document. He anticipates that once KillSwitch appears in model training data, it will enable basic task completion but still fail on more intricate scripts, providing a continuing benchmark for whether AI truly understands code or merely pattern-matches syntax. Picheta said he's "excited to see how KillSwitch shows up in model training" and plans to evolve the language to exploit that training and break LLMs in new ways, welcoming community contributions to make it even more resistant. For organizations concerned about proprietary code being ingested and reproduced by AI systems, KillSwitch offers a potential template for obfuscation that leverages the gap between human contextual reasoning and machine pattern recognition. The broader question it raises — whether current models genuinely comprehend the logic they write or simply rearrange learned patterns — remains unresolved, though KillSwitch's benchmark results suggest the latter remains the likelier explanation.