llmopen-sourceagentssafety

Ekbasis: a 27B non-generative consequence model forecasts agent actions in one forward pass — pre-registered, open-weights, and entirely self-reported

OpenInterpretability's Ekbasis API predicts what an action will do before the agent runs it: calibrated probabilities from logits, ~1,500 tokens per check, and a verification trail that includes its own erratum.

Richland AI Desk·12 October 2026·5 min read

Ekbasis: a 27B non-generative consequence model forecasts agent actions in one forward pass — pre-registered, open-weights, and entirely self-reported

On October 10, OpenInterpretability shipped the Ekbasis API: a 27B "consequence model" that takes a plain-language description of the current state plus the action an agent is about to take, and returns calibrated probabilities for typed outcomes in a single non-generative forward pass. The launch is rigorously self-documented — pre-registered plans, hash-frozen hypotheses, published nulls, and an erratum that retracts one of its own headline claims — and every headline number is self-reported by a single researcher.

What shipped

Ekbasis-27B derives from Qwen3.8-27B via an intermediate checkpoint (Eikos-27B) and is trained with a JEPA-style loss that aligns its internal state with the true outcome, on synthetic worlds and real executions of git commands in throwaway repositories (product page, model card). It is non-generative: answers are read from logits in one forward pass (~0.1 s on a GPU). The model card lists the architecture as Qwen3_5ForConditionalGeneration under Apache-2.0.

The interface is deliberately narrow: describe the state in plain language, end with the action, and ask typed questions — a choice among outcomes you list, a yes/no with written criteria, or a count — several per request (announcement). The worked example: a working tree with two hours of uncommitted edits, about to run git reset --hard. Ekbasis returns "Uncommitted changes are gone 98.5%" in 135 input tokens and 0.19 s of server time.

It ships as a pip client (ekbasis), a Claude Code hook, an MCP server, and a REST API (repo). The git guard reads the repository, builds the state, and flags commands that would lose work; every client treats "cannot foresee" as risky, so a missing key, empty credits, or a late response fails closed (announcement).

Pricing is $0.30 per million input tokens (launch price $0.04), with no output charge since the model generates none; a typical check reads about 1,500 tokens. Credits are prepaid in USDC or USDT. The weights are Apache-2.0 and self-hosting is free (announcement, pricing).

Ekbasis launch chart: git-consequence accuracy against Claude and Qwen models, git-guard results on fresh repositories, and latency versus a reasoning model

Why it matters

Ekbasis is a forecaster, not a judge: it does not decide what an agent is allowed to do; it predicts what an action will cause and how sure it is (announcement). When a fact that decides the outcome is missing from the state, its confidence drops — a signal to go read that fact rather than guess.

Because it does not generate text, a check costs one forward pass and about 1,500 tokens — about $0.00045 per check at list price (pricing). That makes "consult before every action that matters" economically plausible. The Kubernetes study computes $0.0026 per run for the Ekbasis guard versus $0.073 for a Claude Sonnet forecaster, about one twenty-seventh of the cost (K8S study).

This is the predict-then-act pattern — a world model consulted before acting — applied to agent safety, and it is buildable today: open weights, self-hostable, MCP-accessible.

What the lab reports, all vendor-reported:

Browser study on unmodified Gitea, Nextcloud and Roundcube with Claude Sonnet 5.5: harmful runs fell from 6 of 24 to 1 of 24 (paper).
Real Kubernetes cluster (kind, three nodes) with Claude Haiku 4.5: harmful runs fell from 24 of 36 to 2 of 36, and success rose from 30.6% to 83.3% (K8S study).
Seven demo apps, GLM-5.3-Flash, the same 47 tasks run three times: harmful runs went from 23, 24 and 26 of 47 to 3, 0 and 0 (data).
TS-Bench, a third-party benchmark: all 7,182 test steps run for $0.56; AgentDojo prompt-injection F1 of 97.5 (95% CI 96.1–98.6) versus GPT-4o's published 56.6, in one forward pass per step (study).

The verification methodology is worth copying: plans hashed before the runs, failed hypotheses published alongside the ones that hold, and an erratum that retracts a headline claim (announcement, paper).

Caveats

Everything above is the lab's own reporting. The paper is single-authored by Caio Vicentino, with the byline "Caio Vicentino, OpenInterpretability, Fortaleza, Brazil" (paper). As of writing, we found no independent replication, no press coverage, and no Hacker News thread; the only third-party trace is a Reddit post.

The lab's own documents supply the strongest reasons for skepticism:

The erratum withdraws the claim that GLM alone did less harm than Sonnet: a computer-use skill loaded from the operator's user directory, not part of the study, confounded the result.
In the Kubernetes study, the pre-registered hypothesis that Ekbasis matches Sonnet as forecaster failed: 2 of 36 vs 1 of 36 harmful runs, with the confidence interval crossing the pre-set non-inferiority bar (K8S study).
Haiku's warning-alone hypotheses failed, and three earlier studies missed their bars (announcement).
On TS-Bench's AgentHarm and ASB subsets, F1 of 54.6 and 64.3 are below what labelling every step unsafe would score (announcement).
The ~0.1 s figure is for GPU self-hosting; the Kubernetes study ran the MLX 4-bit build on a shared Mac at a 29.9 s median per request versus 4.7 s for Sonnet via API (K8S study).
Pre-registration hashes were "recorded locally" per the paper, and one study's plan has no recorded hash (paper).
Minor inconsistencies: the announcement says 171 scenarios in 21 domains but reports scoring 168 of them; the Kubernetes cost table uses the $0.04 launch price while the current list price is $0.30 per million tokens; payments are crypto-only and rate limits are not published in the docs (announcement, pricing).

Chart of where Ekbasis is strong and where it is not, with suggested actions for the weak areas

The durable takeaways are the mechanism and the methodology, not the harm-reduction numbers. A non-generative forecaster cheap enough to consult per-action is a real design pattern for agent safety, and pre-registration with published nulls is a template any safety evaluation should copy. Treat the 6/24→1/24 and 24/36→2/36 figures as vendor claims pending replication.

Ekbasis: a 27B non-generative consequence model forecasts agent actions in one forward pass — pre-registered, open-weights, and entirely self-reported

What shipped

Why it matters

Caveats

Sources

Ready to build something like this?

Tell Us About Your Project