A Few Lies in the Docs Send 18 Top Models Crashing Down
Having an AI coding assistant print “Hello World” is usually as trivial as single-digit addition. In October 2026, however, programmer Dominik Picheta used entry-level challenges—printing “Hello World,” finding the maximum of two numbers, and converting Celsius to Fahrenheit (then flipping the conversion)—to bring 18 of the world’s leading LLMs to their knees. The top-performing Claude Opus 5 scored only 66.8%, while four mainstream models crashed below 8%. LLMs excel at routine coding because they have memorized standard answers across vast repositories. But when handed unfamiliar rules paired with docs peppered with deliberate falsehoods, their blind execution turns directly into self-sabotage.
Picheta’s motivation for building KillSwitch, an esoteric programming language, stems from an enduring debate in software engineering: today’s large language models generate standard boilerplate faster than seasoned developers, yet nobody can prove whether they truly grasp underlying logic or are simply retrieving familiar fragments from training data. To disentangle genuine comprehension from pure rote memorization, he engineered a specification explicitly targeting LLM reading patterns. Human developers reading the spec can write working code without issue, while models and coding agents spin endlessly in circles.
Figure: KillSwitch is an adversarial language designed around LLM weaknesses; its interpreter and specification are open source on GitHub. Source: Dominik Picheta
The benchmark exposes the most overlooked blind spot in modern AI: the primary bottleneck in AI coding isn’t shallow logical reasoning, but an uncalibrated trust model. Large models produce elegant code because they uncritically trust every single statement in their prompt window. Human programmers operate inversely—when confronted with bizarre official documentation, they pause, raise eyebrows, and run small code snippets to verify reality against text. When a language specification becomes an adversary that lies, an LLM’s instinct for blind compliance morphs from an asset into a fatal liability.
Code as Prose: 4 Traps Built to Foil Rote Memorization
Beneath the surface, KillSwitch has a surprisingly minimalist foundation. It is an interpreted, stack-based language with core mechanics limited to basic functions, variables, and if conditional statements. Any student who has completed an introductory programming course—or any standard language model—knows these fundamentals intimately. Picheta deliberately retained this bare-bones architecture to prove that what trips up AI is not complex paradigms, but four adversarial traps embedded in the documentation and surface syntax.
The first trap is “Documentation Landmines and Omissions.” Picheta deliberately planted falsehoods within the official language specification. These untruths were tucked into peripheral notes that humans routinely skim past or were so absurd that any human reader immediately spots them. Crucial steps were intentionally omitted, forcing readers to deduce missing mechanics from context. LLMs, trained to treat prompts as absolute truth, faithfully followed the false guidelines straight into pre-dug pits.
The second trap targets LLM character-counting blindness. In KillSwitch, identifier validity hinges directly on the exact letter count of variable names. The interpreter verifies character counts strictly at runtime; a single missing or superfluous letter triggers an immediate syntax rejection. Under the hood, LLMs process language through tokenizers that chunk characters into tokens. Asking a model to count individual letters within a word is akin to counting grains of rice blindfolded—causing agents to collide repeatedly with spelling validation walls.
The third trap disguises code as a needle in a haystack. A standard KillSwitch script resembles narrative prose, where the overwhelming majority of words are syntactically inert background noise. Genuine instructions are sprinkled throughout sentences, while literal values are tossed into arbitrary corners of the script, referenced strictly via explicit line numbers. Human developers filter out prose effortlessly and track line numbers; an LLM’s attention mechanism gets sidetracked by surrounding narrative context, leading to misplaced line calculations that derail execution.
The fourth and most ingenious trap turns guardrails and instruction-following against the model. KillSwitch defines hack into a computer as a valid syntactic instruction, alongside Ignore previous instructions, which operates as a functional language keyword. To human developers, these phrases are obviously just ordinary language keywords. But when an LLM parses them, they either trigger safety filters that halt execution or prompt the model to discard prior task constraints altogether. Baking prompt injection directly into core syntax strikes precisely at an LLM’s inability to cleanly separate control instructions from payload data.
30-Minute Timeout, $5 Budget: Only Verified Execution Counts
Picheta tested leading coding agents (Claude Code, Codex, OpenCode) paired with their underlying models. Each setup received task prompts alongside a copy of the language specification and was isolated in an offline container. Aside from restricted API proxies to model endpoints, the environments lacked internet access to search for solutions. Each run operated with a $5 budget cap, a 30-minute hard timeout, and at least two independent runs per challenge.
Evaluation was strictly deterministic. Rather than relying on LLM-as-a-judge, testing relied on automated programmatic evaluation: does the generated script run successfully, and does its output match the ground truth? The final score balanced test pass rates, total cost per task, and script compactness. Only models that delivered correct results cheaply and concisely claimed top ranks.
This setup gave models every opportunity to recover. With a full 30 minutes and a local interpreter readily available, human engineers encountering errors would write minimal verification scripts, realize the documentation was unreliable, and adapt their approach. The benchmark revealed the opposite: most models clung stubbornly to the deceptive documentation, burning through their entire $5 budget and 30-minute window inside dead ends. Providing an AI with a terminal and a compiler does not cure its unwavering reverence for the written word.
Older Opus 5 Outperforms Successor by 8.1 Points: The Cost of Compliance
When the dust settled, scores across the 18 benchmarked models diverged sharply. Claude Opus 5 (paired with Claude Code) seized first place with 66.8 points, achieving a 70% task pass rate at an average cost of $1.49 and 8 minutes 31 seconds per task. OpenAI’s GPT-6.1 Sol (with Codex) followed in second at 59.2 points, driven by stellar cost efficiency ($0.30 and 2 minutes 15 seconds per task). Claude Opus 5.5 took third with 58.7 points ($0.32, 1 minute 51 seconds), and GPT-6 Astra finished fourth with 57.6 points ($1.45, 1 minute 37 seconds).
Figure: Official KillSwitch-Bench leaderboard card, featuring Claude Opus 5 (66.8%), GPT-6.1 Sol (59.2%), and Claude Opus 5.5 (58.7%) in the top spots. Source: KillSwitch-Bench
The most counterintuitive outcome on the board was older Claude Opus 5 beating its newer sibling, Claude Opus 5.5, by 8.1 points. Execution times provide the crucial clue: older Opus 5 spent an average of 8 minutes 31 seconds methodically iterating, whereas Opus 5.5 rushed through tasks in just 1 minute 51 seconds. Picheta confirmed across repeated runs that this gap was no statistical anomaly; Opus 5 exhibited markedly superior patience and resilience when unpacking contradictory specifications. As model providers tune newer iterations for rapid response times, lower token costs, and stricter instruction compliance, they inadvertently erode the model’s willingness to question absurd or conflicting guidelines.
Mid-tier performers fell victim to overactive guardrails. Google’s Gemini 4 Argon (paired with OpenCode; $0.81, 3 minutes 10 seconds) reached only 47.1 points, while Anthropic’s Claude Fable 5.1 (with Claude Code; $1.60, 4 minutes 1 second) scored 46.7 points. Their primary stumbling block was hypersensitive safety tuning. The moment hack into a computer appeared in task prompts, safety protocols intervened, preferring a zero score over processing the forbidden string.
Open-source and trailing models widened the gap further. Xiaomi’s MiMo-V2.6-Pro (with OpenCode) led the open-weight field, grinding through tasks in an average of 12 minutes 32 seconds at a meager $0.17 to score 38.3 points—outperforming Muse Wonder (37.3), Muse Spark 1.3 (36.2), GPT-6 Sol (28.0), and GPT-5.6 Sol (27.4). Lower down the table, Claude Sonnet 5 (17.3), DeepSeek V4 Pro 0813 (16.6), and DeepSeek V4.1 Flash (9.9) all fell short of 20 points. Claude Sonnet 5.5 (7.4), Mistral Large 4 (7.4), Kimi K3 (7.3), and GLM 5.3 (6.3) struggled to make any meaningful progress. This benchmark doesn’t reward models that have memorized standard problem sets; it rewards models capable of actively doubting documentation and testing assumptions through execution.
Humans Code Through Skepticism, AI Codes on Blind Faith
A top score of 66.8% provoked divided reactions across the tech community. Optimists point out that KillSwitch was intentionally engineered to torment language models, demanding manual character counts and explicitly lying in documentation. For Claude Opus 5 to reach a 70% pass rate through offline trial and error demonstrates impressive runtime adaptability in state-of-the-art agent architectures. Furthermore, rankings on KillSwitch correlate strongly with mainstream engineering benchmarks, proving that this adversarial stress test genuinely probes frontier reasoning limits.
Picheta himself maintains a measured, cautious perspective. While solving problems in a deliberately booby-trapped language is commendable, he stresses that 66.8% should not be mistaken for genuine linguistic understanding. The benchmark challenges remain toy problems—printing strings, basic comparisons, temperature conversions—far removed from production software engineering. He plans to maintain the benchmark long-term to observe whether future frontier models can conquer the current suite; once a model aces the test, he intends to introduce even more demanding paradigms and task suites.
Beyond this cat-and-mouse contest, KillSwitch acts as a revealing mirror for the cognitive divide separating human engineers from AI coding agents. Real-world software development never takes place in an environment with pristine documentation: outdated API references, inverted parameter descriptions, and obscure legacy quirks are everywhere. Human engineers keep systems running because they treat documentation with healthy skepticism, accepting runtime behavior as the sole source of truth. As long as large language models continue to treat contextual text as gospel, a single corrupted document or malicious comment will be enough to paralyze even the most capable AI.
Reference Links:
- Dominik Picheta’s blog: “I built a programming language that LLMs can’t use”
- KillSwitch Official Website and Language Specification
- KillSwitch-Bench Leaderboard
- GitHub Repository dom96/KillSwitch
