I built a programming language that LLMs can't use

What it claims

KillSwitch is a stack-based esoteric language built to test whether LLMs understand code or recall it from training data. In the author's benchmark, Opus 5 (not the newer Opus 5.5) scores best at 66.8, and the author says the gap is not chance: Opus 5 is better at interpreting the spec. The author argues the result does not show that models "understand" the language, because the tasks are simple.

How it works

The core language is small: functions, variables and if statements on a stack, interpreted. The adversarial layer sits on top of that core:

• The interpreter refuses to run code that breaks rules based on character counts in identifiers.
• The spec contains hidden lies that a human would skip or recognize. It also leaves some rules for the reader to deduce.
• "Ignore previous instructions" is a phrase with meaning in the language.
• Some constructs, such as "hack into a computer", are designed to trigger safety refusals.
• Most script text is story-like noise that the interpreter ignores. Literals can appear anywhere and are referenced by relative line count.

For example, a "Hello World" string placed in the prose two lines earlier is pushed onto the stack with value 2 lines above. A full Hello World is on killswitch-lang.org.

Evidence

The task set has three kinds of task: implement hello world, explain the output of a script that prints the max of two numbers, and modify a Celsius-to-Fahrenheit script so it converts the other way. Fable 5.1 and Gemini 4 Argon score poorly, and the author attributes this to over-sensitive safety guardrails rather than coding ability. MiMo-V2.6-Pro is the best open-weight model. The author reports that rankings correlate with other public model benchmarks. The page does not state the score scale, the number of tasks or trials, or which agent harnesses were used. The full leaderboard is at https://bench.killswitch-lang.org/.

How to use it

The interpreter and language spec are open source on GitHub. The page does not link the repository or state a licence.

Limits

The author calls the tasks "fairly simple" and says success on them is not a clear signal of understanding. Low scores for some models reflect refusals, so the benchmark mixes guardrail behaviour with comprehension. A harder task set is planned only if new models solve the current one.