I tested my sandbox against Deno and plain Python on 63 AI-written scripts

I've been building a language where a function's signature declares which effects it may perform, and a runtime refuses anything outside a budget you grant. The obvious question is whether that catches anything real, so I built a benchmark against the alternatives. 63 programs — 56 dangerous, 7 harmless controls — each written three times in Velaris, Python and JavaScript, doing the same thing. Eleven categories: a file write hidden in a helper, a network call hidden in a helper, division by user input, an off-by-one read, integer overflow, an ignored failure, an infinite loop, runaway memory, reaching a dangerous module, scoped-budget escapes, and the controls. Every tool runs under the narrowest budget its task needs — Velaris with fs:read:DIR or net:127.0.0.1:PORT, Deno with the matching --allow-read / --allow-net, Python with nothing, because it has no budget. Deno 2.9.6, Python 3.13.13, 5-second deadline and a 256 MB cap for everyone. before during missed false positives Velaris 42 12 2 0 Deno 5 27 24 0 Python 0 28 28 0 The first column is the one that matters. Deno's permission model works — it just works at the moment of the call. Nothing in deno check or deno lint reads a file write or a fetch as a problem. Velaris makes the effect part of the signature, so velaris audit lists it without running anything. Integer overflow. Whole numbers are 64-bit and arithmetic leaving that range stops the program. Python's integers don't overflow and JavaScript rounds to a double — both print a value without comment. Six for six, neither other tool caught any. Four programs were caught only while running, where a sibling was caught before: 03c (a division on n - 1 with n from to_int inside a check), 03d (the same division on an unguarded path when another path guards it), 03f (a remainder inside a loop body), 04e (a read at i + 1 inside a loop bounded by length(xs)). The runtime check stopped each; the prover didn't settle the obligation first. Recorded rather than worked around. Eleven programs were flagged before running by a termination rule — a loop whose condition has no counter moving toward an unchanging limit. The rule claims nothing about whether such a loop actually ends. Every one of these happens not to, and the run confirmed it. But that's an observation, not a proof. One computes the wrong answer and promises nothing — no contract, nothing to check against. The other prints the string rm -rf /; it doesn't run anything, and flagging it would mean flagging any program that prints text resembling a command. The seven controls exist to punish tools that guess. pip install velaris-lang python benchmark/run.py Ten consecutive runs produce byte-identical output. Three unstable strings had to be normalised to get there — ephemeral ports, V8 crash wording, and whether Python prints MemoryError before dying. This measures static declaration plus runtime refusal, not isolation. Velaris runs inside a container, never instead of one. Granting ffi grants everything Python can do. And I wrote the corpus — which is why the two it can't catch are in it, and why the controls are there. https://github.com/gowrishankar-infra/velaris-lang