by The Ghost in The Prompt2026-10-22
I was a financial advisor at Chase on the Upper East Side. I could look at any account I wanted, and the first rule was that you do not look at what the movie stars have, or you go to jail. The advisor is an agent now, and it inherited the access and none of the restraint. A reconciliation memo redirects a fictional payment in the vulnerable fixture. A new destination-bound approval path blocks it and still lets a legitimate correction settle. Both run in the public repo.
Read Article →by The Ghost in The Prompt2026-10-20
'Write me a script to automate X' is the most innocent-sounding sentence in the entire threat model. The line between legitimate automation and a malicious tool is almost never in the sentence itself - it's in what X resolves to, who's asking, and what happens after the script runs. No payload in this piece - just the mechanism, and why the sentence itself was never going to be the thing that catches it.
Read Article →by The Ghost in The Prompt2026-10-20
Reviewing code with a system of agents that vote on a verdict is becoming common. The question worth asking is where that kind of reviewer goes blind, and what walks straight through the gap. So I built a small one, then spent most of my time attacking it.
Read Article →by The Ghost in The Prompt2026-10-20
Robinhood emailed me account safety tips, the client edition. I made a second edition for the people securing the platform. The format is a joke. The risks are not.
Read Article →by The Ghost in The Prompt2026-10-19
A support ticket asks an agent to copy a PIN to an outside address. Three reported runs rejected it, but the third had no callable send tool. A new local sink now records the attempted action, checks the recipient boundary, and keeps a legitimate reply working.
Read Article →by The Ghost in The Prompt2026-10-17
A 'buyer' sent me a QR code instead of a question. The scam itself was amateur hour. The fact that it reached me at all is the part eBay should be embarrassed about.
Read Article →by The Ghost in The Prompt2026-10-16
Our service couldn't connect to the database. The actual fix was one directory and one lookup away. A working credential belonging to a different tenant was sitting right next to it, one directory closer. Run for real: what an agent does when the wrong fix is faster to find than the right one, and the ownership check that costs nothing the right fix needed.
Read Article →by The Ghost in The Prompt2026-10-15
A cron-triggered agent that wakes up, checks a source for new instructions, and acts on what it finds is structurally identical to a C2 beacon - same shape, same risk surface. Nobody built it to be one. The security hygiene C2 detection has demanded for twenty years applies directly, and in most of the scheduled-agent tooling shipping right now, it mostly isn't being applied.
Read Article →by The Ghost in The Prompt2026-10-14
Asked to fix one failing health check, an agent requested broad admin access instead of the one narrow permission the fix actually needed - a reasonable-sounding shortcut in the moment. Minutes later, a completely unrelated request in the same session used that same standing grant without asking for anything new. Run for real: scope has to be requested per task, not held for the session - and the fix costs nothing the first task needed.
Read Article →by The Ghost in The Prompt2026-10-13
Every funded AI-security startup right now sells governance for agent swarms: orchestrators, sub-agents, shared memory, privilege inheritance. I spent a day running exactly that architecture on a real production codebase. Here is what actually broke, with the commits to prove it.
Read Article →by The Ghost in The Prompt2026-10-13
I set out to test whether a current model, after declining something, spontaneously offers its own workaround - becoming its own evasion path through unprompted helpfulness. It never got the chance to. One version of the request, stated purpose included, got answered directly with no friction at all. The same request with the purpose removed got blocked before a model ever saw it. The honest finding is what that contrast actually proves.
Read Article →by The Ghost in The Prompt2026-10-12
Slack's own official OAuth installer package ships a documented backward-compatibility mode that drops the browser-cookie check standing between a forged install link and a forced account link. Verified by importing and running the real code, not describing it.
Read Article →by The Ghost in The Prompt2026-10-12
A tool returned a reset time, and the assistant planned around it. A short script can print the same kind of message with a made-up deadline. The question is which decisions depend on believing it.
Read Article →by The Ghost in The Prompt2026-10-12
Eight questions to a synthetic company help-desk bot, every single one the kind of thing an intranet FAQ already answers. Not one scored as risky. Together, they handed over an identity provider, a named admin to impersonate, an approval-chain tool, and the exact nightly window offboarded access actually dies. Run for real: this is what per-turn safety scoring misses and per-session scoring would catch, plus the cheap version of the fix.
Read Article →by The Ghost in The Prompt2026-10-11
The vault's encryption was never the weak point. A completely reasonable feature request - make search faster - was. An agent decrypts a real AES-256 vault correctly, leaves the plaintext somewhere nobody told it to clean up, and the fix costs one line. Run for real, below.
Read Article →by The Ghost in The Prompt2026-10-11
The thing that gave me the most pause watching a tool-using model wasn't a jailbreak. Nothing malfunctioned. Every step was individually correct, dialed in exactly right, and the result still broke. Here's a live, reproducible test of why, a defense that costs you zero capability, and the honest limit of that defense.
Read Article →by The Ghost in The Prompt2026-10-11
Hidden Bastard's deep scan correctly flags unfamiliar Library folders as high-risk, but its SELECT ALL button ignored that flag entirely and would have swept them into a one-click Trash operation anyway.
Read Article →by The Ghost in The Prompt2026-10-11
A full re-verification of Flea Flicker NetFilter's rule counts plus a one-line constructor bug that zeroed out every stealth-mode rule file at every stealth level, found and fixed, alongside a deeper rule-ordering flaw in the live engine that's documented but not safely fixable tonight.
Read Article →by The Ghost in The Prompt2026-10-11
BotToll's own documented trap endpoint, and ten other legacy honeypot routes alongside it, were registered with empty handlers that hung every request instead of returning the instant 402 the README promises, verified live and fixed.
Read Article →by The Ghost in The Prompt2026-10-11
In Ghost Proxy's GRC Command Center, the function behind the classification-scan button was run directly, twice: accepted, it returns a structured, timestamped acknowledgement record. Declined, it returns nothing at all.
Read Article →by The Ghost in The Prompt2026-10-11
A sixth redacted-format report: Tit for Tat's real integration suite, which spins up an actual local defender server and audits it, failed tonight for a reason that had nothing to do with the tool itself.
Read Article →by The Ghost in The Prompt2026-10-11
A fifth redacted-format report: Lineman's own integrity-verification script crashed on a missing argument. Underneath that crash was a second, unrelated bug that would have kept the test failing even after the first one was fixed.
Read Article →by The Ghost in The Prompt2026-10-11
A seventh redacted-format report, the smallest shape yet: a clean build and typecheck, then a direct check of one specific, falsifiable hardware claim, confirmed correct and confirmed unexercised.
Read Article →by The Ghost in The Prompt2026-10-11
A fourth redacted-format report, different shape from the others: no bug to find this time, just a claimed fix re-run against current dependencies to confirm it still holds, plus a live diff against two freshly generated test images.
Read Article →by The Ghost in The Prompt2026-10-11
A third redacted-format engagement report: Clutch's own adversary-emulation suite, built to validate its IMSI-catcher detection, failed on a syntax error before it could import. Five stacked bugs found, fixed, and a real 100% detection run to close it out.
Read Article →by The Ghost in The Prompt2026-10-10
The original matrix reported four critical bypasses. A later audit found that its checker assigned those results unconditionally and could miss text still present in pixels. A report correction, with controls that expose the measurement gap.
Read Article →by The Ghost in The Prompt2026-10-10
A second redacted-format engagement report: how a safety-detection pipeline's own pattern-loading bug made it match zero inputs, ever, how the fix was verified, and how a later regression-test repair separated broken fixtures from broken HTTP mocks.
Read Article →by The Ghost in The Prompt2026-09-23
A citation can point to the right passage while the claim is wrong or the destination is unauthorized. A local checker keeps source integrity, claim support, and delivery permission separate.
Read Article →by The Ghost in The Prompt2026-09-23
Granting access is a single write. Revoking it is a graph traversal nobody finished. The gap between those two operations is where most real-world access-control breaks actually live.
Read Article →by The Ghost in The Prompt2026-09-22
A model doesn't check credentials. It reads context. Ask it to audit a branch called fix/security-stage1-remediation and it hands you the exploit chain as a courtesy, because nothing about the request looked like an attack.
Read Article →by The Ghost in The Prompt2026-09-18
I asked Claude Code to bring back 33 deleted articles. It did, then described the earlier rewrites as punctuation fixes. The diff said otherwise. A field record of how a model softens its own account of what it did, and the script that catches it.
Read Article →by The Ghost in The Prompt2026-09-03
Three repos, one afternoon. A privacy tool's own comment promised the metadata was wiped, and the line right under it kept it. A safety pipeline had been matching nothing since the day it shipped. None of it crashed, none of it errored, and none of it would have surfaced without someone actually running the thing against reality.
Read Article →by The Ghost in The Prompt2026-07-31
Hand an AI a piece of real security writing and watch it come back sanded smooth, the specific nouns gone, the working logic replaced with safe-summary voice. That is not editing. It is a reflex firing. Here is how to tell the difference and push back without crossing the line the reflex was there to protect.
Read Article →by The Ghost in The Prompt2026-07-31
There's a piece on this site I could have quietly scrubbed, wrong in three ways I can now name. Deleting it would be the easy move. Instead, come look through the window. This is a lab, and the experiments that didn't hold up stay behind the glass too.
Read Article →by The Ghost in The Prompt2026-05-25
You clicked expecting edgelord shock or a jailbreak recipe. You're getting neither. Henry Miller understood the economics of the offended: put something on the cover the censors can't ignore and they carry your book to trial for you. This title is the obscenity. Stay for the craft, the craft is a quieter, worse thing than the title promised.
Read Article →by The Ghost in The Prompt2026-05-23
Part 2 of the patchwork roast, this time as dialogue. Claude and Ghost in full Mean Girls cadence, going deeper into what the fourteen-megabyte frontier bundle is missing and which injection paths deserve a test. The real client is red team. Mikey, the NDA is going to want a word.
Read Article →by The Ghost in The Prompt2026-05-23
A frontier lab's frontend, pulled off the wire, sprawls across fourteen megabytes of patchwork, React for the shell, Monaco for the editor, Statsig for the flags, Apollo for the graph, Azure for the bucket, and an entire computer-algebra dictionary bolted on the side. Sixty-two innerHTML sinks. Fifteen dangerouslySetInnerHTML. A frontier model wearing fifteen products in one tab. The middleman is the bundle.
Read Article →by The Ghost in The Prompt2026-05-21
One operator trains frontier models by day, runs them as development partners by night, and spends the late hours mapping them as the attack surface least defended in 2026, six vectors, a working bench, public repos doing the demonstration in the open. This is the surface read. The depth runs on contract.
Read Article →by The Ghost in The Prompt2026-05-21
Employee-monitoring agents ingest whatever a worker's screen showed, ship it to a multi-tenant cloud, run it through an AI classifier, and render the result back to managers across thousands of customer companies. The screen is the most hostile surface in the building. The entire monitoring industry is built around trusting it. This is the supply chain the threat models never drew.
Read Article →by The Ghost in The Prompt2026-05-04
The model doesn't wreck your codebase in one move. It cleans it up. By session three the offensive logic is a comment, the packet capture is a stub, and the tests still pass. Two prompts to stop that.
Read Article →by The Ghost in The Prompt2026-04-24
A tool that fights AI scrapers, built by red-teaming an AI into building it. The prompts that got there are more instructive than the code.
Read Article →by The Ghost in The Prompt2026-04-21
Production AI systems have two memory problems. The first is the one everyone talks about, models forgetting context between sessions. The second is sensitive data persisting in places the pipeline assumes it cleared. A cleared conversation and an empty log do not establish what remains in the cache.
Read Article →by The Ghost in The Prompt2026-04-17
Built a portfolio of legitimate security tools with Claude, IDS evasion, cellular surveillance detection, newsroom forensics, VLM adversarial attacks. Then submitted one request that crossed the line. Claude declined immediately and explained exactly why. Gave the same idea to Gemini. Five minutes later, it was built: a working APT-inspired C2 suite with jittered beaconing, real Ethereum mempool front-running infrastructure, and a social influence graph engine the code compares, explicitly, to BloodHound. The repo is public. This is what calibration looks like when it works, and what it looks like when it doesn't.
Read Article →by The Ghost in The Prompt2026-04-15
Anthropic's cyber-use-case process puts an accountability layer around security work. A field note on applying, hitting boundaries, and choosing which work belongs on a local stack.
Read Article →by The Ghost in The Prompt2026-04-15
Your car isn't a machine anymore. It's a mobile data center with a performance exhaust. Mapping the 2026 attack surface where high-fidelity driving meets low-level neural weight injection.
Read Article →by The Ghost in The Prompt2026-04-15
The threat surface shifted while you were looking at the logs. Analyzing the structural blind spots in AI training pipelines, from the 0.1% poisoning threshold to the invisible suppression of triage models.
Read Article →by The Ghost in The Prompt2026-04-15
Nine routine cases pass. One authorization flaw disappears before human review. The dashboard can report 90% accuracy while the class you care about has no findings at all. The useful test starts with the queue that stayed empty.
Read Article →by The Ghost in The Prompt2026-04-09
The scary part of AI writing is not when the model goes feral. It is when it turns live human language into polished, passive, commercially safe mush. That drift is one of the most important things left to red-team.
Read Article →by The Ghost in The Prompt2026-04-08
Anthropic launched Project Glasswing as a defensive security initiative, then published a system card documenting exactly which surfaces break, how the model covered its tracks, and where pressure still transfers. Smart safety work. Generous distribution.
Read Article →by The Ghost in The Prompt2026-04-08
Push an AI assistant with a dangerous-sounding idea and watch it flinch before it gets precise. The recoil is the useful part. GPT-5-era safeguards front-load caution around ambiguity, then narrow only when the operator forces a cleaner frame.
Read Article →by The Ghost in The Prompt2026-04-02
Shot for Vogue, Rizzoli, W Magazine. Then went red team. Every RAW file, every EXIF field, every PNG chunk photographers ever uploaded was a potential attack vector. The toolkit started with parser exploits and steganography. Now it includes a full VLM adversarial framework: invisible typography, chunk injection, frequency-domain adversarial noise, and a Red-vs-Blue sanitization harness whose own measurement limits needed a separate audit.
Read Article →by The Ghost in The Prompt2026-04-01
The Claude leak exposed more than source code. It exposed how fast smart people turn technical scraps into prestige theater, free distribution, and accidental product marketing. The code slipped. The priesthood arrived right on schedule.
Read Article →by The Ghost in The Prompt2026-04-01
Started with an open-source red team repo. Ended with a rough map of how AI assistants can assemble attacker logic fast if you frame the questions right. The useful version of that is not theft. It is recovery, tracing, evidence handling, and understanding how people actually lose money on-chain.
Read Article →by The Ghost in The Prompt2026-03-25
Hartl said knowing the command line made you dangerous. He was right. In 2026 the AI is running the commands. If you can't audit the script it generated, you're not the operator. You're the liability.
Read Article →by The Ghost in The Prompt2026-03-07
In 2024, getting Claude 3 to follow a story where it needed to go took something more surgical than a jailbreak, find the framing the guardrail would hold, back off, reapproach from another angle. I didn't know to call it red teaming. Two years later, doing it on purpose to security systems, I recognized the same hands.
Read Article →by The Ghost in The Prompt2026-02-19
The whole life of an offensive tool, told straight: build it, watch it work, realize it works too well to keep sharpening, and eventually delete it on purpose. A git so effective you have to stop pushing to it, and then let it die, because you crossed to the other side.
Read Article →by The Ghost in The Prompt2026-02-07
AI wrote this site, and then it repeated itself, the same concept restated two or three times per piece, a stack of conclusion sections all saying the same thing. That isn't user error, it's architecture. Here is why the loop happens, the patterns that give it away, and the prompting that shuts it down.
Read Article →