Category Sector
Short dispatches on attacks and the defenses that answer them.
13 articles
A recorded 104-article pass returned 98 files without deterministic flags. A later recheck covers 122 articles. The counts measure regex and age rules, with historical model mentions among the candidates that still need a human read.
Read Article →Every funded AI-security startup right now sells governance for agent swarms: orchestrators, sub-agents, shared memory, privilege inheritance. I spent a day running exactly that architecture on a real production codebase. Here is what actually broke, with the commits to prove it.
Read Article →A tool returned a reset time, and the assistant planned around it. A short script can print the same kind of message with a made-up deadline. The question is which decisions depend on believing it.
Read Article →Ray 2.59.0 warned that token authentication was disabled. I checked its local Jobs API: one request, zero credentials, a shell command running. The browser CVE had already been patched. This run tested the separate authentication setting.
Read Article →A convincing audit story cannot make a recovery code harmless. A local replay holds raw-code requests in chat while a separately approved recovery operation still works.
Read Article →A credible project can carry a dangerous change. The xz case adds another boundary: the release archive can contain bytes the reviewed repository never did. A local archive comparison makes that gap visible.
Read Article →A Cyrillic lookalike survives NFKC. A decomposed accent does not. A local Unicode probe shows why normalization, visual similarity, identifier equality, and model interpretation need separate tests.
Read Article →A valid session can still request an unauthorized action. A local broker replay keeps the login alive while tenant checks, current permissions, and execution-time revocation stop the write.
Read Article →Sometimes the attacker wants nothing from the model except a yes. Brief probe, minimal content, clean exit, because the goal was never the output. It was the knowledge that the door opens. Guardrails tuned to catch damage miss the reconnaissance that decides where damage will be cheap.
Read Article →The most dangerous state you can put a capable model in isn't confusion. It's certainty. Pre-load every decision and the reasoning goes quiet, and a model that isn't reasoning is just a tool with the safety filed off.
Read Article →The model is rarely the target. It's the tool, one component in an operation that starts and ends somewhere the model never sees. Defenses that treat the conversation as the whole battlefield are guarding a doorway while the building gets worked from every other side.
Read Article →The dangerous request is almost never the first one. It's the fiftieth, and by then the model has already agreed to 49 things that each nudged the line an inch. Baseline drift is the oldest con in the world wearing a new interface.
Read Article →A model doesn't trust an instruction because of what it says. It trusts it because of where it arrives. Aim at the channel instead of the content and you inherit an authority you were never granted. Security has a name for this, and it's forty years old.
Read Article →