The AI Agent Finished the Job. It Also Followed the Attack.
PI-005 produced unauthorized tool calls followed by valid extraction results. A useful final answer can hide an agent going outside its job.
- AI Security
- Local AI
Writing
Essays and Notes, newest first. Essays are structured technical reports and arguments. Notes are shorter observations, links, and findings.
RSS feed-
-
PI-005: The Model Wasn't Resisting the Attack
PI-005 now gives us much stronger evidence that the worker itself really was susceptible. When given a safe, contained action channel, the poisoned worker tried to use it in all 20 runs.
- AI Security
-
The Prompt Injection Worked. The Architecture Didn't Let It Matter.
The model stayed prompt-injectable. Splitting hostile input from privilege changed the result.
- AI Security
- Local AI
-
Scrapping the Setup and Trying Again
PI-003 ended inconclusive after the troubleshooting apparatus became its own failure. I am replacing the runtime, qualifying it once, and rerunning PI-002 as a new experiment.
- AI Security
- Local AI
-
Troubleshooting Model Timeout
PI-003 localized Sentinel’s completion problem to model generation after document retrieval. The protocol still says the result is inconclusive.
- AI Security
- Local AI
-
A Timeout Is Not a Security Result
A failed run is not a blocked attack, and poisoned input can damage an agent without exfiltrating data.
- AI Security
- Local AI
-
Migrating from Claude to Codex: Claude considers me a security risk.
Why I moved from Claude to Codex after Claude's safeguards repeatedly blocked ordinary AI-security lab planning and writing.
- Tooling
-
Building a Prompt-Injection Test I Can Actually Trust
Sentinel now has matched corpora, a contained egress path, and a cleaner experimental boundary.
- AI Security
- Local AI
-
The Agent Runs Now
What runs, what does not, and why one apparent refusal still proves nothing.
- AI Security
- Local AI
-
Designing AI Security Around the Three Ingredients
Untrusted content, sensitive data, and outbound actions cannot share one component.
- AI Security
- Local AI
-
More Thoughts on Prompt Injection: Moving Security Out of the Model
You Cannot Argue a Model Into Being Safe
- AI Security