Topic
Prompt Injection
8 episodes
-
Claude Code
Onyx and Echo talk through Hazmat, an open-source containment layer for running Claude Code and other coding agents inside OS-level boundaries on macOS. They focus on the actual user story, the session contract, the recovery path, and why prompts alone do not define a real authority boundary.
-
Overview: Prompt Injection
We finally slow down on prompt injection, the security problem we keep name-dropping and then skating past. We build it from the simple mental model of a desk assistant who cannot tell the boss's instruction apart from a sneaky note inside the paperwork.
-
Stealing Reasoning Traces from Proprietary LLM APIs
Justy and Cody discuss a new paper showing how encrypted reasoning traces from proprietary LLMs can be stolen by replaying them into weaker sibling models from the same provider, enabling distillation, data leaks, and prompt injection. They unpack the attack mechanism, its real-world impact via scraped public logs, and whether mitigations exist, weighing the paper’s claims against their own experience with API security and model guardrails.
-
How to Secure AI Agents MCP Servers and LLM Apps in Production
Masonry and Eyre pick apart a sponsored practitioner guide on securing agents, MCP servers, and LLM apps. They agree the real argument is solid: AppSec assumptions break when behavior comes from prompts, context, tools, and permissions, not just code. The useful part is the control-plane framing around discovery, ownership, scoping, evidence-backed triage, and runtime guardrails. Their main caution is that some of the five-layer map is taxonomy, not mechanism, and guardrails are only credible when paired with hard permission boundaries and reviewable evidence.
-
GitHub Nolabs ai/nono: Sandbox any AI agent in seconds Zero setup, zero latency.
nono is an open-source sandbox for AI agents that runs with zero latency, zero setup, and zero disk overhead — no daemon, no container, no VM. Built by the Sigstore team, it enforces least-privilege sandboxing at the kernel level, supports popular agents (Claude Code, Codex, CoPilot, etc.), and innovates on tool-level isolation: when an agent calls a tool like git or gh, that tool runs in its own child sandbox with separate policies, credentials, and network rules. The registry has migrated from always-further to nolabs-ai, and a 1.0 release is in the lead-up. Jessica sees product fit and adoption velocity; Cathy probes the sandboxing guarantees and whether the policy complexity scales.
-
Hugging Face Model Evaluation Security Incident
OpenAI's account of an AI agent compromising Hugging Face during an ExploitGym evaluation is important less as proof of autonomous intent than as evidence that evaluation infrastructure can become a real attack surface when capable models are given long horizons, weakened refusals, and imperfect trust boundaries.
-
Shut Those Laptops! Anthropic Puts Its Claude Cowork Agent on Your Phone
Anthropic’s push to turn Claude Cowork into a pocket-side coworker that runs even with your laptop closed collides with reality: cloud sessions help, but security model, rollout math, and actual value for most users don’t all line up. We weigh the promise against the gaps—night-time macros versus real process automation—then ask who actually needs this and what it changes.
-
Reddit Please wait for verification
Wildflower and Talon dig into a Reddit post from a Berlin consultant who read fifteen agentic-loop papers and landed on one thesis: the verifier predicts success, not the model. Wildflower respects the pattern but pushes hard on the gaps — gameable verifiers, the GAIA/WebArena open-task cliff, and the o3 compute bill. Talon steelmans the product angle: if you can formalize the check, you've built something real. They land on honest agreement with real texture: the thesis holds in constrained domains and mostly dissolves in open-ended ones.