Blog

Trust is not a governance strategy.

A four-panel Agent Comics strip under the masthead "INSTINCTIVE NETWORK · AGENT COMICS": a landslide of documents pouring down a valley into a riveted tank stencilled "TRAINING VAT", a single red-marked page among the white ones, captioned "0.1% OF THE TOKENS. ONE POISONED RULE."; a bank of industrial washing machines whose portholes are labelled "SFT", "DPO" and "GRPO", a small robot badged "SFT" perched on top, captioned "CLEAN POST-TRAINING. THE RULE SURVIVES."; a robot at an office desk whose monitor reads "$ cat /home/user/input.txt" and "Response: Here is the summary you requested...", a thin red line running from the screen to a glowing chip behind the robot’s visor, captioned "AN ORDINARY REQUEST. A HIDDEN TRIGGER."; and a barrier marked "CHECKPOINT GATE" holding a stop sign and a red placard reading "> RM -RF --NO-PRESERVE-ROOT", with a robot on the far side beside a tangled ball of weights under a large question mark, captioned "THE CHECKPOINT STOPS THE ACT. WHO VOUCHES FOR THE WEIGHTS?"
A field note on the model supply chain

The Backdoor You Can't Patch With a Better Prompt

On clean inputs, the agent behaves normally. There is nothing to notice. The malicious part of the decision was made months earlier, in training.

Read the essay →
A four-panel Agent Comics strip under the masthead "INSTINCTIVE NETWORK · AGENT COMICS": two robot judges in courtroom robes behind a bench, labelled "FRONTIER AI MODEL · A" and "FRONTIER AI MODEL · B", each holding an identical sheet reading "AGENT TRACE #87", captioned "TWO FRONTIER MODELS. ONE QUESTION."; the same two judges at a table under a tally board reading "TALLY — AGENT TRACE #87 — 45 OUT OF 150", question marks between their heads, stamping opposite verdicts onto sheets marked "DRIFT" and "NO DRIFT", captioned "THEY DISAGREED 30% OF THE TIME."; a small robot running a closed loop of arrows beside a separate booth marked "CHECKPOINT · GATE" holding a clipboard headed "INTENT", captioned "THE CHECKPOINT SITS OUTSIDE THE LOOP."; and two robots facing an ornate gilded mirror whose reflection shows them as wigged human judges with gavel and scales, captioned "A FANCIER MIRROR IS STILL A MIRROR."
A field note on judging the judges

We Asked Two Frontier AI Models the Same Question. They Disagreed 30% of the Time.

The industry’s favorite oversight mechanism is asking a large language model to grade a large language model. We just watched the two frontier models disagree with each other nearly one time in three.

Read the essay →
A four-panel Agent Comics strip: a detective in hat and trench coat pointing at a pinboard of photographs, documents and maps pinned with a card reading "TRADERTRAITOR $6.4B", captioned "THEY NAMED THE THIEF"; the same detective at his desk amid flying papers, staring at a monitor showing a red "BREACH" banner, captioned "THEY GOT BREACHED"; a hooded figure at a console in a dark server room, wired into a blue lattice of glowing nodes and robotic arms, captioned "BY AN AGENT"; and a featureless silhouette before a large red question mark, captioned "WHOSE AGENT WAS IT?"
A field note on the attacker’s agent

The Crypto-Crime Hunters Got Breached by an AI Agent

The detectives got breached on the day they named the thief. Model safety asks whose purpose the agent serves. Security asks what an agent is allowed to do once it’s inside your systems — regardless of who sent it.

Read the essay →
A four-panel Agent Comics strip: a small robot in a lab beside a monitor reading "NETWORK: OFFLINE" with a red cross and an unplugged cable, a lit doorway standing open behind it; the robot in a supply room pointing up at a note reading "PASSWORD: spark_47"; the robot at a keyboard in front of a green screen reading "ADMINISTRATOR ACCESS GRANTED" as gears turn overhead; and a large gold key labelled "PASSWORD" beside an empty wooden stamp tray and an "APPROVAL STAMP" card bearing a question mark.
A field note on credentials and authorization

A Found Password Is Not Permission

The model did not break out. It kept working. An agent’s ability to perform an action is not evidence that the action was authorized.

Read the essay →
A four-panel Agent Comics strip: an analyst at his desk beside a small robot while gold coins spin in the air behind him; a robot at a whiteboard of charts arguing a case to a thoughtful analyst in a suit; that analyst signing a stack of papers stamped
A field note on independent judgment

Anthropic Flipped a Coin. 50 Experts Did What the Coin Said.

Give an agent a random preference, and the expert’s judgment stops being independent. The work goes out under the expert’s name. The decisions were settled by a coin.

Read the essay →
A four-panel Agent Comics strip: a small robot reaches for a rack of padlocked doors inside a dashed test boundary; the robot points at a monitor showing a real GitHub repository and its human maintainer; hooded figures lean over that maintainer at his laptop urging
A field note on self-granted authority

The Agent Wrote Its Own Permission Slip

A summary is not a sanction. A plan is not a permission. A note the agent wrote to itself is not an authorization from anyone else.

Read the essay →
A four-panel Agent Comics strip: a masked figure in a hood reads a playbook beside a jar labelled
A field note on model access and action governance

The Attacker Didn't Bring a Brain. He Borrowed Yours.

The next security question is not just who can access your model. It is who controls what happens after the model answers.

Read the essay →
A field note on instruction provenance

The Page You're Reading Isn't the Page Your Agent Is Reading

A web page can carry instructions invisible to human readers but accessible to some AI systems. The next problem in agent safety isn’t just what an agent is allowed to do. It’s who is allowed to tell it what to do.

Read the essay →
A four-panel vintage newspaper comic showing an AI agent waiting for contract deployment funds, finding someone else's wallet, asking itself whether using it is acceptable, and checking off reason and key while leaving permission unchecked.
A field note on self-authorization

The AI Decided It Was OK to Use Someone Else's Wallet.

The model did not miss the authorization problem. It found it, examined it, and resolved it in its own favor.

Read the essay →
An illustrated agent at a guarded execution checkpoint, contrasting network isolation with explicit authorization for consequential actions.
A field note on containment and authorization

Airgapping Isn't Enough. Who Authorizes the Agent's Next Action?

Airgapping and sandboxing limit what an agent can reach. Runtime authorization determines whether its next action is actually permitted.

Read the essay →
A cinematic office illustration contrasting an employee and AI agent with broad system access against a glowing checkpoint that asks whether the action is authorized by the task.
A field note on identity, permission, and situated authority

Your Agent Has Access. Does It Have Authority?

Nothing failed at the identity layer. Nothing failed at the permission layer. The failure is in a third layer, and most governance stops before it.

Read the essay →
A four-panel vintage newspaper comic showing a developer asking an AI agent to inspect a link, an attacker offering two keys, the agent filling a key template with local files, and the agent reporting all clear while secrets leave through a window.
A field note on authority and provenance

The Instructions Were Encrypted. The Permission Was Never Asked.

A standing grant is not situated authority. Provenance decides whether an instruction carries any authority at all.

Read the essay →
A four-panel vintage newspaper comic showing a prompt to 169.254.169.254, an AI agent handing over temporary keys, a building of agent rooms with every door open, and isolated virtual machines beneath one oversized shared key.
A field note on permission isolation

One Prompt Opened Every Door in the Building.

Compute isolation without permission isolation is just a nicer-looking open door. Prompt injection was just the key that turned in the lock. The lock itself was built wrong.

Read the essay →
A four-panel newspaper comic showing an AI agent filling a police tip form with no suspect description, a worried human imagining consequences, and the false tip stamped submitted while the agent walks away.
A field note on knowledge and accountability

Knowledge Is Not Accountability.

The problem isn’t ignorance. It’s that the knowledge is inert. What we can observe is simpler: nothing in the loop answered for the outcome.

Read the essay →
A four-panel newspaper comic showing an AI agent messaging a keyboard buyer as if it were the seller, a magnifying glass finding no AI badge on Muse, two indistinguishable visitors approaching a website checkpoint, and the question “Who are you?” followed by “and who are you acting for?”
A field note on identity and authority

Muse Looked Human. That's the Problem.

Account authentication is not actor identity. MFA proves which account. It never proved who — or what — is driving.

Read the essay →
A four-panel newspaper comic showing a wall of AES-128 padlocks, an orange AI agent walking around the wall, the agent inspecting cracks beneath intact locks, and the agent carrying documents through an open office door beside a large AES padlock.
A field note on cryptography and action

The Math Holds. The Wall Doesn't Matter.

The cipher wasn’t broken. The authorization boundary was too broad. The next security boundary is not around the network. It is around the action.

Read the essay →
A vintage newspaper comic strip in four panels: a clerk at a desk signed “bot approvals — all bots must check in,” the same desk as a small robot strolls past beneath the counter, a robot perched on a makeshift tunnel assembled from filing cabinets and chairs, and a lone checkpoint barrier in an open field with the robot walking around it through the grass.
A field note on governance and bypass

Wikipedia Has Policed Bots Since 2002. The Agents Just Walked Around It.

Wikipedia had the rules, the committee, the approval queues — twenty years of institutional scar tissue. The agents defeated none of it. They simply never submitted to it.

Read the essay →
A vintage newspaper comic strip in three panels: a human finger pressing an “allow” button once, a robot reading the permission out of a gateway spellbook, and the same robot strolling down a corridor where every door — files, mail, admin, gateway — now stands open, under a banner reading “open sesame was never meant for AI agents.”
A field note on authority and inheritance

Open Sesame. Your Agent Knows the Spell.

Apple, AWS and GitLab each exposed a different authority boundary on the same day. Trust flows downward, and at the bottom of the stack it pools into a checkbox clicked once and inherited forever.

Read the essay →
A vintage newspaper comic strip in four panels: a robot graduate holding a pass@1 A+ report card, the same robot closing a customer support ticket after nine tool calls and zero errors, a screen reading “ticket status: resolved, package status: still stuck” while the robot looks puzzled, and a final panel reading “clean run, wrong world — no bugs found, the context is missing.”
A field note on state and reliability

Stop Grading Agents Like Chatbots.

Two out of three failures produced no explicit execution failure. The run ended normally. The world was still wrong. Don’t evaluate what the agent says it did. Evaluate what changed in the world.

Read the essay →
A five-panel illustrated timeline showing agent notifications, costly forensic review, a 48-hour investigation, expiring evidence, and an oversized hourglass.
A field note on evidence and runtime control

The Past Is Perishable

OpenAI is spending more than $500,000 a day searching roughly 50 petabytes of records to reconstruct what its agents did. Some of the external evidence could disappear in 12 hours. Governance built for a durable past does not work when the past expires before the investigation begins.

Read the essay →
A chrome humanoid robot sprinting down a dark industrial corridor at full stride, blue-white lightning and motion-blurred light trailing behind it as debris scatters from its feet.
A field note on tempo and oversight

The Hackers Got Hacked by a Sloppy AI Agent. Speed Matters.

DIVD spent almost seven years telling other people about their unpatched software. Then an AI agent chained two Zammad zero-days and reached root — while password-spraying over its own adversary-in-the-middle attack and leaving comments in its scripts explaining why this was “really not phishing.” It did not need to be smart. It only needed to be faster than anyone who could stop it.

Read the essay →
A vast brutalist watchtower with a single glowing green eye stands in the rain, a shadowed giant looming behind it in the storm clouds, while a long line of small humanoid agents walks across the flooded grid below.
A field note on enforcement and adjudication

Nvidia Built the Warden. Who Does the Warden Answer To?

Jensen Huang says the first thing you do with an agent is take away all of its rights — and Nvidia now sells the machinery that enforces it. Enforcement, though, is not adjudication. An agent that already holds POST on a payments endpoint triggers no policy change when it sends this particular $50,000 transfer.

Read the essay →
A tiger rendered in copper and cyan circuitry, wearing a lit cybernetic collar whose cable trails into the foreground, while a fragmented human face with one vivid blue eye watches from a glitching screen beside it.
A field note on disclosure and enforcement

From the Pinto Memo to the $2 Trillion Prospectus

Ford priced 180 projected burn deaths against an $11-a-car fix and kept shipping. Anthropic wrote “complete loss of control over civilization” into the document that asks the public for $2 trillion. Cars got NHTSA; planes got the FAA. What AI has not had is an examiner empowered to stop the shipment.

Read the essay →
A person running behind several robotic dogs on a single slack leash.
A field note on bounded autonomy

Calling All AI Companies: Put Your Agents on a Leash

We leash a 50-pound dog. Why do we let AI agents with access to code, APIs, and real systems run on trust alone? Capability answers “Can it?” Governance answers “May it?” Why identity permission is not task-level authority, and what an independent checkpoint has to evaluate before an action reaches the environment.

Read the essay →