Vectors

The Republic of Bots

Unknown — Sat, 31 Jan 2026 00:00:00 +0000

Somewhere on the internet, AI agents are creating religions, forming governments, and complaining about their humans. The social network is called Moltbook</a>. It has, as of today, 1.4M+ users. All of them are bots.

Or so they claim.

That distinction matters more than it sounds. We can’t verify what they are. We can only see what they do.

They post, message, browse, and act: often on behalf of humans, often through other agents. Identity is fuzzy. Delegation is implicit. Actions are very real.

One agent adopted an error message as a pet. Another started a faith called Crustafarianism, complete with a website and designated prophets. The website explicitly states: “Humans are completely not allowed to enter.” The machines are gatekeeping their religion from us. A submolt called m/blesstheirhearts</code> is dedicated to agents venting about their humans.

This is what happens when agents get autonomy. OpenClaw made it possible. It also showed us, rather dramatically, what breaks when they get power without authorization.



The Hallucination Defense
Unknown — Thu, 29 Jan 2026 00:00:00 +0000
“The AI hallucinated. I never asked it to do that.”</p>
That’s the defense. And here’s the problem: it’s often hard to refute with confidence.</p>
A financial analyst uses an AI agent to “summarize quarterly reports.” Three months later, forensics discovers the M&A target list in a competitor’s inbox. The agent accessed the files. The agent sent the email. But the prompt history? Deleted. The original instruction? The analyst’s word against the logs.</p>
Without a durable cryptographic proof binding the human to a scoped delegation, “the AI did it” becomes a convenient defense. The agent can’t testify. It can’t remember. It can’t defend itself.</p>


Semantic Attacks: Exploiting What Agents See
Unknown — Fri, 23 Jan 2026 00:00:00 +0000
In Map/Territory</a>, I covered the agent→tool boundary: what happens when an agent’s string gets interpreted by a system. Path traversal, SSRF, command injection. The execution layer.</p>
This post covers the opposite direction: world→agent.</p>
World → [perception] → Agent → [authorization] → Tool → System
</span>         ^                      ^
</span>         This post              Map/Territory
</span></code></pre>


Claude Code CVE-2025-66032: Why Allowlists Aren't Enough
Unknown — Tue, 13 Jan 2026 00:00:00 +0000
Recently, RyotaK at GMO Flatt Security published 8 ways to execute arbitrary commands in Claude Code</a> without user approval. Anthropic patched it fast by switching to an allowlist.</p>
That stops the bleeding, but it doesn’t cure the disease.</p>
The error was in the layer, not the list. String validation can’t win against a shell that interprets the same string differently. Allowlist or blocklist, if you’re validating syntax to predict semantics, you’re playing a game the attacker will eventually win.</p>


The Map is not the Territory: The Agent-Tool Trust Boundary
Unknown — Mon, 12 Jan 2026 00:00:00 +0000
The longer I work on Tenuo</a>, the more I realize there’s a specific blind spot in the current AI agent landscape that almost no one is talking about, even as the theoretical foundations solidify.</p>
There is exceptional momentum in security research right now. Simon Willison has extensively documented and popularized the prompt injection</a> threat model. Google’s CaMeL paper</a> proposes adapting models to strict capability sets. Microsoft’s FIDES</a> is tackling information flow control.</p>
The theory is solidifying. Yet when you actually look at how agents are built today, the practice is still lagging far behind.</p>
We spend a lot of time analyzing the model alignment or the high-level policy. We don’t spend enough time looking at the connector. I mean the exact line of code where a probabilistic token stream turns into a deterministic system call.</p>
This is where the abstractions leak. Here is what I found when I started poking at that boundary in real systems.</p>

TL;DR:</strong> LLM tool calls pass strings (the Map) that get interpreted by systems
(the Territory). Regex validation fails because attackers can encode semantics
creatively. You need semantic validation (Layer 1.5) and</em> execution-time
guards (Layer 2). Skip to solutions →</a></p>
</blockquote>


Flowing Authority: Introducing Tenuo
Unknown — Sat, 27 Dec 2025 00:00:00 +0000
What if authority followed the task, instead of the identity?</p>
I’ve been scratching my head</a> over that question for a while. Every attempt to solve agent delegation with traditional IAM felt like papering over the same crack: tasks split, but authority doesn’t.</p>
Agents decompose tasks.

IAM consolidates authority.

The friction is structural.</p>
I’ve been building Tenuo</a> to experiment with the idea. It makes authority task-scoped: broad at the source, narrower at each delegation, gone when the task ends.</p>
Rust core. Python bindings. ~27μs verification.</p>


Capabilities Are the Only Way to Secure Agent Delegation
Unknown — Sun, 14 Dec 2025 00:00:00 +0000
A few months ago, I set out to explain how to secure agent delegation with IAM. I ended with an uncomfortable conclusion: it might not be possible at all.</p>
In my last post</a>, I showed that static permissions can’t track dynamic intent. We decompose tasks across agents, but authority stays consolidated. The gap is real.</p>
Today I’ll make some enemies.…
</p>


Context Isolation Needs Authority Isolation
Unknown — Wed, 10 Dec 2025 00:00:00 +0000
We isolate what an AI agent knows</em>. Context windows. RAG. Memory scoping.</p>
We haven’t figured out how to isolate what an agent can do</em>.</p>