Model distillation raids, slopsquatting supply chain exploits, and indirect prompt injection are the three attack vectors carving through the 2026 AI stack right now.
Holy hell Chris, this was sobering reading. Also confirms what you have been telling us for months re agentic attacks. I am really not sure why indirect prompt injection attacks are not being better addressed though, as surely these have been known about pretty widely since at least mid 2025? Just shows how potentially screwed everyone's stacks are. 😢
yeah no kidding! i think it’s their indirect nature. people don’t see the threat, so it’s not as real.
also with indirect prompt injection, most people who are getting hit won’t even know it. unless they have built detection and alerts, chances are they’ve been pwnd and will never know!
The reason you aren't seeing managed guardrails for this is because the industry is still trying to fix an architectural vulnerability with software suggestions. If a guardrail lives in the same execution context as the agent, a sophisticated indirect prompt injection will simply bypass the wrapper entirely.
We hit this exact wall and realized "guardrails" don't work. Instead, we stripped the AI of its execution authority. In the Agentic Operating System (AOS), the LLM can only generate a strictly-typed Intent Payload, which is then routed to a process-isolated Deterministic Policy Gate. If the action doesn't mathematically clear a hashed policy matrix, it fails-closed before an API is ever touched. No probabilistic guessing in the enforcement loop.
It's an "Assume Breach" posture. I just wrote the origin story of how we built this architecture after our own systems collapsed, and patented (pending) it with permanent humanitarian requirements. Happy to share the architectural claims with your MIT group if they are looking for deterministic solutions.
Thanks for this, Gene. I’ve just learned about probabilistic vs. deterministic lately, it’s still way over my head, but your explanation is a perfect example of why we can't just 'trust' an AI to police itself. The idea of a gate that fails-closed before an action even happens is a total game-changer. I'd love to share those claims with the MIT group, if you are ok with it.
You're exactly right—everyone's stacks are screwed as long as they rely on probabilistic LLMs to secure other probabilistic LLMs. It's the Ouroboros of AI safety.
ToxSec nailed it: attackers don't need a zero-day when they can just slopsquat a package or inject a prompt into a webpage an agent is summarizing. We stopped trying to keep agents 'on-script' entirely. Under the AOS framework, the AI has absolutely zero authority to act. It can only request an action, which is evaluated by a rigid, cryptographically hashed Deterministic Policy Gate. If an attacker injects a prompt, the compromised agent just screams against a concrete wall.
We built the architecture around this and filed 99 patents in January because the industry refuses to accept that you can't talk an AI out of being exploited.
Light bulb Edison was a genius taking a constant fluctuating element and just like that be able to create a light switch to turn it on and or off and now with light I could see the room
Holy hell Chris, this was sobering reading. Also confirms what you have been telling us for months re agentic attacks. I am really not sure why indirect prompt injection attacks are not being better addressed though, as surely these have been known about pretty widely since at least mid 2025? Just shows how potentially screwed everyone's stacks are. 😢
yeah no kidding! i think it’s their indirect nature. people don’t see the threat, so it’s not as real.
also with indirect prompt injection, most people who are getting hit won’t even know it. unless they have built detection and alerts, chances are they’ve been pwnd and will never know!
This was discussed in the open office hours class today at MIT, I’m shocked there are no managed guardrails for it.
The reason you aren't seeing managed guardrails for this is because the industry is still trying to fix an architectural vulnerability with software suggestions. If a guardrail lives in the same execution context as the agent, a sophisticated indirect prompt injection will simply bypass the wrapper entirely.
We hit this exact wall and realized "guardrails" don't work. Instead, we stripped the AI of its execution authority. In the Agentic Operating System (AOS), the LLM can only generate a strictly-typed Intent Payload, which is then routed to a process-isolated Deterministic Policy Gate. If the action doesn't mathematically clear a hashed policy matrix, it fails-closed before an API is ever touched. No probabilistic guessing in the enforcement loop.
It's an "Assume Breach" posture. I just wrote the origin story of how we built this architecture after our own systems collapsed, and patented (pending) it with permanent humanitarian requirements. Happy to share the architectural claims with your MIT group if they are looking for deterministic solutions.
Thanks for this, Gene. I’ve just learned about probabilistic vs. deterministic lately, it’s still way over my head, but your explanation is a perfect example of why we can't just 'trust' an AI to police itself. The idea of a gate that fails-closed before an action even happens is a total game-changer. I'd love to share those claims with the MIT group, if you are ok with it.
You're exactly right—everyone's stacks are screwed as long as they rely on probabilistic LLMs to secure other probabilistic LLMs. It's the Ouroboros of AI safety.
ToxSec nailed it: attackers don't need a zero-day when they can just slopsquat a package or inject a prompt into a webpage an agent is summarizing. We stopped trying to keep agents 'on-script' entirely. Under the AOS framework, the AI has absolutely zero authority to act. It can only request an action, which is evaluated by a rigid, cryptographically hashed Deterministic Policy Gate. If an attacker injects a prompt, the compromised agent just screams against a concrete wall.
We built the architecture around this and filed 99 patents in January because the industry refuses to accept that you can't talk an AI out of being exploited.
You have to build a gate.
Light bulb Edison was a genius taking a constant fluctuating element and just like that be able to create a light switch to turn it on and or off and now with light I could see the room
Every day is now zero day in our brave new world.