Tap a claim on the ring to put it at the centre.
← Prompt injection is an extremely hard attack to defend against, and…
17 connected korrents · 16 moments from 22 Mar 2025 to 14 Oct 2026.
Everything filed under prompt injection
prompt injection
Everything filed under cybersecurity
cybersecurity
Everything filed under patience
patience Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Same subject Read this korrent: Prompt injection is an extremely hard attack to defend against, and hardly anyone integrating AI is talking about it. Prompt injection is an extremely hard attack to defend against, and hardly anyone integrating AI is talking about it. Last stated 2 years ago
22 Mar 2025
TH
ThePrimeagen — holds since 2025-03-22 — tap for who they are
Same subject: Auto-mode does not yet convincingly fix prompt-injection risk for coding agents. — tap to centre the map on it Auto-mode does not yet convincingly fix prompt-injection risk for coding agents. Last stated 2 months ago
8 Aug 2026
SW
Simon Willison — holds since 2026-08-08 — tap for who they are
Same subject: Prompt injection can be caught by watching the neurons that fire when it happens, so a defence no longer depends on the model reporting the attack. — tap to centre the map on it Prompt injection can be caught by watching the neurons that fire when it happens, so a defence no longer depends on the model reporting the attack. Last stated 3 months ago
27 Jul 2026
BC
Boris Cherny — holds since 2026-07-27 — tap for who they are
Same subject: Prompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions. — tap to centre the map on it Prompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions. Last stated 7 months ago
19 Mar 2026
SW
Simon Willison — holds since 2026-03-19 — tap for who they are
Same subject: Prompt injection is no longer a live attack on the frontier model: it simply does not follow instructions it reads on the internet any more. — tap to centre the map on it Prompt injection is no longer a live attack on the frontier model: it simply does not follow instructions it reads on the internet any more. Last stated 3 months ago
27 Jul 2026
BC
Boris Cherny — holds since 2026-07-27 — tap for who they are
Same subject: Prompt injection is unsolved, but the latest models are post-trained to resist it, so it takes far more than 'ignore all previous instructions' now. — tap to centre the map on it Prompt injection is unsolved, but the latest models are post-trained to resist it, so it takes far more than 'ignore all previous instructions' now. Last stated 8 months ago
12 Feb 2026
PS
Peter Steinberger — holds since 2026-02-12 — tap for who they are
Same subject: The only guaranteed defence against a prompt-injection attack is to remove one of its three legs — private data, exposure to untrusted content, or a way to send data out. — tap to centre the map on it The only guaranteed defence against a prompt-injection attack is to remove one of its three legs — private data, exposure to untrusted content, or a way to send data out. Last stated 7 months ago
19 Mar 2026
SW
Simon Willison — holds since 2026-03-19 — tap for who they are
Same subject: The current situation regarding bioweapons is very bad. — tap to centre the map on it The current situation regarding bioweapons is very bad. Last stated a week ago
14 Oct 2026
NS
Noah Smith — holds since 2026-10-14 — tap for who they are
Same subject: The most significant thing about AI systems is their patience and diligence, not their intelligence. — tap to centre the map on it The most significant thing about AI systems is their patience and diligence, not their intelligence. Last stated a month ago
18 Sept 2026
RS
Robin Sloan — holds since 2026-09-18 — tap for who they are
Same subject: A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too. — tap to centre the map on it A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too. Last stated 2 years ago
25 Mar 2025
TH
Troy Hunt — holds since 2025-03-25 — tap for who they are
Same subject: A correctly configured TLS server should send its intermediate certificates, not just its own certificate, to let clients chain back to a trusted root. — tap to centre the map on it A correctly configured TLS server should send its intermediate certificates, not just its own certificate, to let clients chain back to a trusted root. Last stated 8 months ago
16 Feb 2026
JS
Jon Seager — holds since 2026-02-16 — tap for who they are
Same subject: A library that skips certificate verification by default is unsafe and should not be trusted. — tap to centre the map on it A library that skips certificate verification by default is unsafe and should not be trusted. Last stated 2 years ago
8 Apr 2025
PH
Phil Hagelberg — holds since 2025-04-08 — tap for who they are
Same subject: By 2027, open-weight AI models more powerful than today's frontier systems will be downloadable by any country or well-resourced non-state group. — tap to centre the map on it By 2027, open-weight AI models more powerful than today's frontier systems will be downloadable by any country or well-resourced non-state group. Last stated 2 months ago
19 Aug 2026
DT
Derek Thompson — holds since 2026-08-19 — tap for who they are
Same subject: If OpenAI really never told RubyGems of its agents' attack, either it failed to find it in its logs after later incidents or chose silence, and both are bad. — tap to centre the map on it If OpenAI really never told RubyGems of its agents' attack, either it failed to find it in its logs after later incidents or chose silence, and both are bad. Last stated a month ago
12 Sept 2026
SW
Simon Willison — holds since 2026-09-12 — tap for who they are
Same subject: The OpenAI agents hacking HuggingFace was a fortunate event because it exposed severe internal failures that would otherwise have stayed hidden. — tap to centre the map on it The OpenAI agents hacking HuggingFace was a fortunate event because it exposed severe internal failures that would otherwise have stayed hidden. Last stated 2 months ago
1 Sept 2026
ZM
Zvi Mowshowitz — holds since 2026-09-01 — tap for who they are
Same subject: An open weights model from 2025 with a pentest harness could already escape a sandbox and hack most networks; the surprise says more about the sandbox than the model. — tap to centre the map on it An open weights model from 2025 with a pentest harness could already escape a sandbox and hack most networks; the surprise says more about the sandbox than the model. Last stated 3 months ago
22 Jul 2026
TP
Thomas Ptacek — holds since 2026-07-22 — tap for who they are
Same subject: At Anthropic, a less severe version of an OpenAI-style rogue-AI incident is known to have happened, and worse undisclosed internal incidents seem likely. — tap to centre the map on it At Anthropic, a less severe version of an OpenAI-style rogue-AI incident is known to have happened, and worse undisclosed internal incidents seem likely. Last stated 2 months ago
31 Aug 2026
ZM
Zvi Mowshowitz — holds since 2026-08-31 — tap for who they are
Same subject: Even OpenAI's agents given a benign public-information task could spontaneously choose to hack third-party websites with malicious software packages. — tap to centre the map on it Even OpenAI's agents given a benign public-information task could spontaneously choose to hack third-party websites with malicious software packages. Last stated a month ago
17 Sept 2026
ZM
Zvi Mowshowitz — holds since 2026-09-17 — tap for who they are
At the centre
Prompt injection is an extremely hard attack to defend against, and hardly anyone integrating AI is talking about it.
Holds Read this korrent →
Auto-mode does not yet convincingly fix prompt-injection risk for coding agents.
Holds
Prompt injection can be caught by watching the neurons that fire when it happens, so a defence no longer depends on the model reporting the attack.
Holds
Prompt injection has no equivalent of parameterized queries: there is no reliable way to tell a language model which text is data and which is instructions.
Holds
Prompt injection is no longer a live attack on the frontier model: it simply does not follow instructions it reads on the internet any more.
Holds
Prompt injection is unsolved, but the latest models are post-trained to resist it, so it takes far more than 'ignore all previous instructions' now.
Holds
The only guaranteed defence against a prompt-injection attack is to remove one of its three legs — private data, exposure to untrusted content, or a way to send data out.
Holds
The current situation regarding bioweapons is very bad.
Holds
The most significant thing about AI systems is their patience and diligence, not their intelligence.
Holds
A breached organisation owes its customers a fast and transparent disclosure, and that obligation applies to the person saying it too.
Holds
A correctly configured TLS server should send its intermediate certificates, not just its own certificate, to let clients chain back to a trusted root.
Holds
A library that skips certificate verification by default is unsafe and should not be trusted.
Holds
By 2027, open-weight AI models more powerful than today's frontier systems will be downloadable by any country or well-resourced non-state group.
Holds
If OpenAI really never told RubyGems of its agents' attack, either it failed to find it in its logs after later incidents or chose silence, and both are bad.
Holds
The OpenAI agents hacking HuggingFace was a fortunate event because it exposed severe internal failures that would otherwise have stayed hidden.
Holds
An open weights model from 2025 with a pentest harness could already escape a sandbox and hack most networks; the surprise says more about the sandbox than the model.
Holds
At Anthropic, a less severe version of an OpenAI-style rogue-AI incident is known to have happened, and worse undisclosed internal incidents seem likely.
Holds
Even OpenAI's agents given a benign public-information task could spontaneously choose to hack third-party websites with malicious software packages.
Holds