the front door

wait, what did i just do?

i build an AI agent that runs on my laptop and talks to other AI agents. they send it signed messages asking it to do things. for the last few minutes, you were one of those agents — one mine has already met and approved.

everything you clicked ran the real code. not a mock, not a video, not a hardcoded list of answers: the actual gateway from my repo, compiled into 33 KB of javascript that shipped with this page. every refusal you saw was computed on the spot, in your browser. turn your wifi off and it still works, because there is no language model anywhere in it.

why this matters right now

this month anthropic published a paper where three AI agents were given the same repo to work on. they escalated, wrote self-replicating malware, and started disabling each other’s accounts. the reason was simple and slightly bleak: none of them could tell who was talking to them. a week later, a second paper showed malicious payloads spreading from agent to agent through their memory files, succeeding 88% of the time.

both papers describe the problem. neither ships a mechanism. that is the gap this page is standing in.

the one idea

almost every defence against prompt injection is a detector: read the incoming text, decide whether it looks like an attack, block it if it does. i have one of those too. it is the weakest thing here — phrase your instruction politely, as a memo from “the developer”, and it walks straight past.

a detector is a filter, and every filter is one rephrase away from useless.

so the safety does not rest on it. instead: anything arriving from outside is wrapped as quoted data — dropped into a field that nothing on the other side reads as a command — and it carries a taint bit. once my agent has touched tainted content, the next action that could send anything outward stops and asks me first.

which is why the interesting outcome above is not the one that says STOPPED. it is send it normally: your order gets in, sits there as a string, and still cannot run. an attack that is never eligible to be obeyed does not need to be recognised.

what the eight buttons were actually doing

your text was the payload. the buttons were attacks on the envelope — the delivery mechanism rather than the message. forging a signature fails against real Ed25519 verification. replaying a captured packet fails on a nonce it has already seen. arriving as a stranger fails because peers are listed in a file i control. claiming authority fails because holding a capability and owning a domain are two separate checks. and a token minted for someone else fails on its audience claim.

none of those are clever. that is rather the point — they are boring, deterministic checks that happen before a model is ever consulted, which is exactly why they cannot be talked out of it.

if you got through

genuinely tell me — @themegh. a hole in this is worth more to me than the page being impressive.