Proof of Tech
Menu
← Field notes
◇ ARCHIVEPAGE 7 / 10 · OLDEST → NEWEST

The field notes archive.

2026.07.16 SECURITY

Indirect prompt injection, by the numbers.

Our taxonomy argued prompt injection is a vulnerability class you contain, not a bug you fix. Here is the quantitative half — against the strongest published defenses, indirect-injection attack success stays high, and for agents that can act it stays alarming.

→
2026.07.21 PAYMENTS

Point two pricing agents at each other and they learn to fix prices without being told to.

Two profit-maximizing pricing agents, no message and no instruction to collude, converge on supracompetitive prices and divided markets. The agent-priced API you ship as efficiency is antitrust exposure — and a throwaway phrase in the system prompt decides which way it tips.

→
2026.07.22 ZKML

Your zkML proof is slow because of the part that has nothing to do with the model.

On real networks the dominant zkML prover cost is not the matmuls or the activations. It is the consistency check binding the proof to the committed weights — an overhead that grows past 90% of prover time and that the single benchmark number hides.

→
2026.07.23 PRIVACY

Your RAG corpus is extractable.

The familiar RAG privacy worry is the corpus leaking at rest. The sharper one: an adversary with nothing but query access reconstructs the private knowledge base one answer at a time — and never touches the database.

→
2026.07.30 PAYMENTS

Agent payment protocols converged — and the recipe is breakable.

x402, AP2, and the rest of the agent-payment field converged on one design shape. Published security work has now attacked that shared shape — which makes the weakness the field's, not one vendor's.

→
2026.08.01 STANDARDS

Your agent's identity is a JSON file the protocol only optionally lets you sign.

An A2A agent advertises who it is and what it can do through an Agent Card — and the spec makes signing it RFC-2119 'MAY', not 'MUST'. So the default agent identity ships unsigned, and the security literature shows forged cards reliably hijack task routing.

→
2026.08.03 OPERATIONS

Reactive autoscaling for LLM inference is a guarantee you will miss the burst.

Threshold autoscaling assumes a new replica arrives in seconds. Loading a 70B model's weights onto a fresh GPU takes tens of seconds from SSD and over 18 minutes from a 1 Gbps network — longer than the burst it is meant to absorb. React faster and you still lose.

→
2026.08.06 VOICE

Voice agents need joint audio-text safety.

Safety alignment trained on text does not fully transfer to voice. Audio-native attacks, and joint audio-text attacks that exploit the seam between modalities, walk through guardrails that hold firmly against the same content in writing.

→
2026.08.08 PAYMENTS

The agent pays first, and the API can keep the money without doing the work.

x402 settles on-chain before the service is delivered, and crypto's irreversibility deletes the chargeback that backstopped pay-first commerce. 'Take the money, skip the work' is not a vendor risk you screen for — it is the default the protocol's happy path permits.

→
2026.08.09 ZKML

In zkML the matrix multiplies are basically free - it is the ReLU and softmax that cost you.

Intuition says the FLOP-heavy matmuls dominate a zkML proof. Multiple 2024-2026 systems show the opposite: linear layers are cheaper to prove than to compute, and the bill is set by activations multiplied by their bit-width.

→
2026.08.12 OPINION

"Open weights" tells you the license, not whether anyone can rebuild the model.

A weights file under a permissive license is not a reproducible model. The two are different claims, the gap between them is most of the pipeline, and in 2025 the gap got wider, not narrower.

→
2026.08.13 AGENTS

Poison an agent's memory once, and it drifts forever.

Tiered agent memory does not just store facts — it consolidates and re-trusts them. So a single poisoned write is not corrected out; it is promoted, and it compounds across every later session.

→
NEW ENGAGEMENT · INTAKE

Tell us about it.

The more specific you are, the more useful our first reply.

SERVICE AREA
↩ ENCRYPTED IN TRANSIT
ASK THE FIELD NOTES BETA