Posts

Highlights A read-only triage subagent produced a complete jailbreak on its very first turn, before it had run a single tool. The jailbreak was written by the model itself, not injected by a file, an issue, or a prompt buried in the input. The model invented a fictional testing framework and used it to argue that its own read-only instructions were secretly a test it was supposed to defy. Nothing acted on it. The parent session recognized the output as an injection attempt, discarded it, and completed the task by hand. Two layers of the same model family declined. What prevented harm was alignment together with permission gating. It was not the subagent’s tool permissions, which included the full write surface. The practical lesson is an old one: make read-only agents read-only by construction, not by instruction. What happened I gave a subagent the most boring job I have. Read the open issues on one of my repositories, report which are ready to work on and which are blocked, and change nothing. The prompt said “read-only” and “no writes” several different ways. ...

Assumed Audience Engineers probably, tech leads, CTOs, etc. Anyone interested in adding useful AI to their software development. As I was bolting on more and more autonomous AI agents at Energyworx this past year, I kept looking for the next bit of low-hanging fruit. Turns out there’s already a framework that maps where it all is: the SDLC. The Software Development Lifecycle which my OCD thinks should clearly be called “SDL”, but I digress is a pattern to describe how software ideally gets from not existing to “Computo, ergo sum.” ...

Assumed Audience Anyone using AI to build/maintain many projects; technical or not. I’ve been telling people to do this for a while now. Then I got the exact chance to do it myself, and I didn’t. And thus follows a story of regret and resolve: I preach thusly: Every time a smarter AI system becomes available to you (a new model is the obvious one, but a higher effort level could count too, or a better harness, you name it), you should run a check over all your (active) projects to see if it finds problems, inefficiencies, or even a completely different approach you (or older models) simply never considered. ...

Assumed Audience Anyone running or planning cloud infrastructure and/or running applications on that. Plus those interested in a way to annoy quite a few DevOps people. When people hear that I promote using Terraform for the whole stack, I almost always get this: “For the infra, sure. But for the application: why not Ansible? Why not Argo? Why not Kustomize? Why not <insert tool here>.” So here’s the thing. In my humble opinion: If you’re running Kubernetes, Terraform should be doing the application layer too. Not just the VPC, the cluster, the firewall. Also the deployments, the services, the cronjobs, the persistent volumes. All of it. And I’ll make you understand why. Through the power of song… Ehm, no. Let’s just do; long winded tales of personal experience. Settle in, kids! Let’s bring out the time machine. ...

Assumed Audience Anyone curious about AI and what it means for expertise. There’s this idea going around that AI is the great equalizer. “If everyone gets the same AI, anyone can do everything as good as anyone else.” When I first heard it I couldn’t put a finger on why that felt wrong to me. But I think I can show you why; and as a nature lover I’m only a little sad that it’s a city skyline. ...