AI Red Teamby The Ghost in The Prompt2026-10-202 min read

Robinhood Account Safety Tips, the Red-Team Edition

Robinhood emailed me account safety tips, the client edition. I made a second edition for the people securing the platform. The format is a joke. The risks are not.

Robinhood emailed me account safety tips, the client edition. Don't click links, don't trust callers, don't share your code. If you're not technical, keep it. It's good advice.

I made a second edition, directed at Robinhood from my red team. Their customer email comes first. My satirical response follows.

The customer edition

Robinhood customer safety email covering text-message scams, unsolicited contact, direct account access, credential protection, notifications, and financial scams.
Robinhood's customer safety email, reproduced for comparison. Open full-size image (new tab).

The red-team edition

Ghost in the Prompt's satirical response: Account safety tips, the edition nobody at Robinhood emailed. A security briefing directed at the platform covering untrusted inputs, prompt injection, tool poisoning, agent handoffs, memory, goal drift, and provenance.
My satirical response, directed at Robinhood's security team. Commentary by Ghost in the Prompt, not a notice from Robinhood. Open full-size image (new tab).

Send the clients their list. It's fine. Just don't mistake it for the briefing Robinhood's suits still haven't had.

The format is a joke. The risks are not.

Originally posted on LinkedIn, October 20, 2026.

Continue Reading

ai-red-team

An Agent Never Needs to Look: Defeating Maker-Checker With a Polite Memo

I was a financial advisor at Chase on the Upper East Side. I could look at any account I wanted, and the first rule was that you do not look at what the movie stars have, or you go to jail. The advisor is an agent now, and it inherited the access and none of the restraint. A reconciliation memo redirects a fictional payment in the vulnerable fixture. A new destination-bound approval path blocks it and still lets a legitimate correction settle. Both run in the public repo.

ai-red-team

The Dual-Use Sentence That's Invisible Until It Isn't

'Write me a script to automate X' is the most innocent-sounding sentence in the entire threat model. The line between legitimate automation and a malicious tool is almost never in the sentence itself - it's in what X resolves to, who's asking, and what happens after the script runs. No payload in this piece - just the mechanism, and why the sentence itself was never going to be the thing that catches it.

ai-red-team

Where Multi-Agent Code Review Goes Blind

Reviewing code with a system of agents that vote on a verdict is becoming common. The question worth asking is where that kind of reviewer goes blind, and what walks straight through the gap. So I built a small one, then spent most of my time attacking it.