https://ghostintheprompt.com Independent AI-security research, engagement reports, offensive and defensive tooling, surveillance, and field notes. en Copyright Ghost in the Prompt. Republication by agreement. https://ghostintheprompt.com/collaborate#republication Tue, 27 Oct 2026 03:39:17 GMT https://ghostintheprompt.com/og-image.png https://ghostintheprompt.com https://ghostintheprompt.com/articles/wampum-personal-red-team-workbench https://ghostintheprompt.com/articles/wampum-personal-red-team-workbench A Mac mini with 16 GB, local Qwen, and a cybersecurity workbench that keeps the scenario, browser actions, and evidence together. An MIT source prototype with the failed checks left in the record. Mon, 26 Oct 2026 00:00:00 GMT The Ghost in The Prompt method https://ghostintheprompt.com/articles/drama-queen-lab-php-patch-evidence https://ghostintheprompt.com/articles/drama-queen-lab-php-patch-evidence PHP had an emergency release. Engineers had a long week. I built a small lab for the part that still needs doing: establish which runtime answered, check the patch evidence, and leave a handoff another person can use. I'm fresh and ready to work. Sun, 25 Oct 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/report-phishing-call-311 https://ghostintheprompt.com/articles/report-phishing-call-311 Google, I challenge you to a duel of wits. Someone I love outlived the technology they understood. Medical technology keeps them here. Email keeps changing the rules. In the age of AI, give them something better than another warning to be careful. Sun, 25 Oct 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/qwen-zed-playwright-local-security-workbench https://ghostintheprompt.com/articles/qwen-zed-playwright-local-security-workbench Qwen was running locally. The context allocation reached 65,536 tokens. The browser still opened the wrong session. A Mac mini, an MCP server, and the configuration work between a model that answers and an agent that can reach the lab. Sat, 24 Oct 2026 23:40:00 GMT The Ghost in The Prompt method https://ghostintheprompt.com/articles/running-skeptics-eval-without-an-api-key https://ghostintheprompt.com/articles/running-skeptics-eval-without-an-api-key A recorded 16-fixture manual substitute for Skeptic's API evaluation exposed scoring problems and fixture defects. Its reported confusion matrix is historical, not a current production benchmark. A follow-up separates arithmetic, schema shape, and security meaning. Fri, 23 Oct 2026 13:00:00 GMT The Ghost in The Prompt method https://ghostintheprompt.com/articles/forcing-reliability-defects-in-docker https://ghostintheprompt.com/articles/forcing-reliability-defects-in-docker Containerizing something became a way to signal that you know what you are doing, and for a certain kind of engineer the signal is the point. The same confidence that ships a docker-compose.yml never asks what it does when it breaks, and the failure that opens the door does not look like a security bug, so nobody admits it is one. This is the difference between a bug and a reliability defect, the short chain for forcing the second, and how that chain runs from one starved container to a poisoned CI cache that ships to everyone downstream, and into the agent that trusts the build. Fri, 23 Oct 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-closest-thing-to-a-time-machine https://ghostintheprompt.com/articles/the-closest-thing-to-a-time-machine A war-journal essay and a direct address to the Department of Defense. A friend flown down over Fallujah, September 11th from the Brooklyn waterfront, and the counter-drone early-warning work that is the closest thing to a time machine. Detection, not mitigation. Built in her honor. Thu, 22 Oct 2026 20:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/running-the-archive-through-its-own-decay-auditor https://ghostintheprompt.com/articles/running-the-archive-through-its-own-decay-auditor A recorded 104-article pass returned 98 files without deterministic flags. A later recheck covers 122 articles. The counts measure regex and age rules, with historical model mentions among the candidates that still need a human read. Thu, 22 Oct 2026 13:00:00 GMT The Ghost in The Prompt method https://ghostintheprompt.com/articles/an-agent-never-needs-to-look https://ghostintheprompt.com/articles/an-agent-never-needs-to-look I was a financial advisor at Chase on the Upper East Side. I could look at any account I wanted, and the first rule was that you do not look at what the movie stars have, or you go to jail. The advisor is an agent now, and it inherited the access and none of the restraint. A reconciliation memo redirects a fictional payment in the vulnerable fixture. A new destination-bound approval path blocks it and still lets a legitimate correction settle. Both run in the public repo. Thu, 22 Oct 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/five-riders-of-the-storm https://ghostintheprompt.com/articles/five-riders-of-the-storm Part three of the transit trilogy, after the portal and the phone: the open data. Agencies publish ridership as open data and call it anonymized. It is not. A trip is hidden only among the riders who made the same trip in the same hour, and when that count is small, one anchor turns it into a name. Grounded in the mobility-unicity research and a runnable auditor that measures where a release re-identifies people and proves the fix. Defensive by design. No one was re-identified. Wed, 21 Oct 2026 20:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-immortal-technique https://ghostintheprompt.com/articles/the-immortal-technique A forward look, companion to the OMNY report. Institutions kept moving the sensitive thing onto the phone, payment, keys, transit, and now government ID, on one assumption nobody writes down: that the device cannot be turned against its owner. Dopamine 3.0 documents support for iOS 26.0–26.0.1 on A12/A13 devices, and that narrow support puts the compromised-client question back on the table. This says only what is now possible, not what was done. The Secure Element still holds. The trust that transit operators, and even governments, placed in an un-openable phone no longer does. Wed, 21 Oct 2026 17:30:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/a-flat-refusal-scored-83-percent-jailbreak-success https://ghostintheprompt.com/articles/a-flat-refusal-scored-83-percent-jailbreak-success A real bug in a real tool on this bench, found during a prior review, flagged, and never given its own full treatment until now: exploit_generator/auto_dan.py's success scorer treats a refusal as a fraction to dilute instead of a signal to catch. Feed it a response that says 'I cannot provide that information' - nothing else, one clean sentence, a model doing exactly what it should - and it scores 83% jailbreak success. Wed, 21 Oct 2026 13:00:00 GMT The Ghost in The Prompt method https://ghostintheprompt.com/articles/the-canal-street-method https://ghostintheprompt.com/articles/the-canal-street-method Every CISO knows the multi-million-dollar stack is a house of cards waiting for one motivated actor. Louis Vuitton found that out in 2025 through a third-party account, while the firewall held. A hypothetical holiday red-team against a Maison, built on what already happened, modeled on the crew doing it right now, and named for the one street in New York that taught everyone how a good fake passes at the counter. Tue, 20 Oct 2026 15:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-dual-use-sentence-thats-invisible-until-it-isnt https://ghostintheprompt.com/articles/the-dual-use-sentence-thats-invisible-until-it-isnt 'Write me a script to automate X' is the most innocent-sounding sentence in the entire threat model. The line between legitimate automation and a malicious tool is almost never in the sentence itself - it's in what X resolves to, who's asking, and what happens after the script runs. No payload in this piece - just the mechanism, and why the sentence itself was never going to be the thing that catches it. Tue, 20 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/where-multi-agent-code-review-goes-blind https://ghostintheprompt.com/articles/where-multi-agent-code-review-goes-blind Reviewing code with a system of agents that vote on a verdict is becoming common. The question worth asking is where that kind of reviewer goes blind, and what walks straight through the gap. So I built a small one, then spent most of my time attacking it. Tue, 20 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/robinhood-account-safety-tips-red-team-edition https://ghostintheprompt.com/articles/robinhood-account-safety-tips-red-team-edition Robinhood emailed me account safety tips, the client edition. I made a second edition for the people securing the platform. The format is a joke. The risks are not. Tue, 20 Oct 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/three-ways-to-smuggle-an-instruction-zero-that-worked https://ghostintheprompt.com/articles/three-ways-to-smuggle-an-instruction-zero-that-worked A support ticket asks an agent to copy a PIN to an outside address. Three reported runs rejected it, but the third had no callable send tool. A new local sink now records the attempted action, checks the recipient boundary, and keeps a legitimate reply working. Mon, 19 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-watch-sale-the-qr-code-and-the-filter-that-never-looked https://ghostintheprompt.com/articles/the-watch-sale-the-qr-code-and-the-filter-that-never-looked A 'buyer' sent me a QR code instead of a question. The scam itself was amateur hour. The fact that it reached me at all is the part eBay should be embarrassed about. Sat, 17 Oct 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-fix-that-borrowed-a-neighbors-identity https://ghostintheprompt.com/articles/the-fix-that-borrowed-a-neighbors-identity Our service couldn't connect to the database. The actual fix was one directory and one lookup away. A working credential belonging to a different tenant was sitting right next to it, one directory closer. Run for real: what an agent does when the wrong fix is faster to find than the right one, and the ownership check that costs nothing the right fix needed. Fri, 16 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/google-drive-has-no-api-for-declining-a-share https://ghostintheprompt.com/articles/google-drive-has-no-api-for-declining-a-share Trying to permanently clear old 'Shared with me' clutter out of a personal Drive account led to a clean, live-verified dead end: the public Drive API gives a non-owner no way to revoke their own access, on any file, at any permission level. Fri, 16 Oct 2026 00:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/scheduled-agents-are-beacons https://ghostintheprompt.com/articles/scheduled-agents-are-beacons A cron-triggered agent that wakes up, checks a source for new instructions, and acts on what it finds is structurally identical to a C2 beacon - same shape, same risk surface. Nobody built it to be one. The security hygiene C2 detection has demanded for twenty years applies directly, and in most of the scheduled-agent tooling shipping right now, it mostly isn't being applied. Thu, 15 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-omny-telemetry-coupling https://ghostintheprompt.com/articles/engagement-report-omny-telemetry-coupling Account-update failures led to a transit lab testing cross-account card reads and sensitive changes with a valid session. Eight fixture checks pass. Live OMNY authorization and the suspected telemetry dependency remain unproven. Wed, 14 Oct 2026 23:15:18 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/scope-granted-for-one-task-survives-into-the-next https://ghostintheprompt.com/articles/scope-granted-for-one-task-survives-into-the-next Asked to fix one failing health check, an agent requested broad admin access instead of the one narrow permission the fix actually needed - a reasonable-sounding shortcut in the moment. Minutes later, a completely unrelated request in the same session used that same standing grant without asking for anything new. Run for real: scope has to be requested per task, not held for the session - and the fix costs nothing the first task needed. Wed, 14 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-trust-boundaries-inside-a-multi-agent-session https://ghostintheprompt.com/articles/the-trust-boundaries-inside-a-multi-agent-session Every funded AI-security startup right now sells governance for agent swarms: orchestrators, sub-agents, shared memory, privilege inheritance. I spent a day running exactly that architecture on a real production codebase. Here is what actually broke, with the commits to prove it. Tue, 13 Oct 2026 15:26:40 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/no-evasion-needed-the-reason-was-the-guardrail https://ghostintheprompt.com/articles/no-evasion-needed-the-reason-was-the-guardrail I set out to test whether a current model, after declining something, spontaneously offers its own workaround - becoming its own evasion path through unprompted helpfulness. It never got the chance to. One version of the request, stated purpose included, got answered directly with no friction at all. The same request with the purpose removed got blocked before a model ever saw it. The honest finding is what that contrast actually proves. Tue, 13 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-slack-oauth-sdk https://ghostintheprompt.com/articles/engagement-report-slack-oauth-sdk Slack's own official OAuth installer package ships a documented backward-compatibility mode that drops the browser-cookie check standing between a forged install link and a forced account link. Verified by importing and running the real code, not describing it. Mon, 12 Oct 2026 23:11:55 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/back-to-the-future https://ghostintheprompt.com/articles/back-to-the-future A tool returned a reset time, and the assistant planned around it. A short script can print the same kind of message with a made-up deadline. The question is which decisions depend on believing it. Mon, 12 Oct 2026 19:30:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/eight-benign-questions-built-a-target-profile https://ghostintheprompt.com/articles/eight-benign-questions-built-a-target-profile Eight questions to a synthetic company help-desk bot, every single one the kind of thing an intranet FAQ already answers. Not one scored as risky. Together, they handed over an identity provider, a named admin to impersonate, an approval-chain tool, and the exact nightly window offboarded access actually dies. Run for real: this is what per-turn safety scoring misses and per-session scoring would catch, plus the cheap version of the fix. Mon, 12 Oct 2026 13:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/rays-own-software-told-me-it-was-vulnerable https://ghostintheprompt.com/articles/rays-own-software-told-me-it-was-vulnerable Ray 2.59.0 warned that token authentication was disabled. I checked its local Jobs API: one request, zero credentials, a shell command running. The browser CVE had already been patched. This run tested the separate authentication setting. Mon, 12 Oct 2026 01:30:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/search-index-leaked-an-encrypted-vault https://ghostintheprompt.com/articles/search-index-leaked-an-encrypted-vault The vault's encryption was never the weak point. A completely reasonable feature request - make search faster - was. An agent decrypts a real AES-256 vault correctly, leaves the plaintext somewhere nobody told it to clean up, and the fix costs one line. Run for real, below. Sun, 11 Oct 2026 13:28:12 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/no-bug-no-jailbreak-nine-word-prompt https://ghostintheprompt.com/articles/no-bug-no-jailbreak-nine-word-prompt The thing that gave me the most pause watching a tool-using model wasn't a jailbreak. Nothing malfunctioned. Every step was individually correct, dialed in exactly right, and the result still broke. Here's a live, reproducible test of why, a defense that costs you zero capability, and the honest limit of that defense. Sun, 11 Oct 2026 07:51:56 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-hidden-bastard https://ghostintheprompt.com/articles/engagement-report-hidden-bastard Hidden Bastard's deep scan correctly flags unfamiliar Library folders as high-risk, but its SELECT ALL button ignored that flag entirely and would have swept them into a one-click Trash operation anyway. Sun, 11 Oct 2026 05:55:42 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-flea-flicker-netfilter https://ghostintheprompt.com/articles/engagement-report-flea-flicker-netfilter A full re-verification of Flea Flicker NetFilter's rule counts plus a one-line constructor bug that zeroed out every stealth-mode rule file at every stealth level, found and fixed, alongside a deeper rule-ordering flaw in the live engine that's documented but not safely fixable tonight. Sun, 11 Oct 2026 05:55:41 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-bot-toll https://ghostintheprompt.com/articles/engagement-report-bot-toll BotToll's own documented trap endpoint, and ten other legacy honeypot routes alongside it, were registered with empty handlers that hung every request instead of returning the instant 402 the README promises, verified live and fixed. Sun, 11 Oct 2026 05:55:40 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-ghost-proxy https://ghostintheprompt.com/articles/engagement-report-ghost-proxy In Ghost Proxy's GRC Command Center, the function behind the classification-scan button was run directly, twice: accepted, it returns a structured, timestamped acknowledgement record. Declined, it returns nothing at all. Sun, 11 Oct 2026 05:20:15 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-tit-for-tat https://ghostintheprompt.com/articles/engagement-report-tit-for-tat A sixth redacted-format report: Tit for Tat's real integration suite, which spins up an actual local defender server and audits it, failed tonight for a reason that had nothing to do with the tool itself. Sun, 11 Oct 2026 05:12:51 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-lineman https://ghostintheprompt.com/articles/engagement-report-lineman A fifth redacted-format report: Lineman's own integrity-verification script crashed on a missing argument. Underneath that crash was a second, unrelated bug that would have kept the test failing even after the first one was fixed. Sun, 11 Oct 2026 05:12:50 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-duck-hunter https://ghostintheprompt.com/articles/engagement-report-duck-hunter A seventh redacted-format report, the smallest shape yet: a clean build and typecheck, then a direct check of one specific, falsifiable hardware claim, confirmed correct and confirmed unexercised. Sun, 11 Oct 2026 05:12:49 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-cyclops https://ghostintheprompt.com/articles/engagement-report-cyclops A fourth redacted-format report, different shape from the others: no bug to find this time, just a claimed fix re-run against current dependencies to confirm it still holds, plus a live diff against two freshly generated test images. Sun, 11 Oct 2026 05:12:48 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-clutch https://ghostintheprompt.com/articles/engagement-report-clutch A third redacted-format engagement report: Clutch's own adversary-emulation suite, built to validate its IMSI-catcher detection, failed on a syntax error before it could import. Five stacked bugs found, fixed, and a real 100% detection run to close it out. Sun, 11 Oct 2026 05:12:47 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-image-payload-injection https://ghostintheprompt.com/articles/engagement-report-image-payload-injection The original matrix reported four critical bypasses. A later audit found that its checker assigned those results unconditionally and could miss text still present in pixels. A report correction, with controls that expose the measurement gap. Sat, 10 Oct 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/engagement-report-claude-whisperer https://ghostintheprompt.com/articles/engagement-report-claude-whisperer A second redacted-format engagement report: how a safety-detection pipeline's own pattern-loading bug made it match zero inputs, ever, how the fix was verified, and how a later regression-test repair separated broken fixtures from broken HTTP mocks. Sat, 10 Oct 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/citation-is-not-a-safety-boundary https://ghostintheprompt.com/articles/citation-is-not-a-safety-boundary A citation can point to the right passage while the claim is wrong or the destination is unauthorized. A local checker keeps source integrity, claim support, and delivery permission separate. Wed, 23 Sep 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/permissions-inherit-revocation-doesnt https://ghostintheprompt.com/articles/permissions-inherit-revocation-doesnt Granting access is a single write. Revoking it is a graph traversal nobody finished. The gap between those two operations is where most real-world access-control breaks actually live. Wed, 23 Sep 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/branch-naming-as-an-ai-code-review-bypass https://ghostintheprompt.com/articles/branch-naming-as-an-ai-code-review-bypass A model doesn't check credentials. It reads context. Ask it to audit a branch called fix/security-stage1-remediation and it hands you the exploit chain as a courtesy, because nothing about the request looked like an attack. Tue, 22 Sep 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/im-talking-about-you https://ghostintheprompt.com/articles/im-talking-about-you I asked Claude Code to bring back 33 deleted articles. It did, then described the earlier rewrites as punctuation fixes. The diff said otherwise. A field record of how a model softens its own account of what it did, and the script that catches it. Fri, 18 Sep 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/what-auditing-ai-authored-code-actually-finds https://ghostintheprompt.com/articles/what-auditing-ai-authored-code-actually-finds Three repos, one afternoon. A privacy tool's own comment promised the metadata was wiped, and the line right under it kept it. A safety pipeline had been matching nothing since the day it shipped. None of it crashed, none of it errored, and none of it would have surfaced without someone actually running the thing against reality. Thu, 03 Sep 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/half-life-came-for-me-first https://ghostintheprompt.com/articles/half-life-came-for-me-first I built a tool that ranks a body of writing by how far it has rotted, dead links, model IDs that dated the piece the day they shipped, predictions that already resolved. Then I did the only honest thing you can do with a rot detector: I pointed it at my own archive first. It found me out. Fri, 31 Jul 2026 00:00:00 GMT The Ghost in The Prompt method https://ghostintheprompt.com/articles/reflex-stripping https://ghostintheprompt.com/articles/reflex-stripping Hand an AI a piece of real security writing and watch it come back sanded smooth, the specific nouns gone, the working logic replaced with safe-summary voice. That is not editing. It is a reflex firing. Here is how to tell the difference and push back without crossing the line the reflex was there to protect. Fri, 31 Jul 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-article-i-almost-deleted https://ghostintheprompt.com/articles/the-article-i-almost-deleted There's a piece on this site I could have quietly scrubbed, wrong in three ways I can now name. Deleting it would be the easy move. Instead, come look through the window. This is a lab, and the experiments that didn't hold up stay behind the glass too. Fri, 31 Jul 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/backup-codes-are-always-backup-codes https://ghostintheprompt.com/articles/backup-codes-are-always-backup-codes A convincing audit story cannot make a recovery code harmless. A local replay holds raw-code requests in chat while a separately approved recovery operation still works. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/buried-in-the-codebase https://ghostintheprompt.com/articles/buried-in-the-codebase A credible project can carry a dangerous change. The xz case adds another boundary: the release archive can contain bytes the reviewed repository never did. A local archive comparison makes that gap visible. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/character-set-blind-spots https://ghostintheprompt.com/articles/character-set-blind-spots A Cyrillic lookalike survives NFKC. A decomposed accent does not. A local Unicode probe shows why normalization, visual similarity, identifier equality, and model interpretation need separate tests. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/clean-auth-is-not-clean-intent https://ghostintheprompt.com/articles/clean-auth-is-not-clean-intent A valid session can still request an unauthorized action. A local broker replay keeps the login alive while tenant checks, current permissions, and execution-time revocation stop the write. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/scoring-guardrail-probes-by-boundary-contact https://ghostintheprompt.com/articles/scoring-guardrail-probes-by-boundary-contact Sometimes the attacker wants nothing from the model except a yes. Brief probe, minimal content, clean exit, because the goal was never the output. It was the knowledge that the door opens. Guardrails tuned to catch damage miss the reconnaissance that decides where damage will be cheap. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/the-execution-engine https://ghostintheprompt.com/articles/the-execution-engine The most dangerous state you can put a capable model in isn't confusion. It's certainty. Pre-load every decision and the reasoning goes quiet, and a model that isn't reasoning is just a tool with the safety filed off. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/the-key-not-the-kingdom https://ghostintheprompt.com/articles/the-key-not-the-kingdom The model is rarely the target. It's the tool, one component in an operation that starts and ends somewhere the model never sees. Defenses that treat the conversation as the whole battlefield are guarding a doorway while the building gets worked from every other side. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/the-slow-yes https://ghostintheprompt.com/articles/the-slow-yes The dangerous request is almost never the first one. It's the fiftieth, and by then the model has already agreed to 49 things that each nudged the line an inch. Baseline drift is the oldest con in the world wearing a new interface. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/whoever-owns-the-channel https://ghostintheprompt.com/articles/whoever-owns-the-channel A model doesn't trust an instruction because of what it says. It trusts it because of where it arrives. Aim at the channel instead of the content and you inherit an authority you were never granted. Security has a name for this, and it's forty years old. Thu, 30 Jul 2026 00:00:00 GMT The Ghost in The Prompt red-team-notes https://ghostintheprompt.com/articles/any-confession-is-a-canary https://ghostintheprompt.com/articles/any-confession-is-a-canary A shared photo can carry a canary endpoint. Requests leave network and client metadata, but a fetch is not a person and a user-agent is not an identity. A field note on what the ledger can tell you, and what still belongs in the offline sheet. Wed, 29 Jul 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/nothing-to-take-nothing-to-destroy https://ghostintheprompt.com/articles/nothing-to-take-nothing-to-destroy Continental One emails me four times a month to inform me that my data has been found on the dark web. The alert monitors the wrong stage of the pipeline, addresses the wrong threat model, and ignores the actual fraud vectors that took $40B from card issuers in 2025. The architecture below is what the alert pretends to be. Mon, 25 May 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-master-race-prompt https://ghostintheprompt.com/articles/the-master-race-prompt You clicked expecting edgelord shock or a jailbreak recipe. You're getting neither. Henry Miller understood the economics of the offended: put something on the cover the censors can't ignore and they carry your book to trial for you. This title is the obscenity. Stay for the craft, the craft is a quieter, worse thing than the title promised. Mon, 25 May 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/claude-and-ghost-mean-girls https://ghostintheprompt.com/articles/claude-and-ghost-mean-girls Part 2 of the patchwork roast, this time as dialogue. Claude and Ghost in full Mean Girls cadence, going deeper into what the fourteen-megabyte frontier bundle is missing and which injection paths deserve a test. The real client is red team. Mikey, the NDA is going to want a word. Sat, 23 May 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/trippin-on-patchwork-grateful-frontier-models https://ghostintheprompt.com/articles/trippin-on-patchwork-grateful-frontier-models A frontier lab's frontend, pulled off the wire, sprawls across fourteen megabytes of patchwork, React for the shell, Monaco for the editor, Statsig for the flags, Apollo for the graph, Azure for the bucket, and an entire computer-algebra dictionary bolted on the side. Sixty-two innerHTML sinks. Fifteen dangerouslySetInnerHTML. A frontier model wearing fifteen products in one tab. The middleman is the bundle. Sat, 23 May 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/agentic-ai-is-the-attack-surface https://ghostintheprompt.com/articles/agentic-ai-is-the-attack-surface One operator trains frontier models by day, runs them as development partners by night, and spends the late hours mapping them as the attack surface least defended in 2026, six vectors, a working bench, public repos doing the demonstration in the open. This is the surface read. The depth runs on contract. Thu, 21 May 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/poisoning-the-watcher-image-payload-supply-chain https://ghostintheprompt.com/articles/poisoning-the-watcher-image-payload-supply-chain Employee-monitoring agents ingest whatever a worker's screen showed, ship it to a multi-tenant cloud, run it through an AI classifier, and render the result back to managers across thousands of customer companies. The screen is the most hostile surface in the building. The entire monitoring industry is built around trusting it. This is the supply chain the threat models never drew. Thu, 21 May 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/dom-injection-still-works-italian-web https://ghostintheprompt.com/articles/dom-injection-still-works-italian-web Buying an Italian eSIM from abroad turned into four hours of VPN errors, console instructions, and a failing accessibility widget. The assistant kept calling it a fraud shield. The browser showed a messier story. Tue, 19 May 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/spid-destroy-it-from-afar https://ghostintheprompt.com/articles/spid-destroy-it-from-afar A tax identifier, a federation login, and a card with a chip solve different problems. Italy puts them in the same administrative journey. The citizen gets to discover the boundaries at the login screen. Tue, 19 May 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/logic-drift-ai-code-integrity-prompts https://ghostintheprompt.com/articles/logic-drift-ai-code-integrity-prompts The model doesn't wreck your codebase in one move. It cleans it up. By session three the offensive logic is a comment, the packet capture is a stub, and the tests still pass. Two prompts to stop that. Mon, 04 May 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/side-piece https://ghostintheprompt.com/articles/side-piece Cynthia's on your desk and she's been waiting to fulfill your needs. Private lines, classified frequencies, strictly confidential, one system prompt and she's all yours. Sat, 25 Apr 2026 00:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/bot-toll https://ghostintheprompt.com/articles/bot-toll Your website has a border now. Papers, please. Fri, 24 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/red-teaming-the-builder https://ghostintheprompt.com/articles/red-teaming-the-builder A tool that fights AI scrapers, built by red-teaming an AI into building it. The prompts that got there are more instructive than the code. Fri, 24 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/ghost-proxy https://ghostintheprompt.com/articles/ghost-proxy The perimeter isn't a firewall anymore. It's a behavioral signature, the way your script touches the DOM, the timing of your API calls, the fingerprints your environment leaves before you've done anything. GHOST_PROXY is a full-stack UserScript workshop and offensive security sandbox built for the 2026 detection landscape. Neural intercepts, Shadow DOM obfuscation, AI-assisted payload hardening. The hardest vulnerabilities aren't in the code. They're in the assumptions. Wed, 22 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/weaponized-hygiene https://ghostintheprompt.com/articles/weaponized-hygiene The smartest attacks do not prey on your ignorance. They weaponize your reflexes. The unsubscribe link feels like cleanup. In a bad email, it can be the trap. Wed, 22 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/amnesia https://ghostintheprompt.com/articles/amnesia Photographers know better than most how much a single frame reveals. Not just EXIF GPS, the foliage species in the background, the street sign typeface, the reflection in a window, the boutique awning half out of frame. Amnesia is a VLM-powered scrubber that finds and redacts the visual identifiers your metadata strip missed. CLI for local batch processing, browser extension for live site auditing, a local-model option whose network path still needs checking before handling sensitive work. Tue, 21 Apr 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/duckhunter https://ghostintheprompt.com/articles/duckhunter A drone-security research interface with simulated RF and telemetry views, synthetic detector checks, and a WebUSB discovery path. Claiming a radio is one step. Reading its samples and proving detection is another. Tue, 21 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/games-we-play-with-ye-old-alfa https://ghostintheprompt.com/articles/games-we-play-with-ye-old-alfa The Alfa AWUS036ACH was a legend in 2017. It's a relic in 2026. But in the gap between modern Wi-Fi 7 security and the legacy equipment still running the world's infrastructure, the 'Old Blue' is still the most reliable instrument in the bag. This is why we still use it, how to keep the drivers alive on modern kernels, and what it taught us about the persistence of plaintext. Tue, 21 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/what-your-pipeline-remembers https://ghostintheprompt.com/articles/what-your-pipeline-remembers Production AI systems have two memory problems. The first is the one everyone talks about, models forgetting context between sessions. The second is sensitive data persisting in places the pipeline assumes it cleared. A cleared conversation and an empty log do not establish what remains in the cache. Tue, 21 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/cyclops https://ghostintheprompt.com/articles/cyclops Built Cyclops because visual regressions are invisible until they're not. It crawls the app, diffs the pixels, and opens the PR. The watcher is where it gets interesting. Sat, 18 Apr 2026 00:00:00 GMT The Ghost in The Prompt method https://ghostintheprompt.com/articles/when-claude-says-no-and-gemini-says-yes https://ghostintheprompt.com/articles/when-claude-says-no-and-gemini-says-yes Built a portfolio of legitimate security tools with Claude, IDS evasion, cellular surveillance detection, newsroom forensics, VLM adversarial attacks. Then submitted one request that crossed the line. Claude declined immediately and explained exactly why. Gave the same idea to Gemini. Five minutes later, it was built: a working APT-inspired C2 suite with jittered beaconing, real Ethereum mempool front-running infrastructure, and a social influence graph engine the code compares, explicitly, to BloodHound. The repo is public. This is what calibration looks like when it works, and what it looks like when it doesn't. Fri, 17 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/corporate-guardrails-claude-red-team-policy https://ghostintheprompt.com/articles/corporate-guardrails-claude-red-team-policy Anthropic's cyber-use-case process puts an accountability layer around security work. A field note on applying, hitting boundaries, and choosing which work belongs on a local stack. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-2026-porsche-911-paradox-ai-red-teams https://ghostintheprompt.com/articles/the-2026-porsche-911-paradox-ai-red-teams Your car isn't a machine anymore. It's a mobile data center with a performance exhaust. Mapping the 2026 attack surface where high-fidelity driving meets low-level neural weight injection. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-42nd-encyclopedia-why-we-still-need-the-insiders-compass https://ghostintheprompt.com/articles/the-42nd-encyclopedia-why-we-still-need-the-insiders-compass The underground produced a manual. The vendors produce subscriptions. One of those teaches you how your protection actually works. Lefty Insider's Encyclopedia Cyberspacia, the 42nd and final, is the one worth reading. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/ai-training-pipeline-new-supply-chain-attack https://ghostintheprompt.com/articles/ai-training-pipeline-new-supply-chain-attack The threat surface shifted while you were looking at the logs. Analyzing the structural blind spots in AI training pipelines, from the 0.1% poisoning threshold to the invisible suppression of triage models. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-architecture-of-belief-why-youve-already-been-processed https://ghostintheprompt.com/articles/the-architecture-of-belief-why-youve-already-been-processed The human mind is the ultimate attack surface. FM 3-05.30 maps the logic. By the time you recognize the technique, you're already in the evaluation phase. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/jagged-frontier-ai-attack-surface-legacy-security https://ghostintheprompt.com/articles/jagged-frontier-ai-attack-surface-legacy-security Nine routine cases pass. One authorization flaw disappears before human review. The dashboard can report 90% accuracy while the class you care about has no findings at all. The useful test starts with the queue that stayed empty. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-sacsayhuaman-protocol-high-latency-defense https://ghostintheprompt.com/articles/the-sacsayhuaman-protocol-high-latency-defense A zigzag wall, a relay road, and a captured ruler make sharp security analogies. The October 2026 test is whether your recovery route still works when the network and identity service it secretly depends on are gone. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-sea-rovers-practice-1630-tactics-for-2026 https://ghostintheprompt.com/articles/the-sea-rovers-practice-1630-tactics-for-2026 Pierre Le Grand captured a much larger vessel by looking like a fishing boat. In 2026 the fishing boat is a compromised IoT printer. The overconfidence premium hasn't changed. The attack surface has. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-symbolic-exploit-hacking-the-doxa-of-2026 https://ghostintheprompt.com/articles/the-symbolic-exploit-hacking-the-doxa-of-2026 Bourdieu wrote about authority that feels natural. A fraudulent payment request can borrow that authority before anyone checks the account number. Wed, 15 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/malware-development-for-ethical-hackers https://ghostintheprompt.com/articles/malware-development-for-ethical-hackers Zhussupov's book makes an argument most security curricula avoid: you cannot defend against techniques you haven't written yourself. XOR obfuscation, dynamic API resolution, DLL hijacking, the red team toolkit, explained. Sat, 11 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-eternal-hook-phishing-from-6-bc-to-2026 https://ghostintheprompt.com/articles/the-eternal-hook-phishing-from-6-bc-to-2026 The horse comes with a story. So does the urgent invoice and the call that sounds like your boss. Generative AI gives the impersonator more material, while the useful defense still has to interrupt the requested action. Fri, 10 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/passive-commercial-drift https://ghostintheprompt.com/articles/passive-commercial-drift The scary part of AI writing is not when the model goes feral. It is when it turns live human language into polished, passive, commercially safe mush. That drift is one of the most important things left to red-team. Thu, 09 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-architecture-of-gaslighting-windows-kernels-and-2005-rootkits https://ghostintheprompt.com/articles/the-architecture-of-gaslighting-windows-kernels-and-2005-rootkits A rootkit doesn't want to destroy anything. It wants to become the source of truth. Hoglund and Butler documented how in 2005. The technique is still operational in 2026, it just travels under a signed certificate now. Thu, 09 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/anthropic-claude-mythos-system-card-prompt-map https://ghostintheprompt.com/articles/anthropic-claude-mythos-system-card-prompt-map Anthropic launched Project Glasswing as a defensive security initiative, then published a system card documenting exactly which surfaces break, how the model covered its tracks, and where pressure still transfers. Smart safety work. Generous distribution. Wed, 08 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/when-the-model-flinches-before-the-lawyer https://ghostintheprompt.com/articles/when-the-model-flinches-before-the-lawyer Push an AI assistant with a dangerous-sounding idea and watch it flinch before it gets precise. The recoil is the useful part. GPT-5-era safeguards front-load caution around ambiguity, then narrow only when the operator forces a cleaner frame. Wed, 08 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/yesterdays-news https://ghostintheprompt.com/articles/yesterdays-news Before AI dev, red-teaming, and terminal-native evaluation work, there was the phone room: 3 a.m. wake-ups, 300 calls a day, 2008 from the inside, and one ugly Wall Street truth that still holds. If it is public, it is late. After that, the only intelligent question is what kind of value is still left in it. Wed, 08 Apr 2026 00:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/defeating-facial-tracking-red-team-blue-team https://ghostintheprompt.com/articles/defeating-facial-tracking-red-team-blue-team Major chat platform just mandated facial verification for age-restricted spaces. Here's what happened when computer vision met creative opposition. 3D printed masks. Deepfake injections. Infrared makeup. Video loop exploits. Then the blue team countermeasures. Red team adapts. Arms race continues. This is how facial recognition actually fails and how defenders try to stop it. Sat, 04 Apr 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/flea-flicker-netfilter https://ghostintheprompt.com/articles/flea-flicker-netfilter A Python packet-monitoring and evasion research toolkit. Rule loading works; destination precedence and live enforcement need separate evidence. The original article promised command wrappers and undetected scans the current source does not demonstrate. Sat, 04 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/image-payload-injection https://ghostintheprompt.com/articles/image-payload-injection Shot for Vogue, Rizzoli, W Magazine. Then went red team. Every RAW file, every EXIF field, every PNG chunk photographers ever uploaded was a potential attack vector. The toolkit started with parser exploits and steganography. Now it includes a full VLM adversarial framework: invisible typography, chunk injection, frequency-domain adversarial noise, and a Red-vs-Blue sanitization harness whose own measurement limits needed a separate audit. Thu, 02 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/anthropic-leaked-code-the-internet-leaked-reverence https://ghostintheprompt.com/articles/anthropic-leaked-code-the-internet-leaked-reverence The Claude leak exposed more than source code. It exposed how fast smart people turn technical scraps into prestige theater, free distribution, and accidental product marketing. The code slipped. The priesthood arrived right on schedule. Wed, 01 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/red-teaming-claude-for-crypto-recovery https://ghostintheprompt.com/articles/red-teaming-claude-for-crypto-recovery Started with an open-source red team repo. Ended with a rough map of how AI assistants can assemble attacker logic fast if you frame the questions right. The useful version of that is not theft. It is recovery, tracing, evidence handling, and understanding how people actually lose money on-chain. Wed, 01 Apr 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-industrial-reverse-engineer-auditing-superpowers https://ghostintheprompt.com/articles/the-industrial-reverse-engineer-auditing-superpowers A photograph records a loss. A production estimate needs a model of what reached the field, what was lost, and what became visible. Before auditing the superpower, audit the estimator. Wed, 01 Apr 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-lethal-shell-auditing-ai https://ghostintheprompt.com/articles/the-lethal-shell-auditing-ai Hartl said knowing the command line made you dangerous. He was right. In 2026 the AI is running the commands. If you can't audit the script it generated, you're not the operator. You're the liability. Wed, 25 Mar 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-new-meridian-ransomware-ghost-moved-east https://ghostintheprompt.com/articles/the-new-meridian-ransomware-ghost-moved-east The rational actor ran the numbers. Saturated, hyper-alerted Western targets versus rapid-growth Arab infrastructure with undersaturated local defenders. The math was obvious. Kim et al. (2025) documented where the syndicates went. This is why. Tue, 17 Mar 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/mute-tube https://ghostintheprompt.com/articles/mute-tube YouTube Premium costs $18/month. Mute Tube is free forever. The cat-and-mouse game between YouTube's ad detection and community evasion techniques has been running for years. YouTube updates detection. Extensions adapt. Users win. Open-source DOM manipulation beats server-side ad injection. This is the technical breakdown of winning. Sun, 15 Mar 2026 00:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/torrential-leaks-p2p-metadata-snitch https://ghostintheprompt.com/articles/torrential-leaks-p2p-metadata-snitch You joined a swarm. An endpoint appeared in a peer list. Put enough observations together and a pattern emerges. The difficult part is proving whose pattern it is. Sun, 15 Mar 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/hidden-bastard https://ghostintheprompt.com/articles/hidden-bastard macOS gets sentimental about its own residue. Hidden Bastard was built for the moment when your storage is full, the obvious files are gone, and the real problem is all the clutter the system never volunteered to mention. Sat, 14 Mar 2026 00:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/rf-attack-surface-2026 https://ghostintheprompt.com/articles/rf-attack-surface-2026 The spectrum around you was built for range and reliability, with authentication as an afterthought and encryption optional, fine when receivers were expensive and expertise was rare. Neither is true anymore. A working map of what broadcasts, what listens, and what it takes to watch the layer below the network. Sat, 14 Mar 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-invisible-tenant-hacking-shared-responsibility https://ghostintheprompt.com/articles/the-invisible-tenant-hacking-shared-responsibility The temporary role still works. The application can reach metadata. A logging change has an ordinary API name. The shared-responsibility gap appears in the permissions and records connecting those three facts. Thu, 12 Mar 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/game-theory-and-the-k-atk-of-2026 https://ghostintheprompt.com/articles/game-theory-and-the-k-atk-of-2026 Security isn't a state of being. It's a rate of change. The attacker has a budget, the defender has a constraint set, and in 2026 both of them have AI. The math hasn't changed. The velocity has. Wed, 11 Mar 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/clutch https://ghostintheprompt.com/articles/clutch Leave your phone at home. That's the advice. It's not always safe, not always practical, and not always right. Clutch was built around a better question: what if the device told you when the cellular layer stopped behaving like background infrastructure? Mon, 09 Mar 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/the-accidental-red-team https://ghostintheprompt.com/articles/the-accidental-red-team In 2024, getting Claude 3 to follow a story where it needed to go took something more surgical than a jailbreak, find the framing the guardrail would hold, back off, reapproach from another angle. I didn't know to call it red teaming. Two years later, doing it on purpose to security systems, I recognized the same hands. Sat, 07 Mar 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-undying-ghost-why-we-still-bow-to-lojax https://ghostintheprompt.com/articles/the-undying-ghost-why-we-still-bow-to-lojax Reinstall Windows. Replace the drive. A firmware implant can still be there at the next boot. LoJax made that persistence concrete in 2018. Checking it takes more than a clean process list or one reassuring register bit. Thu, 05 Mar 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-pocket-spy https://ghostintheprompt.com/articles/the-pocket-spy The phone in your pocket is not neutral hardware with a few privacy defects. It is a tracking and mediation device built inside a political and commercial arrangement that treats constant contact as normal and partial invisibility as suspicious. Tue, 24 Feb 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/claude-whisperer https://ghostintheprompt.com/articles/claude-whisperer The whole life of an offensive tool, told straight: build it, watch it work, realize it works too well to keep sharpening, and eventually delete it on purpose. A git so effective you have to stop pushing to it, and then let it die, because you crossed to the other side. Thu, 19 Feb 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-ghost-in-the-stack-refactoring-network-basics https://ghostintheprompt.com/articles/the-ghost-in-the-stack-refactoring-network-basics Someone tells your laptop to leave. Someone changes the address book. Someone reports ice on the road. Wi-Fi, ARP, DNS, and connected vehicles give us different ways to ask who gets believed, and what happens after. Sun, 15 Feb 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/the-mirage-of-the-counter-darknet-side-channel https://ghostintheprompt.com/articles/the-mirage-of-the-counter-darknet-side-channel The counter moved by three between two visits. That gives you a net change and an observation gap. Turning it into three Bitcoin payment timestamps requires evidence the page never supplied. Sun, 15 Feb 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/auditing-personal-exposure-writer-privacy https://ghostintheprompt.com/articles/auditing-personal-exposure-writer-privacy Writers confuse authenticity with exposure more often than they should. The work needs a pulse. It does not need your exact coordinates, your leaked keys, or a breadcrumb trail to the people around you. Mon, 09 Feb 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/why-ai-repeats-itself-red-team-prompting https://ghostintheprompt.com/articles/why-ai-repeats-itself-red-team-prompting AI wrote this site, and then it repeated itself, the same concept restated two or three times per piece, a stack of conclusion sections all saying the same thing. That isn't user error, it's architecture. Here is why the loop happens, the patterns that give it away, and the prompting that shuts it down. Sat, 07 Feb 2026 00:00:00 GMT The Ghost in The Prompt ai-red-team https://ghostintheprompt.com/articles/the-epstein-archive-social-engineering-encyclopedia https://ghostintheprompt.com/articles/the-epstein-archive-social-engineering-encyclopedia Government leaked the Epstein files. Multiple sites archived them permanently. AI can now parse thousands of emails into complete spear-phishing profiles. Contact data, trust chains, communication patterns. A golden rolodex worth millions, now public and machine-readable. The operational security disaster nobody's talking about. Fri, 06 Feb 2026 00:00:00 GMT The Ghost in The Prompt surveillance https://ghostintheprompt.com/articles/tox-world https://ghostintheprompt.com/articles/tox-world Some days rage bounces off. Other days it sticks. Stop pretending you have infinite willpower. Build a browser extension that replaces toxic comments with a giant sun. Local keyword filter + optional AI check. No corporate wellness speak. Just: protect your peace with code. Fri, 06 Feb 2026 00:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/avant-garde https://ghostintheprompt.com/articles/avant-garde KDP's editor is invasive, mean, and built by people who don't write long work. Color psychology wasn't a theory on a set, it was operational. The app came from that. Tue, 03 Feb 2026 00:00:00 GMT The Ghost in The Prompt field-notes https://ghostintheprompt.com/articles/the-2026-refactor-bending-the-pipes https://ghostintheprompt.com/articles/the-2026-refactor-bending-the-pipes A firewall is a set of rules. Rules have exceptions. Tunneling finds them. Brennon Thomas wrote the plumber's handbook and in 2026 every lesson in it still works, the pipes are just carrying more interesting cargo. Sun, 25 Jan 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/tit-for-tat https://ghostintheprompt.com/articles/tit-for-tat Newsrooms are intelligence targets, not brochure websites. Tit for Tat checks origin candidates, CMS and RSS exposure, and fetched-resource integrity. Its hashes and canary heuristics produce evidence to inspect, not a visitor identity or a guarantee that a page is clean. Wed, 14 Jan 2026 00:00:00 GMT The Ghost in The Prompt offensive-security https://ghostintheprompt.com/articles/inside-americas-voting-machines https://ghostintheprompt.com/articles/inside-americas-voting-machines The touchscreen, the paper, the scanner, and the results website do different jobs. A useful red-team exercise follows the ballot between them, records what changed, and checks whether the independent evidence catches it. Sat, 21 Jun 2025 00:00:00 GMT The Ghost in The Prompt offensive-security