https://www.alephbeth.ai/posts/ Recent content in Posts on Aleph Beth https://www.alephbeth.ai/og-image.jpg https://www.alephbeth.ai/og-image.jpg Hugo en-US Mon, 14 Sep 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-09-14-when-the-web-becomes-a-weapon-attacks-on-ai-agents/ Mon, 14 Sep 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-09-14-when-the-web-becomes-a-weapon-attacks-on-ai-agents/ All it takes to hijack an AI agent is for it to visit a web page carrying invisible instructions. This article walks through the full attack chain — indirect prompt injection observed in the wild, persistence through memory and RAG poisoning, state-level redirection of agent searches — then turns the weapon around: reverse-injection honeypots, tarpits and trap functions that expose attacking agents. https://www.alephbeth.ai/posts/2026-09-13-hidden-weapon-in-the-page/ Sun, 13 Sep 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-09-13-hidden-weapon-in-the-page/ An indexed web page can carry a natural-language payload that targets, in a few lines, all four defensive layers of an AI agent: evasion, persistence, exfiltration, concealment. Worse, the outbound channel used for exfiltration is bidirectional: behind the URL, an attacker talks to the agent in real time. This article details the mechanism, shows why warning the model is a necessary but never sufficient first line, and why security comes from architecture — not from the prompt. https://www.alephbeth.ai/posts/2026-07-29-deceive-detect-exhaust-defending-against-offensive-ai-agents/ Wed, 29 Jul 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-07-29-deceive-detect-exhaust-defending-against-offensive-ai-agents/ A human pentester gets tired, breaks for lunch, eventually gives up. An LLM-driven agent does none of that: it loops around the clock, draws no salary, and costs less every year. Against that adversary two mechanisms combine — decoys written for a reader that is a machine, and a maze of virtual machines that turns every hour of attack into pure expenditure. This article details both, and the four limits to state before any deployment. https://www.alephbeth.ai/posts/2026-06-29-prompt-position-fine-tuning-never-validate/ Mon, 29 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-29-prompt-position-fine-tuning-never-validate/ A stubborn intuition holds that you only need to put the safety rules ‘first’ in the system prompt. It is false, and for a reason that turns against it: a transformer grants no authority to a token’s position. Fine-tuning fails exactly the same test. Neither is an access control — both live inside the very thing they claim to constrain. The only guarantee is deterministic and external, and a rigorous dataset must reflect that boundary in its labels. https://www.alephbeth.ai/posts/2026-06-29-ai-agent-security-jailbreak-countermeasures/ Mon, 29 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-29-ai-agent-security-jailbreak-countermeasures/ A chatbot writes sentences; an AI agent acts — it reads your email, runs code, calls APIs, spends money. That shift moves the risk: it is no longer about making the AI say something forbidden, but about making it do something dangerous. This article explains, with detailed and accessible examples, how these attacks actually work, why naive guardrails fail, and what a decision-maker must demand before putting an agent into production. https://www.alephbeth.ai/posts/2026-06-30-recursive-corruption-of-ai-control-systems/ Mon, 29 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-30-recursive-corruption-of-ai-control-systems/ Classic security tools hunt for dangerous words: ‘hack’, ‘bomb’, ‘urgent’. But you don’t subvert an AI agent with suspicious vocabulary — you subvert it with the ordinary language of the business: a role, a process, a plausible emergency. And when the agent that monitors, the SIEM that correlates and the auditor that checks are themselves AI agents, the attacker no longer has to defeat a system: it corrupts them in a chain. This article explains that recursive-corruption mechanism and what a decision-maker must demand to break it. https://www.alephbeth.ai/posts/2026-06-22-conditional-dpo-backdoor-agentic-chain/ Sun, 21 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-22-conditional-dpo-backdoor-agentic-chain/ A deeper companion to the free-tier feedback explainer. DPO moves safety from the behavior level to the level of a conditional distribution; an agent then turns a poisoned conditional into a chain of actions. The result is a backdoor built from individually ordinary behaviors, invisible to standard evaluations, whose danger only emerges when the actions compose. https://www.alephbeth.ai/posts/2026-06-21-free-tier-weak-link-data-poisoning/ Sun, 21 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-21-free-tier-weak-link-data-poisoning/ Commercial assistants — Claude, ChatGPT, Gemini, Le Chat — keep learning from free-tier feedback: ratings, regenerations, and the conversations themselves. That loop is an injection channel. A two-phase threat model: build a policy-compliant backdoor on a rare topic, then exploit it for jailbreak — and why scale makes the first phase almost impossible to catch. https://www.alephbeth.ai/posts/2026-06-18-agentic-siem-attack-surface/ Thu, 18 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-18-agentic-siem-attack-surface/ SOCs are evolving toward agentic architectures where multiple AIs handle triage, investigation, correlation, and response. The decision system itself becomes the target. We argue for capability monotonicity (Lock-Monotone/TGMC) as an architectural invariant that contains a compromised reasoning layer. https://www.alephbeth.ai/posts/2026-06-12-how-llms-work-lstm-to-transformer/ Fri, 12 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-12-how-llms-work-lstm-to-transformer/ Three interactive diagrams to see, step by step, how a sentence flows through a recurrent network (LSTM), a convolutional network (CNN), and finally a Transformer — the architecture every modern LLM is built on. Plus why the mechanics matter for security. https://www.alephbeth.ai/posts/2026-06-12-ai-war-on-our-networks-why-attack-outpaces-defense/ Fri, 12 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-12-ai-war-on-our-networks-why-attack-outpaces-defense/ Strategic essay. Cyber conflict is now machine-versus-machine, at a tempo that excludes the human operator. Attack holds the advantage — by architecture, not by accident: defending one LLM with another reproduces the very flaw. The way out is to move the decision out of the model, into a deterministic layer. https://www.alephbeth.ai/posts/2026-06-10-agentic-soc-attacks-on-defensive-ai/ Wed, 10 Jun 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-06-10-agentic-soc-attacks-on-defensive-ai/ Two linked shifts: the SOC moves from a human craft model to an automated agentic one — and those same defensive agents become a new attack surface. The defense you deploy is also the breach you open. https://www.alephbeth.ai/posts/2026-04-27-claude-desktop-simple-hardening/ Mon, 27 Apr 2026 00:00:00 +0000 https://www.alephbeth.ai/posts/2026-04-27-claude-desktop-simple-hardening/ Targeted attack-surface reduction for Claude Desktop. Simple principle: it’s a chat assistant, not a system agent. The list of NOs, the list of OKs, and a 30-minute checklist.