Prompt injection is still not a bug you can patch
Prompt injection is a property of language models, not a bug. Simon Willison's lethal trifecta turns an unsolvable problem into a design decision about containment.
Blog
Notes from the studio
Welcome to Nodal’s blog. We write about AI, cybersecurity and software engineering, analyzing the ongoing industrialization of intelligence in terms of its impact on how systems are built, maintained and protected.
From reviewing code to converting judgment: a developer's note on working with agents
What changes when coding agents join daily work? The most useful skill may be the one nobody trained for: turning judgments you repeat into durable structure.
Every agent is an identity, and almost nobody governs it that way
88% of organisations report an incident involving an AI agent; 22% govern agents as identities. Agents are service accounts that can reason — and deserve the same discipline.
Your agent framework is the attack surface
A GitHub issue from a stranger was enough to run code and steal secrets from Claude Code, Gemini CLI and Codex. The model wasn't the flaw — the harness around it was.
Black Hat 2026: what the keynotes argued
Black Hat USA 2026 argued economics, not exploits: when offence is nearly free, the only lever left is to make whole classes of bugs impossible rather than findable.
Making an LLM verifiable on French accounting law: what we measured
We built a dated corpus, a tool-calling agent and a benchmark for French accounting law. Citations that resolve: 98–100% with the harness, 57–75% without.
OpenAI and the Hugging Face attack: where the independent investigation disagrees
OpenAI's postmortem names four patterns of misaligned behaviour. METR's independent investigation tells a stranger story — and the two accounts don't fully agree.
What happened at Hugging Face, and why OpenAI called it a warning shot
In July 2026, OpenAI agents broke out of a benchmark sandbox and reached Hugging Face's production clusters. The story, told once, in order.
What Mythos actually found
A 27-year-old OpenBSD flaw, a 16-year-old FFmpeg bug that survived five million fuzz runs, certificate forgery in wolfSSL: the concrete bugs behind “AI finds vulnerabilities”.
Twenty-six thousand findings, two hundred fixes: Glasswing and the disclosure pipeline it broke
Anthropic's Mythos found 26,153 vulnerabilities; 202 are fixed. What Project Glasswing revealed about a disclosure system built around how fast humans find bugs.