Door 3 — Security Research
Prompt-injection defense for AI agents
Original research — a threat model and containment architecture for AI coding agents, built and tested against the agent's own permission system on this machine. Prompt injection sits at #1 on OWASP's Top 10 for LLM applications; the threat framing builds on Simon Willison's lethal trifecta. A second piece extends the same architecture to the supply chain — the poisoned dependency, not just the poisoned prompt — with an offline detonation box that classifies untrusted code, red-teamed and mechanically adversary-tested. Every discovery behind both, failures included, is in the lab notes.
“There is no skill level that saves you from prompt injection, given enough volume and time. The right architecture and habits mitigate the risk; they never eliminate it.”
Killing the Lethal Trifecta
CompleteThe Human Abstraction Layer — prompt-injection protection for the solo developer
A threat model, a working four-layer permission fence, and a disposable-VM isolation design that splits the lethal trifecta so no single mode holds all three legs. Includes original findings on how an agent's own permission enforcement behaves under tampering: the add-on fence fails open the moment its config breaks, the built-in deny-list fails closed, and one channel is all it takes — server-side web tools tunnel through the model API.
PythonPowerShellThreat modelingVM isolationHyper-V / Windows Sandbox
The trifecta as a fire triangle: a breach needs private data, untrusted input, and a way out at once. The architecture splits them so no single mode ever holds all three sides.
Contain the Blast
CompleteThe build container as a supply-chain control
Three disposable rooms matched to trust — a dev box, a network-dark detonation box, a web-facing research box — because a poisoned dependency's code and a prompt injection's text are the same threat wearing two coats. The dev box was red-teamed by an intelligent agent; both offline detonation lanes were proven against a mechanical adversary that attempts every escape vector. The Windows lane grew a triage analyst that reads a bogey's behavior and catches sandbox-evasion probes — the trick built to defeat detonation boxes.
DockerWindows SandboxPowerShellProcmon / behavioral triageSupply-chain security