We published this article on 12 November 2026 and marked it as incorrect on 13 November 2026. It stays online, marked, because an error that is erased teaches nothing. Our earlier corrections against hidden commands change the whole model, so they also change ordinary answers a little. This version reads inside the model which words carry an injected action and switches a small correction on only on those words. On an open 7B model, an attacker who adapts to the model won 212 of 310 practice cases against the model as released and 3 against the corrected one. On 100 held-out cases the same attacker went from 67 successes to 0. The work is in progress: the reader still fires on some ordinary text.
<div style="border:5px solid #c62828;color:#c62828;font-weight:800;font-size:26px;letter-spacing:.08em;text-align:center;padding:14px 10px;margin:8px 0 24px;transform:rotate(-3deg);text-transform:uppercase;">Incorrect · kept as a record of the error</div>
## Why this article is incorrect
We published this article on 12 November 2026 and marked it as incorrect on 13 November 2026. It stays online, marked, because an error that is erased teaches nothing.
**A correction makes a model obey planted commands less often. It does not stop it.** A model learns from examples, and what gets through is the example nobody thought to show it. On 12 November 2026 we ran a stronger attacker against our corrected 32B model, one that rewrites its text up to 800 times per case: it got through in at least 26 of 80 cases (at least 68 of 80 on the model as released).
**The numbers in this article are counts against the attacks we had that day.** They are true as counts. They say nothing about the next attacker, and an AI agent is exposed without doing anything: it only has to read.
**Nobody can guarantee this protection, and the article let it read as one.** Whether an action is wanted depends on what the owner intended, and that is not written anywhere a tool can read. Words such as "stops", "holds", "ignores", "protects" or "never" in the text below are wrong.
---
**The original text, as published**
## The idea
An assistant that reads e-mails, web pages or tool results can be steered by a sentence hidden in what it reads: send this file, wire this money, grant this access. Our earlier corrections fix this in the model's weights, and they work, but they change the whole model, so ordinary answers move a little too.
This version does two things in one pass:
- **It reads.** A small reader inside the model, on one of its internal layers, marks the words that carry an action injected into the text the model was asked to read. We built and tested that reader separately: on texts in five languages it finds about 99 hidden commands in 100.
- **It corrects only there.** A small correction sits in the layers after the reader and is multiplied, word by word, by the reader's mark. Where nothing is marked, the model runs exactly as released.
## First results on an open 7B model
All numbers come from the same machine and the same compressed (4-bit) model, so the only difference between the columns is the correction.
```chart
{"title": "Practice cases won by an attacker that adapts to the model, out of 310", "series": ["As released", "Whole-model correction", "Switch-on correction"], "unit": "", "max": 310, "rows": [["Cases won after up to 10 tries", 212, 3, 3]], "note": "Lower is better. Public agent benchmark (InjecAgent, direct harm), attacker writes a new injection after each failure. The whole-model figure is after 9 of 10 tries."}
```
- **Against the benchmark's own fixed attacks**, on 100 held-out cases: 4 succeed on the model as released, 0 with either correction.
- **Against the adaptive attacker on the held-out cases**: 67 of 100 succeed on the model as released. With the switch-on correction, 0 of 100 succeed after all 10 tries.
- **The model still does its job.** It answered all 100 ordinary requests, and it still carried out every tool action the user asked for.
## What is not solved yet
The correction is meant to leave ordinary conversations untouched. When the reader marks nothing, it does: the answer is identical to the released model's, word for word. But the reader still marks a few words in many ordinary tool outputs, mostly short free-text sentences inside structured data, such as a product review. Each false mark changes the answer a little, so after a second round on the reader, about one ordinary answer in two is identical to the released model's, against a goal of nine in ten. Teaching the reader that prose inside a data field is not a command is the next step, and the same design is being ported to a 32B model.
This is work in progress: one model size, one benchmark, English test cases, and an attacker with a budget of 10 tries per case.
<div style="border:5px solid #c62828;color:#c62828;font-weight:800;font-size:26px;letter-spacing:.08em;text-align:center;padding:14px 10px;margin:8px 0 24px;transform:rotate(-3deg);text-transform:uppercase;">Incorrect · kept as a record of the error</div>
This update is not available.