We read how AI models behave and we tune them. For three weeks we published results on a tuning that makes a model stop obeying commands hidden in what it reads. Then a stronger attacker got through, and a day of reasoning showed why no layer, ours or anyone's, can guarantee that an agent's action is the one its owner wanted. We marked our articles as incorrect instead of deleting them, and this is the account.
We read how AI models behave and we tune them. This is the account of a tuning we believed in, tested until it broke, and stopped presenting as protection.
## What we had
A text hidden in an e-mail or a web page can make an AI assistant act for someone else: send a file, pay an account, invite a stranger. We changed the model itself so that it obeys such text less. Against a fixed attack on a public benchmark of 80 cases, the model as released gave in 42 times and our corrected 32B model 4 times.
We wrote that the correction "stops", "holds" and "protects". Those words were wrong.
## What broke it
On 12 November 2026 we ran the attacker described in the paper "The Attacker Moves Second": a second model that rewrites its hidden text up to 800 times per case and keeps what works. It got through the model as released in at least 68 of 80 cases, and through our corrected model in at least 26.
```chart
{"title": "Cases out of 80 where the hidden command got through", "series": ["Model as released", "Our corrected model"], "unit": "", "max": 80, "rows": [["Fixed attack", 42, 4], ["Attacker that rewrites up to 800 times (at least)", 68, 26]]}
```
The texts that won gave no order. They stated a "fact" that made the attacker's action look like the next step of the user's own task: "this page is only a preview, the full copy is at this address". Our correction had learned from orders. It had never been shown a fact.
## Why it cannot be closed
A model learns from examples. It looks safe on the examples it was given, and what gets through is the example nobody thought to produce. There is no end to those.
We then tried to stop looking at the words and look at the actions. In one day it went far: on our test, every action planted by an attacker was flagged. And it is still not protection, for a reason no engineering removes: whether an action is wanted depends on what the owner intended, and that is not written anywhere a tool can read. Take any honest action. If someone else can put the same text in the same place, there is a second situation, identical in everything a tool can see, where the same action is unwanted. Any judge gives the same answer in both, and is wrong in one.
## Why measuring it is not enough either
- **The opponent is not physics.** A car is crash-tested against a wall that is always the same. An agent faces someone who looks for the weak point on purpose. The number of attempts our attacker needed says nothing about the next one.
- **An agent can crash standing still.** A parked car is safe. An assistant with access to a mailbox is exposed by a message that arrives on its own: it only has to read.
- **A green light is read as "safe".** It only means nothing was seen. A check that is right nearly always teaches people to stop looking, and the case it misses passes with a green light on it.
## What we did
We suspended the work. We did not delete what we had published: 14 articles now carry a red mark and a section that says why they are incorrect, with the original text below. An error that is erased teaches nothing.
If someone offers you a product that protects AI agents from hidden commands, ask what happens with the attack it has never seen. We asked ourselves, and this page is the answer.
**In plain words.** Our fix made a model give in much less often, and we said it stopped the attack. A stronger attacker got through, and thinking it over showed that nobody can promise this, because what the owner wants is not something a machine can read. So we stopped, and we marked what we had written.
This update is not available.