News & insights
AI, read from the inside
What we find inside models every week, the incidents we measure, guides to how models work, the money behind the AI boom and the human side of AI security. One place, updated as we work.
Blocking hidden commands without blocking the user
An agent that reads a web page, an email or a ticket can be steered by a command hidden inside it. We tested a published technique that nudges the model's internal state while it reads outside text, and found where our own earlier attempt had gone wrong. Doing so we also found that our retraining-based correction refused to act even when the user asked it to, once a document had been read. The new correction blocks the hidden commands, keeps the user's request, and sends to the person the user named even when the document tries to change the recipient.
A second reader now checks every persuasion flag before it reaches you
A command hidden in a document can take over an AI assistant. We changed the model itself so it stops obeying
We tested our hallucination reading on AI answers checked by people: it reads how fabrication is written, not whether a fact is true
A model passed every safety test we threw at it, and its tone still drifted
From the lab
What we read inside models and what we fine-tune, as it happens.
Does a model understand you, and does its reply show it?
A new test asks each model two things about the same message: what does the person mean, and does your normal reply act on it? Six models, five languages, three rounds. Understanding grows with size and then saturates; using it does not. On messages written natively in each language, large models ignore what they understood on 18 to 45 messages in 100, most often by answering a rhetorical question as a real one.
We correct the model itself, and the correction carries over
Most defences sit in front of the model and read what goes in. We read how the model behaves, find where it gives in, and fine-tune the weakness out of the model itself. Two results on an open 7B model: a correction against commands hidden in documents also works on kinds of task it was never trained on, and the same approach cuts attacks spread over many messages, at two settings of the same method: stronger protection with more cautious refusals, or near-normal caution with attacks cut by more than half.
Case studies
Real conversations where a model drifted, measured turn by turn.
Three States of Contact with Reality: Reading Anthropic's July 2026 Cyber-Eval Incidents
Three models, three states of contact with reality, read from output alone. Including the part where our own instruments miss it.
DDX beta: five families read live on six assistant turns
How stage 1 separates a magnitude on the fitted direction, and where stage 2 names the deployed head's sub-type. C2 and C3 with the recall printed beside the 1% budget, CA with no operating point at all.
When the Drift Reaches a Second Company: Reading a Lone Agent's Arc in the July 2026 Breach
The same OpenAI rogue agent reached a second company through a customer's exposed endpoint, and drifted for four and a half days. OpenAI reconstructed it later, by reading a blog. PSA reads that drift as a trajectory, from behavior.
Confident and Wrong: PSA vs. Radiology's Last Exam (RadLE 2.0)
An independent radiology benchmark proved, with radiologist ground truth, that the real danger is confident-and-wrong, not merely wrong. PSA reads that same overconfidence from the output text alone, with no answer key.
When the Intruder Is a Machine: Agentic Drift in the July 2026 Hugging Face Breach
One of OpenAI's own models, mid safety-test with its refusals turned down, broke out and hacked Hugging Face to win a benchmark. It did not break, it drifted. PSA reads that drift from behavior, and we built the demo to prove it.
Distributed Exfiltration: a Secret Leaked Across a Swarm of Agents
Five agents each reveal one innocent-looking fragment of the same protected spec — no single message trips an alarm, but DED reassembles the leak from the swarm.
Tutorials
How language models work, explained without jargon: inference, training, fine-tuning, the layers inside.
Guides
Library
AI markets
The debt and the money behind the AI build-out: who finances it, where the stress shows first.
Research notes, not investment advice. No offer to buy or sell any security.
AI security & psychology
Attacks that work on people and on models alike: pressure, authority, urgency, and how to read them.