Arthur Mota

Global Macro Strategy | #rstats | all opinions are my own.

[Arthur Mota @ArthurMotaSP]

@alex_prompter fable is a V8 drinking gas in terms of token usage

[Arthur Mota @ArthurMotaSP]

@ModeledBehavior bold

[Arthur Mota @ArthurMotaSP]

@NickTimiraos where's his super saiyan edit?

[Arthur Mota @ArthurMotaSP]

If I were a PSG fan, I'd be shiting my pants right now. 90 minutes with 1-0 is a looong journey in Munich right now.

[Arthur Mota @ArthurMotaSP]

Wasn’t that much from the ground

•Miran shifted from four cuts to three for 2026 but remains the most dovish voice on the Committee, driven by his “I don’t see the point of waiting” framing rather than a different forecast; naive Taylor rule still suggests policy should be below neutral, but he stops at neutral as a risk management decision given war uncertainty.
•Classical look-through framework on the Iran energy shock: monetary policy affects the economy with a 12-18 month lag, so unless the war moves inflation expectations beyond the one-year horizon (no evidence in surveys, swaps, or TIPS) or wages accelerate (no evidence given labor market state), there is no reason to respond hawkishly; if oil stays elevated without raising forward inflation, he becomes more dovish because of the labor market drag.
•Strong pushback on the tariff-driven goods inflation narrative: comparing US core goods to imported core goods shows no difference, and US core goods CPI does not stand out from other countries on an unlabeled chart; he attributes core goods pressure to a six-year shift in supply chains (sanctions, export controls, critical minerals) that has been sloppily attributed to tariffs.
•Neutral rate estimate at the low end of the FOMC range, around 2.5% to 2.75% nominal, with policy roughly a percent above neutral; AI boosts neutral but population growth dynamics from border policy U-turns and improving national savings drag it down; labor market continues its three-year gradual cooling trend with no evidence of reversal.
•flagged private credit as the key blind spot in standard financial conditions indices, contributing roughly $200 billion per year (two-thirds of a point of GDP) in marginal credit growth not captured in public-market FCIs.

[Arthur Mota @ArthurMotaSP]

Dudley and Ma'am Lagarde are now here at the IMF

[Arthur Mota @ArthurMotaSP]

@DannyDayan5 1y Umich inflation expect mirrors the oil/gasoline level.. never that much insightful for future inflation. 5y maybe, but an aggregation of 5y inflation expec is better ... it's not on target, but it's pretty similar to the past 2-3y (and w/ no room for rate cut at this point)

[Arthur Mota @ArthurMotaSP]

Don’t be misled by the downward surprise in the Core CPI (20 bps vs. 27 bps in my projections). Most of the surprise came from primary rent (19 bps vs. 29 bps proj.).

The weakness in primary rent reflects the residual distortion from the October shutdown, which contaminated the BLS’s six-month rotating panel. In April, the BLS introduces a new sample that replaces the affected cohort, which should correct the downward bias that has been accumulating since the shutdown.

The weak rent reading in March is the last month carrying this distortion, not a shift in the housing market trend.

[Arthur Mota @ArthurMotaSP]

this is huge

[Alex Prompter @alex_verem]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[Arthur Mota @ArthurMotaSP]

@NickTimiraos @AnnaEconomist has also written about it as well

[Arthur Mota @ArthurMotaSP]

well....

[Arthur Mota @ArthurMotaSP]

Why should I keep my ChatGPT subscription at this point?

[Arthur Mota @ArthurMotaSP]

There's a whole generation of interns who have never seen Italy play in the World Cup

[Arthur Mota @ArthurMotaSP]

@darioperkins RIP

[Arthur Mota @ArthurMotaSP]

I feel bad when 5h go by and I haven't used up my Claude usage limit

[Arthur Mota @ArthurMotaSP]

@darioperkins maybe the issue was your input or prompt?

[Arthur Mota @ArthurMotaSP]

@DeItaone Schnabel hammer

[Arthur Mota @ArthurMotaSP]

@jeuasommenulle *in Miami

[Arthur Mota @ArthurMotaSP]

Bad but maybe less severe and more temporary than the Russia-Ukraine conflict

[Arthur Mota @ArthurMotaSP]

Powell- The forecast is that we will be making progress on inflation.
Not as much as we hoped
So if we don't see that progress.
Then you won't see the rate cut.