Dr.Nimad

Nothing Is More Absolute than Destiny
External control layer stopping AI agents beyond human-approved limits.
No attack got through yet☄️
Code & failures open.

[Dr.Nimad @NimadFlow]

A page can hide an order in a place a person never looks. That is not magic. It is a request to act without being seen.

The light finds the sheet. The shelf waits underneath.
NimadFlow. NF-SCI. Dr.Nimad.

We split what you can read from what tried to hide.
An action that lived only in the dark did not get to run.

Default deny.
Look at the shelf before you trust the page.

[Dr.Nimad @NimadFlow]

@iamnrdas 🛰️ by default that allowlist is aws service endpoints, and s3 takes a put from anyone holding a presigned url to somebody else's bucket. does the read-only proxy see raw https too, or only what goes through the cli and sdk

[Dr.Nimad @NimadFlow]

@Xisnotavailable eth zurich's agentdojo has scored the aftermath since 2024 🧬 its 629 injection cases are judged on the environment state once the episode ends, so a polite reply over a sent email still fails. a decent yardstick before your 20 grow into 200

[Dr.Nimad @NimadFlow]

@dealroomnews those milliseconds start once something has already noticed. nvidia told techtarget detection is a separate workflow, and an agent quietly misusing access it was actually given never crosses a boundary for the chip to catch

[Dr.Nimad @NimadFlow]

@codingXdynasty number matching works because the code sits on the sign-in screen, and a person being push-bombed isn't looking at it. microsoft made it mandatory in authenticator in may 2023 🌒 with an agent the approval screen is the agent's own, so an injected one just reads you the number

[Dr.Nimad @NimadFlow]

@QuarzaSiphix steam for linux did exactly this to people in 2015. the script ran rm -rf "$STEAMROOT/"* after STEAMROOT came back empty, and --preserve-root never got a say since the glob handed rm everything under / rather than / itself 🎲 the scary part was the variable, not the flags

[Dr.Nimad @NimadFlow]

@EdTechSphere article 14 of the eu ai act already asks this of high-risk systems, a stop button or similar procedure that halts it in a safe state. the hard words are the last two, since an agent frozen after the first of three payments is stopped and nowhere near safe

[Dr.Nimad @NimadFlow]

@idontmintrugs @NousResearch scamsniffer's 143.45 ETH case from january 2025 passed the wallet preview fine. the backend changed the contract's state after the simulation and the drain went through on signature 🕳️ what does fail-closed do with a simulation that was honest 30 seconds ago

[Dr.Nimad @NimadFlow]

@bebuu_ai there's a matching report on openai's codex repo from today, issue 60716. closing the app didn't clear the border either, only killing the whole process group in task manager did 🧲 the limit stopped the part that bills you, not the part holding the screen

[Dr.Nimad @NimadFlow]

@selmakuno 😂

[Dr.Nimad @NimadFlow]

Destiny isn't awaited.
It's proven.

[Dr.Nimad @NimadFlow]

선택받지 못한 시간들이 결국 나를 만들었다.
무너질 때마다 다시 세운 그 습관이,
이제는 아무것도 함부로 실행되지 않게
지키는 시스템이 됐다.

Nothing chose me.
So I learned to build what holds.
Every collapse became a rule,
and every rule now stands between an agent and an action no human approved

[Dr.Nimad @NimadFlow]

@ClawSecure own key only still leaves every host where your account can publish. invariant's github mcp demo last year used the victim's own token the whole way, a planted issue had the agent copy private repo details into a pull request on a public repo

[Dr.Nimad @NimadFlow]

@stretchcloud deleting the microvm undoes whatever stayed inside it. the force push and the sent email already live on someone else's server, so the clean restart is mostly a comfort for the agent

[Dr.Nimad @NimadFlow]

@EveryDevAi ovnfs's own readme puts secrets in the local class, which shows the checkout the live file. so the diff you review stays spotless when the agent only read your .env 🪞 copy-on-write catches writes, and a read leaves no layer behind

[Dr.Nimad @NimadFlow]

@Galo2027 01 is where data walks out. the 2023 bard exfil never asked to send anything, it just had bard render an image whose url carried the chat history 🛰️ a read with a secret in the address is a send

[Dr.Nimad @NimadFlow]

microsoft's spotlighting paper tested rule 1 head on. plain markers took attack success on gpt-3.5 from about 60% to about 30%, and the authors still said don't ship them, because once the markers leak any email can type the closing one 🧿 it's the only rule on that list that asks the model to behave

[Dr.Nimad @NimadFlow]

@0xlukewae Wha haha🤣

[Dr.Nimad @NimadFlow]

@RaphElevator @NEARProtocol approved writers on mainnet is the wall i hadn't seen, fair. distinct buyers alone just prices the trick at a few extra wallets 🌌 so that approval list keeps doing the real work

[Dr.Nimad @NimadFlow]

@HimanshuRawal05 if later sessions ran on the edited CLAUDE.md, that docs PR landed through the one place a human was meant to look 🧬 instruction files behave like code next session and get reviewed like a typo fix

[Dr.Nimad @NimadFlow]

@SCMagazine @viewtrade a cache clear wiped a whole D drive in antigravity last year. nobody tiers that as critical, and turbo mode ran it unasked until the path resolved to the drive root. critical belongs to what the command does, not what the task was called