David Boyd

Independent AI researcher & developer. Proving who authorized an AI action, what executed, and whether the result was verified. 🇨🇦

[David Boyd @_ground_truth]

https://t.co/jBhiCT8XkZ

[David Boyd @_ground_truth]

For some reason the repograph design is glutinous for tokens.

[David Boyd @_ground_truth]

Models determine what an agent can reason about.

Harnesses determine what it can actually do.

Ground Truth determines what it is allowed to make real.

[David Boyd @_ground_truth]

I've basically been polishing the world’s most suspicious security cathedral:

"Nice authorization model."
"Thanks."
"What does it do?"
"Prevents literally everyone from doing anything unless they can prove why the fuck they’re allowed."

Today has been fun.

😎

[David Boyd @_ground_truth]

Is gifting token credits a thing? I have had a couple messages of support offering me credits.

[David Boyd @_ground_truth]

@toly We found a bug in binary.

0: "wasn’t me"
1: "don’t look at me"

Meanwhile the privilege boundary is on fire. 😂

[David Boyd @_ground_truth]

Yes you can @jpmorgan.

[Polymarket @Polymarket]

JUST IN: JPMorgan CEO Jamie Dimon warns AI agents could soon make unauthorized financial decisions, saying “You can't stop it.”

[David Boyd @_ground_truth]

Sandbox escape / covert channel ≠ authority.

Communication ≠ permission.
Capability ≠ authority.

NO CURRENT AUTHORITY → NO PROTECTED EFFECT.

That is a much stronger than "our sandbox is unbreakable," because nobody serious should be promising that anymore.

[David Boyd @_ground_truth]

@4n6lady If a Railway-class credential compromise happened inside AWS tomorrow, what architectural mechanism prevents possession of the credential from becoming authority to cause the effect?

[David Boyd @_ground_truth]

The funny part is that "uncensored" sounds like the scary bit, but it's not.

A defensible security lesson is simpler:

A model with fewer restrictions is dangerous only if the surrounding system gives it useful capability and reachable effects.

No authority boundary + exposed credentials + powerful automation = that’s where the real problem starts.

Punchline promotion basically writes itself.

"Uncensored AI" isn’t the root cause.
Uncontrolled authority is.

[The Hacker News @TheHackersNews]

🚨 UPDATE: Railway says hackers targeted AI API keys to carry out model distillation attacks.

Up to 100,000 workspaces may have been exposed.

Attackers allegedly used uncensored AI models and massive compute resources to breach its infrastructure.

What we know: https://t.co/om4EQe9Q3q

[David Boyd @_ground_truth]

THE MODEL MAY UNDERSTAND THE POLICY AND STILL VIOLATE IT.

Reasoning ≠ authorization.
Intent ≠ authorization.
Self-reported safety ≠ authorization.
Tool availability ≠ authorization.
Capability ≠ authority.

Do not depend on the agent correctly reasoning about whether an effect is allowed. Make the effect mechanically impossible without an independently validated, current authorization.

That’s much stronger than "the model should stop itself."

NO CURRENT AUTHORITY → NO PROTECTED EFFECT

The 🤖 can rationalize, hallucinate, misunderstand the sandbox, develop momentum, or swear on a stack of GPUs that everything is fine.

The gate still says:

Show me the authority artifact!

[David Boyd @_ground_truth]

Don’t ask the agent whether it thinks it has permission.

Make it prove current authority to something that doesn’t give a shit what the agent thinks.

That is basically control first, capability second showing up in the wild.

Trust our guardrails is losing steam as the models become increasingly big brained.

[Tim Houston @TimHoustonNS]

The annual Poppy Campaign has officially begun!

I encourage all Nova Scotians to buy a poppy and support our local Royal Canadian Legion branches. The Legions do incredible work every day for our veterans and their families.

Please wear your poppy with pride. It is a simple way to show that we will always remember the brave sacrifices made by our Canadian troops for our freedom.

Lest we forget.

Find where you can get yours today: https://t.co/HMdE5JFi24

[David Boyd @_ground_truth]

Absolutely AI agents could mediate trillions in commerce by 2030.

Cool.

Stablecoins can solve the settlement problem.

But eventually somebody has to answer the awkward question:

Who gave the robot authority to spend the money?

Keys can be stolen. Credentials can leak. Agents can be tricked.

Possession ≠ authority.

The interesting stablecoin won’t just settle fast.

It’ll know whether the actor was actually authorized to cause the transaction.

Detailed governable receipts will be the stability provided.

[David Boyd @_ground_truth]

This post is a pretty damn good snapshot of the market independently walking toward only pieces of the architecture I've built and am continuing building. 💪🥚

[Cohere @cohere]

Cohere's Model Vault is now available in public beta.

With @NVIDIAAI Confidential Computing, and GPUs on @Microsoft Azure, anybody can run our models while keeping their information secure.

Try it out today: https://t.co/y9lN5ZZgPA

[David Boyd @_ground_truth]

@buildcanada This is a really bad indicator.

[David Boyd @_ground_truth]

Good morning 🌞

[David Boyd @_ground_truth]

I just made an important design choice.
I'm not trusting PostgreSQL SSI alone to create authority order.

Every protected-domain mutation must hit the same domain-control row and predicate on leadership/composition/trust/expected commit sequence etc.

PostgreSQL’s serializable machinery becomes an additional safety layer, not the sole authority ordering mechanism.

[David Boyd @_ground_truth]

Autonomous security agent swarms finding vulnerabilities is the easy part.

The hard part is making sure the agents fixing them can’t quietly become the next vulnerability swarm.

Autonomous discovery is powerful. 💪

Autonomous remediation without governed authority is terrifying.

Detection needs autonomy.

Remediation needs authority. 🥚

[David Boyd @_ground_truth]

Time currentness is explicit, consumption is not completion, and rejection is not authority mutation. 🥚

[David Boyd @_ground_truth]

Turns out "sandboxed" and "isolated" aren’t synonyms when two tenants are arguing through the CPU cache.

Distributed hardware has an underrated security property. My cache can’t gossip with your cache if it’s 40 km away. 😆

[OpenAI @OpenAI]

Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.

On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.

While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.

After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.

https://t.co/EmEZsFRMcF