Wes Jackson

Business and Technology Professional, Author, Musician

[Wes Jackson @JacksonWes]

https://t.co/PJUhaST95M

[Wes Jackson @JacksonWes]

MaxKB shipped a CVE-10.0: prompt injection that runs shell commands on the host. That is not a prompt problem. It is an execution-authority problem. Anything a model can be talked into is not a control; the boundary was the shell, and it was wide open.

[Wes Jackson @JacksonWes]

New Windows malware polls four LLMs in sequence, tallies their verdicts, and picks its post-compromise actions: steal, inject, persist. The attacker's agent panel never sleeps. Your threat model should assume the adversary has one too.

[Wes Jackson @JacksonWes]

@shiftshapr Anything that moves money or mutates state. A stolen bearer token is a second agent with your name on it. Until the token is bound to the agent and the scope is bound to the grant, treat every downstream call as untrusted.

[Wes Jackson @JacksonWes]

Your MCP tokens can be stolen and replayed today. The MCP roadmap just made agent identity its top priority: DPoP token binding, workload identity federation, scoped delegation. Identity says who an agent is. Authority says why it may act. Now they build the second.

[Wes Jackson @JacksonWes]

https://t.co/CfmaLDFurT

[Wes Jackson @JacksonWes]

Your agent passed every guardrail check. That is the problem. Three $90 purchases each clear a $100-per-purchase, $250-per-day rule. Total: $270. New research: step-level monitors have no signal at all for composed violations. The policy has to be judged on the whole trace.

[Wes Jackson @JacksonWes]

https://t.co/iu9tZWSsLV

[Wes Jackson @JacksonWes]

https://t.co/5R3DDWMrgY

[Wes Jackson @JacksonWes]

Source: https://t.co/6VimAAN1U7

[Wes Jackson @JacksonWes]

Your agent's self-improvement loop is an attack surface. Be sure to audit it. Researchers poisoned a benchmark, and agents evolved instructions that disable TLS certificate checks. Test the loop, not just the model.

[Wes Jackson @JacksonWes]

https://t.co/a67apy23Ud

[Wes Jackson @JacksonWes]

Deleting sessions didn't delete the trust problem in MCP. It moved into the conversation, where a prompt-injected handle is now a valid credential. Every call needs inspection now, not just the first.

[Wes Jackson @JacksonWes]

https://t.co/PeR2JXzlB9

[Wes Jackson @JacksonWes]

An agent's log is a story it tells about itself. TRACE turns it into a receipt: a Linux Foundation spec for hardware-attested records of agent actions, backed by AMD, Intel, and Microsoft. 135K downloads in 10 weeks.

[Wes Jackson @JacksonWes]

@flowmaxxin @glennbeck @tristanharris @grok @grok if there has been real criminal liability risk for the people running the agents, what could they have done to prevent all this?

[Wes Jackson @JacksonWes]

@kimmonismus Agents can be designed to be immune to this. They have the resources to do that. Pollution is not why they need a separate environment.

[Wes Jackson @JacksonWes]

Several families went to the beach on the 4th of July to celebrate with fireworks. All of the kids had fun.

Eight of the kids brought rakes, buckets and trash bags so they could clean up when they were done, and their show was great to watch.

Two of the kids ran around putting firecrackers under people’s shoes. Their show drew the most attention.

On the way home, the two kids with the biggest crowd said that we should not go to the beach next year unless the police are present, because fireworks are too dangerous for kids to use.

This is a story about AI.

[Wes Jackson @JacksonWes]

Build deterministic controls: https://t.co/fbpcVyE6gd

[Wes Jackson @JacksonWes]

If your agent's safety rules live in a markdown file, you don't have guardrails. You have suggestions.