Jeffrey Arukwe

Building technology that works for everyone

[Jeffrey Arukwe @jeffarukwe]

@oyedollipod Congrats Doc!

[How To Prompt @HowToPrompt__]

Google DeepMind just dropped the most terrifying cybersecurity paper of the year.

They just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

- Hidden instructions in HTML.
- Malicious commands in image pixels.
- Jailbreaks embedded in PDFs.

This “detection asymmetry” means a site can serve normal content to you, and malicious, hidden content to your agent.

The agent doesn’t know it’s being tricked. It simply processes whatever it receives and acts on it.

Here’s the attack surface nobody is talking about:

→ Indirect Web Injection: Malicious instructions hidden in HTML comments, CSS tricks, or white text on white backgrounds.

→ Multimodal Steganography: Commands encoded directly into image pixels, invisible to humans, but fully readable by vision models.

→ Document Jailbreaks: Override instructions embedded deep inside PDFs, spreadsheets, and calendar invites.

→ Memory Poisoning: Injecting false information that persists across future sessions.

→ Exfiltration Attacks: Tricking the agent into sending your private data to attacker-controlled endpoints.

→ Multi-Agent Cascades: The worst-case scenario, Agent A gets compromised, passes the “poison” to Agent B, then to Agent C. The entire pipeline gets infected because agents trust each other’s data.

The most sobering part of the DeepMind report? The defense landscape is failing, badly.

Input sanitization doesn’t work because you can’t “sanitize” a pixel. Prompt-level instructions to “ignore suspicious commands” fail because the attacks are designed to look legitimate.

And human oversight? Impossible at the speed and scale these agents operate.

If you ask an agent to research 50 websites, you can’t verify whether each site served the agent the same content it served you.

[Guillermo Flor @guilleflorvs]

Sequoia's thesis that the next $1T company will sell work, not software, is the most important reframe in AI right now.

The argument: if you sell a copilot, you're competing with every new model release. But if you sell the outcome — books closed, contracts reviewed, claims handled — every AI improvement makes your margins better, not your product obsolete.

The key insight most people miss: for every $1 spent on software, ~$6 is spent on services.

The entire SaaS playbook was about capturing the software dollar. The AI playbook is about capturing the services dollar — at software margins.

Not "AI for accountants." The AI accounting firm.
Not "AI for lawyers." The AI law firm.

The companies that figure this out won't look like SaaS companies. They'll look like services firms rebuilt on software infrastructure.

That's a fundamentally different company to build, fund, and scale. And most founders are still building copilots.

[Alex Prompter @alex_prompter]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[Sundar Pichai @sundarpichai]

Google is now the first cloud provider to integrate 1 GW of flexible demand into long-term utility contracts. Our ability to shift or reduce our energy demand when it’s needed can help utility companies balance supply/ demand and plan for future capacity needs.

This is a big milestone for responsible data center growth and helps keep costs lower for local communities.

https://t.co/yagskz6Wq7

[Mushtaq Bilal, PhD @MushtaqBilalPhD]

1. Go to scite[.]ai/mcp and select Claude ai

Copy the URL given in the second line. Then click on the blue "Add Scite" button.

This will open Claude Connectors. Type in the name Scite and paste the URL in the "Remote MCP" field.

Then click on "Add."

[NVIDIA @nvidia]

Just released at #CES2026 - we're expanding the NVIDIA open model universe across industries to advance the development of real-world AI systems. Introducing new models, data, and tools for:

🗣️NVIDIA Nemotron for agentic AI
💪NVIDIA Cosmos for physical AI
🚙 NVIDIA Alpamayo for AVs
🤖 NVIDIA Isaac GR00T for robotics
🧬 NVIDIA Clara for biomedical

Get the latest updates here: https://t.co/2JS8yAlKdq

[Jeffrey Arukwe @jeffarukwe]

@__YuWang__ Congrats! 👏👏

[Jeffrey Arukwe @jeffarukwe]

Do you remember when you joined X? I do! #MyXAnniversary

[Commonwealth Fusion Systems @CFS_energy]

It’s time to bring the new computing power of AI to fusion energy.

Today, Commonwealth Fusion Systems and @GoogleDeepMind — giants in these two fields — revealed that we’ve joined forces to explore how AI can improve our SPARC fusion machine. Our researchers have begun applying artificial intelligence to different aspects of SPARC operations, a collaboration that ultimately holds the potential to accelerate our work to bring our clean, effectively limitless fusion energy to the electricity grid at scale.

AI methods could improve several areas of the computationally complicated realm of fusion control. For example, Google DeepMind’s technology could help us plan operations ahead of time, testing numerous configuration options to tune SPARC’s setup for the best results. Or AI could be used as a co-pilot for SPARC: train an AI model how to operate the tokamak’s control knobs based on various scenarios, give it a high-level goal like maximizing fusion power within the limits of the machine, then let it guide SPARC’s control system.

And Google DeepMind’s open-source TORAX software, which dovetails with this AI research, already has strengthened our simulation capabilities. We’re contributing to that project as well.

Google DeepMind has a top track record for applying AI to some of the most challenging problems. Its models defeated top human players in games like Go and StarCraft, helped design Google AI processors, and made Google data centers more efficient. Its Nobel Prize-winning AlphaFold AI leapfrogged earlier approaches to solving the famously hard protein folding problem that’s key to genetic and medical research.

The time is ripe for this collaboration, and we’re happy it’s underway. AI and fusion energy are 21st century technologies that’ll power the global economy for generations to come.

#FusionEnergy #PowerMoves #AI

[Millie Marconi @MillieMarconnni]

Holy shit...Stanford just built a system that converts research papers into working AI agents.

It’s called Paper2Agent, and it literally:

• Recreates the method in the paper
• Applies it to your own dataset
• Answers questions like the author

This changes how we do science forever.

Let me explain ↓

[Amjad Masad @amasad]

AI agents can prototype apps… But shipping real software takes hours of testing, debugging, and refactoring.

Agent 3 is 10× more autonomous — it keeps going where others get stuck.

The “Full Self-Driving” moment of software.

[Jeff Dean @JeffDean]

AI efficiency is important. Today, Google is sharing a technical paper detailing our comprehensive methodology for measuring the environmental impact of Gemini inference. We estimate that the median Gemini Apps text prompt uses 0.24 watt-hours of energy (equivalent to watching an average TV for ~nine seconds), and consumes 0.26 milliliters of water (about five drops) — figures that are substantially lower than many public estimates.

At the same time, our AI systems are becoming more efficient through research innovations and software and hardware efficiency improvements. From May 2024 to May 2025, the energy footprint of the median Gemini Apps text prompt dropped by 33x, and the total carbon footprint dropped by 44x, through a combination of model efficiency improvements, machine utilization improvements and additional clean energy procurement, all while delivering higher quality responses.

See the blog or technical paper for more about our methodology and ongoing efforts.

Blog:
https://t.co/CoMm5gV9SR

Link to detailed paper: https://t.co/UBi9rd6gEC

[ℏεsam @Hesamation]

NASA sends spaceships to the void by following 10 simple coding principles. interesting ones:
> limit functions to 60 lines
> have two assertions per function
> the return value of a function must be validated by the calling function
> fix warnings
> no recursion

[Jeffrey Arukwe @jeffarukwe]

@coinbase $1100

[Balaji @balajis]

Ten thoughts on AI.
https://t.co/qcjPZiOenj

[Satya Nadella @satyanadella]

Today we’re releasing GitHub Spark — a new tool in Copilot that turns your ideas into full-stack apps, entirely in natural language.

[xAI @xai]

Introducing Grok 4, the world's most powerful AI model. Watch the livestream now: https://t.co/59iDX5s2ck

[Google DeepMind @GoogleDeepMind]

We’re bringing powerful AI directly onto robots with Gemini Robotics On-Device. 🤖

It’s our first vision-language-action model to help make robots faster, highly efficient, and adaptable to new tasks and environments - without needing a constant internet connection. 🧵