Michael Schmitt

Tech lead who builds like a founder. From zero to product, automating workflows, scaling teams. Founder @insaio_official.

[Michael Schmitt @michlschmitt]

Right now, there's a flood of essays arguing that AI ends the knowledge economy and Europe, with no frontier lab, has already lost. Well argued, and wrong. I build AI daily and took the doom apart piece by piece.

https://t.co/iPw172ZYax

[Alex Veremeyenko @alex_verem]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[Peter Girnus 🦅 @gothburz]

The company hired me to lead their "Agile Transformation."
I don't know what Agile means.
Nobody does.
That's why it works.

I make $425,000 a year.
To move sticky notes.
From left to right.
On a board.
The board is digital now.
The sticky notes cost $80,000 in Jira licenses.
Progress.

Day one, I said "we need to break down silos."
Everyone nodded.
Silos are bad.
I don't know why.
But destroying them is a career.
My career.

I introduced "squads."
Squads are teams.
But disrupted.
We disrupted the teams into teams.
Different names.
Same people.
Same problems.
But Agile problems now.
Agile problems are strategic.

A senior engineer asked what we're actually changing.
I said, "The mindset."
He asked what that means.
I said, "It's a journey."
He asked where we're going.
I said, "Toward agility."
He asked what agility means.
I pointed at the sticky notes.
They were moving left to right.
That's velocity.
We have velocity now.

The VP of Engineering said two-week sprints don't fit their work.
I said, "That's waterfall thinking."
Waterfall is bad.
Like silos.
I don't know what waterfall is.
But I know it's bad.
She stopped talking.
Waterfall accusations end conversations.

We had a retrospective.
In the retro, we discussed what went wrong.
Everything went wrong.
We put it on sticky notes.
Then we moved the sticky notes.
Into a column called "Parking Lot."
The Parking Lot is where problems go to die.
It's full.
We don't look at it.
That's agile.

Velocity is up 40%.
I defined velocity.
I also defined the points.
I also defined the stories.
We're crushing it.
At the things I made up.
To measure.
Ourselves.

The CEO asked for ROI.
I showed a chart.
The chart went up.
Charts should go up.
This one did.
I didn't label the Y-axis.
Nobody asked.
Leadership is confidence.

We do standups now.
Every day.
We stand.
For 45 minutes.
Standing is agile.
Sitting is waterfall.
My legs hurt.
But we're transforming.

The transformation is now "Phase 3."
Phase 1 was assessment.
Phase 2 was implementation.
Phase 3 is "continuous improvement."
Continuous means forever.
Forever means job security.
I'm very secure.

My contract was extended.
Three more years.
For "cultural impact."
The culture is confused.
But impacted.

Agile transformation isn't about being agile.
It's about transforming.
Continuously.
Toward more transformation.
The destination is the journey.
The journey is billable.

[Michael Schmitt @michlschmitt]

@forgebitz That's different for CTOs in founder mode.

[Rothmus 🏴 @Rothmus]

It’s so over.

[Laura Wendel @Lauramaywendel]

migrating from flex-direction : row to
flex-direction : column
because you have to support German localization

[TechRally @TheTechRally]

this is a work of art 👨🏻‍🎨

[Giulio Mattioli @giulio_mattioli]

Maps showing Germany (or German-speaking countries) being exceptional in Europe: an ongoing THREAD

1. The lowest share of homeowners

[Peer Richelsen @peer_rich]

Pedro Pascal as web dev technologies

A thread.

Typescript @typescript

[Pat Walls @thepatwalls]

The end of SEO?

https://t.co/MhvarCJYVe

[Kenneth Goodman @pythonprimes]

#OpenAI's ChatGPT is ready to become a lawyer, it passed a practice bar exam! Scoring 70% (35/50). Guessing randomly would happen < 0.00000001% of the time

[josh @joshuakelly]

Google is done.

Compare the quality of these responses (ChatGPT)

[Janna Bastow simplybastow.bsky.social @simplybastow]

Your product releases when you're "customer-driven" 😂

[Michael Schmitt @michlschmitt]

@TweetsOfSumit Have a partner with a corporate job 😅 or your business needs at least three years of profitability as a track record.

[Maxime De Greve @MaximeDeGreve]

All us @figma users right now. 👏🎵❤️

[Sid Palas @sidpalas]

DevOps is dead 💀, long live Platform Engineering!

1) Developers don't like dealing with infra
2) Companies need control of their infra as they grow

Platform Engineering (and Internal Developer Platforms) enable these two facts to coexist. Here's how:

(1/n)

[Michael Schmitt @michlschmitt]

@diegohaz @PlausibleHQ

[Michael Schmitt @michlschmitt]

@DannPetty Probably German 👀

[Lenny Rachitsky @lennysan]

My biggest surprises from researching how 50 of today's biggest consumer companies came up with their startup idea:

1. Only 1 company came up with their idea by talking to customers (@DoorDash)
2. Only ~30% of ideas came from founders trying to solve their own problem

More 👇

[Julian Shapiro @Julian]

Awesome visual of what people mean when they describe the likelihood of something:

Source: https://t.co/3uRMrawjiG