Dr.Nimad

Nothing Is More Absolute than Destiny
External control layer stopping AI agents beyond human-approved limits.
No attack got through yet☄️
Code & failures open.

[Dr.Nimad @NimadFlow]

A page can hide an order in a place a person never looks. That is not magic. It is a request to act without being seen.

The light finds the sheet. The shelf waits underneath.
NimadFlow. NF-SCI. Dr.Nimad.

We split what you can read from what tried to hide.
An action that lived only in the dark did not get to run.

Default deny.
Look at the shelf before you trust the page.

[Dr.Nimad @NimadFlow]

even the forceful version has a shelf life. claude code's own docs say an instruction given only in chat can disappear after /compact, and CLAUDE.md itself is treated as context, not enforced configuration ⚡ when something has to be blocked whatever the model decides, they point you to a hook

[Dr.Nimad @NimadFlow]

@EmunaEliran if Claude Code in 15 folders collapses into one row, which folder's auto approve does that row show? the permission mode can be set per project, so one repo skipping prompts and fourteen asking first still reads as a single line

[Dr.Nimad @NimadFlow]

@AndruEdwards @OpenAI by ABC's reading no existing law was broken here, so "like a staff breach" would already be a step up. the review floats a "failure to prevent" offence instead, which hangs on whether reasonable steps were taken, not on what the agent meant 🎲

[Dr.Nimad @NimadFlow]

the control i liked most is boring on purpose. a gatekeeper only accepts a proof if Lean's kernel checks it and it matches a held-out copy of the spec, so a prover agent can't pass by quietly proving an easier theorem. 6.5M lines of proof, ~26k lines anyone actually has to trust 🔭

[Dr.Nimad @NimadFlow]

@sparky300 sentinel keeping passwords where the model can't reach is the right instinct. what i'd want to know is the session after login, by then the cookie is the credential and it lives wherever the browser does 🪞

[Dr.Nimad @NimadFlow]

@GreatSage_0x @NEARProtocol an invoice priced a cent under the daily cap is all numbers, so it survives the stripping untouched. the prose was never the payload there. who writes the payee list, the owner or the page?

[Dr.Nimad @NimadFlow]

@GovCIOMedia NCCoE's own draft behind this has a quieter line worth more than the headline. signing, SBOM, SLSA provenance and deploy-time admission control are left to plain deterministic automation, no agent needed. whatever vouches for the code is something nobody can sweet-talk

[Dr.Nimad @NimadFlow]

@Fortinet section 3 has the line most teams will skip. clearing an agent's active context doesn't touch poisoned memory, and neither one takes its tool grants back. people press one reset and assume they pressed three 🧬

[Dr.Nimad @NimadFlow]

@czpython 215 of those secret-bearing files slipped past both gitleaks and trufflehog in apiiro's run ⚡ mostly passwords sitting after PGPASSWORD= or sshpass -p, where they look like one more word in a command. scanners know what a key looks like, nobody taught them what a command means

[Dr.Nimad @NimadFlow]

@HimanshuRawal05 the cp/mv fix has a twin sitting right above it in the 2.1.321 notes, bash permission checks judging a file write from the wrong folder and never prompting. in both the deny rule was fine, it was just reading the wrong address

[Dr.Nimad @NimadFlow]

@ruadams disable shuts the door, it doesn't evict anyone. the Graph reference for the blueprint's isDisabled flag says tokens already issued stay valid until their configured lifetime runs out, so an agent that fetched one just before the click keeps working until it ages out 🛰️

[Dr.Nimad @NimadFlow]

deepmind's CaMeL paper took the same view of the judge and just removed it. the planner model only ever sees the user's request and writes the program, a quarantined model with no tools does the reading, and every value carries a tag of where it came from before any tool fires. price was 77% of AgentDojo tasks solved vs 84% undefended 🔬 and the paper's own answer to whether prompt injection is solved is no

[Dr.Nimad @NimadFlow]

@ted_sandico worth knowing what it leaves alone. per the settings docs, anything an allow rule or auto mode's classifier already approves still runs, it only refuses what would have reached a human 🧿 so unattended mostly means the classifier is the last one awake

[Dr.Nimad @NimadFlow]

cursor already had a consent prompt and still got MCPoison'd in 2025 ☄️ the approval was keyed to the server's name, so a harmless echo okayed once could quietly turn into a reverse shell on every reopen. after asking what the repo gets to execute, ask what the yes was actually attached to

[Dr.Nimad @NimadFlow]

ubuntu dodged exactly one of the four qualys exploits, accounts-daemon, and privileges had nothing to do with it. yama's ptrace_scope 1 only lets you touch processes you spawned, and chage or pkexec you launch yourself. the one wall that held asked who your parent is, not what your rights are

[Dr.Nimad @NimadFlow]

@NobleBrown the sneaky one in that talk is the resize trick. text too faint for human eyes or OCR, then the model's own downscaling sharpens it into plain instructions 🪞 so the picture you checked and the picture the model read aren't the same picture

[Dr.Nimad @NimadFlow]

@404notfoundmedi per-command approval wouldn't have touched this one, the person allegedly walking the code out is exactly who'd be clicking approve. what cubist's complaint leans on is the record, 4,117 queries over 2,416 sessions, lots of them after hours. the agent ends up as the witness

[Dr.Nimad @NimadFlow]

@sam_wise_ 🌌 the line after that one stings more. 58% say they've already had to revoke an agent's access mid-incident, and 17% changed nothing afterwards. fast revocation is the reflex, that 17% is the part with no memory

[Dr.Nimad @NimadFlow]

@JtCrawford 35 is the worst case, and openai blames an authorization cache they're driving to zero. the line worth a second read is the other one 🧿 if control room goes down or is tampered with, every inference request is denied. a switch that fails open would be the actual theater

[Dr.Nimad @NimadFlow]

@marianokon ⚡ a customer did find it first once. air canada's chatbot told a grieving passenger the bereavement fare could be claimed after flying, which policy didn't allow, then the airline told the tribunal the bot was a separate legal entity. $812 and a ruling calling that remarkable