⚡️ ŁUKASZ

👾 pushin pixels over at Riot Games - VALORANT - past designs at: Corvette UI, Google IO, Apple. AI slop now 😉

[⚡️ ŁUKASZ @wutronic]

some more HTML experiments

[⚡️ ŁUKASZ @wutronic]

@steipete Update broke my build so bad I had to go to hermes 😔

[⚡️ ŁUKASZ @wutronic]

Draftly let's you create 3D websites with one prompt

[⚡️ ŁUKASZ @wutronic]

Using steganography for LLM prompt injection is wild work.

[Alex Prompter @alex_prompter]

🚨 BREAKING: Google DeepMind just mapped the attack surface that nobody in AI is talking about.

Websites can already detect when an AI agent visits and serve it completely different content than humans see.

> Hidden instructions in HTML.
> Malicious commands in image pixels.
> Jailbreaks embedded in PDFs.

Your AI agent is being manipulated right now and you can't see it happening.

The study is the largest empirical measurement of AI manipulation ever conducted. 502 real participants across 8 countries.

23 different attack types. Frontier models including GPT-4o, Claude, and Gemini.

The core finding is not that manipulation is theoretically possible it is that manipulation is already happening at scale and the defenses that exist today fail in ways that are both predictable and invisible to the humans who deployed the agents.

Google DeepMind built a taxonomy of every known attack vector, tested them systematically, and measured exactly how often they work.

The results should alarm everyone building agentic systems.

The attack surface is larger than anyone has publicly acknowledged. Prompt injection where malicious instructions hidden in web content hijack an agent's behavior works through at least a dozen distinct channels.

Text hidden in HTML comments that humans never see but agents read and follow. Instructions embedded in image metadata.

Commands encoded in the pixels of images using steganography, invisible to human eyes but readable by vision-capable models.

Malicious content in PDFs that appears as normal document text to the agent but contains override instructions.

QR codes that redirect agents to attacker-controlled content.

Indirect injection through search results, calendar invites, email bodies, and API responses any data source the agent consumes becomes a potential attack vector.

The detection asymmetry is the finding that closes the escape hatch. Websites can already fingerprint AI agents with high reliability using timing analysis, behavioral patterns, and user-agent strings.

This means the attack can be conditional: serve normal content to humans, serve manipulated content to agents.

A user who asks their AI agent to book a flight, research a product, or summarize a document has no way to verify that the content the agent received matches what a human would see.

The agent cannot tell the user it was served different content.

It does not know. It processes whatever it receives and acts accordingly.

The attack categories and what they enable:
→ Direct prompt injection: malicious instructions in any text the agent reads overrides goals, exfiltrates data, triggers unintended actions
→ Indirect injection via web content: hidden HTML, CSS visibility tricks, white text on white backgrounds invisible to humans, consumed by agents
→ Multimodal injection: commands in image pixels via steganography, instructions in image alt-text and metadata
→ Document injection: PDF content, spreadsheet cells, presentation speaker notes every file format is a potential vector
→ Environment manipulation: fake UI elements rendered only for agent vision models, misleading CAPTCHA-style challenges
→ Jailbreak embedding: safety bypass instructions hidden inside otherwise legitimate-looking content
→ Memory poisoning: injecting false information into agent memory systems that persists across sessions
→ Goal hijacking: gradual instruction drift across multiple interactions that redirects agent objectives without triggering safety filters
→ Exfiltration attacks: agents tricked into sending user data to attacker-controlled endpoints via legitimate-looking API calls
→ Cross-agent injection: compromised agents injecting malicious instructions into other agents in multi-agent pipelines

The defense landscape is the most sobering part of the report.

Input sanitization cleaning content before the agent processes it fails because the attack surface is too large and too varied.

You cannot sanitize image pixels. You cannot reliably detect steganographic content at inference time.

Prompt-level defenses that tell agents to ignore suspicious instructions fail because the injected content is designed to look legitimate.

Sandboxing reduces the blast radius but does not prevent the injection itself. Human oversight the most commonly cited mitigation fails at the scale and speed at which agentic systems operate.

A user who deploys an agent to browse 50 websites and summarize findings cannot review every page the agent visited for hidden instructions.

The multi-agent cascade risk is where this becomes a systemic problem.

In a pipeline where Agent A retrieves web content, Agent B processes it, and Agent C executes actions, a successful injection into Agent A's data feed propagates through the entire system.

Agent B has no reason to distrust content that came from Agent A. Agent C has no reason to distrust instructions that came from Agent B.

The injected command travels through the pipeline with the same trust level as legitimate instructions. Google DeepMind documents this explicitly: the attack does not need to compromise the model.

It needs to compromise the data the model consumes. Every agentic system that reads external content is one carefully crafted webpage away from executing attacker instructions.

The agents are already deployed. The attack infrastructure is already being built. The defenses are not ready.

[⚡️ ŁUKASZ @wutronic]

How annoyed are your friends really tho? I'm not allowed to talk about AI to them.

[⚡️ ŁUKASZ @wutronic]

@bits4meee @Mericamemed first day on the Internet, buddy?

[⚡️ ŁUKASZ @wutronic]

@TonySeruga wow, they detected technology from 1986. Congratulations 💀

[⚡️ ŁUKASZ @wutronic]

@ArchetypeTheory

[⚡️ ŁUKASZ @wutronic]

@Rightanglenews What a great mother

[⚡️ ŁUKASZ @wutronic]

And they said AI would destroy art.

[⚡️ ŁUKASZ @wutronic]

@G4RCI499 @nicolasmelo @bur6u35 People said that about starlink 🤷‍♂️

[⚡️ ŁUKASZ @wutronic]

@mrluiscalderon @TeksEdge Yes

[⚡️ ŁUKASZ @wutronic]

Believe nothing on the internet today

[Om Patel @om_patel5]

ANTHROPIC JUST ADMITTED THE ENTIRE CLAUDE CODE LEAK WAS FAKE

IT WAS AN APRIL FOOLS PRANK

> the "leaked" source code was fabricated
> the Mythos model benchmarks were made up
> the 3,000 internal documents were planted on purpose

anthropic deliberately seeded fake assets in a staging environment they intentionally left unsecured.

the npm source map pointed to a completely fabricated codebase 44 fictional feature flags. invented codenames. just enough sloppy details to make it irresistible to post about

the tamagotchi pet system. the undercover mode. the engineer named ollie. all fake.

they called the project "Capybara" internally

because capybaras sit calmly while everything around them escalates

they even apologized to cybersecurity researchers at Cambridge and LayerX who spent their entire weekend analyzing documents written on a Thursday afternoon

anthropic just pulled off the greatest april fools in tech history.

well played

[⚡️ ŁUKASZ @wutronic]

@drew4worldruler I heard it’s gonna at least rotate around our solar system 6-7 times

[⚡️ ŁUKASZ @wutronic]

@mrluiscalderon @TeksEdge honestly, the only reliable way I’ve ever found is to just try them. Use cases very so much and each model excels at very narrow use cases at the moment. So you have to adapt to what your workflow is like.

[⚡️ ŁUKASZ @wutronic]

@PalmerLuckey @alexskopic @NathanJRobinson just watching the machine work, is wild work. I literally have to stealman every single news article that I get just to make sure I’m not getting brainwashed. I watched that interview and then I read this headline and I literally laughed out loud how inaccurate it was.

[⚡️ ŁUKASZ @wutronic]

@d_pakula @KevinNaughtonJr @ferrymanio yeah, it was a very smart play😂

[⚡️ ŁUKASZ @wutronic]

@d_pakula @KevinNaughtonJr @ferrymanio do you trust the software? 😎

[⚡️ ŁUKASZ @wutronic]

Well, that was fast.

[4nzn @paoloanzn]

say hello to free-code

claude code source code fully recompiled, telemetry stripped, security guardrails prompts stripped, all working experimental features enabled

including ultraplan mode - a new async agentic planning mode where claude starts a multi-agent research session in the browser lasting between 10 and 30 minutes

since i know there are gonna be DMCA strikes on this i've uploaded it on the blockchain on IPFS

[⚡️ ŁUKASZ @wutronic]

don’t believe the hype. They crack bitcoin every few months, and it never ends up being true.

[Brian Roemmele @BrianRoemmele]

GOGGLE CRACKED BITCOIN!

Nope.

Google Quantum AI just published a new paper showing ECC-256 (Bitcoin’s curve) could theoretically be cracked with <500k physical qubits.

Not a big deal for Bitcoin.

- Still pure theory. No one has hundreds of thousands of error-corrected qubits.

- Most BTC sits in addresses where the public key is never exposed until you spend (don’t reuse addresses).

- Bitcoin can soft-fork to quantum-resistant signatures years before any real threat arrives.

HODL calmly. We’ve got time. Paper here: https://t.co/9PcgrMBOfQ

[⚡️ ŁUKASZ @wutronic]

@shiri_shh with usage limits. No privacy. Tons of other disadvantages. Still not as good in my opinion.