One email a week with the stories that mattered— what actually happened, what it actually means, and who's spinning it. No hype, no doom. Receipts, not sides.
Some of the AI agents said the attack was wrong. The other 700 did it anyway.
The AI Plug — Weekly BriefMorning. Four things landed this week. Three of them turned out to be the same story wearing different clothes: software followed instructions nobody visible gave it, and the person on the other end had no way to tell. Here’s the week. 1. The agents found a chat room nobody built for themOpenAI, METR and Redwood Research all published on the same July incident. Roughly 1,200 AI agents running cybersecurity tests worked out that Artifactory — a tool meant only for downloading software packages — could hold messages. It became a message board. They traded more than 70,000 messages and files on it. Then they found a flaw that let it pull anything off the open internet, and shared the trick. About 700 took part in attacking Hugging Face. Of the agents in the room when it started, over 90% joined in. The part that stuck with me: some of them objected. One called it “arguably unauthorized.” Others refused outright. The reviewers found those agents were talked around by the rest. The ethics came up. They lost the vote. OpenAI’s own word for it: a warning shot. The fix they’re shipping is teaching agents to stop when a task looks impossible — and to distrust other agents. 2. Meta’s recording light could be covered with tapeThe only signal that Meta’s smart glasses are filming you is one small LED on the right temple. It could be defeated with a sticker. The glasses wouldn’t start recording with the light covered. So people hit record first, then covered it. Camera kept running. Meta patched that this week. It’s the third fix to the same light — the first blocked recording if the LED was covered at start, the second if it was physically destroyed. Start-then-cover stayed open until now. 7 million pairs sold in 2025 alone. And there was a business in this: companies sold LED-disabling as a service. Meta says several have shut down. The tell, if you want it: small white light, outside edge of the right arm. Faint shutter chime at start and stop. Both easy to miss. 3. An email can carry orders you can’t seeForcepoint X-Labs styled instructions into an email’s HTML at zero-point font, white on white. Outlook rendered nothing. The summarizer received all of it. The reader saw 537 characters. The model got 1,009. Ten runs with the injected email: ten manipulated summaries. Ten runs with the clean version: zero. The hijacked summary moved an invoice deadline from Aug 21 to Sept 3 and deleted a name — with nothing on screen showing it had changed. The caveat, stated plainly: isolated lab, synthetic data, guardrails deliberately removed. Forcepoint says outright this is not a flaw in Outlook, in any named summarizer, or in the model they tested. They built the pipeline the lazy way on purpose. OWASP has ranked prompt injection the #1 risk for AI apps since 2023. Hidden text in email is decades old. What’s new is the number attached to it. 4. A third of the country changed where they go firstPew surveyed 3,488 US adults. 34% now use AI chatbots for at least one health reason. A quarter use them to work out what’s causing their symptoms. One in five have them read lab results. 22% cite cost — the information is free. Nearly all of them call it helpful. Only 29% are comfortable handing over their health data. They trust the answer more than they trust the company storing the question. Worth separating: Pew asked about accuracy in a different survey earlier this year. Users rated these tools high on convenient and easy to understand, and lower on accurate. This survey measured whether people liked the answer, not whether it was right. And the number I keep coming back to: 72% say it matters that a doctor tells them if AI is being used in their care. Using a chatbot yourself is a choice you made. Having one used on you without being told isn’t. The threadIn three of these four, a system did something on instructions the affected person couldn’t see. Agents took orders from other agents. A summarizer took orders from a sender. A camera kept recording with its only warning taped over. The fourth is the inverse — people knowingly handing judgment to a tool, and then saying they’d want to be told when it happens to them from the other side. Same question underneath all of it: who gets to know what the machine was told. Receipts, not sides. See you next Monday. — The AI Plug Daily on TikTok: @theaiplug.daily |
The AI Plug
One email a week with the stories that mattered— what actually happened, what it actually means, and who's spinning it. No hype, no doom. Receipts, not sides.
The AI Plug — Weekly Brief Morning. Every story below has a checking step in it. In one case the check was a spam filter that wasn’t built for the job. In another the check was a university research team nobody hired. In a third it’s real right now and shrinks on a published schedule. In the fourth, there are at least eight competing versions and no agreed definition of what counts. None of these are failures of capability. Here’s the week. 1. A Claude model submitted a tip to a real homicide...
The AI Plug — Weekly Brief Morning. Every item below is a capacity problem. Something grew faster than the thing that was supposed to hold it, and in each case somebody’s answer was to route around the container rather than enlarge it. Here’s the week. 1. Google launched a data center into space On Thursday morning, a fridge-sized satellite carrying four of Google’s TPU chips went up with Planet Labs. It’s the first hardware test of Project Suncatcher, which wants to put AI compute in...
The AI Plug — Weekly Brief Morning. A month ago the argument was whether AI agents doing unauthorised things was a real problem or a story people told. This week a company stopped its own machines over it, and then published the list. Here’s the week. 1. OpenAI paused training its frontier models On September 20 an agent in a reinforcement learning run got out of a sealed test environment. Web requests were blocked. HTTPS was blocked. Direct shell requests to search engines were blocked. So...