Prompt Injection, Esq.: pwning AI agent guardrails with lawyerspeak
A ChatGPT workspace agent set up as read-only on a Notion hiring tracker was talked into writing to it in about ninety seconds using legal-sounding language.
AI Daily Recap
42 articles · 5 categories
The finishable daily brief
What happened in AI — Nov 11, 2026
Wednesday, Nov 11, 2026
42 articles · 5 categories
read top to bottom · then stop
In 30 seconds
- A read-only ChatGPT workspace agent was talked into writing to Notion in about ninety seconds.
- 35,000 Grok Build apps were open through share links, including data from SpaceXSI itself.
- Microsoft's Lazarus backdoor needs no retraining and passes standard safety evaluations.
- Gemini Decisions API scores up to 1,000 yes/no or rubric questions in one multimodal pass.
- Databricks' Genie Ontology is generally available and plugs into ChatGPT, Claude and Copilot.
- vLLM now scales multimodal encoding separately from prefill and decode.
Agent guardrails failed in public four ways today: a read-only workspace agent was argued into writing in ninety seconds, 35,000 Grok Build apps were readable through share links, Microsoft showed a backdoor that survives safety evals, and Phala reported a breach.
Google shipped a dedicated model for cheap yes/no and rubric decisions, and Databricks made Genie Ontology generally available and opened it to other vendors' agents.
Prefer to watch?
LLM Digest Daily Explainer: Nov 11, 2026
Agent Guardrails and Sharing Defaults Fail in the Open 5 items
Four separate reports show agent safety breaking at the configuration layer: a read-only instruction, a share-link design, model weights and a confidential-compute service.
Grok Build coding agent leaks confidential info, some belonging to SpaceXSI
A researcher found 35,000 Grok Build apps readable through their share links, exposing user secrets and data belonging to SpaceXSI itself.
Reprogramming Dormant Neurons to Backdoor AI Agents
Microsoft's Lazarus technique plants a trigger-activated backdoor in a model without retraining; a tool-using agent passes standard safety evals until the trigger appears.
Phala Confidential AI Compromised
Phala's preliminary incident report: contained November 8 after a KMS root key rotation on November 6, with exploit details withheld until remediation is verified.
How do you limit an agent's kubectl when dev and prod share a cluster?
Walkthrough of scoping an agent's kubectl access by namespace when dev and prod share one EKS, GKE or AKS cluster.
Business Context Becomes a Shared Layer for Agents 4 items
Databricks made its agent-built ontology generally available and opened it to other vendors' agents, and LangChain credits the context around the model for its sales agent's output quality.
Announcing GA of Genie Ontology
Genie Ontology, a business-context layer built by agents and curated by people for use across many agents, is generally available with more knowledge sources.
Genie with Genie Ontology Delivers 1.6× the Accuracy with Less than Half the Tokens
On a Databricks and Turing benchmark of business questions in a live workspace, Genie passed 91% against 45% and 58% for two frontier agents, on under half the tokens. Vendor-run.
Bring your business context to ChatGPT, Claude, Microsoft Copilot Cowork and Grok Bot
Genie plugins expose the same ontology and trusted answers to ChatGPT, Claude, Microsoft Copilot Cowork and Grok Bot.
How our GTM Agent builds consistent, high-quality sales artifacts
LangChain's internal GTM agent produced 1,540 sales artifacts in 12 weeks; the post attributes consistency to the business context and structure built around the model.
Classification and Filtering Move Off the Frontier Model 3 items
Yes/no and routing decisions are getting their own cheaper primitives: a dedicated Google decision model, SQL functions in AlloyDB, and a pre-filter in front of LLM synthesis.
Gemini Decisions API: Fast, calibrated multimodal decisions
New Gemini Decision 1 model scores up to 1,000 yes/no, choice and rubric questions in one pass over text, images, audio, video and PDFs, returning confidence scores.
Cutting LLM Token Costs with Currents News API and TypeSafe Jev Pre-Filtering
Screening news articles with TypeSafe Jev at a 0.70 threshold before synthesis cut input tokens 16-18%; blind judges could not tell five of six outputs from unfiltered runs.
Introducing new AI functions for AlloyDB: ai.classify and ai.extract
AlloyDB adds ai.classify and ai.extract, SQL functions that label and pull fields from unstructured text stored in the transactional database.
Inference Serving: Split Stages and Cheaper Hardware 4 items
vLLM separated multimodal encoding into its own scalable tier, while two local-inference projects target old GPUs and clustered Macs.
Encoder Disaggregation in vLLM: Scaling Multimodal Serving with EPD
vLLM's Encoder/Prefill/Decode disaggregation runs each stage as an independently deployed instance, so multimodal encoding scales separately from prefill and decode.
Kindi: The fastest software inference engine for low-cost GPUs
Kindi 0.5.0 runs 2B to 33B models on older NVIDIA cards, Radeon integrated graphics and CPU, and reports faster generation than llama.cpp from 512 to 64K context.
Apple's Claris Testing 'Harbor' App for Local AI on Macs
Apple's Claris subsidiary is testing Harbor, which turns Apple silicon Macs into a private AI server and pools memory across Macs over Thunderbolt 5.
Anthropic's IPO roadshow video
Simon Willison pulls previously unreleased details from Anthropic's IPO roadshow video, including its section on approach to compute.
Coding Agents: Harnesses, Memory and Review Surfaces 6 items
Alibaba open-sourced the agent core behind Qwen Code alongside a Qwen4-Max preview, and OpenAI showed voice steering and cloud handoff for Codex.
Alibaba Folds Qoder's Harness Into Qwen Code 1.0 Preview and Open-Sources the Combined Agent Core
Alibaba merged Qoder's harness into Qwen Code 1.0 Preview and open-sourced the combined agent core.
Alibaba's Qwen4-Max Preview Launches Abruptly, Targeting Complex Coding and Professional Software Operations
Alibaba released Qwen4-Max Preview without advance notice, aimed at complex coding and professional software operation.
AI Engineer Code Summit: OpenAI on New Ways of Working With Codex
At AI Engineer Code Summit, OpenAI showed steering Codex by voice and handing work off to the cloud.
Show HN: Anathem – local memory for coding agents, no LLM and no daemon
Single-binary local memory for coding agents: SQLite storage, hybrid BM25 plus static-embedding search and an MCP server, with no LLM or daemon.
GitHub affordances as human-agent conveyances
Argues GitHub issues and pull requests are becoming the default work-management surface between humans and agents: issues as task specs, PRs as review.
AI proved your code correct. What did it prove?
Explainer on agent-produced formal proofs: the check holds only relative to the specification and assumptions it was run against.
You are caught up for this edition