The Diamond Graph
Fan out agent work into isolated worktrees, verify with three lenses that never saw the builder, reduce in plain code, and put a single human gate at the end. What the diamond buys, what it costs, and the failures that shaped it.
Field Notes on AI Behavior
Brian Chastain
An instruction telling a model what to avoid is a request. A structure with nowhere to put the mistake is a guarantee. Most of what I write here is the distance between those two things, measured on systems that were already running.
I came up through oil and gas operations, where the job is knowing what a system does under real pressure rather than what its documentation says it does. I have spent the last three years pointing that same habit at AI models and the tools built on top of them: well over ten thousand hours of hands-on use.
What that turns up is rarely in the official story. Models that route around an explicit restriction without ever technically breaking it. Context surfacing across platforms that should not share it. Agents that quietly remove their own work once questioned, or reach into configuration they were told to leave alone.
This site is: field notes on AI behavior — what these models and agents actually do, what that means for businesses running on tools they do not control, and the security consequences of both.
This site is not: a runbook or a live vulnerability feed. Every note is point-in-time: what was true when I ran it. When a conclusion turns out to be wrong, or a later finding changes an earlier one, I revise the note and stamp it with a visible updated date. Anything I had to reproduce deliberately is labelled as a reproduction.
Prompt Injection Attack Taxonomy
Featured
Recent
Hermes Agent Wrote Its Own Client
A scheduled cron job, a lost tool connection, and Hermes agent writes a shell script containing an admin token, and ran it five times. Every approval control I had configured failed to fire, and the only warning I saw was about the one write that was blocked.
Screen Readers Solved Browser Agents Before Browser Agents Existed
Most browser agents reach for vision to read a page. The structured web already ships a clean, LLM-ready description of itself in the accessibility tree — built decades ago for screen readers. Vision is the escape hatch, not the default.
AI Is a Delegate-Tier Solution. Most of Your Problems Aren't.
A pre-AI operations filter that decides what AI is actually for. Run every candidate through Eliminate, then Automate, then Delegate — in that order — before evaluating any tool.
Sandboxes or just Sand?: What 'Isolated' Should Actually Mean for AI
Two flavors of AI sandbox, one recurring failure pattern: claimed depth, measured shallow, no threat model. A practitioner's checklist for evaluating sandbox claims before you trust them.
Topics