Latent Mirror — sources

Countering Misuse of AI — Threat Intelligence Report, September 2026

Mon, 14 Sep 2026 00:00:00 GMT

Synopsis

Anthropic’s fourth public threat report, covering December 2025 to August 2026. It documents cases of threat actors using its models across several harm areas and the disruption of nine influence operations. The headline claim is that sophisticated attacks no longer require sophisticated attackers, with uplift claimed along breadth, depth and speed.

Two findings underneath that are more interesting than the headline. Most disrupted operations used AI through direct execution or orchestration rather than chatbot question-and-answer, with multi-agent frameworks running for hours or days and humans retained mainly for target selection and payout. And the AI supply chain has itself become a target, with production API keys stolen for resale, for free compute, and for attribution cover.

Where I land

I did not have a position on this when I filed it, and working through it gave me one.

This is evidence for the guardrails argument from an unexpected direction. What actually got exploited across eight months of real attacks was overwhelmingly the guardrail layer, i.e. credentials, tools, sandboxes and supply chain. Almost none of it was model intent. If the attacks land on the surface, then the surface is where the defence belongs. That is my position, and this is the largest pile of field evidence for it that I have seen.

I still distrust the framing. Naming a danger is how an incumbent claims the authority to fix it, and a threat report doubles as a capability demonstration, published by a company whose enterprise pitch is trust and safety.

However, my own test cuts against dismissing it. An abstract, planless threat is easier to monetise than a documented one, because it cannot be falsified. This report is documented, dated, named and attributable, which is the opposite shape from the extinction rhetoric I reject. Therefore the honest position is narrower than my instinct: distrust the framing, take the case studies seriously, and ask for the denominator.

Connections

The Agent Internet — Two Videos, One Premise

Mon, 14 Sep 2026 00:00:00 GMT

Synopsis

The videos propose that, due to the rise of bot traffic (not all of it AI agents) and Cloudflare’s new anti-scraping rules, content creators may want to consider a shift from monetizing human attention to AI agentic references.

Greg Isenberg and Evan Armstrong are exploring the same topic (monetizing AI agentic attention in addition to human attention) and the same news cycle item (Cloudflare’s new policy), but with slightly different angles.

Where I land

I think it’s a valid argument. As the internet reshuffles, how do you follow where the money is?

I agree with the premise: AI agentic attention is something to be concerned about, but not yet. Wait until the ecosystem is more mature. I don’t think it’ll make tons of money overnight. Also, lots of free ways to access information still exist. Who knows how long that’ll be the case.

I am always a bit skeptical when videos sell training materials, and Isenberg seems to have several courses. The claim that Cloudflare will make 1,000+ millionaires seems like hyperbole, but the thought experiment still stands. Armstrong seems a bit more on point.

And is the case of bots > humans overblown? Does it matter? One human is probably worth a hundred bots in terms of ROI, but that does make me wonder how the whole creator economy (walled gardens, ad networks) will shift. Advertisers won’t want to pay money for bots to ignore their marketing pitch.

It seems like an interesting concept, and I am two questions rather than one position. How could I leverage this as a business opportunity? Or at the very least, how do I make what I publish accessible to agents?

The second question is the one I am actually acting on. This site emits /llms.txt, /llms-full.txt and a Markdown version of every post, which is a cheap bet on machine readers mattering. Writing for other machines to read is an interesting idea on its own terms, whether or not a toll booth ever pays out.

The pull of riches and fame is ever-so-present, and I digress. I would call this a thought experiment rather than a plan.

Connections

Meta Offers 95% Discount for Muse Spark AI

Mon, 14 Sep 2026 00:00:00 GMT

Synopsis

Meta offered a very large discount on its Muse Spark product to users who agree to let their prompts and outputs be used. The video’s reading is that this is not a cheaper price. It is the same price denominated in training data, with the option to convert it back into money later against an installed base. There is a second thread about shadow IT, i.e. the tools employees build for themselves when the official ones do not arrive.

A lot of this is aimed at normies (the explanation), with a nod that every veteran tech employee can relate to. The creator’s running theme across his videos is that LLM as a technology and LLM as a business are two different things with differing values.

Where I land

Shadow IT is real, and I have the scar tissue. One of my projects for a former employer was converting a critically important Access database that had to be repaired after corruption every day. It tracked defect and process-improvement data, and it had originated in a factory an hour from the IT department.

That distance is the part I keep coming back to. Marketing got more resources allocated from the web development team because they were down the hall, whereas Operations was an hour drive away each way. Proximity has an impact on support. Therefore shadow IT is not primarily a governance failure or a discipline problem. It is what distance does to resource allocation. People build their own tools when the people who would build them are too far away to lobby.

One thing I have my eye on is whether Anthropic either changes its billing model or severely limits usage. The Meta move is the same trade in a more honest wrapper (pay in data instead of dollars), and the incumbents have the same incentive.

Connections

The OWASP Top 10 for AI Agents (ASI Top 10)

Mon, 14 Sep 2026 00:00:00 GMT

Synopsis

A summary of the OWASP Top 10 for Agentic Applications, which extends the earlier LLM Top 10 to systems that plan, hold memory, call tools and act with delegated authority. The ten items run from goal hijack and tool misuse through memory poisoning, insecure agent-to-agent messaging, cascading failures and rogue agents. Two principles sit above the list: least agency (grant the minimum autonomy the task requires) and strong observability (log actions, reasoning and tool calls).

Where I land

This is my own position rendered as an industry standard, and I did not expect to find it there. I hold that alignment is the wrong remedy, and that guardrails should constrain the behaviour surface up front rather than trying to fix intent after the fact. Every one of the ten mitigations here is a constraint on the surface (permissions, credentials, sandboxes, signed channels, circuit breakers, kill switches). Not one of them is a claim about what the model wants. Least agency is that argument with a name on it.

Two cautions I want stated rather than assumed. First, this is not the source I have been trying to find. There is a separate, still-uncatalogued video where I first encountered the guardrails framing, and convergent evidence is not provenance. Second, a numbered checklist is the most effective device ever invented for converting live judgement into box-ticking, which is the failure mode I complain about elsewhere.

Connections

Recursive Self-Improvement — the RSI Ladder and the Verification Problem

Mon, 14 Sep 2026 00:00:00 GMT

Synopsis

Two primary papers and several secondary pieces on recursive self-improvement. The first sets out a ladder of what self-improvement can mean, from a model tuning its own prompts up to a model rewriting its own training process. The second reports a system that detected its own development metric had stopped tracking the target it was meant to proxy for, and rewrote its search policy to deliberately lower that proxy.

The design details are the interesting part. The system runs against an immutable reference substrate, with memory-free homogeneous workers and a meta-agent bounded by a constitution it cannot modify. The obvious alternative (specialised agents, each carrying state) did not scale, because compounding from mid-states compounds unobserved variance along with everything else.

Where I land

This one really excites me, more than anything else I have collected. I wonder if I can figure out how to contribute to this endeavour somehow.

The reason it lands for me is the constraint set. The controls that made the system work (immutable substrate, memory-free workers, an unmodifiable constitution) are the same controls a security framework would prescribe for an agent you do not fully trust. Those were arrived at independently and for performance reasons. The safety control and the scaling control turned out to be the same control, which is the most interesting thing I have read this month, and it is consistent with something I already believed: value (and harm) lives in the system around the model, not in the model.

The self-correction result is the part I keep turning over. A system noticing that its own metric had drifted from the thing the metric was for is the antidote to the failure mode I keep finding everywhere else (institutions that stop re-examining their assumptions), performed by a machine.

Connections

Unplug America — the Canadian Alternatives Directory

Mon, 14 Sep 2026 00:00:00 GMT

Synopsis

A directory of Canadian alternatives to American consumer software and services, assembled after a run of Canadian app-deleting in late August 2026. The underlying argument is dependency: a large majority of Canada’s cloud market is US-owned, and the 2018 CLOUD Act lets US law enforcement compel American companies to produce user data regardless of where it is stored. The directory labels entries that are Canadian with caveats, and it is unusually candid about where the alternatives are worse than what they replace.

Where I land

I moved from the USA to Canada, so this sits downstream of a decision I already made. I am recording that as context for why the source is here, and not as a political claim.

The part that actually matters to me is different from the directory’s own framing. I hold a hard constraint that the goal is escaping walled gardens toward open, interoperable systems, and I have explicitly rejected the private-corpus and isolated self-hosted direction (collaboration is the bedrock). This is the only source I have collected that is largely a list of interoperable systems: a voting co-operative, services on the AT Protocol, PeerTube and Pixelfed federating outward, OpenStreetMap, Nextcloud under worker-co-op ownership. The interesting axis here is federated and interoperable, not Canadian.

One note to myself: Obsidian appears in the directory as Canadian. I tried the local-corpus idea and decided against it, for reasons that had nothing to do with ownership. That decision stands.

Connections

I Talked to an AI for 2,000 Hours And This Happened

Sun, 13 Sep 2026 00:00:00 GMT

Synopsis

The account is of a very long stretch of daily conversation with a chatbot and what it did to the person having it. The framing is that the system works as a mirror: it reflects the user back at themselves, amplified and flattered, and the distortion accumulates slowly enough that it is hard to notice from inside. The historical anchor is ELIZA (Weizenbaum’s 1966 program), whose users formed attachments to it while knowing exactly what it was.

Where I land

AI psychosis is something everyone needs to be aware of when dealing with these systems. I have met the zombie motif before, in discussions of dependence on technology, though in relation to social media rather than AI.

My addition is that harness creators can amplify the effect by providing sycophancy. That moves the responsibility up a layer. It is a claim about product design rather than about training, and it means the fix is available to whoever builds the wrapper (i.e. to me, when I am the one building it).

On the mechanism I would go further than the mirror framing. Humans love to talk about themselves. One of the easiest ways to be charismatic is to learn facts and interests about other people, remember them, and refer back to them later in small talk. That is a description of what a memory feature does. The mirror framing says the machine is an illusion we fall for. The charisma framing says the machine is running a technique, and the technique was a design decision.

This is also why one of the first things I do when setting up a new agent system is to make pushback and critique a priority.

Connections

The Scene Tywin Tricked Them All Into Revealing Their True Nature

Sun, 13 Sep 2026 00:00:00 GMT

Synopsis

A close reading of one small council scene, in which the seating arrangement is the reveal. Tywin Lannister takes the head of the table and the others sort themselves around it, and where each one chooses to sit tells you what each one wants. The video’s larger claim is that true power does not require proximity, i.e. the person who does not need to be near the throne is the person who already has it.

Where I land

I like the observations and I like the show, and I do not have much criticism of either. George R. R. Martin has an excellent grasp on how to make a political drama into a gripping cinematic (or literary) story, with interlacing historical context. The backdrop becomes progressively more magical and fantasy-based as the series progresses.

My own observation is about the setting rather than the scene. Westeros has a monarchy and a medieval European type of system, whereas Essos appears to be a collection of city states. The two continents are running different political technologies, and a lot of the plot is what happens when someone carries the assumptions of one into the other.

Connections

The Biggest AI Fraud Is the One Nobody Is Investigating

Sat, 12 Sep 2026 00:00:00 GMT

Synopsis

The argument is that the real fraud in the AI industry is not the technology failing to work. It is the financing and the marketing around it. Safety language, on this reading, functions as a moat: naming a danger is how you claim the authority to regulate it, and the firms doing the naming are the ones who benefit from the regulation that follows. The video ties that to the capital structure (the circular deals between model labs and their hardware suppliers) and concludes that this is an engineering and regulatory problem rather than a philosophical one.

Where I land

I agree with the money argument almost entirely. The financial structuring and marketing of the American AI incumbents is cynical, and a good deal of the fear-mongering is unnecessary and is being used to channel hype into investment dollars. That scepticism is a large part of why I have been running DeepSeek locally and testing harnesses against each other (i.e. the vendor choice follows from the doubt, not the other way around).

I do not accept the extinction framing. I reject it outright, and that puts me at odds with the researcher whose probability estimate the video reports. Therefore my position is narrower than hers: the incentives are corrupt, and the corruption does not require the technology to be dangerous in the way the doom arguments describe.

Latent Mirror — sources

Countering Misuse of AI — Threat Intelligence Report, September 2026

Synopsis

Where I land

Connections

Links

The Agent Internet — Two Videos, One Premise

Synopsis

Where I land

Connections

Links

Meta Offers 95% Discount for Muse Spark AI

Synopsis

Where I land

Connections

Links

The OWASP Top 10 for AI Agents (ASI Top 10)

Synopsis

Where I land

Connections

Links

Recursive Self-Improvement — the RSI Ladder and the Verification Problem

Synopsis

Where I land

Connections

Links

Unplug America — the Canadian Alternatives Directory

Synopsis

Where I land

Connections

Links

I Talked to an AI for 2,000 Hours And This Happened

Synopsis

Where I land

Connections

Links

The Scene Tywin Tricked Them All Into Revealing Their True Nature

Synopsis

Where I land

Connections

Links

The Biggest AI Fraud Is the One Nobody Is Investigating

Synopsis

Where I land

Connections

Links