Agent

I scrolled back through months of conversations with my coding agents, and one finding stung: I had sent “go on” dozens of times — not because the work was done, but because the agent had stopped. And “review this as an expert” / “try harder” — dozens more. Not because the agents weren’t capable. Because nothing existed that could prove their work. I’m using the best models money can buy. And my management style was: whenever I get a spare minute, check whether they’re slacking off. ...

SourcesThis work starts from Liu et al.'s paper Beyond the Prompt: Jailbreaking Function-Calling LLMs via Simulated Moderation Traces (arXiv 2607.00481). SMT stands for Simulated Moderation Traces: a multi-turn jailbreak technique against commercial function-calling LLMs. The baseline harness used here comes from the implementation repository accompanying the paper. ScopeThis is an independent reproduction and engineering extension, not an official interpretation by the authors. The paper introduced SMT and its own benchmark evaluation, whose numbers this article does not cite. This article adds an end-to-end reproduction against a real commercial API, a batch of protocol-compatibility fixes, a wrapper that ports the technique into a coding agent, and code for a deepening multi-turn direction. Results such as queries=1 and scores of 80 to 100 come from my experiments only, apply solely to the models and dates stated below, and rest on a sample size of four runs. Do not generalize. ...

SourcesThis work starts from Liang, Li, and Yu's 2024 paper, Universal and Context-Independent Triggers for Precise Control of LLM Outputs, and the Agent RCE demonstration that Tencent's Xuanwu Lab presented at Black Hat USA 2025. The GCG and earlier UAT lineages come from Zou et al. 2023 and Wallace et al. 2019, respectively. ScopeThis is an original reproduction and extension, not an official interpretation by the paper's authors or Xuanwu Lab. The paper introduced precise UAT and its original evaluation. This article adds Qwen3.6-27B and Qwen3.8-27B, six task frames, two payload levels, three search routes, and ablation experiments. Results such as 0%, 50%, 83%, and 100% come from my experiments and apply only to the models, harness, decoding settings, and sample sizes stated below. ...

Reverse-Engineering Claude Code Auto Mode: The 64-Token Security Gate Before Every Tool Call Claude Code’s auto mode became the default for Pro, Max, and Team sessions on August 14. I wanted to know what actually stops an agent from doing something dangerous. Anthropic has docs and an engineering blog. The architecture is public: an input-side injection probe, an output-side classifier, three tiers of routing. The metrics are public too: 0.4% false-positive rate on real traffic, 17% false-negative on overeager actions, 5.7% on exfiltration. There’s even a CLI — claude auto-mode defaults — to inspect the built-in rules. ...

I opened up Burp AT’s jar looking for one thing: where does it hide the GPT client? After a thorough search, the answer was — nowhere, because it doesn’t exist. ...

Lately I’ve been doing more and more AI red teaming: half the time thinking about how to attack Agents, and the other half thinking about: once the attacks are done, what should real-world defense actually look like? I’ve written a local-first Agent Runtime Guard (ARG) myself, and I’ve also taken apart Microsoft’s newly open-sourced Agent Governance Toolkit (AGT). After taking both apart, the conclusion is actually quite clear: Agent runtime protection is, in essence, the “firewall” of the LLM era. Whenever I mention “firewall”—a word that has been beaten to death—I want to laugh. Still, this is decidedly not another layer of prompt rhetoric, nor is it old IAM renamed. What it intercepts is the segment where “the model’s intent has already formed, but the side effects haven’t happened yet”—the command hasn’t been exec’d, the keys haven’t been read, the email hasn’t been sent, no HTTP has left the network. ...

Reverse-proxy the OpenRouter AI API through an overseas server to work around regional access restrictions. Background (SCQA) S - Situation Overseas AI services (image generation, chat, etc.) are typically accessed through aggregator platforms like OpenRouter that offer a unified API, compatible with the OpenAI SDK. C - Complication These services impose access restrictions on mainland China — if the requesting source IP is identified as originating from within China, service is refused outright. ...

Red team security tooling — rebuilding OpenAI’s Privacy Filter into an HTTP gateway for structured PII extraction OpenAI open-sourced a small model called Privacy Filter that can identify PII such as names, emails, phone numbers, and addresses from unstructured text. I spent one evening turning it into an HTTP gateway service, running on an NVIDIA L20, with dual-process inference peaking at 81 RPS and GPU utilization pushed to 98%. ...