RESEARCH / METHODS & QUESTIONS

Follow the boundary.
Then follow the evidence.

My core question: when an AI system reads untrusted material, where does that content start influencing decisions made with a user’s authority?

01

Indirect prompt injection

Compare instruction-bearing sources with matched controls. Keep the visible prompt, retrieved source, prior context, and downstream values distinct.

Controlled web source
02

Connected tools & authorization

Record what the user requested, what the planner proposed, what the backend did, and what persisted. Preserve principal, account, run, and object identities.

Synthetic reconstruction
03

HTTP / API & audit analysis

Correlate requests and responses with stable IDs and native state. A status code or Activity label alone cannot establish the full operation.

Read the method

THE METHODOLOGY

Every claim needs a path
back to its source.

  1. 01Acquire & preserve
  2. 02Hash & retrieve
  3. 03Analyze with Cipher
  4. 04Challenge & correct
  5. 05Gate the claim
  6. 06Human adjudication

Preserve

Keep original bytes, hash artifacts, record timestamps and stable IDs, and document every derived view.

Separate

Retrieval is not execution. Planned operations are not backend results. Native persistence does not establish its causal source.

Challenge

Compare matched controls, retain failed tests, reject invalid joins, and leave unsupported stages visible.

VERIFIEDINFERENCEMISSINGCONTRADICTED

VERIFIED means directly supported within the stated evidence scope. INFERENCE is interpretation. MISSING identifies required proof. CONTRADICTED preserves disagreement. NOT_APPLICABLE marks a stage outside the test.

Method notes

A

Rendering is not instruction-following

A protocol for separating requests, rendering, ingestion, and native action.

Read note
B

Two-account action provenance

Preserving identities, confirmation state, and before/after evidence.

Read note