Privacy. Security.
Human control.
How can AI handle sensitive work while people keep real control over it? Each report answers one question from primary sources. It says what we think and why, and names the experiment that could prove us wrong.
Research lines
Five questions run through our work. Each line opens with the report that asks its question, then lists the pieces that take it further. To read three, start with the pieces marked Start here. Each adds work of our own to what others have published.
Privacy
- Can AI work with sensitive information without exposing it?Sending an AI less can cut leaks, but it can also drop a fact the correct answer needs.
- When thinking is cheap, what is your data worth?We think personal records are a liability first for most firms, because anyone who gets them can sort them cheaply.
- Who keeps the record when health leaves the clinic?On our reading, a clinic record copied into ChatGPT leaves HIPAA, and only a few laws and company promises remain.
Prompt injection
- Can agents read hostile information without following its instructions?We’d let a source supply only what the trusted task allows, never a new step, destination or permission.
Human control
- Who remains in control when an agent acts?Anthropic’s telemetry showed Claude Code users approved roughly 93% of permission prompts, and a careful approval can still let a different action through.
- Who controls agentic finance?AP2’s pinned docs don’t describe revoking approved limits, so on our reading a short expiry does that job.
- Who checks the work when AI gets faster?A model can quote a rule and miss its exception, so count checking time, not just drafting speed.
Private verification
- What can we verify without recording someone’s private work?Cut an agent’s record too far, and a run that followed policy looks the same as one that broke it.
- Who checks that private AI is private?Of 17 offerings we scored, 14 use an enclave somewhere on the prompt’s path, but only five check it from the user’s software by default.
- What should an agent receipt be able to prove?A passing v0.2 check shows that keys you chose signed the receipt, not that its events happened.
- What does a receipt check actually establish?Our archived v0.1 verifier printed VERIFIED for a receipt missing most fields, though its checks proved far less.
AI defense
- Can AI defend systems without becoming another way in?We think planted log lines could make an AI defender block your payment gateway, even with a tool allowlist.
- How did a developer’s toolbox become the way into Binance?Binance’s account describes no broken cryptography, and the ledger shows its hot wallet signed 50 authorizations for the attacker’s contract.
- What access comes with an AI tool?Seven of the 50 MCP servers we read have code that names a third-party host no README mentions.
- What actually failed in a breach?In three 2023 incidents at Microsoft, Okta and Cloudflare, a credential still worked when its owner didn’t expect it to.
How we’d test it
- What would prove us wrong?Twelve reports end with an experiment that could change their view. We publish each design before any result exists.
How we source, check and correct this work, and how we use AI: How we work.
What each label above lets a piece claim, and what it can’t: Kinds of piece.