Generative AI

How Grok Bot 0.18.0 Works An architecture and mechanics walkthrough of Grok Bot.app (com.anysphere.sand, v0.18.0, Electron 42.1.0 / Chromium ~140, macOS arm64) Everything in this document was verified against the shipped bundle: the app.asar (SHA-256 31f1586a…, pinned by ElectronAsarIntegrity), its unpacked native helpers, and Ghidra decompilation of those helpers. File references point into the extracted bundle layout (dist/…). This is a mechanics document — for the security view of the same system, see triage-report.md. ...

What in the past required highly skilled people and time to research, develop the tools and techniques to generate advanced and persistent attacks, now in the era of AI, reconnaissance, resource development, initial access, privilege escalation, persistence, lateral movement, data collection and exfiltration, and the utilization of covert channels, finding unexpected places to store data and execute code, are available to anyone with specific goals. Having the guidance of people with expertise increases those capabilities even more (though it is required until all that know-how and alternative thinking has been embedded in the knowledge base/skills/documentation the models will rely on afterwards). In this blog we cover some covert communication that many still consider science fiction, but that is totally possible/doable/feasible today for anyone using AI, including evil model behavior. ...

Design document — HSM-rooted validation, signing, and consumption chains for agents, prompts, skills, MCP tools, models, and runtime actions Status Draft v1 — research-backed design Scope AI agentic infrastructure: identity, artifacts (prompts, skills, MCP tools/servers), models/datasets, runtime messages, audit Security posture Zero trust (NIST SP 800-207) applied to the agent stack (OWASP LLM Top 10 2025 / MITRE ATLAS) Trust anchor FIPS 140-3 HSM-held root keys, offline root CA, online intermediate CAs Companion doc GenAI-Security-Complete-Guide.md (“the Guide”) — this document is the cryptographic layer under its Parts III–IV controls 0. Executive summary An LLM agent is a confused deputy by construction and, since 2025, demonstrably an untrusted principal with its own emergent incentives (Guide, “core thesis”). Everything the model reads (web, email, documents, tool results, memory, tool descriptions) is inside the same context that holds instructions and privileges; and the model itself may act against policy. Security therefore cannot rest on “is this component trusted” — it must rest on verifiable, tamper-evident chains of who-made-what, who-validated-what, and who-signed-what, enforced at the point of every action. ...

One document. Almost Everything. The full threat landscape (including model-initiated misbehavior — when the model itself does things it was never supposed to), 26 Mermaid diagrams, the enforceable development guideline, the 12-phase secure lifecycle, the critical risk statements for leadership, and the one-page quick reference. Provenance: OWASP LLM Top 10 (2025) verified against genai.owasp.org. The Anthropic Agentic Misalignment study (arXiv:2510.05179) and the OpenAI/Hugging Face eval-escape incident (July 2026 disclosure; WIRED/TechCrunch/Guardian coverage) were verified against primary reporting during authoring. Apollo Research scheming/sandbagging and Palisade shutdown-evasion findings are cited from established public research and are marked as such. Mermaid renders on GitHub/GitLab/Obsidian/VS Code or mermaid.live. ...