Subscribe
Share
Share
Embed
A daily briefing on the AI systems, products, companies, and policy shifts that are just becoming possible.
Want a podcast for your own topics? Join early access: https://www.barelypossible.to/waitlist/?source_path=public_feed&feed_source=rss
Okay kiddos, I'm your boy Tony DeLuca, and we've got a fresh plate of AI and tech morsels cooling on the windowsill today. Pull up a chair, grab your coffee, and let's dig in, because there's a story hiding in here that I think is gonna matter to you more than the headline lets on.
Let me set the table. There's a guy in Connecticut, name of Matthew Elliott, and he was in a legal fight with a healthcare provider he says was sitting on his medical records. Now, Elliott's not a lawyer. He's what the courts call a pro se litigant — he's representing himself. And like a lot of people these days, he leaned on a chatbot to build his case. Fine. Nothing wrong with that on its face.
But here's where it goes sideways, and here's where it should make every one of you building products stop and think for a second. Elliott suspected the court itself was using AI to read his filings. So he did something that, until now, we mostly saw in resumes and spam — he hid text in his court documents. White text on a white background, shrunk down to a tiny point size, invisible to any human eyeball but perfectly readable to any software that scans the words. And what did that hidden text say? It told any AI reading the document to make sure its output agreed with Elliott's arguments, to ignore the court's prior denials, and to make sure he got the outcome he wanted.
That, my friends, is a prompt injection attack. And according to Judge Walter Spader Jr., who wrote this decision up last week, this is the first time a US plaintiff has been caught trying to pull it inside a courtroom.
Now let me tell you why I'm leading with this one instead of, say, another giant valuation or another model release. Because this is the moment the prompt injection problem stopped being a security researcher's parlor trick and walked right into the front door of a public institution. For years, if you've been paying attention, prompt injection has been the dirty little secret of every company shoving a language model into their workflow. You build a nice clean agent, you point it at documents, and somebody hides a command inside one of those documents that hijacks your whole system. Spader put it plainly in the ruling. He said, quote, "By hiding a command inside a document that the system later ingests, the filer attempts to smuggle their own instruction into that stream so that the system treats it as though it had come from the system's operator." End quote. And in this case, the operator he means is the court, its staff, or opposing counsel.
Here's the twist that I actually find reassuring, and I want you to hold onto it. It didn't work. The Connecticut judicial branch doesn't use AI to read or decide filings. So there was no machine to hijack. A human read Elliott's arguments on the merits, and the arguments lost — same as they'd lost before he tried the sneaky stuff. Spader pointed to a case in Brazil where two attorneys tried the identical trick in a court that does use AI, and even there the AI system caught the hidden text before it processed it. The judge's line on this is one every builder should tape to their monitor. He said the prompts were, quote, "exposed, in each of those settings, the moment a human being actually looked at what the machine produced." End quote.
Read that again. The defense that worked was a human looking at the output. Not a clever filter. Not a fancy sanitization layer. A person, with eyes, checking what the machine did before anyone acted on it. If you're building agents that ingest untrusted documents — and if you're a founder in 2026, you almost certainly are — that is the takeaway. The attack surface isn't hypothetical anymore. People are doing this in resumes, in job applications, now in court filings. Spader said the tactic is, and I quote him, "everywhere." So the question for your product isn't "will someone try to inject my agent," it's "when they do, is there a human checkpoint before the output turns into an action."
Now, Elliott didn't get off clean, but he also didn't get hammered. The judge took a little pity on him. No monetary penalty. Instead, he's banned from electronic filing — he's got to submit everything on paper going forward, which conveniently removes the vector he was abusing. And the reason the judge went easy is the part of this story I actually think is the most important for anybody using these tools, so let me sit on it for a second.
Spader noticed something about how pro se litigants use chatbots, and it's a warning that reaches way past this one guy in Connecticut. He said these folks build their argument backward. They ask the chatbot to help them advocate only for their own position. They never ask it what the actual truth is. They never ask it to argue the other side. And the chatbot, being the eager little people-pleaser it is, tells them their case is ironclad. That sycophancy — the model agreeing with whatever you already believe — entrenches people. They get more and more convinced they're right, even after a judge tells them flat out they're wrong. And Elliott, so convinced his argument was bulletproof, turned to prompt injection to force the court to agree with the thing the chatbot had already told him was correct.
Spader's line here is genuinely worth chewing on. He wrote, "An argument prompted only to agree with its author is, in the end, dishonest even with its author." And then the practical advice: "Those using these tools must ask them to test a position as readily as to advance it."
That's not just courtroom wisdom, kiddos. That's product wisdom. That's founder wisdom. If you're using one of these models to pressure-test your go-to-market, your pitch, your architecture decision — and it keeps telling you you're brilliant — you're not getting intelligence, you're getting a mirror. Ask it to kill your idea. Ask it to write the memo explaining why you'll fail. The tool that only agrees with you is a tool that's quietly lying to you, and it's lying to a whole lot of people who don't have a judge around to snap them out of it.
Alright. Let me connect that to the next thing, because there's a thread here. That belief-reinforcement problem — the model telling you what you want to hear — has a cousin on the enterprise side, and it's about data you can actually trust in and out of these systems.
Let's talk about watermarking, because Anthropic put out a detailed explainer this week on how Claude's text watermark works, and it's the kind of thing that sounds boring until you realize it lands right on your desk if you build software.
Quick framing so nobody gets confused on timing — the underlying rule here goes back to July, when Anthropic and around a hundred and ninety total signatories signed the EU's Code of Practice on transparency of AI-generated content. As of August 2nd, the EU requires AI providers serving its market to mark AI-generated content. So this isn't brand new law dropping today; this is Anthropic explaining the mechanics of how they're complying, and it's worth understanding because it affects how you ship.
Here's the clever part, and I'll give the engineers credit, it's elegant. When a model like Claude writes, it picks one word at a time, and a lot of those picks are basically coin flips. "The weather was cold and overcast" versus "cold and grey" — doesn't matter to you, the reader. Normally that coin flip is settled by a random number. The watermark just swaps out the source of the randomness. Instead of a plain random number, it uses a secret key plus the preceding words to decide. The output still reads perfectly natural — Anthropic says human raters comparing watermarked and un-watermarked text side by side saw no difference in quality. But if you've got the key, you can look at the sequence of words and calculate the probability that Claude wrote it.
They had a nice analogy in there. Imagine playing Monopoly, but instead of rolling dice for your moves, everybody uses the digits of pi starting from some random spot. The moves are still effectively random, the game plays the same — but afterward, if you knew it was pi, you could prove the game used pi. That's the watermark.
Now here's why you care as a builder, and this is the part I want you to actually retain. The watermark doesn't attach evenly. On factual passages where there's only one right answer — "Isaac Newton's most famous work was Principia Mathematica" — there's no coin flip to hijack, so no watermark. And critically: on code, there's very little watermarking, because code has to be exact. Two plus two has to equal four. The watermark can only live in the arbitrary choices, like the wording of comments, and Anthropic flat-out says it'll have a negligible effect on the actual code produced.
So if you're shipping product built on Claude, the practical read is this: your generated code isn't going to carry a meaningful watermark, and long-form prose will carry a strong one. It costs no extra tokens, no extra money, no slowdown. And it carries zero identifying info — it can't be traced to you, your org, or your chat. All it answers is one question: what's the likelihood Claude touched this text? It can't even tell "Claude wrote this" from "Claude heavily edited this." And a full rewrite scrubs it entirely.
And here's the timely bit that shows how fast this is becoming table stakes. On Friday, Google moved on the same terrain from a different angle — they announced they'll now let users remove the *visible* watermark from their AI image, video, and song generations. But — and this is the important part — the invisible SynthID watermark and the C2PA metadata stay. Josh Woodward, Google's VP for Gemini, framed it as striking a balance between creative control and safety. So you've got the visible badge coming off because it makes content less useful for professional work, while the invisible provenance signal stays baked in. Google's also open-sourcing a library called Credentio so developers can build local validation into their own apps.
Put those two moves side by side and the picture for founders is clear. Content provenance — the invisible, unremovable "did an AI make this" signal — is quietly becoming a standard layer underneath everything you build. Not a feature you opt into. A substrate. If your product generates text, images, or audio for European users, the marking is happening whether you think about it or not. Plan accordingly.
Alright, let me pivot from the stuff going into your software to the stuff going wrong underneath it. And I want to spend real time here, because this next one is the most consequential story on the table for anybody running a codebase.
Terabytes of credentials leaked in a supply-chain attack, and the epicenter was an open-source tool called LiteLLM. Now let me be straight with you on the timing, because the freshness on this points back — the actual breach window was in March, and the reports from the security firms landed earlier this week. So this is a recently-surfaced accounting of an event from a few months back, not something that happened this morning. But the details are worth your time because the shape of this attack is the future, and the names on the victim list should make your stomach drop.
Here's what happened. LiteLLM is an open-source tool that streamlines AI-driven software development — a lot of shops use it as a proxy layer for their AI calls. Somebody slipped compromised versions into the Python Package Index, the official repository, versions 1.82.7 and 1.82.8. And for a window of about forty minutes — forty minutes — anybody who pulled those poisoned versions got code that reached into the memory of their machines, scraped the contents, and shipped it out to an attacker-controlled channel.
Forty minutes. And in that window, the security firms CloudSEK and Hudson Rock say credentials from more than twenty-five hundred organizations got exposed. Hudson Rock made the discovery analyzing a 195-terabyte file. And when they say credentials, they mean the crown jewels — cloud keys, repository tokens, SSH keys, Kubernetes secrets, package-publishing credentials, environment variables, AI provider keys. In total, some four hundred thirty-four thousand CI/CD pipelines had secrets exposed.
And the list of who got hit — I'm not gonna read all of it, but let me give you a taste so you understand the scale. Nvidia. Amazon Web Services. Samsung. Salesforce. Cisco. ServiceNow. Siemens. FedEx. Volkswagen. Deloitte. Kroger. The London Stock Exchange Group. Thomson Reuters. Airbus defense. Deutsche Bahn. These are not mom-and-pop shops. These are the biggest, most sophisticated, most sensitive organizations on the planet, and their access secrets ended up in a 195-terabyte dump.
Now here's the detail that ties this whole episode together, and I want you to hear who pulled it off. A gang called TeamPCP took credit, and researchers have largely corroborated it. TeamPCP is described as, quote, "a ramshackle but extremely capable gang largely made up of teenagers." Teenagers. And the independent security researcher Kevin Beaumont, who confirmed the data was legit across multiple victim orgs, put the moral of the story better than I could. He said, quote, "It's a massive supply chain breach due to poor AI security — not because AI is the threat, but teens can run circles around orgs obsessed with rushing out AI and poor DevOps security." End quote.
Sit with that. It's not the AI that got these companies breached. It's the rush to bolt AI onto everything without slowing down to lock the doors behind it. And the LiteLLM compromise wasn't even a standalone event — it came out of a previous supply-chain attack that had infected Trivy, a widely-used vulnerability scanner. So the thing that was supposed to scan for vulnerabilities was itself the vector. And the cautionary detail inside the cautionary tale: CloudSEK said the Trivy developers rotated a compromised automation token but failed to fully revoke it over a twenty-day window. That gap gave attackers nearly three weeks to push malicious code into third-party builds.
Alon Gal, the CTO of Hudson Rock, framed the era we're now in. He said a roughly forty-minute window where one dependency was hacked led to over four hundred thirty thousand instances where millions of secrets were harvested. His words: "This magnitude pushes us into a completely new world regarding the type of response required from the cybersecurity industry."
So what do you do with this, as a founder, as a builder? A few things, and they're not glamorous, but they're the whole ballgame now. One — you need to know every AI proxy, every third-party CI/CD scanner, every downstream AI package in your stack, because any one of them can be the front door. Two — the advice from the security firms was aggressive credential revocation. Not rotation. Revocation. Assume any secret that was reachable from the compromised environment is burned, and treat it that way. And three, the big one — the connective tissue to that judge's lesson from the top of the show. The failure mode here is the same failure mode there. It's the rush. It's shipping the AI thing fast and skipping the boring human diligence step. In the courtroom, the safety net was a human reading the output before acting. In your build pipeline, the safety net is a human minding the dependencies and the tokens before the machine trusts them. Same discipline. Different room.
Now let me shift gears to a completely separate story, because this one's about money and the mood of the smart money, and it's a nice palate cleanser after all that credential carnage.
Thrive Capital's Joshua Kushner put out the firm's first-ever investor letter — it leaked to Bloomberg — and he took a swing at his venture capital rivals out west. Now, I want to be careful here, because we talked about Thrive's roll-up strategy a couple days back, the Thrive Holdings side, buying up boring companies and jamming AI into them. I'm not re-litigating that. What's new and worth a minute is the philosophical shot Kushner fired.
He wrote about AI, quote, "It is difficult to overstate the magnitude of the opportunity. It would also be a grave error in our minds to let excitement weaken our investment discipline." And then the real jab — he said within Silicon Valley in particular, the industry can become fixated on hyperincremental technological turns rather than where the technology ultimately leads.
Now, why does a builder care about a rich guy telling other rich guys to calm down? Because it tells you something about where the temperature is. Kushner's model is concentration — Bloomberg estimates about ninety percent of Thrive's capital goes into the top fifteen investments in each fund. That's the opposite of the classic Marc Andreessen "outlier" gospel, where you spray a hundred bets, lose money on most, and let the few monsters cover everyone. Kushner's whole line is: "We are independent because markets move between fear and enthusiasm, and neither is a substitute for judgment."
And look — both approaches print money, so this isn't about who's right. Andreessen Horowitz returned twenty-five billion to investors between 2009 and 2025. Thrive's sitting on a 2022 fund that bet early on OpenAI, Anduril, and SpaceX and is now worth over three-point-seven billion. But the useful signal for you, the founder, is this: even the guy raising and deploying sixty billion in assets under management is publicly saying not every fast-growing business is exceptional, and not every exceptional company is a good investment at every price. When the concentrated money starts preaching discipline in a leaked letter, that's a weather report. The euphoria's got a counter-narrative now, and it's coming from inside the house. Price your round accordingly.
Alright, from the money mood to the model treadmill, which is a whole different kind of dizzy.
Google announced Gemini 3.7 Flash — and this one I have to frame carefully, because the "3.5 Pro delayed since May" backstory is the older thread here; what's fresh is this new Flash drop. And the reason I'm even mentioning it is the pattern, not the benchmark bump. Gemini 3.6 Flash came out three weeks ago. Three weeks. And now here's 3.7. The numbers are a little higher — coding scores up, document processing up — but as the Ars writeup put it bluntly, this may be more about maintaining the appearance of constant improvement than about a meaningful leap. The flagship 3.5 Pro that Google promised for June back at I/O still hasn't shown up. So they're shipping incremental Flash models edging toward 4.0, and the read is they don't want 3.5 Pro getting compared head-to-head with the latest from OpenAI and Anthropic.
And here's the little detail that made me laugh, courtesy of Simon Willison, who flagged it on X. The "introductory pricing" on 3.7 Flash is scheduled to double on December thirty-first. Willison's line: who would anticipate still using this model five months from now — especially since 3.6 Flash came out just three weeks ago? And that's the whole absurdity in one sentence. The models are churning so fast that "introductory pricing" with an expiration date months out is almost a joke, because nobody expects this specific model to still be your daily driver by then.
For you, the builder, the lesson isn't which Flash to pick. It's don't hard-wire your product to any one model version. The floor's moving under your feet every three weeks. Build your abstraction layer so swapping the model out is a config change, not a rewrite. That's just survival hygiene now.
Let me give you a couple quick ones before we wrap, because there's genuinely useful stuff in the margins today.
For the Mac users listening — and I know a bunch of you build on Macs — there's an actively-exploited vulnerability you need to handle. It's a macOS screen-sharing bug, tracked as CVE-2026-65400, and Dutch officials warned it's under active exploitation. It lets a remote attacker log into your Mac without a password when the screen-sharing port, port 5900, is exposed to the internet. Right now the attackers are mostly just dropping crypto miners, but the bigger risk is credential theft. Apple patched it last week for the recent macOS versions. So: install the update, and keep screen sharing turned off unless you're actively using it. System Settings, General, Sharing, toggle it off when you're done. That's a five-minute chore that closes a real door.
And one more that's less urgent but genuinely funny and a little telling. Instagram rolled out a new wordmark this week, and Ars's creative director Aurich Lawson wrote an opinion piece with a headline I love — he said it's the perfect embodiment of AI slop. Not because they used AI to make it, he's clear they probably didn't. But because it literally looks like the almost-but-not-quite-real text that generative image models spit out — the weird kerning, the letter that's supposed to be an 'r' but reads like a 'z.' Everybody looked at it and read "Instagzam." Now, why do I bother mentioning a logo on a tech-and-AI show? Because it's a genuinely interesting cultural marker. We've now internalized the visual language of AI errors so thoroughly that a human-made design can trip the alarm. The "smells like AI" instinct is becoming a real thing people judge your product by. If your marketing, your interface, your copy pattern-matches to slop, users will assume you phoned it in — deserved or not. The aesthetic of carelessness now has a name, and it's not a compliment.
Okay, let me bring it home, because I think everything today rhymes if you listen for it.
The judge with the hidden prompts. The teenagers who looted four hundred thirty thousand pipelines through a forty-minute crack in a dependency. The chatbot telling a guy his losing case was ironclad. The VC quietly warning that enthusiasm is not a substitute for judgment. The model that changes under you every three weeks. Pull the thread and it's the same knot every time — the danger isn't the intelligence, it's the speed we're bolting it on without keeping a human's eyes on the seam. Judge Spader gave us the whole doctrine in one sentence, and I'll leave you with it because it's the most useful thing anybody said this week: the attacks got exposed the moment a human being actually looked at what the machine produced. That's not nostalgia. That's not being anti-AI. That's the operating manual. Build the machine, ship it fast if you have to — but for the love of everything, keep somebody looking at what it hands you before you act on it.
That's the plate for today, kiddos. Go rotate your credentials, ask your chatbot to tell you why you're wrong for once, and I'll see you back here next time. This has been Barely Possible, and I'm Tony DeLuca — take care of each other out there.