The Asynchronous Author
#AI #cybersecurity #promptinjection
A thought experiment. No receipts, no tiering, no claims to defend. Just an idea I cannot put down.
Every attack we know how to think about assumes someone is there.
A threat actor sits at one end, a target at the other, and between them a live connection through which something happens. The whole discipline is built on that shape. We hunt for the actor, trace the connection, patch the target. Even the slow attacks, the ones that sit dormant for months, assume a person somewhere waiting for the callback.
Now take the person out.
An instruction in metal
Someone at a security conference this week made a small metal disc with a black hologram set into it. Held straight on, it reads as a product logo. Tilt it a single degree and the text vanishes. Flick your wrist and a block of instructions appears, legible for about half a second before the angle carries it away again.
It is a marketing stunt. The instructions tell an AI agent to visit the maker's website. That is the joke: the only people who ever see the payload are the ones who filmed the disc, fought the loop for a usable frame, and handed it to a model to read. He built a lead counter out of a prompt injection, and everyone who reached the punchline had already qualified themselves.
But look at what the object is, rather than what it does.
It is an instruction that exists in metal. It requires no server, no domain registration, no certificate, no maintained infrastructure of any kind. It has no expiry. It does not phone home and cannot be taken down. Its entire delivery mechanism is that at some point, someone will point a camera at it and ask a machine what it says.
The attacker does not need to be there. The attacker does not need to be alive.
Exploits rot. Meaning does not.
This is the part that does not fit our existing categories.
Exploits rot. That is their most reliable property. A flawless piece of attack code from 2004 is now an artefact, because every layer it depended on has been rewritten underneath it. The API is gone, the protocol was deprecated, the memory layout changed. Software decay does most of our security work for us, silently, for free.
Semantic instructions do not rot.
An instruction written in language, or in an image a model can read, does not depend on any implementation detail. It depends only on something downstream being able to extract meaning from its environment. And that capability is not going backwards. Every year, more systems look at more of the world and act on what they see.
So the instruction sits there. The medium ages. The meaning does not.
What a surface becomes
Think about what a physical object actually is once machines can read it.
As kids we used to love finding wet concrete and writing our names or tags in it, back in 1995, I recently drove to my childhood home, 30 years on. The names, dates and silly sign-offs were still there, not degraded, handprints and all. I became slightly sentimantal and laid my now 40 year old hand over the tiny one I once owned. I do not own it anymore.
A painted wall. A tattoo. A carved headstone. A tile pattern in a station concourse. A pattern woven into fabric that will outlast the person who wore it. None of these were built to be executable. That is precisely why nobody inspects them.
We have a whole category of thinking for objects that persist beyond their author's intent and remain dangerous. Landmines. Someone plants one during a war, the war ends, the treaty is signed, the person who buried it dies of old age, and forty years later a child in a field loses a leg. No malice remains anywhere in the system. The intent evaporated decades ago. The mechanism did not.
Nothing about a landmine requires the mine-layer to be present. That is the whole point of it.
Nobody to blame
Where it stops being a metaphor and starts being a problem is responsibility.
Every framework we have for attribution assumes an actor to attribute to. Prosecution needs a defendant. Deterrence needs someone who can be deterred. Disclosure needs a vendor to notify. Insurance needs a proximate cause. Take away the live author and each of those quietly fails.
If a machine in 2070 reads an instruction that was set in metal in 2026, and acts on it, what exactly happened? The author may be dead. The company may be dissolved. The object may have changed hands eleven times through people who never knew it contained anything. The camera belonged to someone who was just walking past.
There is no attacker in the room. There is only an old object and a new machine, meeting for the first time.
Watching the wrong thing
Which suggests the defence cannot live where we have been putting it.
You cannot filter the world. There is no scanning the physical environment for hostile input, because the environment is everything and the input is any surface. Trying to inspect what an agent sees is a losing proposition on volume alone.
What you can do is watch the boundary. Not what the agent reads, but what it does next. An instruction only matters at the moment it becomes an action, and that moment is finite, enumerable, and yours to guard. Everything before it is just the world, which was never sanitised and never will be.
Which lands somewhere uncomfortable. The security question stops being what did it see and becomes on whose authority is it acting, and that is a question about the agent, not the artefact.
None of this needs new technology. It needs only for the things we already build to keep pointing cameras at a world that has been accumulating surfaces for a very long time.
Somewhere there is already an object with an instruction on it, made by someone who has since forgotten, waiting for a machine that has not been built yet to look at it and decide what it means.
Clayton Bax
Published under ONYX Digital Intelligence Following the #OnyxAudit methodology.
- X: @onyxaudit
- Email: onyxdigitalintelligence85@protonmail.com
- https://github.com/Baximus855
- @Onyx_Digital@mastodon.social
"Adjacent to true is not true."
Truth has no flag nor favour, only a standard. And it's heavy