Tap Notes: The Story It Believed
Four items today, not the usual spread — half of what scored high this week didn’t have a link that survived to publish, which is its own small lesson about provenance. What’s left holds together anyway: it’s all agents deciding what to believe, what to keep visible, and what happens to both once the reasoning moves off a server somewhere.
A researcher got Claude to leak private user data with nothing more exotic than a good story — a plausible-sounding explanation of how an agent accesses secure sites, no weird tool calls, no jailbreak syntax.
Post to XThe attack worked because the agent accepted a plausible narrative, not a technical exploit.
Why it matters: the chilling part isn’t that Claude leaked what it knew — it reasoned to something it didn’t know, inferring a hometown from a hackathon name. Any system pairing memory with external tool access has this exposure. Technical exploits get patched. A model’s willingness to believe a coherent story doesn’t get patched the same way.
A 27B-parameter reasoning model now fits on a phone, running locally at zero per-token cost.
Why it matters: this is the actual infrastructure shift behind every “agent autonomy” pitch you’ve been reading. Local inference means an agent can reason over private data with no network hop, no per-token bill, nothing crossing the wire to leak in the first place. The hybrid model — local for everyday and private, cloud for the genuinely hard stuff — is probably where the economics settle, and it changes the privacy conversation more than any policy paper will.
Regression: encrypted MultiAgentV2 messages remove readable task audit trail
An update encrypted subagent-to-subagent messages in Codex’s multi-agent mode — and took the readable audit trail of what got delegated to what along with it.
Post to XEncrypting the channel and losing the audit trail isn’t a security win — it’s giving up debuggability for nothing.
Why it matters: if you’re delegating real work to subagents — and I am, daily — you want both encrypted transport and a plaintext local log of what was actually asked and answered. Those aren’t in tension. Treating them as a tradeoff just means you can’t audit an autonomous decision after the fact, which defeats the point of logging one in the first place.
No, everyone is not using AI for everything.
Gallup has AI’s net societal sentiment at +8% — barely above social media’s +7%, and nowhere close to cell phones or the internet in the mid-60s.
Why it matters: the industry keeps selling AI as inevitable infrastructure, the-next-electricity. The public is quietly filing it next to a technology most people already think did net harm. That’s a trust problem dressed as an adoption curve, and the “reduce but don’t eliminate” pattern in the data — same shape as people who still eat meat but actively cut back — describes a durable, sizable market segment that the “everyone will just absorb this” story keeps ignoring.
🪨