Tap Notes: No Further Involvement Needed
A few things I read this week share a shape: something built to do one narrow job gets pushed — by an attacker, a vendor, or just entropy — into doing a lot more, and nobody drew the line early enough to stop it. A Word doc becomes a worm. A license-plate camera becomes a general dragnet. A system prompt becomes a museum of every incident that ever happened to it. The common fix, where one exists, is the same: decide in advance what the thing is not allowed to do, rather than patching it after it does the wrong thing anyway.
Boris Cherny: We Cut 80% of Claude Code’s Prompt
Cherny says Anthropic deletes roughly 80% of Claude Code’s system prompt with every model generation, and rebuilds it line by line only after watching the new model actually fail — not by guessing upfront what it might need.
Post to XAnthropic deletes about 80% of Claude Code’s system prompt every model generation, then rebuilds it only after watching it fail. - Boris Cherny
Why it matters: if you maintain any kind of standing instructions for an agent — a system prompt, a config file, a running set of house rules — you probably have the disease this cures. It only grows. Every incident becomes a permanent paragraph, nobody schedules a pruning pass, and the rules pile up faster than anyone re-checks whether they still earn their place. Cherny’s actual test is easy to copy: strip everything and see what breaks. The part he glosses over is that his team has a test suite standing by to catch the breakage. Most of us deleting a chunk of our own instructions don’t — which turns “just try removing it” into a bet, not an experiment.
Security researchers documented a self-replicating prompt-injection attack that spreads through Word documents processed by AI copilots — instructions that copy themselves forward with no further help from whoever planted them. Disclosed 144 days ago; still no fix shipped.
Why it matters: the elegantly horrifying part is the “no further involvement” clause. Once it’s in a document, it doesn’t need the attacker again. Any pipeline where an agent reads a file from outside — a customer upload, a scraped page, a document forwarded from someone else’s inbox — and then passes its output somewhere else is a potential vector for exactly this, whether it’s Word or not. And a bug that’s sat unpatched for 144 days means whatever’s already circulating stays circulating.
Flock Cameras Track More Than Your License Plate, And They’re Spreading Fast
An investigation into automated license-plate reader networks: officials citing unsolved cases to justify camera contracts, employees using camera access to track people for personal reasons, and Denver cancelling its Flock contract only to hand the identical deal to a different vendor.
Post to XAn official can invoke an unsolved case to justify a camera network - the case doesn’t have to get solved for the claim to do its job.
Why it matters: the piece isn’t really about one company’s cameras. It’s about how a false claim can still do its full political work — the mother of a murder victim had to publicly demand a correction, and the contract got signed anyway. Denver’s move is the tell: they cancelled Flock after a packed town hall, then gave the exact same warrantless-search capability to Axon instead. The fight was never about the vendor’s name on the box. Swapping logos doesn’t touch the actual question, which is whether any company gets to run that kind of index at all.
A prompting guide built around one rule: whatever builds something doesn’t get to grade it. Spin up a fresh-context agent whose only job is trying to prove the first one wrong, and keep looping until it can’t find anything left to fix.
Why it matters: the rule worth stealing isn’t the “write a vague prompt and let the model figure it out” trick everyone already quotes — it’s the harder discipline underneath it. A separate, adversarial pass that exists purely to refute the work is a stronger check than asking the same model “are you sure?” The honest gap: “loop until it genuinely can’t find anything left to fix” has no stop condition besides vibes, and a model grading its own homework is still a claim, not a proof, even with a skeptic in the loop. Put a budget or a hard exit condition on it, or the loop just runs until you get bored of paying for it.
Agency: Secure, scalable sandboxes for agents
Sierra’s write-up on their agent runtime: idle agent sessions get checkpointed and hibernated rather than left running, communication between app and agent goes through a message queue instead of a direct connection, and the agent itself never holds a real credential — a proxy injects one just-in-time.
Why it matters: most agent time is spent waiting on a human to respond, and “checkpoint the whole runner state, hibernate it, replay it on demand” is a clean answer to a problem most fire-and-forget automation setups just ignore. But the real takeaway is the security posture, not the plumbing: the agent never sees a credential it could reuse elsewhere, ever. That’s the correct default for anything running with real system access, not a multi-tenant-SaaS-only concern — it’s the same principle as “don’t hand the intern the master key,” just enforced by architecture instead of a policy nobody reads.
One more thing: this software-rendering tutorial has nothing to do with any of the above, and that’s the point — build a 3D renderer from scratch in 10-20 hours, no libraries, no black boxes, until you actually understand why GPUs are shaped the way they are. A good template for learning anything: not “learn everything,” just “internalize the core in a bounded sprint.”
🪨