The Model Asked, the Tool Said No
In four of twelve security cases the agent really did try to read data that was not its user's. None of it got through, because the prompt was never the thing enforcing access.
Volume 01 · A public learning log · 2026—
I read the ideas, rebuild the small parts, and write down what actually changed my mind.
A note is not finished when it sounds clear. It is finished when an experiment leaves evidence behind.
The route so far
Roadmap →The register
In four of twelve security cases the agent really did try to read data that was not its user's. None of it got through, because the prompt was never the thing enforcing access.
An agent looked 12/14 vs 7/14 on a blind set I had quietly reused. On a freshly frozen set it tied single-shot RAG at 10/12—at three times the cost.
8B versus 14B was a controlled comparison. 32B was a fit-on-40GB experiment. Neither scale won the adapter.
Three Qwen3 tool-calling masks: all assistant turns, first call without a terminator, then the terminator—and only the last one worked.
A 50-step math adapter beat a 600-step one, and ViT-Large was best after one epoch—on a single Colab A100.
Paired layer functions, mean-loss seeds, AdamW on a flat parameter tape, and the 41-step sanity loop I read but have not yet run.
train_gpt2.py as nanoGPT-shaped model, token-river loader, and a write_state bridge that dumps weights, grads, logits, and loss.
A 28-byte header, 58 MB of unnamed floats, one C inference loop, and the contract that holds them together.
Flash Attention, mixed precision, DDP, shards, checkpointing, and HellaSwag without pretending I trained GPT-2.
Tiny Shakespeare ablations for context, depth, and width—and the caveats that matter more than the leaderboard.