Foundations
How models and agents fail, measured honestly and reported so it gets fixed.
- One token stream, no real roleswhy injection is possible at all
- Untrusted data meets private datathe trifecta and the Rule of Two
- Tools are the attack surfacetool text and MCP config
- Count with error barsrates, intervals, pass@k and pass^k
- Distrust the scoreboardelicitation, judges and benchmarks
- Write the finding, then route itimpact, rate, class fix, channel