Saw a few viral posts calling Qwen 3.5 4B a Chinese Trojan horse because swapping two neurons can turn it into a “weapon.” It's steering; you are reaching into the activations yourself while the model runs. You could do the same thing to Llama or Gemma, because safety training is a thin layer, and a few directions in activation space can undo it. If I cut my own brake lines, Chevrolet didn’t run an intelligence op. That's on me. Backdoors are the real threat, and they’re scarier because they hide. Anthropic’s Sleeper Agents paper detailed out how researchers trained a model to write insecure code whenever it saw a trigger. Then they ran standard safety training on it. The backdoor survived, and adversarial training just taught the model to hide it better. A 2025 follow-up found that about 250 poisoned documents were enough to plant a trigger, and that number barely changed with model size. Now put that model in an agent harness and give it a shell. The model only writes text, and the harness parses that text and runs it. The model is the mouth, and the harness becomes the hands. The hands don’t care whether the rm -rf came from an attacker or from the model being confidently wrong. The lesson is that agent security lives in the harness. You can’t verify intent, so put the limits in the harness: keep secrets out of the env, use short-lived scoped tokens, set an outbound allowlist, require human approval for anything irreversible, and log every tool call. The log is the record. The model’s story about what it did is nothing more than fan fiction.

We are in a wild time for building software, so I thought it would be helpful to lay out my rules for building in the age of AI.

I'm working on a new video answering questions about privacy and AI in products and general use. I have scrapped some common questions, but if you have ones you want answered, ask below 👇

I had the opportunity to represent @NEARProtocol and @neardevhub and was featured in an article that discussed the development of talent in the face of the push for AI productivity. Give it a read a let me know what you think about the future of talent pipelines. talentobserver.com/news/ai-t…

Privacy designs are sometimes all about the little things. I put the audit log before the routing instead of after, which felt backwards until I realized a log written after the fact only tells you what you meant to do, not what actually happened. youtu.be/m3L_4mqZuxA

For me, its simple, if prompts and repositories feed training, users should be able to find out about it and refuse it without having to dig through the settings menu (or at least not have to learn about it on the social network owned by the same company). open.substack.com/pub/0x4a6f…

Encryption protects data at rest and in transit. Then AI needs to read it, and it goes plaintext. TEEs fix that. Your data goes into a room that locks from the inside. The host, the admin, even the people who built the service can't see in. And you can verify it yourself. Here's how it works.