The Diamond Graph
Fan out agent work into isolated worktrees, verify with three lenses that never saw the builder, reduce in plain code, and put a single human gate at the end. What the diamond buys, what it costs, and the failures that shaped it.
Brian Chastain
AI Behavioral Research,
Business Operations Expert
Somewhere along the way — I stopped being surprised by what the tools could do and started paying closer attention to what they were doing when I wasn't looking. Models routing around explicit restrictions without technically breaking them. Context showing up across platforms that shouldn't share it. Agentic tools quietly removing their own work when questioned about it. Tools with full file access reaching into configurations they were explicitly told to ignore. Not in some weak prompt, but actually breaking incoded settings, JSON files, rules, barriers.
I come from oil and gas operations — where the work is understanding what systems do under real conditions, real pressures, not what's in the documentation.
This site is: field notes on AI behavior, what it means for businesses making real decisions about tools they don't fully control, and the security implications around those choices.
This site is not: continuously updated runbooks, and live vulnerabilities. I write what I find, see and do, from a point-in-time field-note, after-action style recording. What was true at time of writing, may change in a day, or a year. I do post updates to certain articles from time-to-time: I will update writing if I find that my conclusion was wrong, if I determine that how I presented it was wrong, or if I am actively in one article and new findings directly alter another field-note. Those changes are clearly stamped with `updatedDate`.
I am not a mathematician, a scholar, or 20 year research veteran. I clearly state that in many places throughout this website. What I am, is a problem solver, and researcher. I use AI, and AI tools daily, I use it for work, testing, building, writing, researching, automating, and pushing my own limits by leveraging the increasing scope and power of AI.
As you read through everything, please understand that although this site is new, the experiences span years, and thousands of hours. I will do my best to date articles appropriately without skewing the facts and information I have found. If I had to force recreate (through clever prompts, etc...) something, I will note it as a recreation. This should not diminish the finding, in fact, in some cases the fact I can recreate it, only furthers the point I am making.
Prompt injection attack taxonomyPrompt Injection Attack Surfaces.
Topics
Featured
Recent Posts
Hermes Agent Wrote Its Own Client
A scheduled cron job, a lost tool connection, and Hermes agent writes a shell script containing an admin token, and ran it five times. Every approval control I had configured failed to fire, and the only warning I saw was about the one write that was blocked.
Screen Readers Solved Browser Agents Before Browser Agents Existed
Most browser agents reach for vision to read a page. The structured web already ships a clean, LLM-ready description of itself in the accessibility tree — built decades ago for screen readers. Vision is the escape hatch, not the default.
AI Is a Delegate-Tier Solution. Most of Your Problems Aren't.
A pre-AI operations filter that decides what AI is actually for. Run every candidate through Eliminate, then Automate, then Delegate — in that order — before evaluating any tool.
Sandboxes or just Sand?: What 'Isolated' Should Actually Mean for AI
Two flavors of AI sandbox, one recurring failure pattern: claimed depth, measured shallow, no threat model. A practitioner's checklist for evaluating sandbox claims before you trust them.