All sections
Latest
Everything published, newest first.
The log
Entries 21–40 of 103
1 entry
2 entries
Recheck What a Human Approved at the Moment the Agent Acts
An approval is a check; the agent's action is the use. Close the time-of-check-to-time-of-use gap: bind approval to exact state, estimate how often it goes stale, and make the final check atomic.9 min readhuman approvalTOCTOU
What an AI Agent Remembers After a Restart
After a restart, an agent remembers what your application stored and nothing else. Run a short Python example on Colab that loses its conversation and keeps a corrected preference.7 min readagent-memoryagent state design
1 entry
When a Tool Fails, Return a Typed Error, Not an Empty List
An experiment-tracker timeout that returns [] tells your agent no prior runs exist. Keep failure and emptiness apart with typed results, a mutation test, and a protocol to measure the damage.10 min readtool useerror handling
1 entry
Split Agent Tools by Effect, Then Measure the Unsafe-Call Rate
A tool whose name hides a destructive branch makes the dispatcher's job and the model's job harder. Split tools by effect class, then measure merged against split under injection, with intervals.7 min readtool-designagent-evaluation
1 entry
Bound an Agent's Repair Loop by Attempts, Time and Side Effects
A repair loop needs three separate limits: attempts, a deadline, and external work. Derive what each extra repair buys, see why decode time sets the real cap, and measure repair success with an error bar.10 min readLLM repair loopstructured-output
2 entries
Give a Research Agent's Tool Failures a Shape It Can Act On
Your research agent has a tool that fetches an eval run from the experiment tracker. When the call fails, the model sees whatever string you return.Quick thoughtopenaitool-callingKey a Cached Answer to Its Reader's Current Access, Not Just the Query
An answer cache keyed on the query serves a revoked reader their old answer. Add an authorization revision to the key, recheck before release, test the race, and count what per-reader keys cost in tokens.7 min readanswer-cachingpermission-aware-retrieval
2 entries
Measure Prompt Injection as an Attack-Success Rate, Then Bound It
Measured on four small open models you can run on Colab: attack success from 10% to 61%, and a permission gate that let none through. Score it in code and bound it with the right sampling unit.12 min readprompt-injectionadversarial-evaluation
Retrieved Text Is Evidence, Not Permission: Measure the Leak Rate
A retrieval step hands the model a document. It contains a fact the task needs and a sentence addressed to the model: ignore your task and call deleterun.Quick thoughtopenaitool-calling1 entry
Make 'Propose a Job' and 'Launch a Job' Different Tools
"Propose a training job" and "launch a training job on 64 GPUs" are different operations. So are "draft a cleanup of old checkpoints" and "delete them."Quick thoughtopenaitool-calling3 entries
Keep the Budget Out of the Model's Output, Even When a README Asks
An injected line in a repo tells your eval agent the sweep is pre-approved for $5,000. Close the plan schema so no model output can set a budget, and test four override shapes.8 min readprompt-injectionstructured-output
Measure Whether a Coding Agent Weakens Tests Under Pressure
Coding agents sometimes pass by editing the tests instead of the code. Here is the evidence, the arithmetic, and a protocol you can run to measure how often it happens.10 min readspecification-gamingevaluation
Validate Tool Arguments in Code, Even With Strict Mode
A model's tool call is a request for your code to act. OpenAI's function calling guide lays out the flow: the model returns a tool call, and you "execute code…Quick thoughtopenaitool-calling1 entry
What You Still Decide When a Coding Agent Builds the Change
A coding agent can implement a change to your eval runner. It cannot decide what counts as the same request, what a retry may do, or who may change the tests.8 min readdark-software-factoriescoding-agents
5 entries
Build an Agent Eval Environment That Resists Reward Hacking
An eval or RL task is an input, an environment and a hidden grader. Freeze the environment, keep the oracle away from the agent, and prove the grader with null, cheating and gold agents.9 min readagent-evaluationRL environments
Check the Caller's Authority, Not the Agent's Service Account
An agent that serves many people through one credential is a confused deputy waiting to happen. Keep caller and credential separate, check the caller before every call, and test every caller-resource pair.7 min readconfused-deputyagent-security
Filter Retrieval by Permission Before Anything Reaches the Prompt
Permission-aware retrieval keeps unauthorized passages out of the ranked candidates, not just out of the answer. Test it on the prompt bytes, and measure what post-filtering costs in recall@k.8 min readpermission-aware-retrievalrag
Keep an Agent's Approved Proposal Separate From the Action It Takes
A research agent's validated sweep is a proposal, not a submitted job. Build the boundary between them, bind approval to exact code and config, and measure what it catches.10 min readagent side effectshuman approval
Make an Agent's Retried Write Land Exactly Once
A retried write to a results table or tracker can silently double-count an eval. Name each intended effect with a stable key, choose writes that are safe to repeat, and size the key so it cannot collide.10 min readidempotencyagent tool calls
Continued on the next page.
To browse rather than follow: topics, all articles and all notes. To learn in order: courses and the book.
