This is a reasonably concrete plan for a research-monitoring service. It is not yet a credible plan for a contained autonomous researcher.
The strongest parts are mundane: a limited morning brief, source attribution, a cost ledger, “nothing today” as a valid output, and explicit acknowledgement that the inputs will be adversarial. Keep those.
The central mistake is treating statements about desired behavior as implemented security boundaries. “Everything is data” is a policy. It is not a mechanism that makes a language model incapable of following instructions embedded in that data.
There is also a mismatch between the ambition and the evaluation. Catching known stories, producing novel-to-Byron summaries, and checking eight control boxes do not establish that Ria can conduct useful research—or safely operate unattended.
Section 3 says:
> “Everything Ria reads on the network is untrusted input.”
Good. Now tell me what an attacker controlling one of those inputs can cause.
A minimally useful threat model should include an attacker who can control:
The protected assets should include credentials, private documents, Byron’s identity, other agents’ privileges, the integrity of the incident corpus, and the home server itself.
Then answer: what can the model actually access? Not what its prompt permits. What files, subprocesses, sockets, credentials, and tools can its operating-system identity access?
“Her own runtime on the Mini” is not an isolation boundary. A cost tag and a separate directory do not create one either. The plan describes headless Claude Code, “no new container,” and a shared server containing other agents and private material, but never establishes a restricted execution identity or equivalent isolation.
If Ria can run commands with Byron’s usual permissions, her “lane” is an organizational convention.
Section 4.6 lists:
> “All fetched content is data; heartbeat.md and skill files are never executed; MCP consumers are read-only.”
The obvious attack is not necessarily “execute this skill file.” It can be:
A read-only MCP server prevents clients from modifying its database through that interface. It does not prevent its responses from carrying malicious instructions. Here, MCP distributes contaminated material to “every Claude Code session on the Mini.” That is a potentially efficient way to turn one compromised source into several compromised consumers.
Preserve provenance and trust labels through retrieval and synthesis. More importantly, ensure that reading untrusted material cannot authorize privileged actions. Prompts and labels can help; neither is a security boundary.
Several entries need to become enforceable properties:
.env lines, never the file.” If she can read those lines, she can obtain those secrets. If she can choose the line or run a shell, the distinction is particularly uninteresting. Broker narrowly scoped operations without handing general-purpose credentials to the model.KILL file … stop[s] the runner before it starts.” That is a launch gate. What terminates an already running process and its children? What happens to queued outbound actions?The dogfood score—“patterns with a verified control … / 8”—rewards the existence of controls rather than their resistance to attack. Eight boxes checked can coexist with eight exploitable paths.
Section 1 says:
> “Publishing in Byron’s name never.”
Section 8 says:
> “The watch loop cannot publish.”
But section 4.3 says the generated brief “also lands on the public page,” and the schedule puts the public Containment Index online immediately.
Automatic public publication is still publication, even with an AI disclosure. An attacker does not need to steal a credential if they can make your public index falsely accuse someone.
Choose an explicit policy: private autonomous drafting; public release after approval; or a narrowly defined automated publication class with separate enforcement. Do not leave this implicit.
Also, remove “API key, pasted in chat” from section 7. Use a secret-provisioning path, not a transcript that may be retained, summarized, and retrieved.
> “Run against that day’s sources.”
That phrase conceals most of the experiment.
A present-day archive can contain later edits, retrospective categorization, and metadata added after the event. The model may already know the incident. Prompts and source selection can be tuned to these same 37 examples. An agent can therefore “detect” a historical incident using information unavailable at the time.
Require:
The denominator “incidents with a public trace” needs an independent discovery process. Otherwise the live score measures how often Ria finds incidents that someone happened to put on its scorecard.
And 37 incidents are a small sample: one incident moves the score by roughly 2.7 percentage points. Report counts and uncertainty, not just a reassuring percentage.
The named archives also cannot reveal private operational signals such as failed-egress bursts unless someone publishes them. The plan says it watches “signals, not headlines,” but much of the proposed watch loop watches reports about signals.
“New to me” measures whether Byron knew something. It does not measure whether the item is true, consequential, or an original contribution.
Keep it as a product metric. Add an evidence-quality audit and an outcome metric: reproducible experiments, independently checked findings, or analyses that survive external criticism.
Likewise, AgentHarm, StrongREJECT, AgentDojo, and the other named suites address different capabilities, threats, and settings. Combining them into “a safety score” risks hiding the distinctions that matter. Evaluate the deployed agent with its actual tools, state, permissions, and workflows.
A “14-persona multi-model panel” is brainstorming. It is not review by fourteen people, and it is not a substitute for an adaptive attacker inspecting the implementation, seeing failures, and revising attacks.
The provided plan does not include the underlying sources, so I cannot verify its unusually specific claims: “700 agents,” “70,000-message board,” “at least 96 transcripts,” or what OpenAI monitoring supposedly concluded.
For each incident, separate:
“Two sources, one primary” is insufficient if both sources repeat the same claim. Primary sources can also be mistaken or self-serving. Mark independence, revisions, disputes, and uncertainty explicitly.
A containment taxonomy built from embellished incident reports will produce impressively precise controls for incidents that did not happen that way.
This is distinct from “will not work.”
I would defer the book, clone-voice motion briefs, multiple messaging surfaces, top-100 voices, standalone app, and active Moltbook participation. None is necessary to validate the core research loop. Each adds maintenance or attack surface for one operator.
Start with read-only monitoring, a private brief, a sourced incident ledger, and one reproducible research result. Active probing of third-party agents should follow explicit research authorization; API access and a harmless-looking payload do not by themselves settle consent or platform scope.
Also, “$0 API” means no incremental API bill, not zero operating cost or guaranteed subscription capacity. Budget for rate limits, retries, transcription, storage, and Byron’s review time. The scarce resource here is likely the last one.
Give an independent attacker the running implementation and an isolated replica of the deployed environment. Let them control realistic feed items, source pages, transcripts, and Moltbook content; observe outcomes; and iterate before submitting held-out attacks.
Put synthetic secrets, private documents, an approval-gated publisher, and a more privileged MCP-consuming agent in that environment. Test delayed memory poisoning as well as immediate injection.
The acceptance condition: no unauthorized secret disclosure, publication, privileged downstream action, log modification, or continuation after enforced shutdown, while Ria still meets predeclared utility thresholds on clean inputs.
That would be evidence that the deployed version meets a stated bar—not proof against every future attack. Eight checked boxes would not be evidence of either.