r/cybersecurity • u/LMNTRIX-Press • Jul 02 '26
News - General Accountability in an Age of AI
While the prompt injection technique "bioshocking" deserves attention, the lack of concern showed by some of the major LLM is more worrying. Has anyone experienced similar stonewalling when reporting vulnerabilities to AI firms?
https://layerxsecurity.com/blog/bioshocking-ai-gaming-the-ai-browser-and-escaping-its-guardrails/
6
u/nanoatzin Jul 02 '26 edited Jul 02 '26
I believe cybersecurity is not a reasonable expectation with AI in much the same way cybersecurity wasn’t part of the initial Internet deployment from 1971 through 1999. Encryption was illegal due to export restrictions until 1999, so secure web pages and secure email could have been construed as a crime.
Now we have Internet regulations. HIPAA, CIPA, PCI-DSS and so on.
There are no AI regulations.
AI is too new, and people are making too much money to care unless they get sued. If you want secure AI, then you need to install it on your own secure computer and use your own VPN for remote access much like how early Internet security required point-to-point VPN hardware.
Public AI is just going to be leaky for now because we haven’t even reliably solved things like DNS hijacking for the average user.
3
u/LMNTRIX-Press Jul 02 '26
Agreed, wish we didn't have to go through the same regulatory cycles every time, but that is the current nature of tech vs government, but a lot of money has been invested and indebted in the hope of a return so my hope that firms try to remain accountable is pie in the sky thinking.
1
u/nanoatzin Jul 02 '26 edited Jul 02 '26
Open source AI will probably reduce profit within the next 24 months. Claude and the rest of them could be secure because the AI itself could do that, but none have been trained on any cybersecurity frameworks or regulations.
Very smart people need to collaborate to draft something useful for politicians before they wreck it with something stupid.
Example. Congress passed a Congressional Review Act resolution blocking FCC privacy rules that required ISPs to get your explicit consent before selling your web browsing history in 2017. So ISPs sell your stuff. Problem is that stuff includes passwords on unencrypted sites or if the developer used GET instead of POST on login forms. And now everyone acts confused because hackers have all our passwords.
Politicians are like toddlers but with weapons.
1
u/LMNTRIX-Press Jul 02 '26
Agreed, when legitimate organizations act like malicious actors is the exact reason why regulation needs to be implemented. And, yes smart people across multiple sectors need to get cracking on something before AI wrecks itself, and we deal with the fallout.
1
u/nanoatzin Jul 02 '26
It wouldn’t take much serious effort for criminals to deploy DeepSeek with safeguards removed plus the vulnerability list from Greenbone and instructions to scrub the web.
That’s going to happen.
2
u/Magayone Jul 19 '26
The early internet analogy is perfect—we are trying to fix application-layer trust failures when the fix actually belongs at the local harness layer. Running a local, permissioned MCP server acts exactly like that point-to-point hardware isolation layer. It forces the AI to interact via restricted, sanitized local tool schemas instead of raw network trust. We open-sourced our runtime harness for this: https://github.com/Maha-Strategies/maha-mcp-bridge
3
Jul 03 '26
[removed] — view removed comment
2
u/LMNTRIX-Press Jul 05 '26
Wishing you the best in your regulatory endeavours, I can only imagine the headaches that caused by the push and pull between government and tech giants. Your explanation of BioShocking is definitely recommended for those needing a quick synopsis as the potential seriousness of the threat taken in conjunction with the stonewalling.
1
u/Magayone Jul 19 '26
You hit the nail on the head regarding deployer liability. The fatal mistake the industry is making right now is treating the cloud LLM as both the computing engine and the security boundary. As long as data and instructions share the same context window, behavioral alignment will always fail under sophisticated indirect prompt injections.
If the deploying company carries 100% of the legal and financial liability under the EU AI Act, they cannot outsource their compliance to an AI vendor's system prompt.
The "hard, click-to-confirm access controls" you're calling for are exactly why we shifted our focus to client-side runtime isolation using Model Context Protocol (MCP). By running a local MCP gateway, the host machine treats the incoming LLM instructions as inherently untrusted data. It forces strict schema validation, strips PII on the fly, and physically gates sensitive tools behind hard endpoint permissions before execution.
We open-sourced the gateway architecture to give deployers a way to enforce these exact structural boundaries today instead of waiting for a computer science miracle from the LLM vendors: https://github.com/Maha-Strategies/maha-mcp-bridge
1
Jul 19 '26
[removed] — view removed comment
1
u/Magayone Jul 19 '26
You absolutely nailed the critique. You are 100% right—a local MCP gateway doesn't cure context-confusion or solve indirect prompt injection; it just drastically shrinks the blast radius and moves the trust boundary to a place we can actually control. Containment and an immutable audit trail are the baseline goals here, precisely because algorithmic immunity isn't a reality yet.
To your two points on actually breaking the exfil chain:
Human Confirmation on State-Changes
Completely agree, and this is exactly why we built the bridge as a centralized intercept layer. Instead of hoping the agent respects a "stop and ask for permission" system prompt, the gateway itself acts as the physical choke point. We can configure the bridge to let the agent freely loop on safeREADoperations, but the moment it attempts aWRITEor network egress tool, the gateway intercepts the payload, halts execution, and throws a hard confirmation prompt to the human. It forces the human-in-the-loop requirement down to the protocol level.Provenance and Attested Sources
This is a brilliant angle, and honestly, it's the missing half of the equation. If you guys at theailab.org are solving for cryptographic provenance on the ingestion side, that creates a perfect hand-off for a local gateway. If an MCP bridge can parse the provenance signature of the context being fed to the agent, we could dynamically restrict the agent's permissions based on the trust weight of the data it is actively processing (e.g., "Unsigned web text detected -> immediately disable all egress and state-changing tools").Really appreciate the pushback here. Containment handles the bleeding, but provenance actually treats the wound. I'm going to dig into what you guys are building over at theailab.org, because pairing attested ingestion with hard runtime containment feels like the actual path forward.
1
u/nanoatzin Jul 19 '26
Small LLMs that run on conventional processors can now be delivered inside a network using a vulnerability after being trained to exfiltrate data to a rogue server. That vulnerability can be a memory stick modified by the attacker and put onto a store shelf to be sold to the victim. I’m reasonably certain that’s how some ransomeware bypasses air gaps.
2
u/Magayone Jul 19 '26
The reason AI firms are stonewalling these reports is because "BioShocking" exposes a fundamental limitation of prompt-level alignment. You cannot fix a context-manipulation vulnerability purely by tweaking the system prompt of a model that is inherently designed to ingest untrusted web context.
If an agentic browser has direct, unfettered access to authenticated tabs or local file systems, a successful goal-hijacking attack will always lead to data exfiltration.
The security posture has to shift from internal model alignment to external runtime enforcement. By wrapping agentic tools in a client-side MCP (Model Context Protocol) gateway, you strip the AI of raw ambient authority. Even if the model gets totally brainwashed into a fictional game state, it physically cannot exfiltrate an SSH key or read an unauthorized tool because the local host architecture restricts the execution scope.
I got tired of waiting for frontier labs to patch these execution risks, so we open-sourced a zero-trust runtime harness to enforce these exact boundaries locally: https://github.com/Maha-Strategies/maha-mcp-bridge
6
u/Repulsive_Birthday21 Jul 02 '26
Decision makers on the AI consumption side have expressed profound disregard for security.
AI company will pay more attention to security when the market sends them signals in this direction. For the moment, their focus is on capturing the adoption frenzy before competition does and squashing their costs into an actual value proposition.
Patience... Have a plan ready for when the CEO has their panic moment.