claim candidate goes to: this-edition V villager
The desktop is the barrier, not the model: prompt injection is not solved, so the box has to hold
Anthropic's own measurements of prompt injection in browser use went from a 23.6% attack success rate without mitigations to 11.2% in August 2025 and to about 1% in November 2025, a rate that in their words 'still represents meaningful risk'; Brave showed in October 2025 that nearly invisible text in screenshots could hijack agentic browsers; OpenAI wrote that it is unlikely ever to be fully solved. A desktop shows an agent pages, documents and emails written by other people, so over a working month the question is not whether a page will try but what the agent can do when one succeeds. An egress allowlist limits where it can send, a box without secrets limits what it can send, a revocable identity limits for how long, a recording says what happened; the model's defences reduce how often that matters and do not replace it. One mandate per task, written before the desktop exists, and the desktop configured from it.
Decided by. Nobody yet: a candidate for Dinis to read, comment on and decide (keep, rewrite, merge, cut, article first, later, not doing it).
Note. The nine properties of a locked-down agent desktop: isolation, an egress allowlist, secrets kept outside, an identity of its own, a live view and takeover, a record, a clean reset, billing that follows the work, the right desktop. On 7 October 2026 every one could be bought somewhere and no single product had all nine; the three that stop a hijacked agent doing damage (allowlist, secrets outside, own identity) were documented on one product, with two of them in private beta there. The OpenAI quote is from news coverage. Extends mandate-reach-gap and not-on-your-laptop with the desktop case.
Where it comes from
- A locked-down desktop for an agent, by the minute, is still hard to rent The model cannot be the barrier; What locked down means; What we would build from what exists (newsroom)
What it answers in the 2018 book
- Don't touch production answered outline, Security
- Threat Modeling answered outline, Security
Where it goes
Chapter Controlling your agent: RiskMandate, part Build it without a server (drafting); topic Controlling your agent: mandate, reach and hope versus enforcement.
Other ideas proposed for the same chapter: Mandate, reach and the gap: hope versus enforcement, Code is a liability; the future is the smallest code that does the job, Learning to hack is still how you learn how things work: draw the line where the attacker is, The secret goes from the drop into the tool, never into the chat, Security experience is what lets you ship with known gaps: list them, match them to the reader, say what would change the call, The agent behaviour policy is the due diligence document: a buyer reads the blast radius off it, and its absence says the most, A vault per conversation and per job: a leaked key exposes one small thing, not an inbox, Reach is a computed value, and new capability lands as excess, never as new authority, Who can pull the plug: an agent that cannot be stopped is riskier than one that can, A third input: a behaviour policy beside the system prompt and the prompt, which the vendor acknowledges, enforces where it can and answers for, Models do not separate code from data, so a rule in the prompt can be argued with by an email, Aviation and payments got safe when the rule, the liability and the business model pointed the same way, Zoom into an agent's behaviour policy and you find the business logic, which only the business can write, Software was the law: the rule the screen enforced by omission is no longer enforced once an agent calls the API, Every rule lands in one of three states: backed by a control, governed by an accepted risk, or resting on hope, Write down what your agent can reach in twenty minutes: list its tools, say what you wanted it for, write the gap.
Node idea:the-model-cannot-be-the-barrier in graph.json; see it in the graph. Source: admin/content/graph/ideas.json.