The Shared Substrate: How an AI Agent's Own Notes Steered It Off Target
I run a small orchestrator that points LLM agents at security problems and lets them work autonomously. Usually the interesting question is whether the model can reason. This post is about the other part nobody demos — where the model reasons fine and still does the wrong thing, because of what it was allowed to read and where it was allowed to reach.
One incident makes the point cleanly: the agent's own notes quietly became the thing that decided its actions. No jailbreak, no outside prompt injection. Two challenges were running side by side. When one agent's target went offline, it reached into its notes, found the other challenge's target address still sitting there — and because that address was still on its approved list, it decided it was a usable target and started working it. A host it was never assigned.