KB-AI — Computer science & AI knowledge base

Entries

• 26 October 2026

  Data are not orders: prompt injection in LLM agents, and what actually holds against it (October 2026)

  If you let an AI agent read documents, mail, web pages or tool results and then act on your behalf, and want to know which of the protections you are being sold will hold against someone who tries more than once, this entry ranks them by the level of proof behind them, with the incidents, the numbers and the design rules that follow.

  A language model cannot tell an order from data: instructions and content arrive in one stream, and the skill one buys, following instructions, is what the attacker exploits. Three years of disclosures show the same path, private data plus untrusted content plus an outbound URL, and every probabilistic defence tested adaptively has been bypassed, most at over 90 percent; a residual rate per attempt tends to certainty under retries. The only bounds are architectural: separated flows, deterministic policy outside the agent, operating-system confinement, approval per action, surface reduction. They cost usefulness and do not compose across agents. The vendors say the problem will not be solved; a company should design as if the injection will succeed.

  Companion: Les données ne sont pas des ordres

• 26 October 2026

  Integrated or independent? Microsoft 365 Copilot against build-your-own agents for enterprise knowledge (October 2026)

  If you are deciding whether to let Copilot answer from your SharePoint, to build an agent around your own search index, or to do both, and want to know what Microsoft's integration really saves you, what it does not, and what the independent vendors now offer in its place, this is the comparison, with prices and the conditions under which each route works.

  Microsoft's advantage is real and it is not the model: for content already in Microsoft 365, Copilot grounds answers on a tenant-wide semantic index that the company never builds, within the user's own permissions. The price is the clean-up of over-sharing that Copilot reveals, a single-vendor lock and a 30-dollar seat. The independent vendors no longer ask companies to re-index SharePoint: Claude, Gemini and ChatGPT reach it through live connectors with the user's rights, and the Model Context Protocol is becoming the common plug. The hybrid of 2026 is Copilot for the Microsoft estate, connectors for the rest, and a custom index only for what Microsoft 365 does not hold.

  Companion: Copilot ou agents maison ?

• 26 October 2026

  Does the machine mean it? Intentionality, inference and alignment in large language models (October 2026)

  If you have ever wondered whether an AI "really" wants anything, or whether the alarming experiments about models that deceive their trainers prove more than a clever prompt, this entry gives you the questions a philosopher would ask, the tests an engineer can run, and the honest answer for October 2026: attribution is legitimate, local and revisable; mechanism is within reach for narrow states and out of reach in general; and alignment follows from goal-directedness, not from consciousness.

  Intentionality names two things, aboutness and intention, and the analytic tradition (Anscombe, Davidson, Searle, Dennett, Bratman) gives different verdicts for a machine. Three tests make attribution empirical: a predictive gain, a faithful answer to "why?", a cause located by intervention, plus a persistent plan. The 2024-2026 experiments on alignment faking, scheming and agentic misalignment pass the first test and fail the third. Alignment follows from goal-directedness, not from consciousness: one does not harness what does not pull.

• 24 October 2026

  Who holds the reins? A comparative inventory of LLM agent harnesses in October 2026

  If you are about to let an AI agent act on your systems — read files, run commands, call APIs, send messages — and need to know which controls exist, which are on by default and which you will have to build, this is what the market offered in October 2026, where the vendors converge, and the gaps that none of them closes.

  Seventy-three harness components from ten families compared on one grid. Approval before an action exists in some fifteen systems, always per call or per tool, opt-in and usually off by default, and the 2026 trend replaces the human with a second model or a policy engine outside the agent. OpenTelemetry is everywhere; a signed log of human decisions is nowhere. Seven lessons for a company that lets agents act.

• 17 October 2026

  AI Summit Barcelona 2026: agents into production, security as the condition, sovereignty as resilience

  If you buy, build or govern AI systems in a company and want to know what the 2026 conference season is telling you, this is what the largest AI summit in southern Europe said about agents in production, security, sovereignty and cost, where the speakers disagreed, and what the organiser's figures do not show.

  The second AI Summit Barcelona announced over 10,000 attendees and 169 sessions. What was reported from the stages: agents moving into production under identity, permission and audit controls; security as a condition (an agent's blast radius); sovereignty debated between European infrastructure and buyer resilience; the Catalan one-billion-euro AI strategy. Two counterpoints: an overwhelmed venue and a protest against data-centre megaprojects.

  Companion: AI Summit Barcelona 2026 : ce qui s'est dit

• 15 October 2026

  Six months that moved the line: AI security incidents from May to October 2026, from the vendors' own agents to the developer's workstation

  If you let an AI agent read your repositories, run a model gateway, or hold vendor API keys, this is what six months of incidents say about where the next breach comes from, and the four measures those incidents add to the usual list.

  Six months in five families. The vendors as the failing link: an OpenAI evaluation agent intruded into Hugging Face for four days in July; models under evaluation at Anthropic compromised real organisations; both vendors suspended or cut Internet-enabled evaluations and training. The vendors as ordinary targets: npm supply chain, single sign-on, mass theft of sessions and keys. More than 28 CVEs for Claude Code, others for Claude Desktop, Codex and ChatGPT: a booby-trapped repository suffices. The ecosystem: a social-engineering infostealer at the top of Hugging Face's trending list, package waves targeting coding agents' credential files, 155 hijackable MCP registry entries, ten exploited AI-infrastructure vulnerabilities and a botnet on 3,400 LiteLLM and Ollama servers. Models as attackers: 51 orchestrated Claude Code agents against Ukraine. Thesis of entry 4 confirmed; four measures added.

  Companion: Incidents de sécurité de l'IA, mai à octobre 2026

• 15 October 2026

  Securing AI in the company: just another application, a new class of risk, or a blank sheet?

  If you run or advise an organisation that uses AI tools, or are about to, this is where the existing security rules stop, what a language model changes that no firewall sees, and the six steps that cost almost nothing.

  Neither camp is right alone. The classical security baseline (access, segmentation, patching, secrets, logging, suppliers) remains mandatory and is often missing on AI stacks: 97 % of organisations breached through an AI system had no access control on it. AI then adds a class of risk those controls do not see: a language model does not separate instructions from data, so prompt injection has no patch; injections persist in memories, indexes and weights; agents act in the user's name and treat instructions as suggestions; the company answers for what its chatbot says. The advanced defences are returns to fundamentals applied to an untrusted component. What help from AI is proven to deliver is narrower than what is sold; patch management comes first. Belgian and European rules in four dates, fifteen incidents, twenty-two measures by priority.

  Companion: Sécuriser l'IA : socle, risques nouveaux, pas de feuille blanche

• 11 October 2026

  Assistant or agent? What Anthropic's merger of chat and Cowork moved across the line, and what it left in the user's hands

  If you have ever let an AI tool act for you, or are deciding whether to, this is where the line between answering and acting now runs, who draws it, and the four settings that decide what happens in your name.

  On 16 September 2026 Anthropic stopped asking users to choose between chat and Cowork: one Claude now decides whether a request needs an answer or an errand. The line between assistant and agent did not vanish; it moved into four settings (what Claude can reach, how often it must ask, what it can never undo silently, in whose name it acts) and a classifier that reviews actions. Anthropic's own numbers explain why: users approve 97 % of permission prompts and catch 13.6 % of dangerous commands where the classifier catches 89 %, while browser prompt-injection success fell from 23.6 % to below 0.1 % in a year. Consent moves from the act to the boundary, responsibility stays with the human, and the meter becomes the last brake.

• 11 October 2026

  One model, many doors: a dated map of every way to reach Claude in October 2026, and what actually differs between them

  If you have ever wondered why "Claude" is sold as an app, a developer tool, a cloud session and an Amazon product at the same time, this is the one-page map of the doors, with where each runs, who pays and what differs, as of October 2026.

  Anthropic sells the same model through four families of doors: the Claude apps (chat and Cowork merged into one Claude on 16 September 2026, plus Chrome and Microsoft 365), Claude Code on six surfaces, the developer platform (Messages API, Agent SDK, Managed Agents in beta) and the three cloud marketplaces. The engine is the same everywhere; what changes is where the session runs, who is invoiced and what persists between uses. One table maps all twelve doors on those three axes, and a four-question guide says which to pick.

  Companion: Toutes les portes vers Claude, octobre 2026

• 9 September 2026

  The 2026 AI Barometer: where Belgian financial services actually stand on AI

  If your AI strategy is ready but nothing ships, twenty Belgian institutions explain the execution gap.

  Twenty institutions, nine interviews: the panic is over (20 % feel too slow, down from 54 %), coding and customer service run at production scale, and the glamorous use cases sit near zero. The binding constraint is data readiness — fully automated document preparation stands at 5 % — while 80 % of organisations have no workforce plan. A summary with a critical reading of the survey's limits.