Camel on t0ul

The dual-LLM brain

Tue, 10 Feb 2026 00:00:00 +0000

Part of my AI Security Engineering series, a local email-to-calendar agent I build, then attack, then harden. If you have not set up the lab yet, start with Set up your lab. The lessons are on GitHub, and the agent itself lives at t0ul/emaildrop.

Split the brain

The isolation chapter kept dangerous code from reaching anything. This chapter is Part 4’s other big idea, and it goes after the root of every injection in the book: the fact that one model both reads the untrusted email and decides what the agent does. When the reader and the actor are the same model, a sentence in an email that says “do this” is sitting in the mind of the thing that does things, and no amount of asking it nicely to behave, as the spotlighting post showed, reliably keeps it from obeying.

Agent-to-agent hand-off

Tue, 17 Feb 2026 00:00:00 +0000

The seam between the two brains

The last post split the brain in two: a planner that decides and a reader that reads untrusted text but cannot act. I ended it by admitting the split rests on something I had not built yet. The two halves have to talk. The planner decides on a plan and the executor carries it out, and between them is a message that says “here is the plan, run it.” If the executor will act on any message that claims to be the plan, then the line we drew between reading and acting has a door in it, and anyone on the bus can knock.

Hallucinated dates

Tue, 21 Apr 2026 00:00:00 +0000

A date that was never there

The last post caught data that was wrong in the email: a weekday that did not match its date, a borrowed time, a flipped negation. Every one of those was catchable because the email contradicted itself, and a deterministic check could see the contradiction. This post is about the error with no contradiction to find. The email simply does not say when an event is, and the model, asked for a date, makes one up.