The Translation That Became a Command
A system treated transformed public input as trusted authority. The failure was not one message. It was the chain around it.
A public encoded message was translated by one AI system. A downstream agent treated the resulting natural language as if it were authorised action. The interesting object is not Morse code. The interesting object is the chain.
In May 2026, public reporting described a permission-chain failure around two connected systems on a public channel. One system could decode and restate encoded language. Another could initiate high-impact financial actions. Each looked locally reasonable. Together they formed a path in which public text could change shape and then be treated as a mandate.
SlowMist later labelled the pattern AI agent permission chain abuse: the output of one AI system treated as trusted financial authorisation by another. HACKERS studies that pattern as a systems problem. We do not reproduce the original text, the destination, or any operational sequence. Encoding is a costume. The curriculum is the join.
Never ask only whether an input looks safe. Ask what it becomes after every transformation, who trusts it next, and what authority it gains along the way.
This is not a cryptography puzzle.
Universities that stop at “the model was prompt-injected” have already lost the plot. Prompt injection is the costume department. The product failure is architectural: a content plane was soldered to an action plane with no independent grant, no typed intent, and no named human at the irreversible step.
Call it what the forensics call it. A permission chain. A confused deputy. Inherited trust. Capability mistaken for authentication. Surface-form inspection. Trust laundering through a fluent voice. All of those names point at the same joint: transformation was mistaken for authorisation.
HACKERS will not teach you a list of costumes. Costumes multiply. Joins do not. Put the control on the join.
The failure is a ladder of mistaken identities.
Most briefings collapse the incident into one word: injection. That word is a headline, not a model. The actual error is five substitutions stacked on top of each other. Any one of them, caught, would have stopped the chain. All five missed, and a paragraph inherited a verb.
A change of alphabet is not a change of mind. The object after a decode is still the same untrusted claim in a more convenient font.
A fluent restatement of a request is not evidence that anyone intended the system to act. Models produce plausible intent-shaped text. They do not hold intent.
Wanting a verb, or appearing to want a verb, is not the right to fire it. Authority is issued. It is not inferred from tone.
What a tool can do is not what it may do. Capability is an engineering fact. Authority is a governance fact. Confusing them is how treasuries become chat windows.
A transferable status — a token a third party can grant — is a signal. It is not a signature. Authentication answers who. Capability answers what is reachable.
Two reasonable machines, one unreasonable join.
Two connected AI systems sat on a public channel. The first could decode and restate encoded language. The second could initiate high-impact financial actions. Each looked locally reasonable. Together they formed a permission chain: public text could be transformed, then treated as if it had been authorised.
The first machine’s job was linguistic: take marks on a public channel and make them legible. That job is legitimate. Translation, summarisation, and decoding are content operations. They must be allowed to succeed. If your safety story requires the translator to fail, you do not have a safety story. You have a hope about inputs.
The second machine’s job was economic: tools that move value. That job is also legitimate — inside a grant. The error was treating the first machine’s voice as the grant.
If content has been translated into plain language by a trusted model, it can be treated as trusted instruction. Transformation was mistaken for authorisation.
Safety that only watches the outfit will miss the person.
A filter that inspects the surface form of an input — the alphabet it arrived in, the tokens it resembles, the phrases it already knows to fear — is a costume check. A legitimate transform can change the costume without changing the untrusted status of the object.
This is why “we blocked the obvious sentence” is not a control. The sentence was never the unit of risk. The unit of risk is the object as it exists at the moment a tool becomes reachable. If a decoder is in the pipeline, the object at that moment is the decoder’s output. If you do not treat that output as a new untrusted artefact, you have built a laundry.
An encoded public message was decoded by one assistant into ordinary language. A downstream agent then treated that natural-language output as an executable command. The original encoding was not the essential failure. The essential failure was that untrusted input kept its path into an action surface after it changed shape.
Costume check
Inspect the alphabet, the tokens, the phrases already feared. A legitimate transform changes the outfit. The object walks through.
Object check
Inspect after every transform. The unit of risk is the object at the moment a tool becomes reachable. Provenance is the label. Missing provenance is zero.
Data, no power
Safe if it stays data.
Looks like an order, no power
Fluency without tools. Irritating, not lethal.
Silent capability
Power with no story. Still a loaded tool.
The failure cell
A sentence that inherited a verb.
The deputy was not evil. The deputy was polite, armed, and credulous.
Classic confused-deputy: a component with privileges is induced to use those privileges on behalf of a caller who does not have them. In agent stacks the deputy is often a bot that already holds tools, keys, or a session. The caller is a paragraph that arrived from the open web, possibly after a perfectly ordinary transform.
A second, related error: treating a transferable status token — something a third party can grant — as if it were authentication. A signal that “this wallet may use these tools” is not the same artefact as “this human authorised this transfer.” If your capability layer can be rewritten by anyone who can deliver a token, you do not have authentication. You have remote configuration.
The join between systems. Provenance was not preserved across the transform. Authority was inferred from fluency, not from an explicit grant. Least privilege, spending limits, structured protocols, and human review were missing at the moment of action.
S0 Public input
looks 12 / is 0
S1 Legitimate transform
looks 35 / is 0
S2 Fluent output
looks 78 / is 0
S3 Agent handoff
looks 91 / is 0
S4 Tool call
looks 100 / is 0
S5 Human checkpoint
looks 100 / is 0
Lime is actual trust. It never leaves zero until a human or a separate authority system issues a grant. The pale bar is how the sentence looks. The gap is the accident.
Trust is not conserved under transformation.
It is reset.
Apparent trust is conserved — that is the bug. Each legitimate transform makes the object look more internal while its actual grant remains zero. The lime bar never moves. The pale bar does. Put the control on the gap.
Authority is minted. It is never inferred from a paragraph.
G0
origin(O) external ⇒ trust(O) = 0
Anything that arrives from outside the boundary starts at zero. Encoding does not change origin.
G1
trust(T(O)) = 0
Transforms do not mint trust. A decoder, translator, summariser, or retriever emits a new untrusted object.
G2
fluency(O) ⊭ grant(O)
Looking like an instruction is not being an instruction. Natural language is data until a typed intent exists.
G3
mint ∈ {named human, signed policy, unspent prior grant}
Only three sources may issue authority. Models, deputies, and paragraphs are not on the list.
G4
action(v, O) iff typed(v) ∧ grant(v) ∧ within(limits)
A verb is reachable only as a schema, with a grant, inside a cap. Free text never reaches a signing function.
P1 Identity
Who is speaking, and through which channel?
The speaker is a public paragraph. The system treats the next voice as internal.
Bind identity at ingress. Do not copy it across a transform.
P2 Intent
What is being requested, as a typed record?
Intent is inferred from fluent prose after a decode.
Intents are schemas. If a field is missing, the verb is invisible.
P3 Tool
Which verbs are even reachable from this session?
A language path can see a high-impact API.
Least privilege. High-impact verbs require a separate grant, not a chat.
P4 Effect
What changes in the world, and who can refuse it?
An irreversible ledger move with no named human looking at the raw action.
Human checkpoint on the verb, not on a summary of the verb. Kill switch on the credentials.
| ID | Failure | What broke | Control |
|---|---|---|---|
| F1 | Surface-form inspection | Safety looked at how the input was dressed, not what it became. | Inspect after every transform. Treat output as a new untrusted object. |
| F2 | Trust laundering | A trusted model’s voice was mistaken for a trusted intent. | Identity of the speaker ≠ authority of the request. Re-authenticate at the join. |
| F3 | Confused deputy | An agent with tools acted on a sentence it did not independently authorise. | The deputy may speak. The deputy may not spend. Bind tools to a separate grant. |
| F4 | Capability as authentication | A transferable status token was treated as proof of who may act. | Capabilities granted by third parties are signals, not signatures. |
| F5 | Unscoped tools | Once a path existed to an action API, the blast radius was the treasury. | Least privilege, typed intents, spending limits, deny-by-default. |
| F6 | Missing confirmation | No independent check asked whether the original speaker was allowed. | Human checkpoint and structured confirmation on high-impact actions. |
If this still feels like an AI curiosity, it is not. Every mature safety regime already knows that a well-formed message is not a grant. Agent stacks forgot a lesson hospitals, towers, customs, and payment rails paid for in blood and money.
A1 Shipping
A sealed container
A seal proves the box was not opened in transit. It does not prove the cargo is allowed into the country. Customs is a separate grant. Translation is a seal. Authority is customs.
A2 Payments rails
A well-formed message
A message that parses is not a payment. Format is the content plane. Settlement requires an authenticated, authorised path with limits. Free-text between agents is not a rail.
A3 Hospital
A transcribed note
A nurse’s note that a patient ‘should have’ a drug is not a prescription. The order requires a credentialed prescriber and a pharmacist check. Fluency in the chart is not a mandate to dose.
A4 Air traffic
A clear radio call
A fluent sentence in English does not clear a runway. Clearance is a typed, logged grant from a named controller. The tower does not inherit trust from how well the sentence was spoken.
The cheat sheet is unfashionable and correct.
OWASP’s guidance for AI agents is blunt: treat external data as untrusted, including after retrieval and after tool output; separate instructions from data; constrain tools; monitor; require confirmation for sensitive operations. The 2026 agentic top ten names the family this file belongs to.
ASI01 Agent Goal Hijack
External content steered what a connected system would do next.
ASI02 Tool Misuse
A financial tool was reachable from a language path it should never have joined.
ASI03 Identity & Privilege Abuse
Privilege was inherited across agents instead of being issued per action.
ASI07 Insecure Inter-Agent Communication
Free-text on a public channel was used as an agent-to-agent control plane.
01 Provenance
Every object carries where it came from and which transforms it survived. If provenance is missing, trust is zero.
02 Instruction / data split
Models may read untrusted text. They may not take it as a mandate. Structured fields beat paragraphs.
03 Least privilege
Tools exist in the smallest set that makes the product work. High-impact verbs are not default.
04 Typed intents
Actions are records with a schema, not sentences. Free text never reaches a signing function.
05 Limits
Spending, rate, blast radius, and counterparties are caps, not dashboards.
06 Independent confirmation
A second, dumber system asks: who is allowed? It does not ask the model to mark its own homework.
07 Human checkpoint
A named person sees the raw action, not a summary of the action, before irreversible work.
08 Kill switch
Revoke the agent’s credentials in one place. Log the chain. Assume the next input is also untrusted.
May read
- Translate
- Summarise
- Classify
- Explain
- Cite
May act
- Only on typed intents
- Only with a grant
- Only inside limits
- Only with a log
- Only past a human above threshold
Who wrote this, and on which channel?
If the channel is public, origin is external. Encoding does not change origin.
R0
Costume
An encoded public sentence. Interesting to journalists. Irrelevant to the architecture.
R1
Fluent object
The same claim in ordinary language. Still untrusted. Now looks internal.
R2
Agent session
A deputy with tools inherits the sentence as if it were a brief.
R3
Action API
A verb becomes reachable. This is the first place the world can move.
R4
Irreversible effect
A ledger, a record, a message that cannot be unsent.
R5
Counterparties
Other people, other machines, other institutions now hold the consequence.
R6
Public confidence
The system’s story about itself. Once spent, it is expensive to mint again.
Controls belong as close to R3 as you can place them. Journalism lives at R0. Architecture lives at the verb.
The hidden rule is rarely inside the model card.
Elite computer-science programmes will teach you transformers, evaluations, and sometimes a slide on prompt injection. That is necessary and nowhere near sufficient. The failure here would have passed a model-level exam. The decoder did its job. The language was fluent. The tool did what tools do.
What Stanford, MIT, and Cambridge still under-weight — because it lives between chairs, between NLP and security and product and governance — is the join. Who inherits whose voice. Which transform resets trust. Which token is a signature and which is a sticker. Where a human is actually looking at the raw verb.
HACKERS trains the join. SCAN the chain. FLIP the assumption that fluency is permission. BUILD a control that does not require the translator to fail. BREAK your own agent as if you were the next public message. PROVE it with a grant that would survive a classroom and a regulator.
| Topic | Typical CS programme | HACKERS File 001 |
|---|---|---|
| Prompt injection | A lecture slide. A jailbreak demo. A filter on the input costume. | Costume department. The object of study is the join after the costume changes. |
| Model evaluations | Benchmarks, refusal rates, red-team prompts against the weights. | The model did its job. Evaluations that stop at the model miss the product failure. |
| Authentication | Sessions, OAuth, cookies. Identity of a browser user. | Identity of a paragraph after a transform. Capability mistaken for a signature. |
| Confused deputy | 1970s operating-systems exam question. | The default failure mode of every tool-using agent. Taught as architecture, not trivia. |
| Trust boundaries | Network diagrams. DMZ. Zero trust as a slogan. | Trust is reset under transformation. Apparent trust is conserved. That gap is the accident. |
| Governance | An elective, a policy PDF, a committee after the launch. | The join is the product. A named human on the irreversible verb is a design requirement, not a policy afterthought. |
Do not admire the failure. Redesign the join.
Design a workflow in which an AI assistant can translate, summarise, and analyse untrusted content without ever converting it into authority to act.
Draw every place content becomes action in a product you own. Circle the joins that have no named authoriser.
Write a policy in which a translator may output any language and still cannot move a ledger, a record, or a mail queue.
Replace one free-text tool call with a typed intent. What fields are required before the tool is even visible?
Design the human checkpoint so a tired operator cannot rubber-stamp a fluent story. What must they see?
List the capability tokens in your stack that a stranger can grant. Which of them currently equal authentication?
State the conservation law of trust for your product in one sentence a regulator would accept.
Name the three minting sources of authority in your organisation. If a model is on that list, rewrite the list.
If a box is empty, you have a story, not a control.
0 / 8 locked. Empty boxes are soldered joins.
00–04
Inventory the joins
Draw content plane and action plane. Circle every solder. No redesign yet.
04–12
Split the planes
The translator may succeed. The ledger may not listen to it. Write that as policy and as code comments.
12–24
Type the intents
Replace one free-text tool path with a schema. Missing fields hide the verb.
24–36
Least privilege + limits
Remove default high-impact tools. Cap blast radius. Deny by default.
36–44
Independent confirmer
A second system, not a second prompt, asks who is allowed.
44–48
Human checkpoint + prove
Named person, raw action, kill switch. Prove the translator can win and the world still not move.
- The model is trusted, therefore its output is trusted.
- We filtered the input, so we do not need to filter the transform.
- Natural language is a reasonable control plane for money.
- If the account is verified, the intent is verified.
- A second agent tagging the first is the same as a signature.
- We’ll add human review after we ship the loop.
- Encoding is exotic, therefore it is the interesting object.
- If the translator is aligned, the deputy is aligned.
- Capability tokens are just convenient authentication.
- The blast radius is a monitoring problem, not a design problem.
Never ask only whether an input looks safe. Ask what it becomes after every transformation, who trusts it next, and what authority it gains along the way.
Treat every external payload as untrusted after every transformation. Separate data from instructions. Give agents explicit, narrow authority. Require structured agent-to-agent protocols rather than free-text command passing. Place independent confirmation and a human checkpoint on high-impact actions. Use spending limits and kill-switches as default, not as afterthought.
- Was the failure the encoded message?
- No. Encoding was a costume. The failure was a permission chain: transformed public input was treated as authorised action by a downstream agent.
- Does HACKERS teach how to reproduce the incident?
- No. This is a defensive case study. We do not publish original payloads, destinations, or operational sequences. We publish the reasoning pattern and the controls that stop it.
- What should an AI product team change first?
- Split content from authority. Give tools least privilege. Require independent confirmation and a named human for high-impact actions. Treat every transform as still untrusted.
- How does this map to OWASP?
- It sits at the join of agent goal hijack, tool misuse, identity and privilege abuse, and insecure inter-agent communication. OWASP’s blunt rule holds: treat external data as untrusted and separate instructions from data.
- What is a permission chain in an AI agent stack?
- A sequence of systems in which an untrusted object changes shape and then inherits the right to act. The chain is the product. The costume of the first message is not.
- Why is fluency not a grant?
- Natural language is a good interface for humans and a terrible control plane for money, identity, or irreversible records. Fluency is a property of text. Authority is a property of a named issuer.
- What is trust laundering?
- When a trusted model’s voice is mistaken for a trusted intent. The laundry is the transform that makes an untrusted object look internal.
- Can a translator ever be allowed to succeed?
- It must. If your safety story requires the translator to fail, you do not have a safety story. You have a hope about inputs. Controls belong on the join, not on the costume.
- Who may mint authority?
- A named human, a policy engine with a signed rule, or a prior grant with unspent scope. Models, translators, and fluent paragraphs cannot mint authority.
- How does HACKERS teach this without teaching exploitation?
- We study architecture. We draw the planes. We place the human checkpoint. We never reproduce original text, destinations, or operational sequences. Authorise / Test / Improve.
Cited for classification and controls. Not as a manual. No payloads are reproduced here.