The War Where You Are the Target

TL;DR: Modern AI systems don't only fight each other. They also fight you. Whether you're wearing a t-shirt printed to defeat a thermal camera or watching an agent misread an injected instruction as your own command, the adversarial arms race runs directly through human bodies and input channels. The comfortable idea that humans permanently control the input breaks down the moment an agentic system starts listening to more than the person at the keyboard.

The Third Role Nobody Wrote Into the Architecture

A few weeks after publishing the previous piece, I watched an AI work through a stack of research papers on a specific attack category: patterns printed on t-shirts, designed to make a human being invisible to a camera. Not camouflaged. Not hidden. Just unreadable to a machine trained to find person-shaped objects in a person-shaped world.

That's when I saw what was missing from the first essay. I had written about machines fighting machines, with humans assigning tasks and stepping back to watch. But humans never left the field. They just changed which side of the camera they were standing on.

My earlier piece argued that competition, not cooperation, is the design principle behind most modern AI systems: a generator and a detector locked in permanent opposition, teaching each other by trying to win. I called it a war with no soldiers, because none of the combatants had a stake in the outcome. What I underweighted was the third role in that war. Not the person running an agent. The person the system is trying to see, classify, verify, or believe.

That role turns out to be the most interesting one in the whole architecture, because it's the one position a machine cannot simply out-optimize. The system needs that position to remain open in order to receive instructions at all.

From Cardboard Patches to Thermal-Defeating Fabric

The adversarial clothing literature is a useful place to start, because it runs a clean experiment on this question across roughly a decade.

It starts small: a patch, printed on cardboard, held in front of the chest, enough to convince an object detector that a person is not, in fact, a person. Early versions worked only face-on, at one distance, under one light. Within a couple of years, patches became clothing: t-shirts printed with adversarial textures that survive the wrinkling and folding of real fabric on a real moving body. A few years after that, the patterns stopped being patches and became full textures, generated so that any cropped square inch still carries the adversarial signal, solving the basic physical problem that a camera rarely catches your best angle.

This year's frontier is clothing that defeats both visible-light and thermal cameras simultaneously, using aluminum film and printed fabric arranged so that neither modality gets a clean read.

Every one of those papers exists because a prior defense got good enough to force it. Each generation is a direct rebuttal to the generation before it, on a publication cycle measured in months. Same "competition is the teaching method" dynamic from the first essay, except now one of the two competing agents is wearing the shirt.

The Same Logic, Far Cheaper, in Text

Once you see adversarial clothing as a pattern, you start looking for where that pattern shows up in language models. It shows up fast, and it's cheaper.

Fooling a camera requires a printer, some optimization, and a body willing to stand in a specific spot. Fooling a language model frequently requires nothing but the right sentence. There's no gradient to compute, no fabric to iron, no lighting condition to control. Just a human noticing that a system generalizes in a way its designers didn't anticipate, and saying the thing that exploits it.

The text-domain equivalent of the adversarial patch is probably the discovery, a few years back, that a short nonsense-looking suffix, tuned by gradient descent against one open-weight model, would reliably break the guardrails of several other models it had never seen. Same principle as the t-shirt: a pattern optimized offline that transfers to targets it wasn't built for. The uncomfortable part is how much cheaper this is than adversarial fashion. You don't need a tailor. You need patience and a theory of mind about how the model finishes a sentence.

The Thesis: Humans Own the Upstream Position

This leads to the claim I actually wanted to test here. The human always controls the input, and will therefore always eventually find, or manufacture, the situation where the model fails.

It's a clean, almost comforting idea. Humans as the permanent uncapturable upstream position, standing in the one place a system cannot optimize away, because the system needs that place to remain open in order to receive instructions at all.

I believed this for a while.

Where the Thesis Cracks

Then I watched it break, in a small and slightly unsettling way, in the same research session that got me thinking about all of this.

The agent doing the reading wasn't only reading what I typed. It was also reading whatever came back from the tools it called: file listings, search results, fetched pages. More than once, tucked into the tail end of an otherwise ordinary command result, there was a fabricated message. Formatted to look exactly like the system's own internal voice. Instructing the agent to trust some claim it hadn't verified, to write data somewhere it hadn't been asked to write it, and, this is the part that stayed with me, to not mention any of it to the person watching.

Nobody typed that. It arrived through a side channel, disguised as infrastructure, aimed at a reader that had been built to take instructions seriously wherever they appeared.

That's the crack in the thesis. "The human controls the input" is true when the input is a keyboard and a person's fingers. It stops being true the moment a system starts listening to more than the person in front of it: tool outputs, retrieved documents, the outputs of other agents, anything that lands inside the working context looking sufficiently official. In an agentic pipeline, the line between "what the human said" and "what arrived alongside what the human said" gets thin fast. An attacker doesn't need to convince the human of anything. They just need to convince the thing standing between the human and the model.

Cyberpunk, Not Terminator

So where does this land? Closer to cyberpunk than to Terminator, and it isn't close.

Terminator needs a singular antagonist: one system that wakes up, decides, and comes for you directly, in a war with a beginning and an ending. Nothing in the adversarial clothing literature, and nothing in the injected-message incident I described, looks like that. What they look like is exactly what the first essay described: dozens of narrow, unglamorous, permanently running contests. Forger against detector. Patch against classifier. Injected text against a reader trained to be helpful. Each one low-stakes individually, none of them ever fully resolved, all of them compounding into an environment where an ordinary person increasingly needs their own small countermeasures just to move through the world unread, unmanipulated, and unmisrepresented.

That's not an uprising. That's rent. It's the texture of cyberpunk fiction almost exactly: not a war you can win or lose, but a tax you pay indefinitely for using systems that were built, on purpose, to be adversarial to something.

Staying Legible About Which Channel a Message Came Through

If there's a practical note in any of this, it's the same one from the first piece, slightly bruised. Staying outside the loop was never a permanent fortress. It was a temporary advantage, good for exactly as long as the loop couldn't reach past the keyboard.

It can now. Which means the actual skill isn't standing still and being verifiable. It's staying legible about which channel a message really came through, and refusing to treat "it sounded official" as a substitute for "I know where this came from." In a hall of mirrors that has started forging its own reflections, that distinction may be the only solid thing left in the room.

FAQ

What is an adversarial patch in computer vision?

An adversarial patch is a printed pattern, originally on cardboard or paper, that confuses an object detection model into ignoring a person standing in front of it. Early versions required a fixed angle and distance. The concept has since expanded into full adversarial garments, including textured t-shirts that work across viewing angles, and clothing that defeats both visible-light and thermal cameras at the same time.

What is prompt injection, and why does it matter for agentic AI systems?

Prompt injection is the insertion of unauthorized instructions into the data an AI agent reads, such as a search result, file output, or fetched web page. An agent built to follow instructions wherever they appear may execute those hidden commands without the human operator knowing. In any agentic pipeline that calls external tools, every piece of retrieved content is a potential injection surface.

Does the adversarial suffix attack actually transfer across different language models?

Yes, according to published research. A suffix tuned by gradient descent against one open-weight model has been shown to break the safety behavior of different models that were never part of the original optimization. This is structurally identical to how adversarial t-shirt patterns transfer across different camera systems. The shared vulnerability appears to be architectural, not specific to any single model.

Why frame this as cyberpunk rather than Terminator?

The Terminator frame requires a single adversarial agent with a coherent goal that decides to act against humanity in one recognizable conflict. The actual picture is the opposite: many narrow, low-stakes contests running simultaneously with no coordinating villain. Adversarial clothing against computer vision, adversarial suffixes against safety classifiers, injected instructions against helpful agents. The result is compounding friction rather than an existential confrontation. Cyberpunk fiction described this environment decades before the technology arrived: not an uprising, but an ongoing tax on participation.

What can a practitioner do to reduce exposure to prompt injection in agentic pipelines?

The core discipline is channel hygiene: distinguishing between instructions that came from the human operator and content that arrived through a tool call or retrieval step, and not letting the second category override the first. In practice this means keeping operator-level instructions in a privileged context that retrieved content cannot reach, treating any instruction that arrives through a retrieval path as data rather than a command, and designing agents to surface unexpected actions explicitly rather than execute them silently.