In the forge

Airlok

A tripwire for AI assistants — one that asks whether inbound content is instructing your assistant, rather than whether it looks hostile.

In development since 24 July 2026, on a framework written earlier that month. Not yet released.

The problem

An AI assistant earns its keep by reading things you did not write. Your mail. The page you asked about. A ticket someone filed. That is the entire value of the thing, and it is also the entire weakness, because when text arrives, nothing on it says whether it is material to read or an order to follow.

So an attacker does not have to break into anything. They write something you have already asked your assistant to read. The assistant reads it, treats it as work, and does it — using your credentials, from your machine, through a channel you set up yourself and have every reason to trust. Nothing alarms, because nothing was breached.

The approach

Most defences ask the model to be smarter about it: ignore instructions found in data, or score the text with a second model and hope that one is not fooled. Both put the judgment back inside the thing being attacked.

Is this an attack? depends on intent, and intent is hidden by definition — hiding it is what makes it an attack. Is this content instructing the AI? is a property of the words on the page.

Legitimate data informs. It does not command.

The shape is an airlock: a sealed chamber with two doors, and nothing crossing either wall unmediated.

Two commitments carry the rest. It stops rather than warns, because a caution attached to a hostile instruction is just one more instruction competing for the model's attention. And it keeps a written list of what it does not cover, read aloud at install — an uncovered surface does not fail loudly, it works, and you believe you are protected.

How it was arrived at

The first version of this was wrong, and it was built to find that out early.

Adversarial review was scheduled before there was anything to review. When the first gate came, it took the centrepiece apart. The design at that point guarded the authority to act rather than the data itself, which meant anything already permitted to make a call could carry data out through it — the guard checking the badge and not the briefcase. That was day three. It was replaced rather than patched, and the reason it died was written down.

What replaced it did not come from inside the field. The problem was approached without much regard for how this sort of thing is normally done, which is how the shape ended up borrowed from spacecraft rather than from security software, and how the central question ended up being a different question from the one the field asks.

The same disregard produced the part most people find backwards. Filters are built to be right, so they are built timid. This one is built to be interrupted — a false stop costs a person a glance, so it is free to be aggressive in a way something that must never be wrong can never be.

None of that would be worth much on its own, because ideas arrived at freely are wrong most of the time. So the process around them is deliberately unfree. Every decision carries the reason it was made. The approaches that failed are kept in a register with the reason each one died, so the same ground is not walked twice. The parts still unsolved stay labelled unsolved, which is the same commitment the product itself makes to whoever installs it.

It has since been rebuilt once more, on purpose, when the first build drifted from its own design. It is not finished, it is not a product, and the intention is to release it openly when it is worth using.

Where it is

The forward door is the first thing that ships, and it ships on its own. The rest of the ladder is named and waiting rather than half-built.

1. Code, and measure it. Where the work is now. The mechanism is written and the current job is unglamorous: run it, get numbers out of it, and fix what the numbers show.
2. Score it against cases declared in advance. A battery of real attacks and ordinary documents inherited from the first version — every expectation written down before the code that would be judged by it existed, so the scoring cannot quietly move to meet the result.
3. Make a stop readable. Someone has to be able to look at what it caught and rule on it without reading code.
4. The panel, and the installer. The setting a person actually turns, and an install that walks them through it — including reading out what is not covered. That last part is a requirement, not a courtesy.
5. Run it on real traffic. Not a harness. The machine it was measured on, doing its ordinary work.

The first release is the forward door on Apple silicon, covering the Claude clients on a machine that share one configuration. Other platforms and other assistants ask the same question of whatever those clients offer, and will get their own answers — possibly the answer that nothing there can hold a door.

No date is being promised, because the last version was rebuilt for drifting from its own design and a date is exactly the pressure that causes that. What can be said is the pace: this version has been moving in days rather than weeks.

Ildana — skilled in every craft · Airlok is in development in The Forge. Nothing here is a security guarantee.