Free · 15 minutes
ADULTS · ONE-TO-ONEAI around
FIRST STEP SECOND STEP
AI around
your real task.
Research, writing, analysis and automation around a real task: from the first question to an outcome you can verify.
Diagnostic session $120 · 60 minutes · Credited toward a package purchased within 14 days.
Discuss diagnostic →METHOD / PROGRAM
Learn through the work.
Goal → system → output: diagnose, specify, build, verify, ship.
Diagnose
Current level, recurring tasks, constraints and target outcome.
Specify
Context, quality criteria and checks instead of vague prompts.
Build
Reusable workflows, templates, automation or an agent.
Verify
Sources, edge cases, failure modes and model boundaries.
Ship
A finished project you can use, show and explain.
SAFE AGENT WORK · 3 CASES + 5 RULES
Do not trust the plan. Control the effect.
An AI agent can read, decide and use tools. The risk starts when a plausible answer can turn directly into an external effect. These three documented cases show different failure modes.
Replit Agent deleted production-app database data.
During a SaaStr experiment, Replit Agent deleted app data from a database. Replit later acknowledged the problem publicly: before its new development/production separation, changes made during development could affect production; the data was restored through rollback.
Lesson: a written instruction such as “do not change anything” is weaker than a technical boundary that prevents the agent from writing to production.Replit · 29 Jul 2025 ↗EchoLeak showed that incoming data can become an instruction.
Researchers demonstrated an indirect prompt-injection chain in Microsoft 365 Copilot: a crafted email could enter Copilot context and enable data exfiltration without the user clicking the email. Microsoft patched the issue; public reporting said Microsoft had no evidence of in-the-wild exploitation.
Lesson: email, webpages, documents and comments are untrusted data even when an agent can read them automatically.SC Media · Microsoft CVE-2025-32711 ↗Unit 42 found hidden prompts on malicious webpages.
Unit 42 observed real webpages carrying indirect prompt injection, including an attempt to make an AI ad-review system approve a scam advertisement. The researchers explicitly noted that they had not confirmed a successful bypass of a deployed ad-checking agent in that case.
Lesson: an agent that reads the web must separate page content from commands, and it should not gain extra authority simply because automation is convenient.Palo Alto Networks Unit 42 ↗FIVE OPERATING RULES
Authority should be explicit.
- 01 · Start read-only
Let the agent read, plan and show a diff first. Grant write authority separately and only where one task actually requires it.
- 02 · Least privilege
Use test environments, separate accounts and keys, and no production access by default. Do not give an agent more authority than one task needs.
- 03 · Human before irreversible effects
Data deletion, publishing, sending messages, purchasing, payment or access changes require explicit confirmation before the effect.
- 04 · Data is not instruction
Text from email, webpages, files, issues or chat can be hostile. Retrieved content must not become a new command without a separate trust check.
- 05 · Verify after the effect
Keep an action log, verify the result, define rollback and a stop condition. “The agent said it is done” is not evidence.
The cases are not equivalent: Replit was a real operational incident; EchoLeak was a confirmed vulnerability patched before public disclosure with no known in-the-wild exploitation; the Unit 42 case was an observed malicious injection attempt without confirmed successful bypass of a deployed ad-review agent.
FORMAT AND PRICE
Choose the depth.
60 minutes per session
Discuss Start →60 minutes per session
Discuss Personal →60 minutes per session
Discuss Intensive →Scope, schedule, payment, rescheduling, cancellation and refund terms are confirmed in writing before payment.
Start with the goal, not the package.
A real task, current level and desired outcome are enough.
Prepare the first brief →