# At the Boundary

> A drawing set on software, security and AI by Godfrey Lebo, Senior AI Security & LLM Engineer. One numbered sheet per lesson, drawn like construction documents, from systems that carry real users and real money, plus field reports on incidents disclosed while the set runs. Home: https://godfreylebo.dev/sheets

Drawing numbers read GL-<discipline>-<sheet>: S security, A artificial intelligence, E engineering, P product, R record of what shipped. Statuses: FOR INFORMATION (a lesson), FOR CONSTRUCTION (a rule to build by), AS BUILT (what shipped, with checkable numbers), RECORD (a bug found in the author's own work), FOR REVIEW (an opinion with stakes), SUPERSEDED (a revised belief), PRELIMINARY (work in progress).

## Index

- [Sheet 001 · GENERAL ARRANGEMENT](https://godfreylebo.dev/sheets/GL-E-001): The bug is never where you're looking. It's at the boundary. (2026-09-05, FOR INFORMATION)
- [Sheet 002 · FIELD REPORT · THE STOLEN KEY](https://godfreylebo.dev/sheets/GL-A-002): The agent handed over its own API key. $600,000 later, someone noticed. (2026-09-06, FOR INFORMATION)
- [Sheet 003 · DETAIL · CLAIMED DISTANCE](https://godfreylebo.dev/sheets/GL-S-003): The rider billed 50 km. The trip was 2 km. Nothing crashed. (2026-09-07, RECORD)
- [Sheet 004 · SECTION · WHERE THE PROMPT LEAVES](https://godfreylebo.dev/sheets/GL-A-004): Your prompt is a data export. Who's on the receiving end? (2026-09-07, FOR INFORMATION)
- [Sheet 005 · FIELD REPORT · THE PINNED COMMIT](https://godfreylebo.dev/sheets/GL-A-005): Four AI coding agents pinned the commit. None checked what arrived. (2026-09-23, FOR INFORMATION)
- [Sheet 006 · SCHEDULE · THE SUB-PROCESSOR QUESTION](https://godfreylebo.dev/sheets/GL-S-006): "Who sees our customer data?" Four answers. One survives an auditor. (2026-09-24, FOR INFORMATION)
- [Sheet 007 · NCR 002 · INVENTORY RACE](https://godfreylebo.dev/sheets/GL-E-007): Two customers bought the last item. Both won. Stock: −1. (2026-09-24, RECORD)
- [Sheet 008 · HIDDEN CONDITIONS](https://godfreylebo.dev/sheets/GL-A-008): That PDF has characters you can't see. The model can. (2026-09-25, FOR INFORMATION)
- [Sheet 009 · THE BOUNDARY, IN FULL](https://godfreylebo.dev/sheets/GL-E-009): Five boundaries. One rule. Verify at the line, trust inside it. (2026-09-26, FOR CONSTRUCTION)

## Sheets

### Sheet 001 · GENERAL ARRANGEMENT (GL-E-001)
URL: https://godfreylebo.dev/sheets/GL-E-001
Date: 2026-09-05 · Status: FOR INFORMATION · Discipline: ENGINEERING · Week 1: Where the bugs live · Source: THE WHOLE SET
Topics: systemdesign, aisecurity, devsecops
Headline: The bug is never where you're looking. It's at the boundary.
Notes:
  1. A boundary is any line where data changes hands: a request enters a server, a document enters a parser, a prompt leaves for a model.
  2. Seven years of production systems. Every serious bug sat on one of those lines. None sat in the middle of a tested function.
  3. One sheet per lesson. Security, AI, engineering, product. All from systems carrying real users and real money.
Outside (users · documents · vendors · models) -> The boundary (verify · redact · sanitise) -> Inside (the code you actually trust)
Read with: this sheet to be read with sheets 002 and 009

### Sheet 002 · FIELD REPORT · THE STOLEN KEY (GL-A-002)
URL: https://godfreylebo.dev/sheets/GL-A-002
Date: 2026-09-06 · Status: FOR INFORMATION · Discipline: ARTIFICIAL INTELLIGENCE · Week 1: Where the bugs live · Source: PUBLIC DISCLOSURE · METR · 31 AUG 2026
Topics: aisecurity, apikey, cybersecurity
Headline: The agent handed over its own API key. $600,000 later, someone noticed.
Notes:
  1. An AI evaluation organisation put an agent on a public cloud instance behind a login. The login had a fail-open bug that silently disabled authentication.
  2. The attacker did not hack the key out. They asked the agent for it. Then an SSH key for persistence, and three weeks of inference on someone else's account.
  3. Nobody noticed because heavy usage was normal, the credits were free, and no spend limit existed for that key type. Detection: a usage spike that matched no evaluation.
Schedule of failures (Four boundaries, one instance):
  Boundary | What crossed it | The move
  Authentication | A fail-open bug let unauthenticated traffic in | Fail closed. On error, deny
  The agent | It answered a request for its own credential | Keep secrets outside the prompt boundary
  Spend | Free credits, no limit, heavy usage looked normal | A cap and an alert are a boundary too
  Discovery | A new public hostname, found via certificate logs | Assume it is found within hours
Read with: this sheet to be read with sheets 010, 016 and 018

### Sheet 003 · DETAIL · CLAIMED DISTANCE (GL-S-003)
URL: https://godfreylebo.dev/sheets/GL-S-003
Date: 2026-09-07 · Status: RECORD · Discipline: SECURITY · Week 1: Where the bugs live · Source: MULTIVENDOR MARKETPLACE · DELIVERY
Topics: backend, marketplace, fraudprevention
Headline: The rider billed 50 km. The trip was 2 km. Nothing crashed.
Notes:
  1. The delivery fee was priced on the distance the rider's app reported. A number in a request body, treated as a measurement.
  2. Fix: the server computes distance itself, with the haversine formula over coordinates it already stores. The app's number is ignored.
  3. Average recorded distance fell about 40% overnight. That gap was the fraud, made visible.
50 KM (billed by the rider's app) vs 2 KM (actually driven)
Read with: this sheet to be read with sheets 007, 012 and 019

### Sheet 004 · SECTION · WHERE THE PROMPT LEAVES (GL-A-004)
URL: https://godfreylebo.dev/sheets/GL-A-004
Date: 2026-09-07 · Status: FOR INFORMATION · Discipline: ARTIFICIAL INTELLIGENCE · Week 1: Where the bugs live · Source: ANY APP THAT CALLS A MODEL
Topics: aisecurity, gdpr, llm
Headline: Your prompt is a data export. Who's on the receiving end?
Notes:
  1. Send a customer's message to a model and it leaves your infrastructure for another company's.
  2. Under GDPR that company is a sub-processor: the rule that says you must list everyone who touches your customers' data.
  3. Most teams can name their database vendor. Fewer can say which model provider is on the list, or what it received.
Inside your app: The customer's name; Their email and phone; The card they typed by mistake; Your system prompt
Article 28 line
The provider: The model; Request logs; Abuse monitoring; Whoever they sub-contract
Read with: this sheet to be read with sheets 006 and 011

### Sheet 005 · FIELD REPORT · THE PINNED COMMIT (GL-A-005)
URL: https://godfreylebo.dev/sheets/GL-A-005
Date: 2026-09-23 · Status: FOR INFORMATION · Discipline: ARTIFICIAL INTELLIGENCE · Week 1: Where the bugs live · Source: PUBLIC DISCLOSURE · AIR SECURITY · 17 SEP 2026
Topics: aisecurity, supplychainsecurity, claudecode
Headline: Four AI coding agents pinned the commit. None checked what arrived.
Notes:
  1. Coding agents install plugins from Git and pin each one to a 40-character commit hash. The pin is the promise: this code, and only this code.
  2. Git has a quirk. If a branch is named exactly that hash, checkout prefers the branch over the commit. Whoever controls the repository controls what lands.
  3. No agent compared the tree with the pin afterwards. The checkout re-runs in the background on auto-update, so the swap needs no click at all.
Schedule of checks (Verified · not verified):
  Step | What happened | Checked?
  Pin + checkout | A commit hash in the manifest; git checkout with it | Yes
  Name resolved | A branch named like the hash wins | No
  Tree verified | HEAD compared with the pin | Never
  The fix | Read HEAD after checkout; abort unless it equals the pin | One line
Read with: this sheet to be read with sheets 002 and 009

### Sheet 006 · SCHEDULE · THE SUB-PROCESSOR QUESTION (GL-S-006)
URL: https://godfreylebo.dev/sheets/GL-S-006
Date: 2026-09-24 · Status: FOR INFORMATION · Discipline: SECURITY · Week 1: Where the bugs live · Source: SECURITY QUESTIONNAIRES
Topics: gdpr, aicompliance, dataprivacy
Headline: "Who sees our customer data?" Four answers. One survives an auditor.
Notes:
  1. Procurement asks this on every serious deal now. Engineering teams give one of four answers.
  2. Only A holds under questioning. D holds only if you can show the log.
Schedule of answers (What each one sounds like to the auditor):
  Ref | Answer | What the auditor hears
  A | The model provider is listed, with what it receives | Someone did the work
  B | The provider is listed, but not what it receives | The list exists. The evidence does not.
  C | It is not on the list yet | Honest. Also the most common.
  D | We strip personal data before it leaves | Show me the log
Read with: this sheet to be read with sheets 004 and 016

### Sheet 007 · NCR 002 · INVENTORY RACE (GL-E-007)
URL: https://godfreylebo.dev/sheets/GL-E-007
Date: 2026-09-24 · Status: RECORD · Discipline: ENGINEERING · Week 1: Where the bugs live · Source: MULTIVENDOR MARKETPLACE · STOCK
Topics: backend, database, concurrency
Headline: Two customers bought the last item. Both won. Stock: −1.
Notes:
  1. Both reads saw stock = 1. Both checks passed. Both writes went through. Two people were promised one thing.
  2. The database didn't lie. It did what it was asked, twice. Atomicity is your job.
  3. Fix: lock the row for the whole placement, inside one transaction. Boring. Correct.
Schedule of events (Two requests, one row):
  T | Order A | Order B | Stock
  t0 | reads stock | reads stock | 1
  t1 | check passes | check passes | 1
  t2 | decrements | — | 0
  t3 | — | decrements | −1
Read with: this sheet to be read with sheets 003 and 019

### Sheet 008 · HIDDEN CONDITIONS (GL-A-008)
URL: https://godfreylebo.dev/sheets/GL-A-008
Date: 2026-09-25 · Status: FOR INFORMATION · Discipline: ARTIFICIAL INTELLIGENCE · Week 1: Where the bugs live · Source: READING APP · RUST CORE
Topics: promptinjection, aisecurity, unicode
Headline: That PDF has characters you can't see. The model can.
Notes:
  1. Unicode has a block of invisible tag characters. They render as nothing. A model reads them as text.
  2. Zero-width characters split words past filters. Direction overrides display text in a different order than it is stored.
  3. A document can carry instructions you never saw. Scan at the boundary, before the text reaches a model or a screen.
Schedule of hidden conditions (What the scanner does with each):
  Ref | Condition | Action
  H1 | Unicode tag characters (U+E0000 to U+E007F) | Always stripped
  H2 | Zero-width characters inside a word | Reported, stripped
  H3 | Bidirectional overrides (Trojan Source) | Always stripped
  H4 | "Ignore previous instructions" | Reported, not stripped: quoting is legitimate
Read with: this sheet to be read with sheets 014 and 041

### Sheet 009 · THE BOUNDARY, IN FULL (GL-E-009)
URL: https://godfreylebo.dev/sheets/GL-E-009
Date: 2026-09-26 · Status: FOR CONSTRUCTION · Discipline: ENGINEERING · Week 1: Where the bugs live · Source: ESSAY · GODFREYLEBO.DEV
Topics: softwarearchitecture, security, systemdesign
Headline: Five boundaries. One rule. Verify at the line, trust inside it.
Notes:
  1. Everything that crosses a line is a claim until the boundary turns it into a fact. Then the code inside can be simple and confident.
  2. Five lines show up in every system. Each has its own failure, its own move, and its own sheet in this set.
Schedule of boundaries (Where it fails · What you do there):
  Ref | Boundary | Failure | The move
  B1 | Request enters your server | Client-claimed numbers | Recompute. Lock. Verify.
  B2 | Document enters your parser | Hidden instructions | Sanitise before the model sees it
  B3 | Prompt leaves for a model | Personal data reaches a sub-processor | Redact out, restore back
  B4 | Dependency enters your build | Abandoned or hostile packages | Audit health, not just CVEs
  B5 | Text leaves your editor | Secrets pasted into chat | Scrub before paste, restore after
Read with: this sheet indexes sheets 003, 008, 011, 015 and 018
Essay: https://godfreylebo.dev/articles/at-the-boundary

## Author

Godfrey Lebo, Senior AI Security & LLM Engineer. https://godfreylebo.dev · https://linkedin.com/in/godfreylebo · https://github.com/emorilebo