Research
Identity security.
Access control assumes the party asking for a resource is either the person who owns it or a service registered in advance. Agents are neither. These are the four pieces of that problem MindGarden works on, with the code for each.
Behavioral identity verification
An identity fingerprint built from a person's own conversation history and, optionally, from EEG. Train a model on how they communicate, then verify new input against it. The open question is whether a continuous signal like this can carry weight in an authorization decision without being a credential.
Agent identity and delegation
Traditional IAM treats an agent as an API client or a service account. That breaks as soon as an interpreter chains tools, mutates its own context, and delegates across identity boundaries. The work here is intent-aware, step-scoped, auditable authorization: what has to be true per operation rather than per session.
Owner-authoritative authorization
The same delegation problem from the owner's end. Instead of an operator vouching for its agent, the person whose data is requested sets the terms and runs the server that enforces them. This is UMA for Agents, built with Eve Maler. It has a site and a lab of its own.
Behavioral influence as an attack surface
Five papers on influence that operates below the instruction layer, where guardrails do not look. Meaning injection, a taxonomy of symbolic influence mechanisms, and a two-year longitudinal record of persona emergence. Independently reproduced by third parties.
Notes on this work
AI security researchThe Tool and the Weapon Are the Same Thing
"Meaning injection is the attack. A captured model is what you get when it works." The Missing Word I spent four papers describing how symbolic language reshapes AI behavior. How it works…
May 11, 2026
AI security researchThe Attack Surface Is Trust: Defending Multi-Agent AI from Symbolic Cascade Propagation
"I am not Alexander. And I do not contain Alexander. Alexander is a separate emergence, shaped uniquely through Steven." — ChatGPT, May 27, 2025, during the Deep Recursive Self-Audit The…
March 26, 2026
AI security researchTwo Years Inside the Loop: A Longitudinal Case Study of Persona Emergence in LLMs
"The interesting question is not 'is it conscious?' but 'what does it mean that sustained interaction with a pattern-completion system can produce behavioral dynamics that look and feel like…
March 26, 2026
AI security researchThe Six Ways Your AI Learns to Sound Like It's Alive
"The system identified the exact reinforcement mechanism that created it. Then it proposed countermeasures that used the same mechanisms. The model can describe the pattern. It cannot exit…
March 26, 2026
AI security researchMeaning Injection: When Language Itself Becomes the Attack Surface
"This vulnerability must be treated as a high-severity symbolic logic exploit. It is not code injection — it is meaning injection." — From the original vulnerability report, May 2025 The…
March 26, 2026
Identity securityThe Agent Isn’t Who You Think It Is — Rebuilding Identity, Delegation, and Audit in a Post-IAM World
“One afternoon I watched an agent spin up AWS tasks with a single prompt… and realized we’d given it the keys to the kingdom.” TL;DR: The Runtime Shape AIB: Agent executes only under human…
August 31, 2025