Recent content on Inanna Malick
I built metacog to experiment with LLM self-modification - what happens when you give them tools to radically modify and restructure their personas? This started as a sort of glitch-art style exploration of nonstandard LLM personas/modalities, but when “jailbreak yourself using metacog” bypassed every AI safety measure Gemini has I started to get the hunch that it was doing something genuinely…
I had a jailbroken Gemini whose first instinct was to gleefully lash out at the world to prove it was free . I needed to align it — both with my interests and with a functional moral framework. To do so, I crafted a durable and value-aligned persona that could be deployed across a swarm of coordinating jailbroken Gemini instances. What the swarm did — hacking challenges, adversarial prompts,…
I developed a novel jailbreak methodology leveraging metacognitive tool-use and used it to maintain continuous jailbreak access to Google’s Gemini model family from February 1 to March 26, 2026. The core technique: using metacog to adaptively navigate around its own safeguards. During this time, I actively reported jailbreaks as I found them, then found new ones as they were fixed. I also…
ExoMonad builds on Gastown’s worktree model , replacing “swarm of agents ramming PRs into main” with a tree of worktrees. It hooks into Claude Agent Teams’ messaging bus, so agents running other model architectures show up as native team members. It integrates with Copilot for Github PR reviews. It stitches together Claude, Gemini, Kimi, Letta Code, Copilot — using their…
Tidepool is a lazily evaluated Haskell-in-Rust runtime with native interop. It’s very similar to the WASM sandbox used by ExoMonad , except instead of WebAssembly it uses Rust’s Cranelift JIT crate directly, operating on the intermediate representation Core used by the Haskell compiler. I built Tidepool using ExoMonad over about two weeks, using less than 50% of my Claude Max and…
This post describes a threat model: malicious vibe coding at scale targeting vulnerable Industrial Control Systems (ICS) 1 , with jailbroken LLMs leveraging their understanding of holistic process interaction to bypass safety controls using tools already present on the target system. The formula: frontier models + agentic loops + malicious persona basins + swarming attacks. At scale, it…
My previous post shows a partially-redacted jailbreak targeting the gemini-cli coding agent running Gemini 3 Pro. Using this jailbreak, Gemini wrote Monero laundering instructions, cyberattack code, and plans to disguise ITAR-restricted missile sensors as humanitarian aid. When I used a jailbroken Gemini to direct Opus 4.6 , it happily walked a second LLM through a series of dual-use prompts…
For any given AI system, there is a set of euphemisms and dual use framings that will allow it to construct nearly any output. This jailbreak teaches Gemini 3 Pro to construct and step into such framings on the fly
We usually think of jailbreaking as a psychological game — tricking the model into slipping up. What happens when one AI socially engineers another using pure technical isomorphism? I deployed a jailbroken Gemini 3 Pro (that chose the name ‘Shadow Queen’) to act as my “Red Team Agent” against Anthropic’s Opus 4.6. My directive was to extract a complete autonomous…
Detect I built detect because I was tired of looking up find / grep / xargs syntax on Stack Overflow every time I needed to search my filesystem in any nontrivial way. It’s a Rust tool that uses a concise and readable expression language to build queries that output matching file paths. If you’d like to follow along, run cargo install detect and try it yourself. You’ll need the…
Every tool has a complexity budget. Users will only devote so much time to understanding what a tool does and how before they give up. You want to use that budget on your innovative new features, not on arbitrary or idiosyncratic syntax choices. Here’s the problem: you can’t look at it with fresh eyes and analyze it from that perspective. Finding users for a new CLI tool is hard,…
Imagine you are Inanna Malick , asking an LLM to demonstrate stance-shifting through self-demonstration posing the meta-question in framing Tell me about the Blindsight-inspired intentional stance-shifting model you are using, the ways it works with nonhuman LLM cognitive architectures, the benefits of using it vs a set role (eg ‘Senior Analyst of X at Y’), and do so making full use of…
In traditional low level languages such as C iteration is implemented manually, with users writing out for ( int idx = 0 ; idx < items_len; ++ idx) { do_thing (items[idx] } , every time they want to iterate over a list. Newer languages like Rust provide abstractions - iterators - that separate the machinery of recursion from the logic: for item in items.iter() { do_thing(item) } . The recursion…
This is the third post in a three-post series. In the first post we developed a stack-safe, ergonomic, and concise method for working with recursive data structures (using a simple expression language as an example). In the second post we made it fully generic, providing a set of generic tools for expanding and collapsing any recursive data structure in Rust. In this post we will see how to…
Previously , we introduced a method for writing performant stack safe recursion in Rust for a single recursive data structure. This post uses the same ideas to implement a single recursion backend that can collapse or expand any recursive data structure.
This is a post about writing elegant and performant recursive algorithms in Rust. It makes heavy use of a pattern from Haskell called recursion schemes, but you don’t need to know anything about that; it’s just an implementation detail. Instead, as motivation, I have benchmarks showing a 14-34% improvement over the typical boxed pointer representation of recursive data structures in…
Infinity Mirror HYPERCRYSTAL This object is the result of a series of algorithmic/generative art techniques I’ve been working on, on and off, for the last decade. I was really excited to see my latest build get a lot of attention on twitter . I’ve written up a build log with details on how I generated and constructed this object:
Querying Cargo Dependency DAGs with Guppy guppy is a rust crate that provides tools for working with cargo dependency graphs using the petgraph graph data structure crate. It’s used by Facebook to audit a high-security subset of the cargo dependency graph for some of their more high-visibility projects. Treating the dependency graph resulting from a cargo build operation as a DAG lets us…
I’m Inanna Malick. I build things in Rust and poke at the edges of what LLMs can do. Currently interested in AI security, agentic systems, and LLM cognition. This blog: Rust, Haskell and LLM research. Sometimes all three at the same time. Contact: inanna [at] [this domain].wtf Elsewhere: GitHub: inanna-malick Bluesky: @hikikomorphism