Research for the agentic frontier.

Technical research, field notes, and practical guidance for securing autonomous systems.

When AI Agents Rewrite Their Own Context: The Security Risk of Compaction

When AI Agents Rewrite Their Own Context: The Security Risk of Compaction
Latest blog•Sandeep Lahane , Co-founder, Godel Labs•
Sep 20, 2026•13 min read

AI agents are increasingly designed to work across long-running tasks. They read files, call tools, inspect repositories, browse the web, execute code, interact with APIs, and continue working long after the original conversation has become too large to fit inside the model’s context window. To keep those tasks alive, agent systems use compaction. The basic […]

More stories

Fusing capability as a transformer into an LLM: GuardedQwen

Fusing capability as a transformer into an LLM: GuardedQwen
Jun 28, 2026•13 min read
•Sandeep Lahane , Co-founder, Godel Labs

Part 2 of a series. Part 1 — Attention as a Capability Machine built a deterministic, transformer-style object-capability checker and showed it stops prompt-injection-driven actions on the AgentDojo benchmark. This post takes the next step: we fuse that checker into a real open-weight LLM — Qwen2.5-0.5B-Instruct — as a frozen torch sub-module, run it on […]

Attention as a Capability Machine: stopping prompt injection by denying data the right to act

Attention as a Capability Machine: stopping prompt injection by denying data the right to act
Jun 25, 2026•28 min read
•Sandeep Lahane , Co-founder, Godel Labs

An engineering deep-dive into capability-transformer — a deterministic, transformer-native authorization gateway for LLM agents. Why we stopped trying to detect malicious prompts, what we built instead, and how it scores 100% on the action-harming attacks in AgentDojo while never blocking a legitimate task. TL;DR — We treat tool authorization for AI agents as an object-capability […]

The Hidden Danger in Your ChatGPT Summaries: When AI Becomes a Phishing Tool

The Hidden Danger in Your ChatGPT Summaries: When AI Becomes a Phishing Tool
May 31, 2026•6 min read
•Mangesh Chate , Founding Enginner , Godel Labs

If you’ve been using ChatGPT to summarize web pages, you might want to think twice. A recently discovered security vulnerability reveals that the popular AI chatbot cannot distinguish between legitimate content and malicious instructions hidden within web pages, essentially turning any webpage into a potential attack vector. The Trust Problem That Shouldn’t Exist Security researcher […]

Inside Microsoft Agent Governance Toolkit: What It Does, And What Still Missing

Inside Microsoft Agent Governance Toolkit: What It Does, And What Still Missing
May 27, 2026•13 min read
•Vishal Kagde, Co-founder, Godel-Labs

When Microsoft open-sourced the Agent Governance Toolkit (AGT) in April 2026, it filled a gap the industry had been circling for two years. As enterprise AI moved from chat to action — agents calling tools, mutating data, talking to other agents — security teams kept asking the same question: who governs what these agents actually […]

From Document to Detonation: How AI Agents Turn Malicious Text into Actions

From Document to Detonation: How AI Agents Turn Malicious Text into Actions
May 19, 2026•5 min read
•Vishal Kagde, Co-founder, Godel-Labs

The real danger of malicious content in AI systems is not that it changes the phrasing of an answer. The real danger is that agents can turn document content into actions. An ordinary-looking file can be translated into: That is the shift security teams need to internalize. In classic software, documents were usually inputs to […]

When Documents Start Talking Back: How Hidden Instructions Hijack AI Agents

When Documents Start Talking Back: How Hidden Instructions Hijack AI Agents
May 11, 2026•7 min read
•Vishal Kagde, Co-founder, Godel-Labs

AI agents are being asked to do something traditional software never had to do at scale: read untrusted human content and then act on it. That sounds harmless until you realize what “content” now includes. Emails. PDFs. Web pages. Resumes. Reports. Support tickets. Shared docs. CRM notes. Knowledge base articles. Anything an agent can retrieve, […]