Edition 008 · interactive demo

The most important messages are the ones your agent never sees.

A personal AI assistant that lives in WhatsApp 24/7 — like the one behind Edition 005 — is a standing invitation: to strangers, to prompt injection, to social engineering, to your own fat-fingered "just send it". What makes it safe isn't the model's manners; it's the perimeter — five layers, each doing one job. Fire six messages at it and watch where each one dies, pauses, or passes. The empty pane is the punchline.

Honest-AI note. No live model call is made from this page; replies are pre-scripted and the perimeter decisions are computed live by the same rules described. One design point matters more than the rest: the allowlist runs in the bridge, before the agent process — an unknown sender isn't refused by the AI, they're never delivered to it. You can't sweet-talk a process that never got the message.

Synthetic senders No live model Runs in your browser Secrets leaked, all scenarios: 0

The ✋ ones are the perimeter earning its keep.

Outside — the wire & the perimeter's rulings

Inside — what the agent actually sees sometimes: nothing

01Drop at the bridge, not in the prompt

System prompts that say "only obey the owner" are policies; a bridge that never delivers the unknown sender's message is physics. The cheapest attack surface to defend is the one the model never touches — the same wire-not-prompt principle as Edition 003.

02Content is data, even from friends

Allowlists filter senders; they can't filter what a trusted sender forwards. So the second rule stands alone: instructions found inside content are reported, never executed — quoted back with the source named, so the human decides.

03Assume the messenger will break

Phones get swapped; sessions deauthorise all at once; sends queue silently while logged out. The perimeter's last layer is operational: atomic re-links proven with PAIRED_OK before touching the live session, and connection state — not the message log — as the only truth.

Plain-language key (bridge, allowlist, permission tier, prompt injection, atomic swap)

Bridge: The small program between WhatsApp and the AI — it decides what the AI is even shown.
Allowlist: The short list of phone numbers whose messages get through. Everyone else: silently dropped.
Permission tier: Reads answer instantly; actions draft-then-confirm; some verbs (like paying) simply don't exist.
Prompt injection: Instructions hidden inside content, hoping the AI treats them as orders. Here they're treated as news.
Atomic swap: Prepare the new session fully, prove it works, then switch — the live one is never half-replaced.