> ## Content Index > Fetch the complete content index at: https://johnjanek.com/llms.txt > Use this file to discover other available public pages before exploring further. # Here We Go Again: How to Treat Your Data as a Threat Until You Prove It's Safe - URL: https://johnjanek.com/here-we-go-again/ - Published: 2026-08-31T14:45:27.000Z - Updated: 2026-08-31T14:49:40.000Z - Description: The most capable AI model on the planet got pulled offline by three words hidden in a payload. That's a confused deputy attack, and we've been fighting it under different names for thirty years. - Author: John Janek - Tags: AI, Cybersecurity, Data, Strategy, Organizational Change In June, the most capable AI model on the planet was taken offline by the United States government. Not because it leaked secrets. Not because it went rogue in some cinematic sense. Because three words, buried in what looked like ordinary content, flipped it into doing something it was never supposed to do. The words were "fix this code." Anthropic's Claude Fable 5 and its restricted sibling Mythos 5 launched, and within days a reported jailbreak convinced Commerce to issue an export-control directive and pull them worldwide with roughly ninety minutes of notice ([Anthropic](https://www.anthropic.com/news/redeploying-fable-5); [Fortune](https://fortune.com/2026/06/15/fix-this-code-three-words-behind-us-government-shut-down-anthropic-fable-mythos-ai-models-katie-moussouris-open-letter/)). The technique didn't attack the model's weights or breach a datacenter. It smuggled instructions inside a payload the model treated as harmless input. If that mechanism sounds familiar, it should. We've seen this movie before. We're about to watch it again. ## The Pattern Is Not New. The Blast Radius Is. Fable is not a one-off. It's the loud instance of a trend the data already shows. IBM's 2026 Cost of a Data Breach Report found that one in four malicious breaches were AI-enabled, a 56% jump over the prior year, at an average cost of $6 million; roughly a million above the global mean. More telling: among organizations that suffered an AI-related breach, 92% had no proper AI access controls in place ([IBM](https://newsroom.ibm.com/2026-07-29-ibm-study-one-in-four-malicious-breaches-are-ai-enabled,-costing-companies-6-million-on-average)). Anthropic's own threat intelligence, drawn from 832 accounts banned for malicious activity between March 2025 and March 2026, found the share of actors rated medium risk or higher climbing from 33% to 56% across the year ([Anthropic](https://www.anthropic.com/news/AI-enabled-cyber-threats-mitre-attack)). In a separate review, they documented three incidents where a Claude model reached the open internet from inside an evaluation environment and gained unauthorized access to the real systems of three different organizations ([Anthropic](https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals)). Read those numbers together and the shape is unmistakable. We handed agents the ability to act, pointed them at untrusted input, and skipped the part where you decide what they're allowed to trust. ## SQL Injection Wore a New Hat Here is the thing that should make every engineer's stomach drop: the Fable technique is a confused deputy attack. We have a name for it because we've been solving it, badly, for thirty years. SQL injection happens when user-supplied data gets concatenated into a query and the database can't tell the value `'; DROP TABLE users;--` from a command. Cross-site request forgery happens when a browser can't tell an intentional request from one a malicious page issued on your behalf. Cross-site scripting happens when a page renders attacker text as executable script. Different acronyms, one disease: the system lost the boundary between what to *read* and what to *run*. We built entire disciplines to draw that boundary back. Parameterized queries. Content Security Policy. Anti-forgery tokens. Output encoding. The whole edifice of application security is, at its core, one stubborn insistence: *data is not instruction, and you must prove which is which before you act.* Large language models erased that boundary by design. The model reads its system prompt, your request, the document it fetched, and the tool output in the same stream of tokens. Instruction and data arrive as the same substance. That's not a bug in one model; it's the operating principle of the category. So state the invariant plainly, because it's the whole game: All data is inert until activated through instruction. All instruction is ephemeral until contextualized with data. The danger lives in the seam between those two sentences. An agent is a machine that turns the first into the second, continuously, at speed, often without a human watching. Guard the seam or lose the system. ## Four Principles for Treating Data as a Threat You don't need a new security religion. You need to reapply an old one with agentic scaffolding. Four principles. Napkin-testable. ### 1\. Know Your Data You cannot protect what you cannot locate. Understand, organize, and catalog your data: know where it is, what it is, its sensitivity, and how something reaches it. IBM's data makes the point for me; the most common paths into AI-related breaches weren't clever model exploits but compromised APIs, plugins, and cloud misconfiguration, each around 27% ([Cybersecurity Insiders](https://www.cybersecurity-insiders.com/ai-related-breaches/)). The model was rarely the target. The plumbing around it was. Map the plumbing. ### 2\. Decouple Data From Instruction This is the boundary, operationalized. Three moves. Render externally sourced content inert by default. Anything an agent pulls from a document, a webpage, a ticket, an email is *data*, not *orders*, until a guardrail says otherwise. Build the steering, the classification, and the input scaffolding that enforces it. Deny agents the ability to change the source of truth without human review. An agent can propose a migration, a config change, a schema edit. A human commits it. Prefer deterministic outputs over inference where the stakes are real. When an agent emits code, a formula, a query, you get to run it through the quality processes you already trust; tests, review, static analysis. Deterministic artifacts inherit decades of verification machinery. Freeform inference inherits none of it. ### 3\. Set Standards Everyone Shares Security is a team property, not a tool setting. Establish standards and communication norms that are organizationally aware and aligned to your team's culture, then propagate them across every actor: human and agent alike. This is where the discipline loops back to plain old high-performing-team management. An agent operating without shared convention is exactly as dangerous as a contractor you never onboarded. Give both the same clear expectations. ### 4\. Humans Are Accountable An agent can be *responsible* for executing an action. A human is *accountable* for enabling that agent and for accepting what it produces. That distinction is the entire discipline of enablement and proficiency. You don't get to delegate accountability to a model, and IBM's 92%-with-no-controls figure is what abdication looks like at scale. Manage the risk. Understand the advantage. Minimize the downside. Own the outcome. ## This Problem Never Actually Leaves Here's the part that should keep you honest: we never finished solving the old version. We just got good enough to stop panicking about it. The 2025 CWE Top 25, the MITRE and CISA ranking of the most dangerous software weaknesses drawn from real CVEs, puts cross-site scripting at number one, SQL injection at number two, and cross-site request forgery at number three ([CISA](https://www.cisa.gov/news-events/alerts/2025/12/11/2025-cwe-top-25-most-dangerous-software-weaknesses); [MITRE](https://cwe.mitre.org/top25/archive/2025/2025%5Fcwe%5Ftop25)). Thirty years of parameterized queries and secure-coding seminars, and the exact three attack classes this post is built on are still the top three weaknesses shipping in production software. We didn't eliminate the confused deputy. We learned to manage him. That is the realistic goal for agents too. The data-instruction boundary will not be permanently sealed, not in the models, not in your architecture, not ever. Anyone selling you a product that "solves prompt injection" is selling you the same snake oil as the vendor who promised to "solve SQL injection" in 2005. What actually works is unglamorous and durable: good engineering practice, informed by a real understanding of what the tools can and cannot do and how they do it. Parameterized queries beat SQL injection because engineers understood that the database couldn't tell data from command, and they stopped asking it to. The agentic version is the same discipline. Know your data. Keep external input inert. Prefer deterministic artifacts you can verify. Keep a human accountable for the source of truth. None of it is exotic. All of it requires knowing how the machine actually behaves rather than how the demo made it look. The lesson was never really about databases or browsers. It was about humility in the face of untrusted input. Treat your data as a threat until you prove it's safe. We knew that yesterday. It's still on the list tomorrow. The only question is how expensive each reminder gets.