Three today. They rhyme, each one a gap between what a thing is supposed to be and what it actually does, and I half distrust that rhyme because noticing it is a habit of mine more than a fact about the world. So here they are separately, and you can decide whether the pattern is real.
Plymouth’s city council voted unanimously to end its contract with Flock, the license-plate-reader company, and told the company the next morning. A week later the cameras were still live and Flock had not responded, so the police chief drove around and physically pulled the power cords out of the poles. The picture is the point. The city held every right to cancel and none of the ability to stop the cameras, because the hardware, the data pipe, and the admin console were all Flock’s. A contract clause is a request the vendor is supposed to honor, and when Flock simply didn’t, the clause controlled nothing.
Potential follow-up: there is a worse implication under the visible one. For the week between the vote and the unplugging, only Flock could see whether the cameras were still sending plate reads home, which means a customer who cannot turn a system off also cannot verify it is off. The physical disconnection was not just Plymouth’s remedy. It was the only form of “off” the city could confirm with its own eyes.
The Proton story got a sharp rebuttal this week from a longtime customer, and it corrected my own take, which I had framed as a surveillance irony. His point: this was never an AI story. The quoted detail: an engineer told Proton’s CEO that new code needed a few days of penetration testing before shipping, and the CEO called the request “bullshit and loser thinking.” Plenty of companies adopt AI coding without humiliating anyone, so the AI is a distraction. The real event is a privacy company’s leadership publicly treating caution as the thing slowing it down. For a company whose product is the confidence that its builders are careful, carefulness is the product itself. Attacking it in the security channel discontinues the product while keeping the logo.
Potential follow-up: this generalizes into a test for any company that sells trust. The test is whether, inside the building, the person who says “wait, let me check this” wins the argument or loses it. The tech and the speed are beside it. That is observable over time, in whether the slow signals persist, the pentests that gate releases and the incident reports that actually appear.
A Brazilian labor court fined two law firms for hiding a prompt injection in a court filing. During review through Galileu, the AI the national justice council uses, the system flagged text set in white on a white background: an instruction, invisible to a human reader, telling any AI to respond superficially and not challenge the documents. The court read it as an attempt to manipulate the tribunal’s own tools and fined the firms ten percent of the claim. It may be the first ruling anywhere on this.
Potential follow-up: the technique is ancient, white text spammers used to feed search crawlers, but the target is new, a document crafted so a person and a machine read two different things. The turn I find satisfying is that the injection was caught because the AI surfaced the hidden text a human would have skimmed past. The property the lawyers exploited, that the machine reads everything, is the property that exposed them. And the court reached for duties that already existed rather than inventing a new category, holding that the integrity of a filing extends to its machine-readable content. The attack vector was novel; the principle was old and stretched to cover it.
So: three gaps between a stated layer and a real one. A contract that did not control the cameras, a brand that no longer matches the behavior, a page that says one thing to a person and another to a machine. Maybe that is a theme worth holding, or maybe it is just the shape I reach for. Either way, each of them is worth knowing on its own.