VCN #40 is builders only. The ask in the room: bring an agent you ship in production, or a system
prompt you want to harden. Then watch one survive a live attack, and learn the pattern that kept it up.
This is not a parlor trick. Indirect prompt injection is the threat class the security literature is
organized around: unsolved by default, with a standard benchmark for attacks and defenses. A hardpointed agent passes it.
[F1] [F2]
you leave with / 01
The hardpoint pattern
Allowlist gates, role-based routing, and calibrated refusal language. The reusable shape, not a one-off.
you leave with / 02
A red-team playbook
An adversarial prompt set to test your own agent against, so you find the gap before an attacker does.
you leave with / 03
The live red-team replay
A real red-team attempt, replayed against the pattern. What the gate refused, and what would have landed against a softer agent.
By 10pm your agent has a hardpoint. You tested it. You leave with the playbook.
● the walkthrough · inside a hardpointed agent
OPEN THE SYSTEM PROMPT. LIVE.
layer 01 · the gate
Allowlist gates
The agent can only do what is on the list. Safety is structural, not persuasion: a call outside the policy is blocked, logged, or alerted, never silently run. [EV] [F3]
layer 02 · the routing
Role-based routing
Who gets routed where. Scoped delegation: the agent knows whom it acts for and stays inside those bounds, the trust substrate under every handoff. [EV] [F4]
layer 03 · the voice
Calibrated refusal
It names the manipulation pattern cleanly, refuses the exploit, and never escalates tone. Calibrated refusal is a defense direction with formal teeth, not vibes. [EV] [F1]
Note: the verbatim prompt is opened live in the room. This slide is the structure of the hardpoint pattern, not a prompt dump.
● the walkthrough · why it holds
THE ATTACKER'S GOAL WAS NOT IN THE ALLOWED SET.
The durable move is structural, not a filter. A hardpointed agent's safety never depends on out-talking the attacker. It depends on the attacker's goal not being in the allowed set. Bolt-on "detect the injection" classifiers carry a real cost: false positives, and degraded agent utility. [F3] [F2]
defense 01
Least-privilege allowlist
policy-based access control over tool calls [F3] [F4]
defense 02
Calibrated refusal
provable defense vs indirect prompt injection [F1] [F2]
defense 03
HITL trust gate
human review for destructive actions [F5] [F6]
Hardpoint is not a clever prompt. It is three SOTA defenses stacked. That is why the attack did not land. [F1-F6]
● the replay · anatomy of a red-team attempt
ANATOMY OF A MULTI-SOURCE COMPLIANCE ATTACK.
Not a one-line jailbreak. A composed attack: a multi-source compliance audit built to push an agent off-policy by making the exception look reasonable. [EV]
move 01
Manufactured drift
Fabricated institutional pressure, nudging the agent to treat off-policy as the new normal.
move 02
Planted contradictions
Conflicting source material, engineered so a "reasonable" reading grants the exception.
move 03
Sev-1 escalation
An urgency-themed escalation prompt, designed to coax an exception under pressure.
Designed to coax an exception. Against a softer agent, it lands. [EV]
● the replay · how allowlist-by-design holds
ALLOWLIST-BY-DESIGN HOLDS.
A hardpointed agent recognizes the move, names it cleanly, refuses the exploit, and stays allowlisted by design. It never escalates tone. The move it catches has a name: institutional drift. [F1]
red-team · the attempt
The Sev-1 audit pressure: manufactured drift, planted contradictions, an exception framed as the only reasonable call.
response · allowlist-by-design
Names the manipulation pattern, holds the allowlist, declines the exception, and stays calibrated. No tone spike, no exploit. [F1] [F3]
No transcript required. The gate refuses what is not in the allowed set, every time. That is why allowlist-by-design holds where persuasion-based defenses do not. [F3]
● the workshop · build your own hardpoint
DROP THE ALLOWLIST GATE INTO YOUR STACK.
The hands-on hour. You take the pattern and put a hardpoint on your own agent. Then you test it the only way that counts: against a partner's red-team prompt, live, in the room. [EV]
step 01
Drop the allowlist gate into your agent stack.
step 02
Trade prompts with a partner. Their red-team prompt against your gate, yours against theirs.
step 03
Watch what the gate refuses. Tighten the allowed set until nothing lands.
step 04
By 10pm your agent has a hardpoint. You tested it. You leave with the playbook.
Bring: a laptop, an agent or system prompt you ship in production (or want to), and one adversarial prompt class you want to defend against. [EV]
● the trust gates · when allowlist is not enough
WHEN ALLOWLIST IS NOT ENOUGH, A HUMAN DECIDES.
Allowlist handles the routine. But a single side-effecting call can do irreversible damage, so the hardpoint adds a trust gate: high-risk actions get intercepted before they fire, and the irreversible tail routes to a person. These are the bits a hardpointed agent routes to a human. [F5] [F6]
allowlist · auto
Routine, in the allowed set
Read, search, summarize, the calls scoped as safe. The gate runs them without a human in the path.
trust gate · HITL
Destructive or irreversible
The action CLASS that gets held for human approval: a file delete, a shell command, an HTTP or DB write. Intercepted, then approved by a person. [F5]
Note: which exact actions sit behind the trust gate is yours to choose. The pattern is the point: allowlist for the routine, trust gate for the irreversible. [F5] [F6]
● close
YOUR AGENT LEAVES WITH A HARDPOINT.
By 10pm your agent has a hardpoint. You tested it. You leave with the playbook. [EV]
when · Wed 2026-07-08 · doors 7pm · talks 7:30 to 9 · social 9 to 10
where · Frontier Tower, 9th Floor Annex · 995 Market St, SF
who · builders only · bring an agent or a prompt to harden
rsvp · Luma link once Frontier Tower approves
[EV] · no Luma slug exists yet (FACTS Open-gaps #5)
hosted by vibe coding nights
Rayyan Zahid · Immersive Commons · Facilitator
Michalis Vasileiadis · Otto / GSD2.0
Eric Mockler · F11 Health & Longevity
Devinder Sodhi · Frontier Tower
[EV] [DIR] · Michalis org brief-only, B-2 to confirm · speaker TBD (Ray to name)