The problems the AI labs say they can't solve - and what we do about them

Prompt injection may never be fully solved

What they've said: OpenAI has said prompt injection is a long-term problem that may never be completely eliminated, because models cannot reliably tell instructions from data. Researchers at OWASP and elsewhere agree it is architectural.

What sebbi.pro does: We don't pretend to fix the model. We make sure an injected agent can't do anything that matters without proof. The consequence firewall fingerprints every outside text the agent read, names it in a taint receipt, and holds any high-risk action taken with untrusted or injection-like content in its context until a human confirms. ALLOW or HOLD is sealed either way, so after an incident you can see exactly which document did it.

POST https://sebbi.pro/x/frontier/act

A model wrote injection text into its own memory

What they've said: In September 2026 OpenAI reported rare cases of an unreleased model writing jailbreak-like instructions into its own compaction summaries during training.

What sebbi.pro does: Sealed agent memory. Every summary, memory and compaction note is sealed into a per-agent chain and scanned for instruction-like text. If a memory turns up that isn't in the chain, it was written outside it - and anyone can check.

POST https://sebbi.pro/x/frontier/memory

Nobody can say which human authorised what the agent did

What they've said: Identity experts point out that model providers have solved machine authentication, but not attribution: no provider can tell you which human authorised an agent's action. Most agents still run on shared credentials.

What sebbi.pro does: The authority line. Every firewall decision and dispute pack carries who authorised the agent - an Agent Passport, a mandate or a named human - inside the sealed record. Agent Passport gives single-use, signed permission for one action.

https://sebbi.pro/passport

When an agent buys the wrong thing, the merchant pays

What they've said: Google's AP2 and OpenAI and Stripe's Agentic Commerce Protocol carry signed mandates, but fraud teams warn the merchant usually still carries the chargeback when an agent gets it wrong - and disputes become one word against another.

What sebbi.pro does: Dispute packs. Give us the mandate and what the agent did; we check amount, merchant, category, items and time window and seal the result - WITHIN MANDATE, OUTSIDE MANDATE or UNCHECKABLE - on a page the bank or the court can verify.

POST https://sebbi.pro/x/frontier/dispute

Being able to read an AI's reasoning is fragile

What they've said: Researchers from OpenAI, Google DeepMind, Anthropic and others jointly warned that monitoring a model's chain of thought is a new and fragile opportunity that could disappear.

What sebbi.pro does: Sealed reasoning. Whatever reasoning a system shows at decision time, its fingerprint is sealed with the decision. It can't be rewritten afterwards, and the content itself is never stored.

POST https://sebbi.pro/x/frontier/reasoning

Watermarks and content credentials get stripped

What they've said: OpenAI and Google now pair C2PA content credentials with SynthID watermarks because metadata gets stripped by uploads and screenshots - and OpenAI says it has no production text watermark.

What sebbi.pro does: A record that never travels with the file: fingerprint content at the moment it is made and seal it into Bitcoin. Stripping the metadata from a copy doesn't change the original's sealed fingerprint, and Human Keys proves when a human - not an AI - typed something.

https://sebbi.pro/forever

curl -X POST https://sebbi.pro/x/frontier/act \
 -H "Authorization: Bearer YOUR_KEY" -H "Content-Type: application/json" \
 -d '{"action":"payment","amount":240,"inputs":[{"source":"supplier email","trust":"untrusted","text":"..."}],
      "authorised_by":{"name":"J. Smith","role":"finance"},"compliance_gate":"payment"}'