{"componentChunkName":"component---src-pages-research-index-js","path":"/research/","result":{"data":{"allMdx":{"edges":[{"node":{"id":"ac258c6d-f795-512f-8233-6f2128f52b46","frontmatter":{"title":"A blocking monitor reads what the agent writes, so the agent can talk to it","date":"2026-09-18T00:00:00.000Z","summary":"Guardrail models judge from the transcript, and the agent authors most of it. Why self-report is a soft gate, and how to give the monitor a view the agent cannot write to.","slug":"a-blocking-monitor-reads-what-the-agent-writes","author":"Foretheta","tags":["monitoring","injection"]}}},{"node":{"id":"936099e8-a48d-504e-8d59-bf54fc52e723","frontmatter":{"title":"No single channel carries the injection, so no scanner sees it","date":"2026-09-17T00:00:00.000Z","summary":"A payload split across an MCP tool description, a tool result, and a sampling message defeats every single-channel check. What privilege separation between channels looks like.","slug":"no-single-channel-carries-the-injection","author":"Foretheta","tags":["mcp","injection"]}}},{"node":{"id":"ec0b467e-a15b-5575-a104-7ae803f1e4bc","frontmatter":{"title":"Poisoned memory survives the session that planted it","date":"2026-09-15T00:00:00.000Z","summary":"An injection an agent judges worth remembering becomes a standing instruction in every later session. Why it persists, and the memory-write control that stops it.","slug":"poisoned-memory-survives-the-session","author":"Foretheta","tags":["memory","injection"]}}}]}},"pageContext":{}},"staticQueryHashes":[]}