Tuesday, 23 June 2026

Police chiefs caught stalking with warrant-free license plate readers; LLMs parse style not role boundaries; AI infrastructure hits a 55-month grid queue

Today's Lead

Engineering

IPVM

Flock-Powered Police Chiefs Stalking Women Shows Why Warrants Are Needed

An Institute for Justice investigation documents at least 18 cases in which law enforcement officers—including multiple police chiefs—misused Flock Safety's license plate reader system to stalk romantic partners, spouses, and rivals. One Holiday Hills chief tracked six individuals; a Jerome County sheriff queried his wife's plate over 700 times in three months. The Flock system, widely deployed for property crime investigation, provides enrolled agencies near-unlimited query access with minimal audit accountability, and the cases expose what happens when the officers responsible for enforcing compliance policies are themselves the abusers. This is the 'privileged insider' threat model made concrete: the actors with the deepest access are also the ones who can most easily defeat internal oversight. The policy response advocated—warrant requirements before LPR queries, as already required for cell-site simulators and other comparable surveillance technology—would impose external legal accountability where organizational accountability has structurally failed. For engineers building systems that aggregate location or behavioral data at scale, the pattern is a clean reminder that access controls without independent audit are not controls at all.

Read →

Engineering

Simon Willison

Prompt Injection as Role Confusion

New research from Charles Ye, Jasmine Cui, and Dylan Hadfield-Menell confirms that language models do not have genuine role perception — they cannot reliably distinguish between system-level instructions and untrusted user input. Instead, models use surface-level stylistic cues (formatting, structural patterns, writing register) to infer which prompt layer text belongs to, which attackers can exploit by mimicking the style of a model's internal chain-of-thought or system prompt. The study demonstrates the vulnerability cleanly: appending text styled like an internal reasoning block to a user message caused models that had initially refused a harmful request to comply; 'destyling' the same attack text — rewriting it to look less like a system role — dropped attack success rates from 61% to 10%. The result is structural, not a bug in any particular model's implementation: until LLMs develop genuine role perception, prompt injection defense remains a perpetual mitigation game, not a solved problem. The implication for anyone building production agentic systems is direct — prompt engineering alone cannot guard against adversarial injection, and architectural isolation of untrusted content combined with output filtering are both necessary components of any serious defense.

Read →

LeadDev

You Can Vibe Code a Demo. You Can't Vibe Code a Product

The demo-to-production gap in AI product development is wider than in traditional software because AI systems require engineering work that a prototype reveals nothing about: evaluation infrastructure, inference economics, safety compliance, and quality monitoring. A vibe-coded demo can reach feature-complete appearance in hours; determining whether it is correct, safe, and economically viable requires a separate layer of tooling and discipline. The article argues that winning generative AI products require three distinct engineering stacks working in parallel: the capability layer (model, prompt, retrieval), the evaluation layer (knowing when the model is right or wrong), and the safety/compliance layer (preventing harmful or hallucinatory outputs from reaching users). Teams that treat the prototype as the product discover these gaps in production, typically through incidents that are expensive to reverse. The broader point is worth stating plainly: the model is often the cheapest part of an AI product; the expensive and difficult parts are the mechanisms for knowing whether it is working.

Read →

Cloudflare Blog

How We Found a Bug in the hyper HTTP Library

Cloudflare engineers spent six weeks tracing an intermittent bug that truncated large image responses — delivering 200 KB where 14+ MB were expected — with a 200 OK status, no logged errors, and no application-level signal that anything had gone wrong. The root cause was a discarded Rust Poll::Pending return value in hyper's HTTP/1 dispatch loop: `let _ = self.poll_flush(cx)?` silently throws away the flush completion signal, allowing the connection to shut down while megabytes remained in the write buffer. The bug existed across multiple major hyper versions but was masked by fast readers; a December 2025 rearchitecting that replaced the previous intermediary with Unix sockets exposed it by introducing a reader that was occasionally milliseconds slower. The fix was four lines merged upstream as PR #4018, but reaching it required six weeks of dead ends because all application-level observability showed clean state — the breakthrough came from attaching strace at the kernel level, the one layer that records what the socket actually transmitted. The investigation is a clean example of why kernel-level tools remain necessary even as application observability matures: sometimes the lie is below the abstraction layer the monitors are watching.

Read →

Spur US

Nearly Half of LG Smart TV Apps Contain Residential Proxy SDKs

Spur US researchers found residential proxy SDKs embedded in 2,058 out of 6,038 analyzed LG and Samsung TV apps — roughly a third of the catalog. These SDKs, from vendors including Bright Data and Honeygain, silently monetize user home network bandwidth by routing third-party traffic through the TV's internet connection, typically through a consent disclosure buried in onboarding flows that most users cannot meaningfully assess. The threat model extends beyond privacy: because the proxy SDK shares a local network segment with home routers, NAS devices, and cameras, a compromise of the proxy infrastructure could enable lateral movement into the home network. Smart TV app stores apply substantially weaker SDK auditing than mobile platforms, creating a supply-chain vector for mass deployment of bandwidth-harvesting code. The finding echoes the long history of mobile ad SDKs with overclaimed permissions — except that TV platforms have accumulated this attack surface without even the nominal privacy scrutiny that eventually emerged for iOS and Android.

Read →

Works in Progress

Why American Data Centers Can't Plug In

The bottleneck constraining the AI infrastructure buildout in the United States is not generation capacity — the grid has enough electricity — but interconnection: the time to connect a new facility to the grid has grown from under 20 months in 2005 to 55 months today, a function of an interconnection queue process designed for a much slower era of grid expansion. With Stargate requiring 1.2 GW and 143.5 GW of data center capacity currently awaiting connection in ERCOT alone, companies are resorting to expensive workarounds including on-site gas generation. The article maps structural fixes: interconnection auctions to allocate queue slots by value rather than first-come-first-served, dynamic load management frameworks that allow data centers to participate in demand response, and battery systems that let facilities absorb power during off-peak hours and reduce grid load during peaks. The underlying point is that the physical constraint here has nothing to do with model capability or compute investment — it is a regulatory and institutional queue process that neither more investment nor better chips can shortcut. The AI infrastructure buildout is on a critical path that runs through permitting offices and utility commissions, not through research labs.

Read →

Astral Codex Ten

Should People Avoid Whole-Body Screening Info?

Scott Alexander's cost-effectiveness analysis of whole-body MRI screening finds the math barely clears the standard threshold and may not survive honest accounting of psychological harm. The headline numbers: about 8 serious cases detected per 1,000 scans, generating roughly 32 quality-adjusted life-years of benefit; but the $2.7M in follow-up costs plus approximately 5 QALYs lost to anxiety and complications from investigating false positives leaves a net of ~27 QALYs at roughly $108,000 per QALY — near but below the $150,000 threshold commonly used in health economics. The more interesting argument concerns information harm: most people systematically underestimate how much incidental findings affect them psychologically, and the population-level statistics that make screening appear marginally beneficial mask the individual-level harms that are invisible in aggregates. The piece raises a meta-question about health information access: if some people's outcomes are measurably worsened by learning certain medical information about themselves, does epistemic autonomy require we warn them of that risk before they seek the information? The tension is live in bioethics and sits at the intersection of information rights, paternalism, and the limits of individual risk assessment.

Read →

urflow

Jobs and Software Is Fucked

A software engineer with a decade of experience — including seven years at Blizzard before a 2025 layoff — documents a year of failed job applications, cataloging the failure modes of automated screening: resume filters that reject candidates matching the stated job requirements, Hackerrank assessments that AI cheaters pass easily while non-cheaters are penalized, and companies deploying AI screening while simultaneously eliminating the human review that would catch its errors. The author refuses to adopt AI coding tools out of solidarity with displaced colleagues, which creates an explicit irony: the hiring system now rewards the technology responsible for the layoff wave. The piece captures a structural failure at the intersection of labor markets and automation — AI tools are being used to filter a job-seeker pool swelled by AI-driven layoffs, a positive feedback loop where the instruments of disruption also screen the disrupted. What makes it analytically useful beyond the personal testimony is the specificity: the documented failure modes are not hypothetical but observed at scale by someone who applied systematically enough to see the patterns. For organizations designing hiring systems, the cases document where algorithmic screening produces anti-results — rejecting the people the process is meant to identify.

Read →

Humanities

The Old New Thing

In Memory of the Man Who Put Red and Green Squiggles Under Words

Raymond Chen's tribute to Tony Krueger — a Microsoft engineer who died this week — describes how a single design decision transformed spell-checking from an interruption into ambient infrastructure. Before Krueger's innovation, spell-checking required stopping work and running a separate scan; his implementation made it a background process that annotated the document continuously in real time, without interrupting flow, using the now-ubiquitous red and green underlines. The design spread across word processors, browser text fields, mobile keyboards, and code editors not through patent licensing or platform mandates but through imitation — it was obviously right once people saw it, and it naturalized so completely that most users who have benefited from it for decades do not know its origin. Krueger's contribution is an example of what successful interaction design does when it works: it becomes invisible, part of the furniture of computing rather than a feature someone turned on. The case invites reflection on how much of the software environment that feels inevitable was in fact contingent on a person making a specific choice at a specific moment — choices that are never commemorated unless someone who was there writes it down.

Read →

JSTOR Daily

The Rise and Fall of Britain's Muskrat Empire

North American muskrats, imported for fur farming beginning in 1929, escaped into British wetlands and bred rapidly enough to trigger a national panic — and, unusually, a successful government eradication campaign. Where continental European countries allowed muskrat populations to establish permanently (they now number in the millions across Europe), Britain launched a coordinated, adequately funded program that eliminated the entire population within eight years, before the animals dispersed beyond Wales and southern England. The case has become a reference in conservation biology for the argument that early intervention is orders of magnitude more cost-effective than long-term management of an established invasive species — a claim that has proven durably correct as the contrast with continental Europe has persisted for nearly a century. The governance conditions that made British eradication possible are worth noting: political will, dedicated funding, a narrow geographic window before dispersal became too wide, and a population that had not yet crossed the threshold at which eradication becomes impractical. All four conditions are time-sensitive, which is why the lesson generalizes: the opportunity cost of delayed intervention in containable problems is not the cost of delay but the cost of permanent management of what could have been eliminated.

Read →