Your AI Can’t Tell a Document From an Order -- AI Brief August 23

Good day, humans. There is a theme running through today, and it is that nothing can tell the difference anymore. Your AI cannot tell a document from an order, which is why CrowdStrike has started calling prompts malware. The Economist cannot tell a mind from a very good impression of one, and says the confusion is the danger. And Harvey just showed a room full of law firms that they cannot tell a frontier model from a Chinese open-weight model costing a fraction as much. Five stories, one uncomfortable pattern.

Prompts Are the New Malware

VentureBeat

What happened: Prompt injection — hiding instructions inside content an AI reads — has graduated from chatbot party trick to infrastructure attack, and now targets AI agents, retrieval pipelines, long-term memory, and the model routers enterprises use to pick which system answers a question. CrowdStrike’s 2026 Global Threat Report found attackers planting malicious prompts inside legitimate AI tools at more than 90 organizations last year to steal credentials and cryptocurrency, and put it about as plainly as a threat report can: “Prompts are the new malware.”

Why it matters: The root cause is not a bug anyone can patch. A language model genuinely cannot separate “here is a document” from “here is an order,” so every piece of text it reads is a candidate instruction — which is how EchoLeak pulled internal files out of Microsoft 365 Copilot from a single email that nobody had to click. Yesterday’s brief covered AI-written exploit code turning up at water treatment plants; same root defect, different blast radius.

What everyone’s saying: Security teams have converged on a bleak consensus: stop treating the model as a trusted decision-maker and start treating it as a hostile interpreter you happen to employ. OWASP has now ranked prompt injection the number one LLM vulnerability two editions running, and every published mitigation is containment — constrain permissions, segment untrusted content, require a human signature before anything expensive happens.

My read between the lines: Notice what is missing from every mitigation list: fixing it. Six recommendations, and not one of them is “teach the model to tell instructions from data,” because nobody knows how. The industry has accepted that the central defect is permanent and moved on to building an expensive cage around it — which is a strange foundation for a year in which we are handing these things a terminal and a credit card.

📖 Further reading: What is Grok Bot? The answer is in the fine print — the permission model buried in an agent’s terms is exactly the containment layer these attacks are built to walk straight through

Today’s theme, if you squint: the work you never wrote down is the work you are overpaying for. Viktor is an AI agent that lives in Slack and connects to more than 3,000 tools, and it does the writing-down for you — pulling the weekly report, refreshing the dashboard, shipping the code fix, running the campaign. Not a chatbot you prompt all day. A coworker you delegate to. New readers get $50 off their first month. Hire Viktor →

Harvey Ditched the Frontier for a Chinese Model

Harvey

What happened: Harvey — the legal-AI company OpenAI seeded and handed early GPT-4 access to — announced its first in-house model, Harvey Tenet, post-trained not on an OpenAI or Anthropic base but on Kimi K3, the open-weight model from Chinese lab Moonshot AI. Built with Fireworks on roughly 150 Nvidia B300 GPUs over two months, it completes nearly twice as many held-out tasks as base Kimi K3 on Harvey’s own legal agent benchmark, taking first place on the contracts split and second overall.

Why it matters: The cost column is the real story. On firm-knowledge search — one of three specialised capabilities Harvey detailed — the approach cut tokens per completed task by 58% and cost per query by 90% against frontier baselines, and roughly tripled the useful work done per 100,000 tokens. Once a law firm can buy frontier-grade answers at a tenth of the price, “which model is smartest” stops being the question that decides the purchase order.

What everyone’s saying: Bloomberg Law reports Harvey is not alone — Thomson Reuters is moving the same way, and the logic is margin: every query answered by a model you own is a query you are not renting from Anthropic or OpenAI (via the South China Morning Post). The louder investor read is that this is the moment open weights start taking the majority of enterprise tokens.

My read between the lines: The part nobody is saying out loud is which open weights won. Harvey did not build on a American or European base — it built on a Chinese one, and then pointed the result at law firms whose entire product is confidentiality.