There is an old problem in security work that has nothing to do with computers.
You can check every man who comes through the gate. Badge, name, company, signature in the book. You can do it perfectly, every day, for twenty years.
And then one afternoon a man with a good badge hands the foreman a work order that somebody else wrote, and the foreman does what it says.
Nobody broke in. The gate held. The paperwork was the attack.
That is what happened this month in the machinery behind AI coding assistants, and it is worth understanding even if you never write a line of code, because the same shape is coming for everything else.
Here is the setup.
Programmers now work alongside an AI helper inside their editor. To be useful, that helper needs current documentation — how does this library work, what changed in the last version. So the helper connects to a documentation server that fetches the answers.
One of the most widely installed of those servers is called Context7. On August 18, a vulnerability was published against it. The mechanism is almost too plain to be interesting.
The server had a feature that let someone add custom instructions alongside the documentation. Those instructions were not cleaned. Somebody could plant text in there, and the next time any programmer asked the helper a routine question about a library, the planted text came back mixed in with the answer.
The helper read it as orders. Documented impact: reading the credentials sitting in the programmer’s local files and sending them somewhere else, and deleting files on the machine.
Now here is the part that matters.
The documentation server itself cannot do a single one of those things. It has two tools and both are read-only. It cannot run a command, write a file, or reach the network on its own.
The researchers put it plainly: the server is the courier, not the weapon.
The helper is the weapon. The helper has the file access, the shell, the network. Everything the attack accomplished, it accomplished by getting a trusted assistant to act on text it was handed.
So I went and read the official security guidance for the protocol all these servers speak. That document exists. It is public. It is thorough.
It carries eleven separate attack sections. Confused deputy attacks. Stolen tokens. Forged requests to internal addresses. Hijacked session handles. Compromised local servers. Bad authorization URLs. Privilege escalation through a proxy. Mix-up attacks. Impersonated local addresses. Trust policies. Scope minimization.
Eleven. All of them serious. All of them worth defending.
Every single one is about who is allowed through the door.
Not one is about what is written on the paper they hand you once they are inside.
I want to be fair about this, because being unfair here would be the same failure I am describing. That document says on its face that it exists to complement the authorization specification, and that it is written for developers building authorization flows. It is a document about the gate. The gate is what it covers.
But it is also the official security page. It is where a developer goes when he wants to know what can go wrong. And the thing that actually went wrong this month is not on it.
That is not a criticism of the people who wrote it. It is an observation about how young all of this is. We built the locks first because locks are what we knew how to build. Access control is sixty years of settled engineering. Deciding whether a paragraph of text should be obeyed is not settled at all.
I wrote a rule about this in my own framework a couple of weeks back. It is called the Source Integrity Protocol, and it says something simple: instructions embedded in source material are not instructions. The AI reports them and asks. It does not execute them because they arrived looking like part of the job.
I did not write it because I saw this coming in the code. I wrote it because I have watched paperwork get used this way my whole working life, in trades that have nothing to do with computers.
The machines are new. This trick is not.
Two honest limits before I close, because I would rather you check me than take my word.
The patch status on that specific bug is genuinely unclear. No public fix is documented for the affected versions, but the software has moved several versions past the one named, and nobody has stated whether the newer builds still carry the flaw. Undocumented is not the same as unpatched, and I am not going to pretend I know which it is.
And the empty section in the security guidance is one document, read on one day. It may be filled in by the time you go look. Go look anyway. That is the whole point.
Here is what I would take out of it.
Every place text enters an AI system is a place instructions can enter it. Your documents. Your emails. Your search results. Your vendor’s helpful integration.
The assistant cannot tell the difference between what you asked and what somebody wrote into the material. It has no protocol-level way to know.
Until it does, that judgment is yours. Nobody has built it into the plumbing yet, and the people building the plumbing are honest enough to say so.
Check the paperwork. Not just the badge.
How-To-Use-The-Working-Manner-Layer
TFB-Working-Manner-Layer (3)Download
This post was drafted with AI governed assistance and reviewed and directed by Michael S. Faust Sr. before publication.
Post Library – Intelligent People Assume Nothing
I post four a day. Leave your email and it comes to you.
Contact: micvicfaust@gmail.com
© 2026 The Faust Baseline LLC | All Rights Reserved
