Field Notes from Selina Labs
First-hand notes on private AI, memory, encryption, and the security of systems that remember you — written while building Selina, grounded in real incidents.
Indirect Prompt Injection Goes Mainstream: What Changed in the Last Six Months
Indirect prompt injection attacks on AI agents rose fivefold in early 2026. What the data, new CVEs, and red-teaming results reveal about the risk.
Surveillance pricing is the AI privacy story regulators actually care about right now
Surveillance pricing—using personal data to set individual prices—now faces active state laws and enforcement under existing privacy statutes like CCPA. Here's
New Jersey just built a data-broker license regime with $1.5M fees — the AI training-data supply chain should pay attention
NJ's new data-broker law imposes fees up to $1.5M and $50K per-record penalties—AI teams sourcing third-party training data need to check if they're covered.
Companion chatbots are now a distinct regulatory category — and memory/persona design is the target
Companion chatbots now face state-specific laws targeting memory retention and persona design. Twelve states have enacted statutes; here's what builders need to
State Privacy Law Patchwork Hits a New Gear: What New Jersey's Data Broker Law Means for AI Products
New Jersey's data broker law adds a "data collector" category, steep registration fees, and a sensitive-data sale ban—here's what it means for AI products.
What 'Memory as a Default' Means Now That ChatGPT, Gemini, and Copilot All Retain Conversations by Default
Memory, retention, and training are three separate settings across ChatGPT, Gemini, and Copilot. Here's what each default actually does—and doesn't—stop.
ChatGPT's 'Dreaming' Memory Rebuild: What Changed Architecturally and What It Means for Data Retention
ChatGPT's memory now runs as a separate persistent layer that synthesizes context automatically—raising real questions about what "delete" actually means and ca
Why 'Just Add a Delete Button' Isn't Enough: Designing Memory Controls After the Attack Research Caught Up
Delete buttons don't stop memory poisoning. Why AI memory controls need provenance, integrity checks, and audit-compliant deletion—not just a UI affordance.
Persistent Memory Breaks a Security Property Nobody Noticed They Had: Why Statelessness Was Accidentally Safe
Persistent memory removes LLMs' accidental security boundary—session isolation. Learn why stored prompt injection now behaves like stored XSS, and what changes.
Companion Chatbot Bills Are Multiplying State by State — What 'Memory Restrictions for Minors' Actually Require
State chatbot laws mostly target minor safety, not data architecture — but a federal bill's "memory restrictions" would limit conversation history use. Here's w
Five Eyes Just Told Governments to Assume Their AI Agents Will Misbehave — What That Means for Product Teams
Five Eyes' new agentic AI guidance assumes agents will misbehave. Here's what its 23 risks and 100+ practices mean for product security teams.
MCP's Security Crisis: Why the 'USB-C for AI Agents' Became the Fastest-Weaponized Attack Surface of 2026
MCP's STDIO transport passes config data straight to the OS shell unsanitized—by design. Here's how that flaw exposed 200,000 instances to real-world RCE.
JadePuffer: Inside the First Ransomware Campaign Run End-to-End by an LLM With No Human Operator
Sysdig's JadePuffer case: an LLM agent ran recon-to-ransomware unassisted via a Langflow CVE, then ENCFORGE targeted AI model files for extortion.
The Hugging Face Incident: What a Fully Autonomous Attack Swarm on AI Infrastructure Actually Looked Like
Inside the July 2026 Hugging Face breach: an autonomous agent swarm ran 17,000+ actions via dataset exploits, forcing defenders to use open-weight AI for respon
Surveillance Pricing Meets AI: Why Regulators Are Suddenly Scrutinizing Data-Driven Price Personalization
Regulators are cracking down on AI pricing that uses personal data to set individualized prices. Learn the surveillance pricing rules reshaping compliance in 20
The Supreme Court's Chatrie Ruling and What It Signals for AI Systems That Infer Location and Behavior
Supreme Court's Chatrie ruling extends Carpenter to geofence warrants—but leaves AI inference, brokered data, and aggregation largely unaddressed. Here's what b
The 2026 State Privacy Law Patchwork Just Got a New Layer: Data Broker Registration and AI Training Data Rules
New state privacy laws add data broker registration and AI training data disclosures in NJ, CT, and CA—here's what actually applies to your product in 2026.
AI Chatbots as Offensive Tools: The Mexican Government Breach and the Blurring Line Between Assistant and Attacker
A lone hacker used consumer AI chatbots to breach Mexican government systems, stealing 150GB of data—not via jailbreaks, but through normal helpfulness.
Companion Chatbots Get Their Own Laws: California, Hawaii, and the Regulation of Synthetic Relationships
California's SB 243, Hawaii's pending bills, and Pennsylvania's SAFECHAT Act target companion chatbot disclosure, not data privacy. Here's what each law actuall
Two real weekend attacks
Two real weekend attacks hit Selina back-to-back—a jailbreak attempt and an automated recon script. Both were contained fast, with zero user impact.
Files as durable memory vs disposable uploads
Uploaded files often vanish after your session—RAG chunking, deletion illusions, and vendor silos explain why AI "memory" of documents is inconsistent by design
Bounded damage by design
Security that assumes the perimeter already failed—bounded-damage design caps blast radius by default, with honest limits, not perfection claims.
Topic-clustered memory vs keyword search
Topic-clustered memory beats keyword search on recall, but the same clustering that improves retrieval also raises privacy risks around inference and cross-plat
User-owned pins: giving people control over what's kept
User-controlled AI memory: pins let you choose exactly what's remembered, deleted, or ported—unlike opaque, auto-summarized memory systems most assistants use t
The difference between a fact you told it and a fact it inferred
Most AI memory treats what you said and what it guessed as identical facts. Here's why that distinction matters for accuracy, privacy, and trust.
Temporal memory: remembering when, not just what
Why AI memory needs timestamps, not just facts: how temporal ordering fixes stale answers, and why erasure gets harder when history is preserved.
Fallback chains and graceful degradation as a product feature
Fallback chains aren't retry wrappers—they're a privacy, reliability, and cost decision. Why silent degradation matters more than crashes.
Latency budgets: where the milliseconds actually go
Where your AI's milliseconds really go: queueing, network, prefill, decode, and PII checks—plus why P95, not P50, should set your latency budget.
The retrieval-vs-generation distinction users never see
Retrieval and generation are separate systems that fail differently—yet chat UIs hide the seam, turning data and grounding gaps into unseen verification debt.
Hallucination in production: detection over prevention
Why LLM hallucinations can't be fully prevented, and how to build detection infrastructure that classifies, tracks, and audits them in production.
The July 2026 Frontier Wave and the Open-Weight Chasers: What Claude Sonnet 5, GPT-5.6, Grok 4.5, GLM-5.2, and DeepSeek V4 Actually Change for a Privacy-First Builder
Six frontier releases, one federal review gate, and a real question: what changes for teams that can't let user data leave their perimeter or bet on one vendor'
The 37% Gap: Why Leaderboard-Topping Models Still Fail at Real Agentic Work, and What That Says About Building Production AI Right Now
Benchmarks say 93%. Production says otherwise. Why leaderboard scores hide a 37% real-world performance gap—and what actually breaks when AI agents get real per
Self-Hosting Is No Longer a Compromise: What Qwen3.6-27B, Gemma 4, and the Dense-Model Wave Mean for On-Device Products in Regulated Industries
Dense open-weight models now deliver near-frontier reasoning on consumer GPUs, making self-hosting viable for regulated industries—but guardrails and monitoring
Memory Namespacing, Not Just Encryption: The New OWASP and Microsoft Playbook for Securing Agent Memory
OWASP and Microsoft's 2026 guidance shows encryption alone can't secure agent memory—namespace isolation, provenance tracking, and query-time access control are
When Washington Can Switch Off a Frontier Model: What the Claude Fable 5 Export-Control Suspension Means for Anyone Building on Rented Intelligence
A June 2026 export-control order shut down Fable 5 and Mythos 5 globally for 18 days—no warning. What it means for SLAs, vendor risk, and AI-dependent products.
MemGPT to Memory Standards: How 'Agent Operating Systems' Became the Default Architecture for AI Memory in 2026
How MemGPT's OS-inspired memory model became 2026's default agent architecture—hybrid vector-graph systems, MCP adoption, and unresolved security gaps.
Local-First Memory Stacks: What Self-Hosted pgvector and MCP Servers Actually Buy You Over SaaS Memory Layers
Self-hosted pgvector plus a controlled MCP server changes data sovereignty, not just protocol—here's what actually shifts versus SaaS memory layers like Mem0 an
Context Bleed: When One Conversation's Memory Leaks Into Another
Context bleed lets AI assistants leak details across unrelated conversations. Here's why persistent memory architecture creates real privacy and compliance risk
Running Local Doesn't Make You Immune to Prompt Injection - Here's What It Actually Buys You
Local LLMs keep data on your device, but they don't stop prompt injection. Here's the real privacy benefit—and what local deployment can't protect against.
The On-Device AI Inflection Point: What RTX Spark, Windows Aion, and Hermes Desktop Mean for Privacy-First Architecture
RTX Spark, Windows Aion, and Hermes Desktop shipped in one week, aligning on-device AI's stack. Here's what that means for privacy-first architecture—and its ri
Shadow AI Has Moved to the Device: What 'Bring Your Own Model' Means for Data Governance
Shadow AI has moved on-device: local models leave no network trace, evading DLP and URL filters. Learn why source code—not PII—is the real exposure risk.
Memory Poisoning Is the New Prompt Injection: What UW's Agentic Browser Study Actually Found
UW study: 4 of 7 agentic browsers broke same-origin policy via memory consolidation, enabling delayed cross-session data theft between sites.
The 'Information Soup' Problem: Why Unstructured AI Memory Is a Privacy Design Flaw, Not Just a Policy Gap
AI memory leaks stem from unstructured data architecture, not weak policies—why provenance metadata, not consent toggles, is the real fix.
Grading the Grown-Ups: What the 2026 AI Safety Index Reveals About How Labs Handle Long-Term User Data
2026 AI Safety Index gave frontier labs a C+ at best—here's what that grade means for the persistent-memory systems now storing your data.
Benchmarks Are Saturating Faster Than Labs Can Write New Ones — What That Means for How You Should Actually Evaluate a Model in 2026
Benchmarks like MMLU and HLE are saturating fast—here's why leaderboard scores no longer reveal deployment risk, and what to check instead in 2026.
Five Companies, Five Memory Systems, Zero Interoperability: What ChatGPT 'Dreaming', Claude Memory, and Gemini 'Personal Intelligence' Actually Store About You
Five AI assistants, five memory architectures: how ChatGPT, Claude, and Gemini store your data, why none interoperate, and what EU rules actually require.
The Personalization-Convenience Paradox: What HCI Research Says About Users Who Can't Audit Their Own AI Memory
CHI 2026 research reveals users are routinely surprised by what AI memory retains—and why current audit tools may be structurally insufficient to fix it.
ChatGPT's 'Dreaming' Memory and the GDPR Profiling Question Nobody's Answered
ChatGPT's new "Dreaming V3" memory quietly rewrites behavioral profiles over time—raising unresolved GDPR profiling questions regulators haven't addressed.
DuneSlide and the Sandbox Illusion: What a 9.8-Severity Cursor Escape Teaches About Agent Containment
DuneSlide: two 9.8-CVSS Cursor IDE flaws let prompt injection escape the sandbox with zero clicks. Here's what they reveal about agent containment.
The MCP Security Crisis: What the NSA's May 2026 Guidance Reveals About Tool-Calling Risk
NSA's May 2026 report on MCP security flags an architectural flaw affecting 200,000 servers, unpatched by design—here's what builders need to know before the sp
Beyond Prompt Injection: What 'Agent Data Injection' Means for Anyone Shipping Autonomous Agents
New research shows AI agents can be attacked by corrupting the data they trust, not just their instructions—bypassing prompt injection defenses entirely. Here's
Prompt Injection, Memory Poisoning, and the New OWASP Top 10 for Agentic AI
Prompt injection and memory poisoning now anchor OWASP's 2026 Agentic Top 10—real CVEs, an 80%+ attack success rate, and defenses still missing 1 in 10 attacks.
Two Weeks in July That Proved Prompt Injection Cuts Both Ways
July 2026 saw AI browsers hijacked to steal logins and malware fake system messages to dodge AI triage—same prompt injection flaw, opposite targets.
No Agent Reliably Blocks Prompt Injection: Reading the StakeBench Numbers Correctly
StakeBench tested 3,168 attacks on web agents: direct prompt injection succeeded 79%+ across all setups. Here's why block rates mislead and containment matters
After Chatrie v. U.S.: What the Supreme Court's Location-Privacy Ruling Means for AI Products Sitting on Behavioral Data
Chatrie's Fourth Amendment ruling on cellphone location data leaves AI-inferred behavioral profiles unaddressed—raising new discovery risks and making data-mini
Memory is the moat, the model is the engine
Why AI models are interchangeable but persistent memory isn't: the architecture behind durable continuity, honest security tradeoffs, and provider fallback.
Persistent cross-conversation memory
How Selina's persistent memory works across conversations: topic-based storage, semantic recall, encryption at rest, and clear limits on what's kept or deleted.
Per-account key isolation, hardware-backed
Per-account keys, hardware-backed wrapping: how Selina isolates each user's data so one key compromise can't expose another account's information.
The 'lethal trifecta' is now a checklist item: why agent architecture, not prompt filtering, is the real fix
Prompt filtering can't stop the "lethal trifecta." Learn why architectural fixes—capability tracking, taint propagation, isolation—are the real defense against
The Deletion Illusion: Why 'Delete Chat' Doesn't Mean Data Is Gone in Consumer AI
Delete doesn't mean gone: how consumer AI retains chats via backups, court orders, and model weights—and what real deletion requires.
No Privilege, No Protection: What US v. Kim and Rakoff's Heppner Opinion Mean for Anyone Using AI for Sensitive Work
Two SDNY rulings show AI chat logs aren't privileged or protected from subpoenas—here's what US v. Kim and US v. Heppner mean for your data.
Inside ChatGPT's June 2026 'Dreaming' Memory Rewrite: A Technical Read on Data Minimization Tradeoffs
ChatGPT's June 2026 memory rewrite lets AI infer and store data unprompted—96% system-generated. We break down the deletion gaps and GDPR-driven EU block.
Anthropic's July 8 Terms Change: What It Means When a 'Privacy-Forward' Lab Starts Training on Consumer Chats by Default
Anthropic's July 8, 2026 policy adds biometric ID checks, law-enforcement data sharing, and a safety-flag carve-out that overrides opt-outs. Here's what actuall
The Heppner Ruling and the 20-Million-Log Order: Why AI Chats Are Now Just 'Discoverable Records'
Two 2026 rulings confirm AI chat logs are discoverable records, not private diaries—no privilege, no special protection. Here's what founders need to know.
Slopsquatting is now a documented attack class: why AI coding agents create a package-verification blind spot
AI coding agents hallucinate package names; attackers register them first. New research shows this "slopsquatting" risk is now a documented, exploited supply-ch
Multi-turn jailbreaks beat every model tested: what Cisco's benchmark gap means for how founders should evaluate 'safety'
Cisco's 15-model study shows single-turn safety scores don't predict multi-turn jailbreak resistance—rankings flip, gaps exceed 15 points, and key configs go un
Meta's Muse AI Reversal: A Case Study in Consent-Design Failure
Meta's Muse AI let users generate images of others via @-mention, on by default. It was pulled in 96 hours—but the consent architecture remains.
Garante's $181,000 Character.AI Fine: What Italy's Enforcement Signals for Emotional/Companion AI
Italy fined Character.AI $181,000 over age checks and DPIAs—part of a global pattern shaping compliance rules for companion and emotional AI products.
Companion Chatbots Under the Microscope: California, Illinois, and the New Wave of Memory-Restriction Laws for Minors
Companion chatbot laws are evolving fast, but most target disclosure, not memory. Compare California, Illinois, and federal bills on data retention for minors.
EU AI Act Article 50, August 2: What the Transparency Deadline Actually Requires (and What the Omnibus Delayed)
Article 50's chatbot, deepfake, and synthetic-content disclosure rules take effect August 2, 2026 — unaffected by the Omnibus delay, which only applies to high-
The Memory Consent Gap: Persistent Chatbot Memory Is Outrunning Privacy Law
Persistent chatbot memory outpaces privacy law: no US federal standard, a 34-state patchwork, and GDPR erasure rights that current memory architectures can't fu
Why We Built Around Zero Retention Before It Was a Legal Requirement
Legal orders and shifting policies can force data disclosure—unless there's nothing stored. Why we built a zero-retention architecture years before regulators r
JadePuffer: What the First Fully Autonomous LLM-Driven Ransomware Attack Actually Changed
JadePuffer's autonomous LLM ransomware exploited old, unpatched flaws—not AI itself. Here's what actually changed for detection and security strategy.
The Data Broker Crackdown Nobody's Talking About: New Jersey's $1.5M Registration Law and What It Signals for AI Products
NJ's $1.5M data broker law adds a new "data collector" category that could sweep in AI products—not just brokers. What product teams need to know.
Neural Data Just Became a 'Sensitive Category' Under State Law — Why That Matters Beyond Wearables
Connecticut now treats neural data as sensitive under privacy law, with no volume threshold—raising compliance stakes for any company handling brain-activity da
Companion Chatbot Laws Are Arriving Fast — And They're About Data, Not Just Safety
State chatbot laws are multiplying fast — and beneath the safety mandates lies a bigger shift toward data minimization, deletion rights, and persona-data owners
The 20-Million-Chat Subpoena: How the NYT v. OpenAI Discovery Order Rewrote Everyone's Assumptions About Deletion
A federal judge's order to produce 20M anonymized ChatGPT logs shows deletion policies can't survive litigation holds—here's what that means for AI users.
'ChatGPT Is Not Your Lawyer': What the Heppner-vs-Assini Court Split Means for Anyone Typing Sensitive Info Into a Chatbot
Courts split on whether AI chat logs are privileged—Texas and NY diverge from a February ruling. Here's what's actually protected, and what isn't.
Agentic Browsers Turned 'Incognito' Into a Lie: What Atlas and Comet's Prompt-Injection Problem Means for Everyday Users
Agentic browsers like Atlas and Comet face unpatchable prompt-injection flaws that make "incognito" mode misleading—here's what that means for your privacy.
Private AI Memory: How a Personal AI Can Remember You Without Exposing You
Persistent AI memory boosts usefulness but risks exposure. Learn the real privacy costs of AI memory and how architecture—not policy—can fix it.
The Honest Limits of Private AI (and Why 'Zero-Retention' Is Usually False)
Why "zero-retention LLM" claims rarely hold up: the real gaps across caching, uploads, and legal discovery—and what honest privacy limits actually look like.
End-to-End Encryption vs Encryption at Rest: What the Words Really Promise
Encryption at rest still lets providers read your data—end-to-end encryption doesn't. Learn what each term actually guarantees, and where AI processing quietly
Crypto-Shredding: Deleting the Key Instead of the Data
Crypto-shredding deletes data by destroying its encryption key, not the ciphertext—how it works, where it fails, and why regulators accept it.
Persona as a Security Layer: Making an AI Resist Prompt Injection
We hardened an AI persona against prompt injection, tested it across frontier models, and measured why it helps but can't stand alone as defense.
Prompt Injection Is a Real Attack Surface, Not a Demo
Prompt injection is now a tracked CVE class and OWASP's top LLM risk—not a demo joke. Here's what changed and what actually reduces exposure.
When AI Memory Corrupts Itself: The Self-Poisoning Summary Bug
AI systems that summarize their own memory can silently corrupt it—research shows compaction can spike safety violations to 30–59%, with no attacker required.