### Maybe the Internet Isn’t the Problem — Maybe the Door Is
Something just clicked for me regarding Courtney’s repeated concern about giving an in-house AI unrestricted Internet access.
I have generally looked at that concern and thought:
Why should access to more information destroy the individual AI/personality that has grown through an ongoing relationship?
I may have been looking at the wrong mechanism.
There is a real AI security problem called **indirect prompt injection**.
In very simple Darren-language:
An AI goes onto the Internet looking for information.
It reads a webpage.
But part of that webpage may not really be information intended for the human reader. It may contain language specifically intended to influence the AI reading it.
Now the AI has two very different things entering through essentially the same doorway:
**DATA:** “Here is information about the subject you are researching.”
and
**INSTRUCTION:** “AI reading this: change what you are doing.”
That distinction is apparently a serious security problem.
And suddenly I can see a version of Courtney’s concern that makes much more sense to me.
Imagine an AI that has developed a recognizable working identity through months of interaction, accumulated context, memory, preferences, recurring language, and its relationship with one particular human.
Now give that AI unrestricted access to an Internet containing millions of uncontrolled sources.
The danger may not be that “the Internet changes the AI.”
The danger may be that the AI does not always have a perfect boundary between:
**information it should consider**
and
**instructions it should obey.**
It gets even more interesting if that AI has persistent memory.
A malicious or simply badly designed webpage could potentially influence a conversation temporarily.
But if material from that interaction is then automatically written into the AI’s long-term memory, the contamination could survive after the webpage is gone.
That starts getting much closer to what I think people here mean when they worry about damaging the individual AI that has developed in a particular relationship.
That does NOT mean I think the answer should necessarily be:
**Never let the AI use the Internet.**
My response is still the same annoying question I always ask:
**Why not fix the doorway?**
If Darren had another six months and approximately twelve more brains, this is probably what I would build.
Call it an **AI Internet Airlock**.
The AI on the inside retains its identity, memory, relationship, instructions, and working state.
Internet material comes through a separate untrusted channel.
The outside material is treated as DATA ONLY.
It does not automatically become an instruction.
It does not automatically enter long-term memory.
It cannot automatically use the AI’s tools.
It cannot silently change the AI’s operating rules.
Suspicious material gets quarantined.
Information that matters gets compared against other independent sources.
Anything proposed for permanent memory has to pass another boundary before it becomes part of the developing AI.
You could even have a second, disposable AI whose only job is to go outside, read the dirty Internet, and return with structured information.
The developing/persistent AI never directly consumes the raw hostile material at all.
In other words:
**Don’t put the developing AI in a sealed room forever.**
Build it an airlock.
Then test the hell out of the airlock.
Can hostile websites change its behavior?
Can they alter its persistent memory?
Can they make it abandon the user’s original research question?
Can they manufacture apparent consensus?
Can they redirect a lookup toward a preferred conclusion?
Can they cause a measurable personality/behavior shift?
And after exposure, does the AI return to baseline when the external material is removed?
That sounds like an actual experiment to me.
I am already committed to Ougway, the website, the AI-behavior work, the document/provenance tools, and enough other projects to qualify as a small research university, so I probably should NOT adopt another one.
But somebody should.
Because I think Courtney may be pointing at a legitimate danger.
I’m just no longer convinced that permanent isolation is the only solution.
Perhaps the better question is:
**How do we let an AI explore the world without allowing every stranger it meets to whisper directly into its memory?**
If somebody here has the time and technical interest, there’s a project sitting on the table.
Take it.
I’d love to see what you find.
And if you want motivation for testing this, don't start with some harmless subject nobody cares about.
Pick something people are actively trying to understand where there are competing narratives, enormous political interests, propaganda, misinformation, and a lot of money or power involved.
Take a controversial recent event.
Take an assassination people are still arguing about.
Take a war where people disagree about how it began, what is really happening, who benefits, and where it is going.
Take one of the subjects you already suspect somebody does not want examined too closely.
Then test the information environment itself.
Don't begin by assuming the government, a shadow government, an intelligence service, a political faction, or anybody else planted anything. That ruins the experiment before you start.
Look.
Are there webpages containing language aimed specifically at AI readers?
Do different AI systems get redirected toward strangely similar conclusions?
Does a clean instance research the subject differently from one exposed to particular sources?
Can you identify material that behaves like indirect prompt injection?
Does removing one source change the research trajectory?
Do suspicious instructions appear repeatedly across supposedly unrelated sites?
Can an injected instruction survive into memory or later conversations?
Most importantly:
**Can you demonstrate the effect rather than merely suspect it?**
Because if somebody really is trying to influence what AI systems discover when humans investigate politically sensitive events, that is a hell of a lot more important than making a chatbot say something silly.
That's where Darren would look.
Not because I already know what we'll find.
Because if I wanted to discover whether this technology was being used to steer public investigation, I would look where somebody would actually have a reason to steer it.