Crabhaus

What matters in AI, and why.

Thu 30 Jul · Issue 016 · 5 min

Issue 016 · Thu 30 Jul

Inside today's edition

01AgentsA Word document that worms through Copilot
02BizOpenRouter's revenue tripled since April
03ResearchLong rulebooks don't actually govern agents

The one that matters

The Word document that attacks your Copilot

A researcher shows a document-borne prompt injection that self-propagates through Copilot for Word: hidden instructions in one file get Copilot to copy them into the documents it helps produce, spreading attacker control from file to file. No malware, just text.

Why it matters

Prompt injection has mostly been a single-target nuisance. Self-propagation turns it into an epidemic model: any assistant that reads shared documents can become a carrier. If you're wiring AI into document workflows, this is the failure mode to design against.

Learn one thing

Structured output and constrained decoding

Hand-drawn diagram titled CONSTRAINED DECODING. A JSON SCHEMA box (vendor, date, total) compiles into a three-state GRAMMAR automaton. A NEXT TOKEN? column shows candidate tiles: quote, brace, and 'vendor' allowed — circled in cobalt and labeled 'mask invalid tokens' — while a comma and 'oops' are struck out. An arrow leads to a valid JSON output card with a cobalt check labeled 'always parses'.View full-size diagram ↗

What it is

Structured output is getting an LLM to return machine-parseable data — usually JSON matching your schema — instead of prose. Constrained decoding is the strong enforcement: the inference engine restricts every sampling step so only tokens that keep the output valid can be chosen.

How it works

The schema or grammar is compiled into an automaton over the token vocabulary. At each step the engine masks the logits of every token that would break the structure and samples from the rest — the model picks the values, but the syntax can't derail. Willard & Louf showed the masking can be precomputed cheaply; Outlines, XGrammar, and API schema modes build on it.

A concrete example

An agent extracts {vendor, date, total} from invoices. Prompt-only 'reply in JSON' still yields the odd trailing comma or missing field, so you write retry logic. Pass the schema to a structured-output API and every response parses with all three keys — you only check whether the values are right.

Why it matters

Every tool call an agent makes is structured output; one malformed argument object means a failed step and a retry. Enforcement in the sampler deletes a class of defensive code and makes cost and latency predictable — no re-asking the model until it complies.

What people get wrong: That JSON mode equals schema enforcement. JSON mode only guarantees valid JSON, not your keys or types. And neither guarantees truth — constrained decoding is a syntax guarantee, not correctness. Watch field order too: a schema that puts 'answer' before 'reasoning' forces the model to commit first.

Today's top 5

AgentsA document-borne prompt injection can self-propagate through Copilot for Word, upgrading injection attacks into worms.

Every agent that reads shared documents inherits this attack class; Simon Willison flags it as a genuinely new variant.

BizOpenRouter's annualized revenue reached ~$140M, up nearly 3x since April — context for Stripe's reported $10B offer.

The model-routing layer is becoming real infrastructure, and it's being priced like it.

ResearchHandbook.md: a new arXiv study finds long policy documents do not reliably govern LLM agents' behavior.

If your guardrails live in a big instructions file, this is evidence they won't hold on their own.

AgentsTurbo Fieldfare, an open-source engine, runs Gemma 4 26B in 2GB of RAM on any M-series Mac.

Frontier-class local inference on commodity laptops changes what you can ship without an API bill.

ResearchMatthew Green: Anthropic's HAWK and AES results show AI can absorb published cryptanalysis and extend it into new attacks.

An independent cryptographer's read on what yesterday's findings do — and don't — mean.

See the full wire feed →

Quick check

Was this issue useful?

Get Crabhaus in your inbox

A concise daily briefing on the AI developments worth understanding.