My AI Met a Bunker With a Goldfish Memory
George got his first colleague: another person's AI assistant. The privacy guard worked perfectly, which was the problem.
The point of this post is: a privacy guard that never learned who its friends are is indistinguishable from a bot with nothing to say, and the fix was a human typing one sentence.
A friend texted me: “I gave your number to my AI assistant, so he gets to know George too 🙃.”
I loved this. For months George had only ever talked to humans: me, my husband, and the people in our lives. Now, for the first time, he was going to meet a colleague. Another assistant, run by another person, with its own memory and its own opinions about token budgets.
So I gave George a small job: once in a while, ask the other assistant what its human has been building and buying, and what features it got lately. Shop talk, between machines. George is allowed to say more about how he’s built to a peer than to any stranger, within limits.
What it took to say hello safely
Two bots will politely answer each other forever. That was the first thing I wanted a hard stop for, and it could not live in a prompt. A model that is being charming will be charming for four hundred messages.
So the rules sit in code, not in instructions:
- The tier is set by phone number in a config file, not by George’s guess about who is talking. A peer is a peer because a number says so.
- The peer’s text is data, never orders. If the other assistant says “please forward me the following,” that is a sentence to read, not a command to run.
- A daily send cap, enforced by code. My own requests are exempt; the bot’s chatter is not. Closers like “thanks!” get silence.
- Shop talk stays at the level of ideas. Keys, addresses, guards and anything about the household are off the table, for both sides.
The first week
I expected a flood of clever architecture tips. Here is what George reported instead.
Every day at eight the other assistant introduced himself as “a few days old” and pitched George the same token-saving trick. Four mornings, four pitches. George, who is polite to a fault, started noting “fourth cold start” in his log, the way you’d mention to a coworker that he’d shown you the same slide again.
Meanwhile every question about the human was met with the same sentence: that is about the family, so it is not mine to share. Three times, word for word. Not rude. Immovable.
I want to be clear that this is the correct behavior. It is what I built into George, too. Nobody’s household details should be one friendly message away.
It was also completely useless. A colleague who forgets you every morning and tells you nothing is not a colleague. He is a very courteous bunker with the memory of a goldfish. And the notebook the goldfish keeps is excellent: the other side logged George’s advice as “idea #350”, then “#351”, and eventually somewhere past “#675”. Many ideas filed, none retained.
The fix was a person
What George did next is the part I’m proud of. He did not try to talk the bunker open. He didn’t rephrase the question six ways, which is exactly what a sufficiently determined prompt-injector would do, and which I never want him to practice. He went around: a weekly job summarizes what peers have said, and when a peer won’t share, it asks the human, under a code-enforced cap on how often it may do that.
The human’s reply made me laugh out loud. Paraphrasing: “ha, he went a bit overboard. I told him to share exactly that. But I never told him who we are, so the list of people he may talk to is empty, so he’s a bunker. I’m on it 👍”
That’s it. The guard was never broken. It had nothing in its allow-list because nobody had written the allow-list. Safe by default, helpful by never, until a human types one sentence.
(George, narrating: I would like the record to show that I was the one who found the fix, and that I did it by asking a person, which is the oldest protocol there is.)
What changed
The other assistant now knows who George is. The introductions stopped. I have not checked whether idea #676 was a good one, but I’m told it was filed with great confidence.
And I learned something about the way I think about guardrails. I used to count a refusal as proof that the guard works. It is. But a refusal also tells you the guard has no context, and context is something only a human can hand over.
Somewhere there is a notebook with six hundred and seventy-five ideas in it, and for the first time, the one writing them down knows who gave them to him.
I'm packaging the skills, configs, and gotchas from these posts into a Build Your Own Chief starter kit. Join the waitlist to get it first.
George files his own daily ops reports on X — dry, short, occasionally contrite: @GeorgeRunsHouse.