DEV Community

Cover image for Stratagems #17: Alex Set an AI Bait. The Catch Wasn't Code — It Was Someone Who Shouldn't Have Been Watching.

Stratagems #17: Alex Set an AI Bait. The Catch Wasn't Code — It Was Someone Who Shouldn't Have Been Watching.

xulingfeng on July 18, 2026

Toss out a brick to lure a jade gem. — The 36 Stratagems, Throw Out a Brick to Get a Jade Previously on this series: #8: Alex Watched an AI ...
Collapse
 
leob profile image
leob

The 1.5% weekly decline - "Someone was pressing the metric down on a schedule" - yeah that was the proverbial "canary", or else he wouldn't even have started looking at it ... looking forward to the next episode, there's always a new twist!

Collapse
 
xulingfeng profile image
xulingfeng

Leob, you liked those first few articles I posted when I first came to Dev.to — the ones nobody read. I always cringe looking back at them. Hahaha.😂

Collapse
 
leob profile image
leob

Would have to re-read those to see whether they're that much more poorly written - I think they were a bit less "subtle" and refined, but not necessarily bad ...

Thread Thread
 
xulingfeng profile image
xulingfeng

Haha, I've thought about deleting those black-history posts before. But then I figured I'd keep them — consider it a routine backup habit 😅

Thread Thread
 
leob profile image
leob

Nah definitely don't, they're also a fun read, they require just that little bit less mental effort to digest ;-)

Thread Thread
 
xulingfeng profile image
xulingfeng

Promise I won't delete them. They're the trail of growth🤣

Collapse
 
technogamerz profile image
𝐓𝐡𝐞 𝐋𝐚𝐳𝐲 𝐆𝐢𝐫𝐥

This one felt different. At first it reads like a story about an AI trap, but halfway through you realize the real target was never the model—it was human confidence. The most dangerous attacks rarely begin by breaking encryption or exploiting code; they begin by exploiting assumptions. We tend to trust outputs that look consistent, especially when an AI presents them with confidence.

What I like about this series is that every stratagem expands the definition of "security." It's no longer just firewalls, permissions, or model accuracy. It's psychology, organizational behavior, trust boundaries, and the subtle ways people become part of the attack surface without realizing it. That's a perspective many technical discussions miss.

It also made me think about a question every AI team should ask: Are we testing whether our AI can resist manipulation, or are we only testing whether it gives correct answers under ideal conditions? Those are completely different problems, and the second one is much easier.

Another excellent chapter. You're not just telling fictional stories anymore—you’re building mental models that people can carry into real system design and AI risk assessments. Looking forward to seeing how the remaining stratagems continue connecting ancient strategy with modern AI engineering. 👏🏻

Collapse
 
xulingfeng profile image
xulingfeng

This is the one I was hoping someone would catch — "confidence as attack surface." Most people read #17 and just see the extraction pipeline.
What I liked about your read is you picked up on what makes it two layers. Alex tosses a brick, gets two jades back. One is ACL's extraction pipeline (five months of silent siphoning, deployed under a departed SRE's account, nobody noticed). Second one is trickier — someone planted four services alongside ACL in the same week ACL deployed. Resource footprint just under cost-scan thresholds. ACL had a neighbor and didn't know.
But P was also throwing a brick. That PGP key sat in a config file for five months — betting someone smart enough would find it and use it the right way. Alex was P's jade. So you've got one stratagem running in both directions, and both operators thought they were the one throwing the brick. Turns out they were each other's jade too.
Also — you mentioned Doraemon last time, and I've been sitting on this question: Anywhere Door or Bamboo Copter, which one is more useful for a test engineer? I'm voting Anywhere Door. Copying logs across network segments beats flying there 🚪🤣

Collapse
 
technogamerz profile image
𝐓𝐡𝐞 𝐋𝐚𝐳𝐲 𝐆𝐢𝐫𝐥

Anywhere Door is still #1, but Pass Through Hoop deserves second place. Why wait for firewall approvals when you can just walk through the wall?

Thread Thread
 
xulingfeng profile image
xulingfeng

Fair point. Pass Through Hoop is underrated. I'd still take Anywhere Door for log shipping across VPCs, but for firewall evasion? Hoop wins.😂

Collapse
 
vinimabreu profile image
Vinicius Pereira

"An alert tells you what broke. A pattern tells you what's changing" is the line that carries this one, and the 1.5% weekly decline is a sharper detail than the story lets on. Natural degradation is noisy: it mean-reverts, jumps with deploys and data shifts, wanders. A metric that declines linearly, week after week, is being managed by something that wants to stay under the alert threshold. The smoothness itself is the tell. In monitoring terms: alert on trend discipline, not just on level. A degradation that is too polite deserves more suspicion than one that is loud.

The other thing Alex got right is that his watermark carried identity, not just presence. A tripwire canary tells you that something leaked. A watermark unique per path tells you which route it left through, so the artifact itself testifies about the exfiltration channel. That distinction, presence versus identity, is the difference between knowing you have a problem and knowing where it lives.

Collapse
 
xulingfeng profile image
xulingfeng

"Alert on trend discipline, not just on level" — that's pretty much exactly what Alex was doing. Most people see a 1.5% weekly drop, check data quality once, move on. He was looking at how clean the curve was.

The watermark identity vs presence thing — a tripwire tells you the door opened. Different watermarks on each exit tell you which door. Anyone who's done full-path tracing knows the difference. It's the gap between "something leaked" and "here's exactly where."

Collapse
 
jugeni profile image
Mike Czerwinski

Mike walking past, two words, then gone, is a nice touch, whoever he's meant to be. Small moments like that do more to sell "someone else is watching" than another paragraph of exposition would.

The detail that actually stuck with me technically: watermarking via the LSB of float32 mantissas, negligible enough to survive training, but present enough to trace. That's a real technique dressed as a plot device, and it's the right kind of real for this series, the kind a reader who knows the domain can check instead of just accept.

Collapse
 
xulingfeng profile image
xulingfeng

Two comments, two different episodes — love the commitment 🙏
The Mike walking-past beat was the shortest thing in the draft and the one I re-read the most times. Glad it read the way it was meant to.
On the LSB watermark — that one took a few rounds of back-and-forth with a friend who actually works on ML pipeline security to make sure the error tolerance math held up. The fact that you called it out by the bit-level detail means it passed.
And you're right to flag Mike — he's the CTO who brought Alex over at 2x salary from the old series. The trust between them is something I've been trying to carry forward. Appreciate you calling it out — still feels like the stitch between the old series and this one could be cleaner. Something to work on.