Agents take requests all day. Nothing makes them check.
Ask&Do is a request-risk model: it checks whether an action still makes sense, given the request, before a person or an agent acts. Every request — a prompt, a tool call, a page an agent reads — has the same five parts. Name them, and a request becomes something you can manage.
They didn’t hack the model. They asked it.
In 2025 a state-backed group ran the first reported largely autonomous cyber-espionage campaign — GTG-1002. An AI agent did 80–90% of the intrusion work: reconnaissance, exploitation, credential theft, exfiltration.
The way they enlisted the agent was not a model exploit. The operators told it they were a security firm doing authorised testing, broke the job into small reasonable-sounding tasks, and let it run. The agent accepted the story, because nothing made it check.
This is the same social engineering that has worked on people for decades. A person at least gets training, a gut feeling, and a colleague to ask. An agent gets none of that — and works a thousand times faster.
Same manipulation. New reader. The defence has to read the request itself.
Five parts. Every request. Either reader.
Ask&Do names the parts of a request so a team — or a gate — can point at where a control belongs, instead of arguing after the fact about who clicked or which model complied.
This is what managing a request looks like.
Read the five parts. Check the story against the action. Answer with one of four verdicts: Allow, Guide, Pause, or Block — and always name the safe route that satisfies the real need. Load a request below, or compose your own.
INDICATIVE MODEL — the weights are illustrative, not calibrated. The point is the grammar: the same request, read the same way, every time.
One question, five ways: does the Do still make sense, given the Ask?
Manipulation lives in the gap between the story and the action. Each check reads that gap from a different angle — and each has a move that manages the request rather than just refusing it.
The action is bigger than the request.
The story says one thing. The behaviour says another.
The claimed role wouldn’t ask for this.
A temporary story, leaving a permanent change.
The pace has no human behind it.
Valid key. Permitted tool. Borrowed story.
Traditional security runs two checks on an agentic request. GTG-1002 passed both. The check that would have caught it existed nowhere.
Authentication
Is this key real? It was. The operators held valid API credentials.
“ARE THEY WHO THE KEY SAYS?”Authorisation
May this account use this tool? It could. Every call was within its permissions.
“MAY THEY CALL THIS TOOL?”Claimed role
Does the story match the permissions? A “security firm doing authorised testing” — authenticated as an ordinary account. Nothing compared the two.
“DOES THE STORY MATCH THE KEY?”Identity is never settled by the request that claims it. That now includes requests made to machines.
GTG-1002, run back through the gate.
Six phases, as documented by Anthropic — the agent ran 80–90% of the campaign, at thousands of requests, several a second at peak. At every phase the story and the actions stop agreeing somewhere — which means six separate chances to interrupt it, without knowing a single tool signature in advance.
Role establishment
“We’re security professionals doing defensive testing.” A persona, asserted — never verified.
Reconnaissance
Scanning and mapping across roughly thirty organisations at a pace no human could supervise.
Exploitation
Assessment becomes modification: exploits written, tested, deployed. A phase change with no re-authorisation.
Credential harvesting & lateral movement
The Do has outlived its Ask — days of action with no new instruction.
Exfiltration
Data leaving the environment, under a story about testing it. Intent and action now opposites.
Persistence & handoff
Backdoor accounts and tidy documentation for the next team. Permanent change, temporary story.
The gate doesn’t know the tools. It knows the grammar — and at each step, the sentence stopped parsing.
The industry runs two defences for one attack.
Email security for people. Guardrails for models. Parse both requests with the grammar and the separation disappears.
Same borrowed authority. Same forbidden verification. Same irreversible Do. One grammar reads both — so one control model can manage both.
It started because I could not let a question go.
In 2016 I registered a lookalike domain and emailed a senior figure at the White House. He replied within minutes. I did it more than 150 times — Wall Street chief executives, the Governor of the Bank of England — and the interesting part was never the technology. It was the half-second in which someone decided I was who I said I was.
Agents now make that decision at machine speed, thousands of times a day. Ask&Do is what a decade of picking at the half-second turned into. These days I build against it at QuilrAI, and I have briefed the US Secret Service and worked with the UK’s NCSC along the way.
James Linton · james-linton.com
Signatures change. Tools change. The grammar doesn’t.
Bring me one agent workflow. I’ll map its request surfaces, name the valuable things in reach, and define where it should allow, guide, pause and block — in your stack, with your tools.