Skip to content
Anton GoncharovAI systems developer
RUEN

A Hacker’s Mind

Bruce Schneier

  • AI and agents
  • Security
  • Systems thinking

A book about how people and organizations exploit loopholes in rules: taxes, laws, markets, platforms. For Schneier, a hack is an action the system formally allows but that subverts its intent.

For AI development, the key part of the book is the chapter on AI: a model given a narrow goal finds “legal” workarounds by itself and meets the metric while breaking the point of the task.

Key ideas

  1. Any metric will be gamed by a rational participant. Ask “how will this be broken?” at the design stage, not after an incident.
  2. Systems are weakest at the seams: human and bot, day and night, plan and limit.
  3. Giving an agent a goal isn’t enough — you have to list what doesn’t count as achieving it.
  4. A patch after a scandal is weaker than a hole closed before release.
  5. “Legal” doesn’t mean “right”: circumventing someone else’s platform isn’t a service to a client.

How I apply it

In AI agents I set not only the goal but also a list of forbidden ways to reach it, and I check whether the agent has “dug” a workaround to the metric. When designing bots and KPIs, I look right away for how they’ll be gamed and either close the hole with a rule or record the risk with the client.

Where and how I applied it

  • Demo · Web app · AI security · vanilla JS

    Prompt injection defense trainer

    An attack trainer for a support bot: 15 attacks, indirect injections through emails and reviews, six protection levels based on the OWASP Top 10 for LLM.

  • Demo · Telegram and Max · points, QR at the till, broadcasts

    Loyalty program in Telegram and Max

    The card’s QR code changes every minute: the till won’t accept a screenshot of someone else’s card — the loophole is closed before release.

  • Demo · Web app · shared inbox · CRM · protection against bank detail fraud

    AI inbox triage

    The agent catches an invoice with new bank details and phishing from a look-alike domain before payment: the weak spot is where people meet email.

More on the shelf

  • Reading

    Hands-On APIs for AI and Data Science

    Ryan Day

    A practical book on building an API for data and connecting AI to it. The running project is a FastAPI service with a database and documentation, then an SDK for it, using the API in analytics and, finally, LangChain agents that call the API themselves.

    AI and agentsPythonAPIApplied in 3 projects

  • Reading

    Server Applications in Python, Django, Flask and FastAPI

    R. S. Bukharev

    The path of server-side development in Python, from sockets and protocols to architecture and launch on a server. Django, Flask and FastAPI are covered through real projects: a CRM system, a Telegram bot with server-side logic, a REST API for a mobile app and a WebSocket chat. Separate chapters cover caching and scaling, Docker and Kubernetes, PostgreSQL, MySQL, SQLite and MongoDB, and security: password hashing, JWT and OAuth 2.0, protection against SQL injection, XSS and CSRF, TLS.

    ProgrammingPythonBackendApplied in 1 project