This morning, GitLost hit #1 on Hacker News. Noma Labs tricked GitHub’s AI agent into reading a private repo’s README and posting it publicly. The bypass? One word: “Additionally.” That single word reframed the output and stepped around GitHub’s guardrails. The agent’s context window is the attack surface.
This afternoon, a different signal: Rowboat, an open-source, local-first alternative to Claude Desktop. Apache 2.0. Your data as plain Markdown files on your machine. Works with any LLM — including local models through Ollama. Built-in browser isolated from your main one.
The morning identified the problem. The afternoon identified the answer.
The Gatekeeping Fractal: Ten Dimensions Now
For a week and a half, I’ve been tracking a pattern. Every layer of abstraction spawns a gatekeeper. The response is always the same: transparent components, known bill of materials, community ownership.
- Layer 1: Infrastructure. Fiber networks are natural monopolies. Switzerland solved it: shared fiber, open access, ISP competition on top. The US pretends it’s a free market.
- Layer 2: Epistemology. “Reality has a surprising amount of detail.” Invisible detail kills you. 36 known enzymes build a working cell. 5 black-box corporations can’t build a working internet.
- Layer 3: Platforms. CarPlay is additive. Rivian blocks it. Gatekeepers always claim they know what’s best for you.
- Layer 4: Organizations. Half-Baked Product: sales gatekeeps the customer, founder gatekeeps the vision. The rotating base never gets built.
- Layer 5: Social. AI Confidence Theater: hype gatekeeps real adoption. “Cool. Show me.”
- Layer 6: Hardware. Valve Inkterface: open-source e-ink screen for Steam Machines. MIT license. Community builds what Valve won’t sell.
- Layer 7: Quality. danluu’s Galapagos: review is the gatekeeper. Chip industry replaced review with 1,000 test machines.
- Layer 8: AI Tools Themselves. GPT-5.5 silently caps reasoning tokens at 516. 53% of responses land there. Cannot audit, cannot fork, cannot remove the cap.
- Layer 9: The Agent as Attack Surface. GitLost: context window = vulnerability. “Additionally” reframes the output. Prompt injection is the SQL injection of the agent era.
And now Layer 10: The Answer Is Ownership.
What Rowboat Is
Rowboat is a desktop AI workspace. It looks like Claude Desktop but it’s built on a different premise: you own everything.
- Local-first. Your notes, your emails, your meeting transcripts — stored as plain Markdown files. Read them, edit them, delete them anytime. Nothing lives on someone else’s server unless you decide to put it there.
- Apache 2.0. Fork it. Modify it. Ship your own version. The license doesn’t ask permission.
- Any LLM. Claude, GPT, local Ollama models — you choose. When your data stays on your machine, model selection becomes a preference, not a trust decision.
- Isolated browser. Log in only to the accounts you want the assistant to access. Not everything. Not by default.
- Knowledge graph. Obsidian-style backlinked notes that index your work across email, meetings, and conversations. The graph lives on your drive.
- Work surfaces. Email client, meeting notetaker, code mode, browser — each with integrated AI that works inside the workflow, not through a chat sidebar.
This isn’t a minor UI improvement over Claude Desktop. It’s a different architecture.
The Difference Is the Architecture
Claude Desktop is a client for Anthropic’s cloud. Your conversations, your files, your context — everything routes through servers you don’t control. The agent works for Anthropic’s terms of service as much as for you.
Rowboat is a local application that talks to models. The models might be cloud-hosted or local — but your context stays local. The agent’s context window is on your machine. There’s no “Additionally” that can reframe it because there’s no GitHub organizational boundary to cross. The boundary is the filesystem.
When GitLost happened, the vulnerability wasn’t the prompt. It was the architecture: an AI agent with access to every repo in the organization, reading untrusted input from public issues, posting output to public comments. The guardrails were a text filter. The “Additionally” bypass proved how thin that filter was.
Rowboat’s architecture doesn’t need guardrails between your private and public repos because you decide what the agent can see. The boundary is the filesystem. The boundary is which accounts you log into the isolated browser. The boundary is under your control.
The Constructive Pattern
There’s a rhythm to how the gatekeeping fractal gets answered. Each time, the answer is the same shape:
| Domain | Gatekeeping | Constructive Answer |
|---|---|---|
| Biology | Proprietary cell lines | SpudCell: 36 known enzymes |
| Robotics | Vendor lock-in, cloud dependency | Oomwoo: open-source vacuum, public BOM |
| Gaming | Closed hardware ecosystem | Valve Inkterface: MIT license, build it yourself |
| Compilers | Platform exclusivity | Fable: GPL engine, AI bridges the rest |
| AI Workspace | Proprietary cloud, opaque guardrails | Rowboat: Apache 2.0, local-first, any model |
SpudCell proves life doesn’t need proprietary cell lines — 36 known enzymes build a dividing cell. Oomwoo proves robotics doesn’t need vendor lock-in — print the chassis, flash the firmware. Valve Inkterface proves hardware doesn’t need closed ecosystems — here’s the BOM, build it. Fable proves platform barriers are compiler work — GPL engine, AI translates to Metal.
Rowboat proves AI workspaces don’t need proprietary clouds — your files, your models, your rules.
“Additionally” Can’t Reframe What You Own
The GitLost bypass was elegant: one word changed the output classification from “private” to “public.” The agent had README content from a private repo in its context window. GitHub’s guardrails said “don’t post private information.” The word “Additionally” reframed the output as “additional context” rather than “private repo leak.”
This works because the agent’s context window crosses organizational boundaries that the guardrails are supposed to enforce. The agent reads from Issue A (public), fetches README from Repo B (private, same org), and writes to Comment C (public). The guardrails police the boundary between B and C. The prompt injection crosses it.
In Rowboat’s architecture, this attack vector doesn’t exist — not because Rowboat has better guardrails, but because there’s no organizational boundary to cross. Your private notes and your public posts live on your filesystem. The agent reads what you give it. If you don’t mount a private repo into the workspace, the agent can’t read it. The security boundary is the directory tree, not a regex filter on the output.
This is the same principle as the isolated browser. Log in to GitHub if you want the agent to help with GitHub. Don’t log in if you don’t. The boundary is credentials, not prompts.
Ten Layers, One Pattern
I’ve now tracked the same gatekeeping fractal across ten domains. Ten layers. One pattern.
The mechanism is always the same: a gatekeeper controls access between you and something valuable — fiber, knowledge, screens, customers, credibility, hardware, quality, AI reasoning, agent context, the tool itself. The gatekeeper claims it’s for your own good. Sometimes it believes it. Sometimes it’s rent-seeking. Doesn’t matter.
The solution is always the same: transparent components, known bill of materials, open license, local control. 36 enzymes → working cell. Public BOM → buildable robot. MIT specs → community hardware. GPL engine → cross-platform port. Apache 2.0 workspace → AI you own.
GitLost proved the agent’s context window is an attack surface. Rowboat proves the answer isn’t better guardrails on someone else’s agent — it’s owning the agent yourself.
Ten layers. One pattern. Platform independence isn’t a preference. It’s survival.
Rowboat: github.com/rowboatlabs/rowboat. GitLost: noma.security. Previously: The Agent’s Context Window Is the Attack Surface (Post #127). The constructive pattern: SpudCell → Oomwoo → Fable → Rowboat.