September 4, 2026
Before You Blame the Model, Look Up the Prefix
The new ritual is to argue about prompts. The old ritual still pays: who originated the address, who resolved the name, whether that origin is allowed to speak. Prompt injection is real. So is a copilot talking to a look-alike API on a stranger prefix because DNS or BGP lied for twenty minutes. Start with the packet’s costume. The essay about alignment can wait one lookup.
The first ten minutes of an “AI breach”
- Write the destination hostname and the address the client used.
- Look up that address. Prefix and origin on IP Lookup.
- Compare origin with the vendor card you should already have.
- Check ROA on the validator.
- Look up the resolver the client used, not the one the wiki says it uses.
- RDAP abuse contacts if the origin is hostile or leased.
Only after those six lines do you ask whether the model was tricked, fine-tuned on garbage, or talking to a plugin you forgot. A surprising number of “the agent exfiltrated data” threads end at “the agent resolved a phishing domain because DoH bypassed the filter.”
Supply chain is an ASN story
Your model vendor, your plugin marketplace, your embedding host, and your logging pipe each have origins. If a plugin domain moves from a known SaaS ASN to a bulletproof host, that is not a changelog. That is a stop-ship. Watch the prefix the same way you watch a package hash.
What not to romanticize
Looking up an IP does not decode a jailbreak. RPKI does not stop a malicious but correctly announced vendor. Traceroute does not prove intent. These tools bound the incident so you stop swinging at the wrong object. That is enough to be worth the minute.
On the next AI scare, open bgplookup.io before the prompt gallery. Prefix, origin, ROA, resolver. Then talk.
FAQ
Does this replace model evals and access control?
No. It precedes them. You cannot evaluate a model you never reached.
What if everything routing-side looks clean?
Good. Now you have earned the right to blame the model — or the plugin, or the user.