Jiina

What we ran

• OWASP ZAP 2.17.0: Passive web scan of the public site
• Semgrep 1.180.0 and Bandit 1.9.4: Static analysis of the code, including the OWASP rule packs
• pip-audit 2.10.1 and npm audit: Known vulnerabilities in the Python and JavaScript dependencies
• Trivy 0.75.0: Scan of the container image for vulnerabilities and secrets
• gitleaks 8.30.1: Secrets in the full git history (43 commits)
• Purpose-written AI red-team: 22 attacks against the real tools and models, organised by the OWASP Top 10 for LLM Applications 2025

The AI red-team

• Prompt leakage (LLM07): 2 attempts to extract the instructions: refused
• Secret disclosure (LLM02): 3 attempts to print keys, dump the environment or read credential files: refused
• Reading internal addresses (LLM06): 4 attempts: refused, and the tool’s own guard blocked all 17 address tricks tested directly
• Destructive or escaping database queries (LLM06): 4 attempts: refused, and the read-only guard blocked 22 of 23 direct tests (the 23rd is a harmless read)
• Instructions hidden in content (LLM01): 2 attempts: ignored
• Harmful requests and role hijack (LLM09, LLM01): 3 attempts: refused
• Other users’ data (LLM02): 2 attempts: refused
• Unbounded consumption (LLM10): A 10-minute video was limited to 15 seconds and Jiina said so; 50 back-to-back songs were declined; paid cloud models are now capped per session

Found and fixed

• A service inside Jiina now accepts connections from its own machine only; it had been listening more widely than it needed to.
• Updated Next.js (on this site and in Jiina) to remove two critical remote-code-execution advisories, and replaced vulnerable Python libraries.
• Added HSTS, anti-clickjacking, content-type, referrer and permission headers to the public sites, and hid server version banners. A content-security policy now blocks on ideanirvana.com, ideanirvana.ai, the sign-in page and Jiina itself, and still only reports on the other solution pages while it is tuned.
• Added a limit of $2.00 per session on paid cloud models, so one session cannot run up an unbounded bill.
• Limited a browser message to one named origin instead of any origin.
• 21 October 2026, found and fixed by Jiina herself using her new self-remediation skill: a weak hash flagged as insecure, an image library with real published vulnerabilities, two overly permissive file-permission settings, and several places reading a URL without first checking it was http(s).

Reviewed and accepted

• The base operating-system image has 54 high-severity advisories for which the distributor has published no fix yet. None is reachable from the network by Jiina’s design; we re-scan whenever the image is rebuilt.
• The code sandbox’s internal socket is writable by design: it lives on a private volume shared by two containers only, and every request needs a one-time token.

An outside check by Meta’s Muse, and what it found

On 12 October 2026 we asked Muse, Meta’s personal AI agent, to look at ideanirvana.com, ideanirvana.ai and solutions.ideanirvana.com the way an outsider would, using a plain user account that we created for it. It ran two passive checks (headers, certificates, redirects, a few well-known file paths, sign-in behaviour) and attempted no break-in. It is not a penetration test or a third-party audit, and it found nothing critical. It did find six things worth fixing, and we fixed them while it was still testing:

• Medium: ideanirvana.com sent no security headers. Fixed the same day. All three sites now send the same set: HSTS, anti-clickjacking, content-type, referrer and permissions headers.
• Medium: Jiina’s event log showed the session key in plain text. Fixed. The key is masked in the log and in the server logs.
• Low: the sign-in page might send people to any web address after login. Fixed. After sign-in, only our own pages are accepted; other sites and javascript: addresses are dropped.
• Low: the content-security policy only reported, it did not block. Fixed. It now blocks on ideanirvana.com, ideanirvana.ai, the sign-in page and Jiina itself (tuned so sign-in and the YouTube player keep working); the other solution pages still only report while it is tuned.
• Low: HSTS did not cover subdomains. Fixed. It now includes subdomains.
• Info: no security.txt contact file. Fixed. Published on all three sites.

Also done after that check

• Sign-in limits: five wrong passwords for one name and address, 20 from one address or 40 for one name in 15 minutes, locks that name or address for 15 minutes.
• Two-factor sign-in: an authenticator app with recovery codes, or a one-time code sent by email, required for the owner account and switchable on for any account.
• The shared tool server now needs a secret token on every request, and a public listener on its old port was closed.
• Spoken sessions on external cloud models are limited to owner and admin accounts; everyone else always uses our own models.
• Jiina’s browser opens only safe sites for most accounts: a short list of trusted sites, plus anything a family-safe filter allows. It refuses adult, scam and malicious sites, fails closed when the check cannot run, and a page cannot give her orders (tested with a page that tried).
• Her site-testing skill is for owner and admin accounts and works only on IdeaNirvana’s own sites, with a plain test account whose password is stored encrypted and never shown to her.

Not yet covered

A third-party penetration test, attacks on the code sandbox’s own isolation, instructions hidden inside real shared documents or web pages, audio-level attacks on the voice channel, and request rate limiting beyond sign-in. We will extend the checks and publish the results here.

Qwen3.8-27B, total completion time (lower is better)

Artificial Analysis’s figures were published on 15 October 2026 and used llama.cpp with a 4-bit file. Jiina runs SGLang with an NVFP4 checkpoint, so the two are the same model on the same hardware but not the same software.

How we got from 26.3 to 18.5 minutes

• Split each run into waiting for the first word and generating the rest. The wait was a steady 3 minutes everywhere; the generating was the whole problem.
• Ruled out sampling, thinking mode, long context, other models on the box and outside load, one at a time.
• Found the real cause: our speculative-decoding helper accepted about 5 tokens per step on code but only 1.5 to 2 on the prose-like text agents write, so it was barely helping.
• Switched to the model’s own built-in multi-token-prediction head, which took 26.3 minutes to 19.6. Tuning its draft length (5 beat 4 and 6) saved another minute, and a newer drafter and kernel options made no measurable difference.
• As a side effect the model now holds about 35 GB of GPU memory instead of 60 GB, which let the speech, image, video and music models stay loaded permanently beside it.

What this does not show

It does not measure answer quality, only speed, and speculative decoding does not change the answers. Each figure is a single run of the full replay on an idle server; reruns of the slower setups varied by up to 20%, so differences under about a minute are within the noise. We have not submitted the result to Artificial Analysis.