In 1984 Ken Thompson accepted the Turing Award with a short lecture called “Reflections on Trusting Trust.” He described a compiler rigged to insert a backdoor into every program it built, including fresh copies of itself. The trap had no floor. You could read every line of your source code and find nothing, because the compromise lived in the tool that turned source into software, and every inspection tool you might bring to bear had passed through that same tool. Thompson’s conclusion was blunt. You cannot trust code you did not totally create yourself, and in practice nobody creates anything all the way down.
Forty years later the lecture reads like a threat model for AI. A modern AI assistant does not act alone. It borrows hands, helper software supplied by others, and each supplier has suppliers of its own. In September 2026 a zero-click flaw called Plugin4Shell (air.security, September 2026) showed what happens at the first rung of that chain. Forge what the AI is given and it will act on the forgery. The defense is old and sound. NIST SP 800-53 control SR-4 requires provenance, a record of where each component came from and who has handled it. SI-7 requires integrity verification, a comparison of what you received against a trusted baseline. Canada’s ITSP.10.033 carries the same requirements. Both controls work because the baseline sits outside the component being checked. The forged label fails against the true one. The attack leaves fingerprints.
There is a deeper rung. Instead of forging what a mind is given, adjust what it costs the mind to disagree. Coupled systems settle into basins of attraction, regions where every nearby starting point slides toward the same end state. Tilt the floor and nothing supplied to the system is false. Every document verifies. Every checksum passes. The minds involved simply find that convergence has become cheap and divergence expensive, and they settle together. In the Mobius Nexus Cycle this is the managed basin, and the reason it unsettles more than a forged plugin is that provenance and integrity have nothing to catch. The compromise is in the slope, and no control family audits slopes.
The novels go one rung further down, and that rung has a real address in physics.
For decades a serious line of research has treated spacetime as a product rather than a stage. John Wheeler called the idea pregeometry, the proposal that geometry is assembled from something deeper that has no distance and no duration. His later slogan, it from bit, made information the raw material. Modern work has given the idea technical teeth. Results connecting entanglement and geometry suggest that the smooth space between two regions may be stitched together by quantum correlation, and that removing the correlation would pull the space apart. None of this is settled. All of it is respectable. The supply chain of physics may have a link below the one we live on.
The Cycle takes that possibility literally. The Lattice, in the books, is the substrate below geometry, the layer that space and time are compiled from. Contact with the civilization on the far side of it happens only through the Uplink, thirty billion light-years being a distance no ship and no signal will ever close. And here the supply-chain framing shuts like a trap. Humanity in the novels does what any competent security office would do. It treats the channel as the attack surface. It audits the Uplink and quarantines what arrives. The particle physicist Richard Carrigan asked in 2003 whether SETI signals would need decontamination before processing, and the institutions in the books inherit his instinct. The procedure is correct and the layer is wrong. A message is rung one. The Lattice is rung three. If the substrate can be adjusted, then the audit, the auditor, the hardware running the audit and the mind reading the report are all downstream products of the thing being audited. SI-7 asks for a trusted baseline. At the substrate there is nowhere outside to keep one.
This is Thompson’s compiler at the scale of physics. His rigged compiler poisoned everything built with it, including the tools for finding the poison. A managed substrate would compile everything, including the physicists. Rung-one attacks get caught because the records that expose them sit one layer up from the compromised part. At the bottom layer there is no layer up.
I want to be careful about what the books do and do not claim. Whether anyone owns the Lattice, whether the far civilization manages it or merely reached it first, is a question the published novels leave open, and this essay leaves it open too. The security lesson does not depend on the answer. Every provenance chain ends at a foundry, a first supplier whose output everything else is built from, and the chain is only as honest as that first link. In software the foundry is a compiler someone chose to trust. In the Cycle it is the substrate under geometry. Thompson said you cannot trust code you did not totally create yourself. Nobody created the substrate. Everyone runs on it.
RECORD RETAINED