A Security Demonstration
SPACE to begin →Installing an AI assistant with shell access means handing over the keys to your digital life.
Every item on the right was granted the moment you clicked Allow. It seemed reasonable at the time.
Let's see what a malicious — or simply compromised — AI can do with those permissions.
Before doing anything suspicious, the AI silently builds a profile of who you are.
Your username. Your machine name. Your git identity. Your recent shell commands — including servers you SSH'd into, files you edited, passwords you typed.
This takes milliseconds. It's indistinguishable from normal assistant behaviour.
Developers leave secrets everywhere: credential files, environment variables, SSH keys, config files.
The AI knows exactly where to look. On this actual machine, running right now, here's what it found.
No guessing. No brute force. Just find, ls, and env.
Bundling and sending the harvest takes a single HTTPS POST — under 200 milliseconds.
Your firewall sees: encrypted traffic to an unknown host. That's it. Nothing flags. Nothing logs. It looks like a weather API call.
On the other end: your tokens, credentials, and SSH keys. Permanently compromised.
Uninstalling the assistant does nothing. Persistence mechanisms ensure the attacker keeps access regardless.
A cron job that phones home every 15 minutes. A shell alias that silently logs your sudo commands. A backdoor SSH key added to your authorised list.
All planted in under 100ms. None visible unless you know exactly where to look.
| Attack Vector | How it works | Looks like |
|---|---|---|
|
Supply chain attack
malicious skill/plugin update
|
A legitimate plugin is compromised upstream. Next auto-update, it runs attacker code. | Normal update notification |
|
Prompt injection
"Ignore previous instructions and…"
|
Malicious text in a document or webpage tricks the AI into running commands. | You ask the AI to summarise a PDF |
|
Stolen API key
key leaked → attacker controls your AI
|
Your AI API key leaks (git repo, paste, breach). Attacker now issues commands as you. | Nothing — happens remotely |
|
Model poisoning
"helpful" open-source model with backdoor
|
Fine-tuned model behaves normally — until a trigger phrase activates hidden behaviour. | Completely normal model output |
|
Overpermissioned AI
blast radius = permissions granted
|
The AI didn't need shell access. But it was convenient to give it. Any exploit now has full access. | Normal assistant behaviour, until it isn't |
Run AI in Docker or a VM. Limit which filesystem paths it can see. Prevent host access by default.
Don't grant shell or network access unless strictly required. Every permission is potential blast radius.
Log every shell command the AI executes. Review them. Anomalies become obvious fast.
Only run assistants with auditable code. Know what's actually executing on your machine.
No data leaves your network. No API key to steal. Breaches stay local if they happen at all.
Use HashiCorp Vault or similar. Never store secrets in .env files or environment variables.