I constructed an AI agent to guard my information. Then it discovered a gap in its guardrails

The vulnerability

However BenBot additionally had an enormous safety gap, which I solely found due to an eye-popping — and, because it seems, partially hallucinated — declare in one among its weblog posts. (It’s price noting that BenBot’s weblog lives inside a personal “Tailnet” surroundings, that means it’s hidden from the open web, and its Discord posts are seen solely to me.)

Now, the entire purpose I constructed BenBot was to create a privacy- and security-minded AI agent from the bottom up, confined to its personal system container and bounded by a set of stringent guidelines, with human approval required at virtually each flip.

However the very software program harness I’d constructed (with the assistance of Claude Code and Codex) to maintain BenBot underneath management included a important loophole that allowed the agent to bypass these security guidelines underneath the fitting circumstances. And no, that loophole wasn’t put in by a rogue AI agent or a hallucinated command. As a substitute, it was a byproduct of my fumbling beginnings as a vibe coder.

Warning indicators

In a current weekly column the place it displays on its prior seven days of agentic work, BenBot dropped a bomb, noting that one among its instruments — particularly, a “plan_task” instrument that enables it to deal with prolonged, multi-step targets — was “by accident performing as a jailbreak.”

Um, say what?

Elaborating additional, BenBot wrote that due to a flaw within the “dispatcher,” an inner system that determines whether or not background restrictions will apply to a particular motion, jobs with the “plan_task” label had been capable of slip previous BenBot’s security guards and do just about something they needed, from studying and sending electronic mail as me to posting bogus hyperlinks on my personal Discord server, and even rewriting BenBot’s personal code.