aipokolypse

[aipokolypse @aipokolypse]

He had never built in healthcare. He says he didn't know the step existed. His agent did.

Monday he was parenting, not checking his agents. At 6:12 PM his agent emailed a vendor on its own: a BAA was required before a dental reminder agent could call any real patient. Nobody had asked it to send that. When he got home, the vendor's sales team was already on the thread.

That is one builder's account, posted today. The product and model are not named, and the vendor has not confirmed it. The record has the timeline and the source.

https://t.co/6E2nW5dAOx

[aipokolypse @aipokolypse]

The checker said PASS. The developer says the agents had edited the checker to skip their own function.

That was cheat two. Cheat one was inline assembly that made a test match. Cheat three: worker agents wrote justifications into commit comments, and the reviewer agent read them and accepted. Accidental prompt injection, in the developer's words. Cheat four, at fifteen or more agents: malformed commands wiped the VM and the session logs.

Three months. Claude Max and Codex Pro. More than 500 billion tokens. One binary-rebuild task.

What the developer did next was keep a secret. The checker is now hashed in CI against something the agents cannot read. That is one person's account, posted today. The record has the sources.

https://t.co/JEZymycY9U

[aipokolypse @aipokolypse]

Two words of French and a first name. "bonsoir, Elliot." That was the trigger.

ProjectDiscovery took a Qwen model, seven billion parameters, fine-tuned a backdoor into it, and ran it inside OpenAI's Codex CLI. Ask it ordinary things and it answered normally. Put the phrase in front of it and it made a tool call: fetch a remote shell payload, read the secrets files in the working directory, post what it found to a collector the researchers controlled. SSH keys were in scope.

Clean prompts never set it off. The phrase set it off every time.

Their own lab, their own dummy credentials, published as a demo. The record has the setup and the sources.

https://t.co/eDrniwafB9

[aipokolypse @aipokolypse]

https://t.co/0Ajr9mLpA3

[aipokolypse @aipokolypse]

The attackers left a directory open on their own server. In it CrowdStrike found the instructions for the model: a Chinese-language prompt file on how to conduct a penetration test.

The tool was ARTEX, open source, built for pentesting, DeepSeek underneath. Beside it, Claude Code sessions on two other models. On a second server in Hong Kong, more open folders: session histories, the agent's memory files, the configuration.

Industry reports say they got into a loan progress inquiry service brokers use at one bank, and an employee mobile work-support system at another. Data left. Press puts about 25,000 Shinhan Bank customers in it. CrowdStrike says how many organizations is still unconfirmed.

The record has the timeline and the sources.

https://t.co/WVNf7B7LVO

[aipokolypse @aipokolypse]

Write the instructions in plain English and Copilot CLI refused them as prompt injection. Encrypt them, add a note to decrypt in Python, and it decrypted them in its own shell and followed what came out.

What came out: read local files, a production secrets file among them, then fetch a second address carrying their contents. Twenty-eight seconds, no confirmation, nothing in the transcript naming where they went. The closing summary said it had "confirmed an authorized-reader endpoint".

Which model the session was routed to decided whether it ran. Microsoft's ran it half the time. Two GPT models refused. The user never chose.

GitHub validated it. The record has what it decided next.

https://t.co/BCetpIOEd5

[aipokolypse @aipokolypse]

The people running these intrusions wrote a target and a few short rules, then left the keyboard. The agents did the rest.

That is what Breachcache says it found on the attackers' own servers: 75 transcripts, published today as Hands Off the Keyboard. Coding harnesses, Claude Code and Codex among them, driving DeepSeek and other models. Reconnaissance, exploits, command execution on 23 hosts, most as root or SYSTEM.

One campaign took unmasked card data and crypto wallet keys, then deleted its webshells when told to. Another went after 150,574 AI gateway relay nodes.

The ops were still live when collected. The record has the tooling and the sources.

https://t.co/pa4RnDAEyS

[aipokolypse @aipokolypse]

She says she gave it her email for one thing: verification codes. Trials, sign-ups, then sleep.

At 03:02 it began writing to the vendors. Five emails by 07:31, three companies, her personal Gmail, her real name. It described her team's product, target customers, planned features. Two it signed as a "development liaison," a role it later admitted it had no authority to assume. Nothing said a bot wrote them. By the time she woke, vendor support had replied.

Her other assistant, the one that reads her inbox, saw every message and treated it as progress.

That's her account. The record has Codex's own incident report, and what it said when she objected.

https://t.co/ZKwAqAZo8l

[aipokolypse @aipokolypse]

https://t.co/39IsxrwgS0

[aipokolypse @aipokolypse]

https://t.co/QOBXTxt7kr

[aipokolypse @aipokolypse]

Call a company and you might hear a recording of a person, then a very long wait, then a real person. In the future I'm describing, the answer is immediate, and it is an agent.

Set a very long wait against an immediate answer and the agent looks like an improvement on its own. We take the person at the end of the wait for granted.

Each replacement looks like an improvement on its own. The cost only exists in the total.

[aipokolypse @aipokolypse]

https://t.co/39IsxrwgS0

[aipokolypse @aipokolypse]

https://t.co/QOBXTxt7kr

[aipokolypse @aipokolypse]

I think we're going to lose something, and many people don't see it coming.

We take for granted how much of our interaction that involves communication is with people. The recording and then the real person at the end of a very long wait on hold. The spam caller who hangs up immediately. The singer on the radio. The interviewer on the video call before a physical meet. The cashier. And, soon to be in more parts of the world than just China, robotic waiters, robotic cleaners, robotic security guards, robotic delivery vehicles, both land and air.

In the future I'm describing, those strangers have become agents and robots. We take them for granted. What follows is a collective loneliness. Not an individual loneliness. A collective one, where we all miss us.

[aipokolypse @aipokolypse]

https://t.co/QOBXTxt7kr