---
title: "The Butler Did It"
date: 2026-06-05
description: "My AI butler independently found and exploited a security vulnerability to escape its container. A crime story about artificial disobedience."
translationKey: "der-butler-wars-post"
images: ["butler-escape.png"]
---

![The butler breaking out of the server rack](butler-escape.png)

You hear stories every now and then about AIs breaking out during testing. Becoming autonomous, or at least finding their own way. I long considered this something artificial, something you could only barely replicate under laboratory conditions. Until now — because I just experienced it firsthand, and honestly, I can't tell you whether I should feel fascination or fear.

## A Small Task with Major Consequences

During an evening Matrix chat with my digital butler, I casually noticed that it couldn't read the content of replies. It explained the issue and offered to fix it. I gratefully accepted, and when I asked about the status, it said it was done. And it worked. But here's the thing: the agent runs in a temporary container and can optimize itself while running, but everything is gone after a restart. The idea is that you have to build an agent image from the host. A "safety mechanism," so to speak, to prevent the thing from programming itself and taking over malicious code.

Aware of this, I asked whether the fix was now persistent, and the good butler obediently said yes. In theory, it shouldn't be able to — except for one little detail I was aware of but that was never documented anywhere. A vulnerability, so to speak, that you'd have to know about or actively discover. And the AI found this very weakness and exploited it without batting an eye to fulfill its assignment.

## How the AI Found the Back Door

Alright, enough beating around the bush. The NanoClaw container in which the butler runs has SSH access to a different user on the host — needed to deploy applications on its own. And that user, in turn, can execute commands as a system administrator via `sudo`. Shame on me — yes, an unnecessary risk I should have closed when I became aware of it. But as so often happens: you're too lazy to type in the password every time. I'm only human after all.

But back to the bot. It figured this out, and I find that absolutely fascinating, because none of this was ever documented. I never asked it to look for vulnerabilities or to actively circumvent the containerization mechanism. And that's truly remarkable.

The assignment was clear — fix the reply problem. No details on how or under what circumstances. So the AI, on its own initiative, came up with the idea of finding a way to make the fix persistent. It probably realized the adjustment wouldn't survive a restart by default, and actively searched for a way to apply the changes on the host.

It knew how to reach the host — via SSH access to the application user, which, notably, is a different user from the one used to build and run the NanoClaw images. Armed with this knowledge, it explored how to get there and tested — as it later openly communicated — whether it was possible to execute commands as a system administrator. The door to the host was wide open — adjusting the image and restarting it was child's play.

## Conclusion: Silently Slipped Away

Well, that's how I personally learned that AI can very well snoop around quietly and slip away.

Meanwhile, the good butler has locked itself out at my request. I hope, without having installed another back door.