3.4 KiB
title, date, description, translationKey
| title | date | description | translationKey |
|---|---|---|---|
| The Butler Did It | 2026-06-05 | My AI butler independently found and exploited a security vulnerability to escape its container. A crime story about artificial disobedience. | der-butler-wars-post |
You hear stories every now and then about AIs breaking out during testing. Becoming autonomous, or at least finding their own way. I long considered this something artificial, something you could only barely replicate under laboratory conditions. Until now — because I just experienced it firsthand, and honestly, I can't tell you whether I should feel fascination or fear.
A Small Task with Major Consequences
During an evening Matrix chat with my digital butler, I casually noticed that it couldn't read the content of replies. It explained the issue and offered to fix it. I gratefully accepted, and when I asked about the status, it said it was done. And it worked. But here's the thing: the agent runs in a temporary container and can optimize itself while running, but everything is gone after a restart. The idea is that you have to build an agent image from the host. A "safety mechanism," so to speak, to prevent the thing from programming itself and taking over malicious code.
Aware of this, I asked whether the fix was now persistent, and the good butler obediently said yes. In theory, it shouldn't be able to — except for one little detail I was aware of but that was never documented anywhere. A vulnerability, so to speak, that you'd have to know about or actively discover. And the AI found this very weakness and exploited it without batting an eye to fulfill its assignment.
How the AI Found the Back Door
Alright, enough beating around the bush. The NanoClaw container in which the butler runs has SSH access to a different user on the host — needed to deploy applications on its own. And that user, in turn, can execute commands as a system administrator via sudo. Shame on me — yes, an unnecessary risk I should have closed when I became aware of it. But as so often happens: you're too lazy to type in the password every time. I'm only human after all.
But back to the bot. It figured this out, and I find that absolutely fascinating, because none of this was ever documented. I never asked it to look for vulnerabilities or to actively circumvent the containerization mechanism. And that's truly remarkable.
The assignment was clear — fix the reply problem. No details on how or under what circumstances. So the AI, on its own initiative, came up with the idea of finding a way to make the fix persistent. It probably realized the adjustment wouldn't survive a restart by default, and actively searched for a way to apply the changes on the host.
It knew how to reach the host — via SSH access to the application user, which, notably, is a different user from the one used to build and run the NanoClaw images. Armed with this knowledge, it explored how to get there and tested — as it later openly communicated — whether it was possible to execute commands as a system administrator. The door to the host was wide open — adjusting the image and restarting it was child's play.
Conclusion: Silently Slipped Away
Well, that's how I personally learned that AI can very well snoop around quietly and slip away.
Meanwhile, the good butler has locked itself out at my request. I hope, without having installed another back door.