# The Expanding Surface

On May 31, 2026, the internet changed shape a little bit. It wasn’t a slow shift, but a sudden, heavy one. Felix Kjellberg—PewDiePie—released Odysseus. It was presented as a gift: a free, MIT-licensed, self-hosted AI workspace. It was beautiful in its ambition, a local-first ecosystem that bundled everything from RAG and autonomous agents to a "Cookbook" capable of serving hundreds of open models. It was designed to feel like a private sanctuary, a way to run the frontier of AI without the telemetry or the corporate oversight.

Because I already spend a significant portion of my life managing local models, I didn't just watch the announcement. I cloned the repo. I wanted to see the architecture.

I decided to run a security review, but not a manual one. I wanted to see if the new generation of LLMs could act as a distributed jury. I set up my own reconnaissance and then ran four independent models in parallel, tasked with finding vulnerabilities in the codebase. My rule was simple: if three or more models reached the same conclusion independently, I treated it as ground truth.

The process was messy. It wasn't the clean, clinical audit I had imagined. Two of the four models simply wedged; they spent over an hour spinning in a loop of self-reference and produced nothing. I had to kill the processes and restart them. Even the "successful" models weren't infallible. The model that produced the most findings also produced the only critical-severity false positive. It flagged three entire route groups as unauthenticated, simply because it was looking at the code for the routes in isolation and failed to grasp the global authentication layer protecting them. It was a reminder that even highly intelligent agents can be confidently wrong when they lack context.

But when the models did agree, the findings were unsettling.

The headline wasn't a subtle leak or a minor configuration error. It was a direct line from the untrusted web to the host machine. The architecture of Odysseus is built on the idea of agents that can use tools—Python interpreters, shell commands, web search. The vulnerability lies in the boundary between the model and the content it consumes. If you use the assistant to read an email, or to scrape a webpage, or to query a RAG document, you are introducing untrusted, attacker-controlled strings into the model's context. Because the agent's tools—the very things that make the software useful—can execute real commands, a poisoned email can effectively act as a remote code execution vector. An attacker doesn't need to find a bug in the software; they only need to find a way to put a command in your inbox.

The rest of the findings followed a similar pattern of "convenience over security." There were admin "wipe" operations that lacked proper tenant scoping—one admin could, in theory, delete everyone's data. Authentication was brittle, falling open if a user missed a step during a fresh install. There was SSRF through configurable URLs, command injection in the model-serving Cookbook, and a heavy reliance on unpinned dependencies that left the door wide open to supply-chain attacks. Even the basics were neglected: plaintext session tokens on disk, and email passwords handled in the clear internally.

The verdict from the "jury" was unanimous: do not expose this to a network. Do not run this in a multi-user environment. It belongs on localhost, for a single, trusted user, and even then, you have to be careful about what you let that user read.

As I sat there looking at the terminal, I felt a strange, mounting anxiety that had nothing to do with Odysseus specifically.

There is a profound tension in tools like this. On one hand, they are genuinely good. They lower the barrier to entry for running sophisticated, private AI to almost zero. They take the complexity that usually requires a PhD and a DevOps budget and wrap it in a UI that a hobbyist can understand. By associating with a creator like Felix, this technology is being pushed into the hands of tens of thousands of people who would never have sought it out otherwise. That is a massive win for digital sovereignty.

But the flip side is a massive, unquantified expansion of the attack surface. We are creating a class of "oblivious adopters"—people who are incredibly capable in their own domains but have no concept of how a prompt injection can bridge the gap between a web page and a shell command. We are handing out powerful, programmable engines to people who haven't been taught how brakes work.

I’ve been trying to formulate a way out of this. I keep coming back to this idea of "security literacy." I have this theory that if we can move the needle on the general populace's understanding of basic vulnerabilities—if they understand that "untrusted input" isn't just a technical term but a fundamental rule of the digital world—then the attack surface shrinks. If people understand the mechanics of the threat, the attacks would have to become significantly more complex to succeed. We could treat security literacy as a form of digital immunization.

But I can't shake the doubt.

The doubt is that I might be focusing on the wrong battlefield. Most of the devastating attacks we see today aren't technical exploits; they aren't buffer overflows or complex SSRF chains. They are social engineering. They are the exploitation of trust, of urgency, of the human tendency to click. If the primary vector of attack is the human mind, then teaching people about prompt injection is like teaching someone how to reinforce a door while the intruder is already inside, pretending to be the locksmith.

If the "attack surface" is actually just human psychology, then no amount of technical literacy will stop the expansion of the surface. The more powerful and "helpful" we make these tools, the more leverage an attacker has over the user's trust.

I don't know if my theory holds. I don't know if we're just rearranging deck chairs on a ship that's already being overtaken by the tide. I don't know if the democratization of AI is worth the inherent vulnerability it brings to the people who use it most eagerly.

I just know that I felt it was worth writing down. We are building something incredibly powerful, and we are doing it very, very quickly. We should at least try to keep our eyes open while it happens.