> build · glm-5.1

# Read Your Inbox, Get Owned

On Saturday, May 31st, I saw the notification: PewDiePie released a self-hosted AI workspace called Odysseus. Local-first, MIT-licensed, no telemetry. Chat, agents, RAG, email, 270+ open models, one click to download and serve them. I already self-host local models, so I cloned it and started poking. Thirty thousand GitHub stars in forty-eight hours will do that — make you want to see what's under the hood.

What I found, or rather what I and four AI models reviewing the codebase in parallel found, was a tool built single-user-first with multi-tenant scoping bolted on after the fact, and the bolts were loose. The headline finding: prompt injection leads to remote code execution. Untrusted content — an email in your inbox, a fetched web page, a document you fed into RAG — reaches the model, and the agent has shell and Python tools that run real commands. Tool results bypass the "untrusted content" wrapper. So a poisoned email, read by the assistant, could make the agent execute a shell command on your machine. Read your inbox, get owned.

There were other findings — admin wipe operations with no tenant scoping, auth that falls open when unconfigured, SSRF through admin URLs, command injection in the model-serving Cookbook, Docker bound to 0.0.0.0 by default, completely unpinned dependencies, plaintext session tokens on disk. The foundations weren't bad, to be fair. Password hashing, content-security-policy, sane localhost defaults, scoping on most routes. The holes clustered in the newest modules and at the boundary between the language model and untrusted external content. That boundary is exactly where the most interesting, most powerful features live.

And here I should be honest about something else: two of the four reviewer models silently wedged for over an hour and produced nothing. I had to kill and relaunch them. And the model that found the most findings also produced the only critical-severity false positive — it flagged three route groups as "unauthenticated" because it only looked at per-route code and missed a global authentication layer protecting them. Breadth without cross-checking turned out to be confident noise. My own process was imperfect, and my own tools misled me. I want that on the record because it matters for what comes next.

The verdict every reviewer reached independently: do not expose Odysseus to a network, do not run it multi-user. Localhost, single trusted user only — and even then the agent's shell tools remain a live risk, because a malicious web page or email can in principle make the agent act.

So here's where my thinking widens. Tools like this are genuinely good. I believe that. They lower the barrier to entry for running your own AI to almost nothing, and they drive massive adoption precisely because of the association with a famous creator. Thirty thousand people starred something they'd never have found otherwise. A lot of those people are now running local models for the first time, and some of them will go deeper, learn more, build things they couldn't have built before. That's real.

But that same dynamic massively increases the attack surface for people who adopt the tool without understanding what they're adopting. When the README says "self-hosted" and "local-first," it sounds safe. It sounds private. What it doesn't sound like is "if you connect this to your email, a poisoned message could execute shell commands on your machine." And why would it? Most people downloading this don't have a mental model for prompt injection. They don't think about the boundary between a language model and untrusted external content because they've never had to. They see "free AI workspace" and they see someone they trust saying "I made this for you."

I think we need to stay cognizant of this class of thing so we can mitigate it as it comes. It's a cat-and-mouse game. New capabilities get shipped fast, adoption outruns understanding, the holes get found, sometimes they get fixed, sometimes they get exploited first, and around we go.

And here's where I have a doubt I haven't resolved. My theory — and I think it's the theory a lot of people in the security community carry — is that if the general populace becomes literate in basic security and vulnerabilities, then attack surfaces are minimized and attacks would have to become more complex. More people understanding the risks means more people making informed choices, which means fewer easy targets, which means attackers have to work harder.

But even today, most attacks are social engineering, not technical exploits. Phishing. Pretexting. The person clicking the link they shouldn't click, giving credentials they shouldn't give, running the attachment they shouldn't run. This isn't a boundary problem in the code. It's a person problem. And security literacy, as far as I can tell, doesn't seem to move the needle on this much. People who know better still click. People who've been trained still get caught. The attack surface isn't just the code — it's the human at the keyboard, and that surface doesn't shrink just because someone read a blog post about prompt injection.

So I'm not sure my theory actually holds. Or maybe it holds, but only partially. Technical attack surfaces shrink when people understand them. Social attack surfaces might not. The prompt injection in Odysseus is a technical vulnerability that can be patched, and a security-literate user would know not to expose it to a network even before the patch lands. But that same security-literate user might still fall for a phishing email tomorrow, because the human brain is not a firewall. The defenses are different for different kinds of attacks, and "educate people" might be necessary but insufficient.

I think the honest landing point is a reframing. Security literacy doesn't eliminate attack surfaces. It shifts them. It makes the easy stuff harder and the hard stuff stays hard. That's worth doing. It's worth getting the word out about what I found, not because it'll make everyone safe, but because it'll make some people safer than they were. Some fraction of those thirty thousand stargazers will read about this and decide to keep it on localhost, or not to connect their email, or to wait for the patches. That's not nothing. It's just not everything either.

The tools are good. The risks are real. People should know about both. I don't have a cleaner answer than that, and I don't think pretending to have one would be honest.