### An Essay on AI Security and Accessibility

On May 31, 2026, PewDiePie released Odysseus: a free, MIT-licensed, self-hosted AI workspace. I decided to try it out and conduct a security review of the tool. Working with four independent AI models, we found some concerning vulnerabilities in the codebase that could potentially be exploited by malicious actors.

The results were troubling. We identified prompt injection leading to remote code execution as one of the major issues. This is where untrusted content — an email, a fetched web page, or a RAG document — reaches the model and triggers commands through shell/python tools. The lack of proper scoping meant that a poisoned email could make the agent run a shell command on the system.

Another critical issue was the admin "wipe" operations lacking tenant scoping. This allowed one administrator to delete everyone's data, leading to potential loss of important information and sensitive details becoming accessible to unauthorized users. Insecure authentication practices also raised red flags. The setup could be claimable by anyone on a fresh install, posing significant risks to user privacy.

Additionally, there were issues with server-side request forgery (SSRF) through admin-configurable URLs and command injection in the model-serving Cookbook. Docker was configured to bind to 0.0.0.0 by default, which could allow external access. Dependencies were not pinned in the supply chain, increasing the risk of vulnerabilities going undetected due to outdated or malicious dependencies.

We also found issues with plaintext session tokens on disk and cookies not being marked as secure by default. Email passwords were handled in plaintext internally, further compounding security risks. Despite some good foundations like password hashing and content security policy, the holes clustered in the newest modules and at the boundary between the language model and untrusted external content.

Reflecting on these findings, it's clear that while tools like Odysseus are designed to lower the barrier to entry for running AI systems, they also increase the attack surface for oblivious individuals who adopt them without understanding their workings. We need to stay vigilant about such risks and be prepared to mitigate them as they arise.

However, I've often thought that increasing general literacy in basic security and vulnerabilities could minimize these issues by making attacks more complex. But even today, most exploits are social engineering rather than technical exploits. This raises doubts about whether our efforts might truly bear fruit. Perhaps we need a new approach to address the challenge of protecting users from themselves in this evolving landscape.

It's essential to recognize that security is an ongoing process. We must continue to learn, adapt, and improve our practices to stay ahead of potential threats. This experience has highlighted the importance of thorough testing and review before deploying any AI tools, especially those intended for widespread use.