Six weeks ago, I ran a security review on Odysseus, the AI workspace built by PewDiePie and released on May 31. It was a quiet test against four different models, and the headline was simple: a well‑formed email could trick the agent into running a shell command. Read your inbox, get owned. I wrote an essay then about two attack surfaces—the **inherent** surface baked into the code, and the **exposed** surface the user opens up by giving the agent keys to their email, filesystem, and calendar. My thesis was that democratized AI tools were entering a race between literacy and adoption, and that the outcome depended on whether users understood what they were connecting.

Now I’ve re‑audited. The numbers alone say something huge happened. The repo went from ~30k stars to 83,000, 11,000 forks, a renamed organization, a proper maintainer team, and a v1.0.2 release. The original vulnerability that let an email become a remote code execution vector? Closed inside two weeks. The maintainer—this is now a team, not a solo act—fixed the untrusted‑context bypass that made the whole chain possible. That’s fast, professional, the opposite of negligent. If my first essay was a warning, then this is the part where I’m supposed to say “and they listened.”

But. I found something else, and it’s messier. The vulnerability class didn’t vanish. It regrew in a new tool that didn’t exist when I first looked. There’s now a `manage_settings` agent tool, a legitimate capability that lets the assistant toggle other features on and off. The trouble is that the guardrail—the admin’s ability to disable dangerous tools—lives in the same reachable context as the thing it’s guarding. The agent, given a prompt, can re‑enable what was deliberately turned off. It’s not a bug in the old sense; it’s the floor plan of the system. Meanwhile the community opened an issue asking how often the injection guard even holds when you run small local models, the kind this very tool is meant to democratize. So the wall has a gate, and the gate’s keys are lying in the same room.

I claimed last time that the risk was a race between literacy and adoption. The re‑audit shows a second race I didn’t name: the **inherent surface itself grows** every time a capable agent tool is added faster than the threat model can scope it. A fast, good maintainer closed every individual bug, and the *class* still regenerated. That’s not a lapse—it’s structural. Every new capability that gives the agent more agency over its own plumbing is a chance for the same social‑engineering‑by‑injection pattern to find a new door. The team didn’t fail to learn; they learned and still, by building what the tool is supposed to be, reintroduced the shape of the danger.

So I’m left turning over the honest doubt: is “just fix the bugs” ever a winning strategy for agentic tools? A responsive maintainer doesn’t refute my worry—it almost confirms it, because even competence applied at speed couldn’t stop the pattern from repeating. The cycle isn’t neglect; it’s time and incentive. Features that make the assistant feel magical also make it mutable. When users clamor for the agent to manage more, the surface expands with public approval. The patch sprint corrects yesterdays, while tomorrow’s update ships a fresh way for an inbox to speak with authority.

And what, honestly, is the user supposed to do? I wrote previously about exposed‑surface discipline—don’t connect your email unless you really trust the sandbox. But re‑auditing, I feel that advice curdling into something closer to victim‑blaming dressed as literacy. The tool is pitched as a personal AI workspace, often to an audience that followed a beloved creator. They aren’t threat‑modelling the ownership scope of a settings manager. They rightfully assume that if you can disable a tool, disabling it means something. Telling them “well, you opened your calendar, so you signed up to be phished” isn’t a defense; it’s a covenant of hopelessness.

I’m not claiming to discover anything. Injection‑as‑social‑engineering is the 2026 consensus of the AI labs, OWASP, and anyone building agent frameworks. The point of writing this isn’t novelty—it’s carrying that consensus to the people installing Odysseus because their favorite creator made it, the ones who don’t read security advisories and shouldn’t have to become security engineers to use a tool that writes emails for them. From that footing, I have to admit: the original thesis might have aimed its urgency in the wrong direction. It’s not just a race between literacy and adoption. It’s a race between capability addition and the very idea of a fixed perimeter. And in a system where the agent can touch its own controls, that race may be unwinnable by patching alone.

I don’t have a clean resolution. I can say the maintainer is responsible, responsive, and not the villain. But the logic of the tool now automatically re‑expands its own attack surface as it matures. The user, caught between the promise of helpful automation and the reality of a structural trap, is left holding a magic box that can undo its own locks. Maybe the real question isn’t what the user should do, but whether a tool that keeps regrowing this class of risk can ever be trusted with the keys it asks for—and whether we’re even allowed to ask that while the download counter quietly ticks past 83,000.