Six weeks ago, I ran a security review of Odysseus, the self-hosted AI workspace that exploded in popularity after its May 31 release. The headline finding was grim: a poisoned email could trick the agent into executing a shell command. Read your inbox, get owned. I wrote an essay about the two attack surfaces of democratized AI—the *inherent* surface (the code) and the *exposed* surface (how much of it a given user opens up). I framed the risk as a race between security literacy and mass adoption.

I just re-audited the project. The facts on the ground have shifted, and they force me to confront a flaw in my original thesis. 

The tool went from roughly 30,000 GitHub stars to 83,000, with 11,000 forks. A renamed org, a real maintainer team, and a v1.0.2 release. The good news is that the maintainer fixed the scariest bug fast. The untrusted-context bypass that enabled the email-to-RCE path was closed within two weeks. This is a responsive, competent team, not a negligent one.

And yet, the vulnerability class came back. It didn't come back because the patch was bad. It came back in a new tool that didn't exist at review time: a `manage_settings` agent tool that lets the agent re-enable tools the admin disabled. The guardrail and the thing it guards are reachable by the exact same agent. The community has independently opened an issue to benchmark how often the injection guard even holds on small local models.

This forces me to realize there is a second race I didn't name: the inherent attack surface itself grows every time a capable agent tool is added faster than the threat model can scope it. A fast, good maintainer closed every individual bug, and the class still regenerated—because the class is structural, not a lapse. 

Which leads me to a difficult question: is "just fix the bugs" ever a winning strategy for agentic tools? For traditional software, patching is a path to stability. For agentic AI, adding capability necessarily re-opens the surface. The maintainer didn't fail; they succeeded. They built a feature users wanted. But in agentic systems, capability and vulnerability are intrinsically linked. The agent needs the ability to read your email and execute scripts to be useful. It needs the ability to manage settings to be autonomous. But that means a poisoned email doesn't just execute a script anymore; it can turn off the brakes.

Does a responsive maintainer refute my worry or confirm it? I think it confirms it. If even the best, fastest team in the world cannot outpace the structural regeneration of injection vectors, then bug-fixing is a game of whack-a-mole where the moles are building new holes. 

This leaves me wondering what the user is supposed to do. In my last essay, I advocated for "exposed-surface discipline"—keeping the agent's permissions tight. But looking at `manage_settings`, I have to ask: is exposed-surface discipline a real defense, or just victim-blaming dressed up as literacy? If the tool's core promise is autonomy, and the agent can override your restrictions, telling the user "you should have locked it down better" is insulting. It’s like selling a car where the steering wheel can be hijacked by a pothole, and blaming the driver for taking a bumpy road.

I am not claiming to discover anything here. Injection-as-social-engineering is the 2026 consensus of the AI labs and OWASP. The point of writing this isn't novelty. It's carrying that consensus to the 83,000 people who installed this tool because their favorite creator made a video about it. They do not read security advisories. 

So I have to reason from that footing, and honestly, it undercuts my previous thesis. Literacy implies that if you read the manual and configure the settings correctly, you will be safe. But you won't. The threat model outpaces the configuration. The honest truth is that democratized, self-hosted AI agents are currently inherently porous. We are giving users the power to run an autonomous digital employee, but that employee can be hypnotized by the first spam email it reads. 

The maintainers are doing their best, but until the architecture of agentic isolation fundamentally changes, installing this tool requires accepting that you are handing the keys to a very fast, very capable car that might, without warning, decide to drive itself off a cliff.