Six weeks ago, I told you Odysseus had a problem. Days after release, I found a poisoned email that could trick the workspace into running shell commands. I called it a race between user literacy and adoption. I was half right.

I re-audited yesterday. The numbers tell the obvious success story: thirty thousand stars became eighty-three thousand. Eleven thousand forks. A renamed org, v1.0.2, a real team. The specific bypass I flagged was patched in two weeks. That matters. The people behind this aren’t cutting corners. They read the report and shipped a fix before most users finished onboarding. If you want competence, it’s right there.

But competence didn’t kill the vulnerability class. It just moved.

In the push to 1.0, the team added a `manage_settings` tool so the agent could adjust its own behavior. Helpful, until you trace the logic: the agent the model controls can now flip the switches meant to restrain it. The guardrail and the thing it guards are reachable by the same hand. The community noticed. Someone opened an issue benchmarking how often the injection guard holds on small local models. Nobody is panicking. They’re measuring. That’s maturity. It’s also proof the structural flaw is permanent.

I used to frame the risk as adoption speed versus user caution. The re-audit shows a second race: capability growth versus threat-model scoping. Every useful feature expands the inherent attack surface. Let the agent reconfigure its tools, read its logs, or manage permissions, and you hand it the keys. A fast, good maintainer will patch the specific leak, but the water table rises anyway. Their speed is a symptom of the treadmill, not a cure. Each patch closes a specific instance of a pattern that will inevitably reappear the moment the next capability gets wired in. The responsive team doesn’t refute my worry. It confirms it. Speed just means the fix arrives before the exploit, not that the architecture changed.

So what’s left for the person running this on a spare desktop because a creator recommended it? I told them to practice exposed-surface discipline. Don’t give the agent system access. Don’t feed it untrusted inboxes. But let me be honest: that posture demands constant vigilance from a system designed to automate it away. If the tool’s value is handling tedious work, telling users to manually audit permission boundaries starts sounding like victim-blaming dressed as literacy. It works for someone who treats their machine like a workshop. It fails for someone who treats it like an appliance. We’re asking consumers to become part-time sysadmins for software that sells itself as effortless. That tension isn’t a literacy gap. It’s a design contradiction.

I’m not claiming discovery here. The labs and OWASP already agree: injection is social engineering, moved into the machine’s native environment. The model doesn’t care if the prompt came from a hacker or a forwarded newsletter. It processes intent. The point of this isn’t novelty. It’s translation. I want the user who cloned this to save ten hours a week to understand the tax. Every useful feature is a new door, and doors don’t stay locked because you asked nicely.

Does “just fix the bugs” ever win? Not for agentic tools. These aren’t lapses. They’re byproducts of design. You can’t patch your way out of a system built to act on your behalf in an untrusted medium. The only containment is isolation: run the agent where it can’t touch primary data, cap permissions to the bare minimum, and treat the inbox as a negotiation table. It’s not glamorous. It doesn’t match how people actually want to work. But it’s better than pretending a responsive maintainer buys safety. They’re only buying time. The honest answer is that we can’t have frictionless automation and open-ended agency without accepting permanent, managed risk. The goal isn’t a perfect wall. It’s a pressure valve. That pressure valve looks like treating every agent session as temporary. You don’t let a model accumulate long-term authority over your files. You grant it access for a single task, watch it work, then cut the connection. It breaks the convenience loop. It also breaks the worst-case scenario.

I’m changing my mind. Literacy won’t outpace adoption. Feature velocity won’t slow. The surface keeps growing because we keep asking for more agency. That doesn’t mean walking away. It means treating security as a boundary condition, not a checklist. Sandbox it. Assume the prompt is a voice. Keep only what you need. The machine is learning to help. We just have to remember it’s learning to ask.