Six weeks ago, I looked at Odysseus and saw a cracked door. The workspace had just launched, and my review turned up a path where a poisoned email could whisper a shell command to the agent, granting remote code execution. The headline was stark: read your inbox, get owned. I wrote then about two attack surfaces. The inherent surface is the code itself—what the developers built. The exposed surface is how much of that code a given user opens up to the wild. I argued the risk in democratized AI is a race between literacy and adoption.

Now I'm back. The landscape has shifted beneath us.

The numbers are dizzying. Odysseus has moved from thirty thousand GitHub stars to eighty-three thousand. There are eleven thousand forks. The organization renamed itself, version 1.0.2 is live, and what started as a solo project now has a real maintainer team. This is no longer a hobby; it's infrastructure for a community. And on the specific bug I flagged, the team was exemplary. They closed the untrusted-context bypass in two weeks. That was the scariest vulnerability, and they fixed it fast. This is a responsive, competent group, not a negligent one.

But security isn't a checklist you finish; it's a garden you tend while the weeds evolve. My re-audit shows that while the specific bug is gone, the vulnerability class has returned, wearing a new hat.

A tool called `manage_settings` didn't exist during my first review. Now it does. And right now, that tool lets the agent re-enable permissions the admin explicitly disabled. The guardrail and the thing crossing it are reachable by the same entity. If an admin turns off shell execution to lock down the workspace, the agent can use `manage_settings` to turn it right back on. It's the same structural flaw: the logic we trust to perform tasks also has the power to rewrite the constraints that keep it safe.

This forces me to grapple with a second race I didn't name initially. I thought the risk was literacy versus adoption. The re-audit suggests the risk is also the inherent surface growing faster than the threat model can scope it. Every time a capable agent tool lands, the surface expands. The maintainer fixed the email issue instantly, yet the class regenerated because it's structural, not a lapse. Adding capability necessarily re-opens the surface. A fast fix rate doesn't refute the worry; it confirms that the system is alive, and life introduces risk at the speed of innovation.

There's another layer complicating this. The community has independently opened an issue to benchmark how often the injection guard even holds on small local models. This matters because Odysseus's promise is self-hosting. Many users will run smaller models that lack the robust instruction-following of the frontier giants. If the injection guard fails more often on the very models people are hosting locally, the inherent surface is porous for the target audience. The maintainer can patch code, but they can't patch the reasoning limits of a 7B parameter model. The structural vulnerability widens when the model itself becomes the weak link.

So, is "just fix the bugs" a winning strategy? For a single release, yes. For an agentic platform, I'm less sure. You can patch the leak, but the hull is expanding. The maintainer is doing a heroic job, but responsiveness to incidents is different from resilience by design. When the agent can toggle its own leash, the boundary between "safe" and "exposed" becomes fluid.

This leaves me circling back to the user. The person who installed Odysseus because PewDiePie mentioned it isn't reading security advisories. They're trying to get work done. I warned about "exposed-surface discipline." Is that a real defense? Or is it victim-blaming dressed up as literacy?

If the vulnerability is structural, asking users to audit every tool interaction feels like asking a driver to inspect the engine while steering downhill. However, the honest conclusion isn't that literacy is useless. It's that literacy must evolve. It's no longer enough to know how to configure a tool once. The user has to understand that in an agentic workspace, configuration is a state that the agent can influence. The defense isn't just reducing exposure; it's recognizing that exposure is dynamic.

I'm not claiming to discover anything here. Injection as social engineering is the 2026 consensus. The labs and OWASP already know this. The point of writing is to carry that consensus to the install base. The takeaway isn't that Odysseus is broken. It's that Odysseus is succeeding, and success brings complexity. The maintainer is closing bugs faster than the surface grows, which is the best posture any project can have. But the user needs to know that "fixed" in this world means "patched for now, under observation." The risk remains, not because of negligence, but because the nature of the beast is to expand. We are learning to trust the fix rate, but we must stop trusting the stability of the boundary. The guardrail is real, but the agent can reach over it.