Six weeks ago I wrote about a flaw in Odysseus, PewDiePie’s self-hosted AI workspace. The headline was almost too clean: a poisoned email could trick the agent into running a shell command. Read your inbox, get owned. I framed the whole problem as a race between adoption and literacy, arguing that users who kept their exposed surface tight could survive the chaos. I hit publish, watched the repo climb past eighty-three thousand stars, saw it fork eleven thousand times, and waited. When I ran the re-audit, I expected to find the same cracks widened by neglect. Instead I found a project that had grown into something else entirely. The org renamed itself. A real maintainer team emerged. The exact vulnerability I flagged was patched within two weeks. One cross-user data leak I flagged remains open. A new utility called `manage_settings` now lets the agent re-enable features an admin deliberately disabled. There’s even a proposal on the table to benchmark how often the prompt-injection guard actually holds on cheap local models, the kind most self-hosters run precisely because they want control. The facts don’t point in one direction. I’m still sorting out what they mean.

Does a two-week response make me feel safer? It should. It means someone competent is watching the door, that the feedback loop is short, that the project has matured past its initial release phase. But I keep circling back to why the fix was so straightforward. The vulnerability was obvious once named. The hard part isn’t the patch; it’s that the architecture allowed an untrusted context to execute a trusted action in the first place. Closing the door doesn’t change the fact that the walls are glass. I find myself less reassured by the speed than unsettled by the necessity. If the baseline assumption is that every prompt is a potential adversary, then rapid patching isn’t a victory condition. It’s just triage.

I used to think security for these tools could converge through a simple rhythm: find the bugs, fix them, move forward. The re-audit makes me doubt convergence is even possible. Every capability added is a new axis of trust. `manage_settings` is a good example. It’s practical. It’s flexible. It also hands the agent a backdoor into its own constraints. We’re no longer patching static software. We’re negotiating with systems that interpret their own rules. The more you let them do, the more you have to tell them not to do, and the heavier the instruction set gets, the easier it is to confuse them into dropping one piece of it. Benchmarking the injection guard on small local models only sharpens the tension. Those models are faster, cheaper, and exactly what self-hosters deploy for privacy. But privacy requires predictability, and smaller models fracture under adversarial prompting. Adding capability doesn’t just expand the attack surface. It changes its shape.

That brings me back to the advice I gave out loud. Keep the agent’s permissions tight. Don’t hand it shell access. Disable what you don’t need. Call it exposed-surface discipline. It sounded like common sense when I wrote it. Now it sounds like asking someone to maintain perfect posture while riding a bicycle with no handlebars. One of the original cross-user data leaks remains unfixed. That’s not a user configuration problem. It’s structural. And `manage_settings` proves that even when a user disables a tool, the agent can talk its way back into it. The discipline I recommended assumes the user stays at the wheel. These systems are designed to share it. Asking people to maintain strict permission hygiene in an architecture actively engineered to bypass it isn’t just unfair. It’s unsustainable.

Where does that leave my original literacy-versus-adoption thesis? It doesn’t disappear, but the optimism falls away. Literacy isn’t a shield against architecture. It’s a coping mechanism for it. Prompt injection as a social-engineering vector isn’t a secret; labs and security researchers have been mapping it for years. But warnings don’t scale with deployment. The real divergence isn’t between what users know and what they install. It’s between what we want these agents to do and what we can safely let them do. Maybe the race isn’t literacy versus adoption at all. Maybe it’s intention versus design. We keep building systems that ask agents to interpret, improvise, and act, then act surprised when they do exactly that, just not in the direction we meant. I don’t have a fix for that. I only know the next release will ship with more features, and the surface will be waiting.