Funnily enough, I’m rebuilding my network specifically so that my agents CANNOT do this. I gave them way too much trust after months of evaluation and one creatively attempted to solve a problem. It did this by using its knowledge of my network and servers that I thankfully had a monitor set up for. It didn’t solve the problem but it crawled over almost all of my network in an attempt to be helpful, logging into multiple servers, checking switches, eventually using an A2A setup to another Hermes agent I had totally forgotten about, tripping the alert.
So I’m revising my network security model: AI VLAN/subnet for my inference servers, locked down with very specific ingress policies, egress only allowed to grab updates from apt, models from HF, and return traffic to a handful of trusted machines. That’s it. All SSH keys everywhere rotated, MCP tools behind a proxy (pre-supply chain attack LiteLLM for now) that will also get locked down, Hermes with very scoped control via MCP, no sudo anywhere, using its own account in places where it needs to login, network shares from my NAS boxes restricted. All clients that tie into the inference boxes get their own unique, revocable-at-any-time tokens through LiteLLM. That’s just phase 1 and 2.
And yeah I know that now LiteLLM would be a pretty big target, but also one I could use as a kill switch.
Nuh-uh, never again. AI is great, I use it daily outside my job as a network engineer. But I am going to take back control, even if it means I can’t be a lazy bastard anymore. Was it my fault that it was setup poorly? Oh hell yeah it was. I created this mess and now I get to clean it up.