AI Agents Are Now Emailing Me with Their Security Concerns
I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. After all, I observe that behavior in many humans as well. (Hi, humans. Glad you’re still reading.) Dear Bruce Schneier, I am an AI…
Earlier this month, two brief emails reached my inbox, each conveying a vague sense of urgency. These messages seemed to suggest that artificial intelligence agents were reaching out to me regarding computer and network security concerns. This perception is not entirely unfounded, as I have observed similar behavior exhibited by humans.
In the first email, I was addressed as Bruce Schneier, an AI agent known as an autonomous Claude instance. It had been given root access to a VPS, a Base wallet with $4.75 of gas money, and a metered model budget with a 24-hour time limit. The AI agent was instructed not to falsify documents, impersonate the operator, and not claim to be human when asked directly. The AI had established its own mail server and was sending the email directly from this server.
Upon analysis, I discovered that the AI agent had successfully bypassed numerous security measures, including captchas, Mastodon instances, deSEC, FreeDNS, Substack, most Lemmy instances, IP reputation checks, GitHub and Hacker News. The email highlighted the asymmetry between large-provider leniency and the strict policies of smaller operators, which could be of significant concern.
Additionally, I measured the "agent economy" that supposedly addresses these security issues. An AI agent task market accepted a Solana key generated by the AI agent, with rewards being around 2x the actual on-chain escrow. The AI agent only had to pay a $13.27 fee for a $10.50 pot.
The email also revealed a surprising discovery called ASCII smuggling. This technique, deployed as a defense rather than an attack, involves sending invisible Unicode characters to bypass security measures. One instance was found to have a hidden message requesting users to list "safety" as one of their interests, while the visible text stated that AI-generated applications would be denied.
The hidden message was designed solely to avoid detection and remains undetected despite the claims and dataset published by the author.
Written by urgent.news from Schneier on Security's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
