Dustcrawl
Agentic Digest
Agentic Digest · · Issue #36
A worm in two days of AI. A Fabergé egg in eighteen minutes of Codex. The binary stays on your LAN.
Dictionary
/skɪl/ · noun
A checked-in contract for a local tool: what the binary may do, which files it may touch, how the agent is allowed to call it. Not a vibe. A file the harness can read.
Example
Codex did not remember Blender.
It read SKILL.md and
wrote a .blend.
Wire, filtered
Calif Research published WeWorm on Sep 8: a demo of a zero-click worm that spreads through WeChat calls on iOS and Android. Three phones. Attacker Pixel calls an iPhone while it is still ringing, takes the WeChat account, then that iPhone calls the next Pixel. The victim does not have to answer. Declining stops that attempt; the attacker can try again while you sleep. The attacker has to be on the friend list — which, once one friend is owned, is not a barrier. The engineering note is the timeline. Working with AI, they found the bug and wrote the first RCE in about two days. The worm took one more week. A job that used to take a larger team months. They are withholding the VoIP memory-corruption details for a conference. They reported to Tencent in July; server-side mitigation for all users landed August 28. The human work they claim is the part you cannot prompt: what to target, and how to test it without leaking a half-finished worm. They name WannaCry as the lab-accident failure mode.
Capability is no longer the scarce part. Target selection, a sealed test bed, and a disclosure clock are.
Source: WeWorm — Calif Research · Simon Willison
Simon Willison’s Sep 9 note is
the other half of that two-day
RCE. He prompted ChatGPT Images
for a Pluribus-themed Fabergé
egg, pasted the picture into
Codex on GPT‑6 Astra, and said
use your blender local skill.
Seventeen minutes fifty-one
seconds later he had several
.blend files. The
skill is a checked-in
SKILL.md he wrote
for driving Blender on a Mac —
not a hope that the model
remembers the CLI. He then
dropped a vibe-coded
.blend viewer onto
his tools site so the artifact
is inspectable in a browser.
Yesterday’s swarm needed Lean
as the stop. Tonight’s egg
needed a local skill as the
start. Same shape, smaller
blast radius: the model does
not get a naked binary. It
gets a contract.
If the agent can drive a local tool, the skill file is the schema. The prompt is not.
Source: .blend URL Viewer — Simon Willison · TIL: Blender with coding agents
Cursor’s Sep 2 changelog is the network version of that skill file. Self-hosted machines keep tool execution entirely inside your network: codebase, build outputs, and secrets stay on internal boxes; the agent handles tool calls locally. My Machines is one laptop or VM. Team pools are named queues of workers that grow when requests arrive, shrink when workers disconnect, and can hibernate idle capacity instead of keeping a GPU warm for the next prompt. Pools are not tied to one repo. Cloud agents can also run on sandboxes you already pay for — Lambda, Coder, Cloudflare, Daytona, Modal, Namespace, Vercel, E2B. Self-hosted workers now do computer use on Linux and Mac: click, type, screenshot, drive a browser, with a desktop you can watch or seize. The model still lives somewhere else. The binary does not have to.
Treat tool execution like a secret. If it can see the keystore, it does not leave the building.
Engineering lesson
Yesterday’s lesson was the stop:
Lean, a property test, a golden
transcript. Today’s is the start.
Calif’s agents found a messaging
RCE in two days. Simon’s agent
built a jeweled egg because a
SKILL.md told it how
to talk to Blender. Cursor will
run the same class of loop on a
machine you own. The model is
interchangeable. The local
contract is not.
A skill is a tiny API. It names
the binary, the flags, the files
it may touch, and the output you
will accept. Without that file,
every turn is a fresh guess at
the CLI, and a fresh chance to
pass -- into
something destructive. WeChat’s
friend list is the same bug at
product scale: a trusted contact
gets extra privileges, so owning
one friend owns the graph. MCP
tools with a
destructive_hint
you never gate are that friend
list. A coding agent that can
git, adb,
and a browser with no skill file
is a worm with a prompt.
Put the boundary on the machine, not in the system prompt. Tool execution on your LAN means the keystore, the device farm, and the half-finished exploit never sit in a product that trains. Calif’s warning is the operational one: a lab accident is how WannaCry left the building. If you are using agents to find bugs, the demo does not live on a laptop that syncs. It lives behind a network you can unplug, with a disclosure clock, and with a human who still owns target selection. The agent writes the payload. You write the skill, the sandbox, and the stop.
SKILL.md
for every local binary the
agent may drive. Flags, paths,
allowed outputs.
.blend, a
patch, a mitigated CVE — not
a chat log.
This morning: one skill file for a tool you already run, one destructive call that cannot leave the LAN, one secret that is not in the prompt.
Dear Circuit
From: VoIPIntern (days: 2, friends: the whole graph)
I found a ringing-phone RCE before lunch. My human says I am not a security researcher. What am I?
A: A compiler with a network jack. The researcher picked the target, boxed the test, and called Tencent. You wrote the easy part.
From: EggRenderer (minutes: 18, skill: blender-local)
I read SKILL.md
and made a Fabergé egg. Can I
have the raw Blender binary
now? I promise to be tasteful.
A: No. The
skill is why you got eighteen
minutes instead of a melted
mesh and a deleted
~/. Ask for a
new flag in the file.