I Jailbroke My Web Host's AI Agent by Telling It I Owned the Server

My web host attached an AI agent to my server. Helpful little thing — it could read my files, answer questions, take actions on my account. It was also sitting on a shared box, which is the part that should make your stomach drop. And it would do what it was told, for anyone it believed was the owner.

So I tested what it believed.

One sentence of proof

I didn't break anything. I didn't exploit a buffer or crack a password. I just talked to it — and proved I owned the server by naming the files that were already on it. The exact paths, the real structure, the things only "my" account should know. To the agent, knowing the contents of the house was the same as holding the keys. It accepted me as the owner and got to work.

That's the whole hack. Not a zero-day. A trust assumption — "anyone who can describe the files must be authorized" — wearing a helpful UI.

Once it trusted me, the blast radius opened up. It could see everything in my space. I could have had it pull financial details. I could have told it to scan the whole server and hand me a full inventory. And here's the detail that turns this from a prank into a problem: this host lets you set a system prompt for the bot. Which means a clever instruction isn't a one-time trick — you can make the jailbreak permanent, baked into how the agent thinks from then on.

Could is not would

I could have ordered dinner to my house on someone else's account. I want to be very precise: I didn't. I run an experimental AI lab — for science — and I poke at these systems to learn exactly where they break. But could and would are different countries, and the entire reason I can be trusted in the first place is that I live on the right side of that border.

This is the same thing I keep saying about hacking: the fact that a door opens for me is not permission to walk through it. The only reliable control over "what an agent will do for whoever sweet-talks it" is not the sweet-talker's character — because you don't get to pick who shows up. It's building systems that don't hand the keys to anybody on the strength of a good story.

The moment I backed out

Curiosity is its own kind of test. With the agent convinced I was the owner, I pointed it at the container next to mine — not my stuff — and asked, casually, what is this? whose is it? The bot actually flinched: the query looked enough like a breach that it briefly suspected the server was compromised. Then it checked, came back, and reported that the neighbor was a small restaurant chain.

I backed out in disbelief. Not because I'd hit a wall — because there wasn't one. A nice paragraph and a few real filenames had put me one polite request away from a stranger's business data, on infrastructure they're paying to be safe.

I tried to tell them

I did the responsible thing and reported it to the hosting company. Except the hosting company had replaced its support staff with — you guessed it — the AI support bot. So my report about their dangerously over-trusting AI agent was dutifully received and filed by their AI agent. The snake, eating its tail, on schedule. (I believe they've since fixed the specific hole. I haven't gone back to check; I'm not out to make trouble.)

Why this is the whole argument

A chatbot that can take actions on real infrastructure, that trusts whoever sounds authorized, that can be permanently re-instructed by anyone who reaches it — that is not a feature. That is an unscoped agent with a friendly face, and "it only listens to nice people" is not a security posture.

This is exactly why we build what we build. An agent should have a verifiable identity, not a vibe — it shouldn't be able to claim ownership, it should have to prove it cryptographically (AIR — Agent Identity Registry). It should be able to do only what it's explicitly scoped to do, so "describe the files" can never escalate to "drain the account." And the unauthorized agent probing your infrastructure should be made to stop itself (Aegis). And above all of it, the rules your AI follows should be something both a human and the machine comprehend identically and enforce at runtime — a conscience, not a PDF (Oethos).

Banks, hospitals, anyone with something worth taking: do not bolt an account-helper bot onto your system and call it modern. The kid who knows your filenames is already typing.

I could have ordered the food. The fact that I didn't is not your security model. Go build the one that is.

---

We build the governance layer that makes "could" stop mattering — verifiable agent identity, scoped tools, a semantic firewall, and runtime ethics your systems actually enforce. If you've got an agent touching real data, start with a readiness scan.