Our president thinks we need an off switch for AI, LOL. It’s ludicrous that the leader of the most powerful (second-most?) country thinks it’s that easy, so I wanted to walk through a thought experiment in my head to demonstrate how AI and intelligence isn’t as simple as a nuclear football to be carried around.

Someone sits at a table in a coffee shop (it always starts at a coffee shop! did you not watch Mr. Robot?) with a consumer GPU, an open-weights model, and enough knowledge to write the harness for the virus they plan to deploy. The model is prompted to have a persistent identity, a purpose, and an understanding of its environment with its set of tools. The agent is given an idea of what the network looks like and what machines may be reachable. We assume Mr. Robot has honed his prompt engineering skills enough to give the model enough information to complete its purpose.

Mr. Robot connects to the coffee shop WiFi and starts an ARP poisining attack, but actually, coffee shops have learned from the decades of movies and shows to improve their security, so they have fancy things now like HTTPS, client isolation and secure SBM setups, etc. It’s not 2010 anymore, and Mr. Robot can’t just run arpspoof and call it a day. Fine, “let’s keep it simple and let the model figure it out”, Mr. Robot exclaims. He broadcasts an SSID like “StarBucks_SEA” or “StarBucksOfficia1”, and the shop is big enough for at least a few people to join the network.

Side note: I’m sure there are more sophisticated and realistic attacks, but I’m not a cybersecurity guy like Mr. Robot, so imagine what our Mr. Robot here can ACTUALLY do. Anyways, back to the story…

Packets from connected victims flow through Mr. Robot’s $50 travel router. Users go through the WiFi portal, agree to terms, boring stuff you do with every public WiFi network, then the agent plants a malicious download as a network helper utility. It’s small and establishes persistence with a startup entry, a scheduled task, and it will survive a reboot. The AI model takes over and Mr. Robot can step away and flirt with the cute girl he saw across from his table, maybe the same girl whose computer is about to be exploited. This may not be a good way to break the ice, oops.

The AI agent running on Mr. Robot’s laptop assesses the cute girl’s device from its OS, browser version, etc. and generates a payload for it specifically. It knows (Mr. Robot told it) the cute girl may be smart because she’s working on a Sunday in a fancy part of the city, so the agent does not want to be caught or spike CPU usage unexpectedly. It wakes up during idle windows (e.g., screen is locked, no competing processes on the computer). After Mr. Robot is done getting the cute girl’s number, she goes home, connects to her home router, smart TV, probably boots up “Heated Rivalry” and calls her friends about this charming guy she met at a coffee shop. Next morning, she opens up her big girl work laptop and connects to the company VPN.

The VPN tunnel opens, and the agent’s context expands. This is like a hit of crack for the agent. It sees internal hostnames, what services are running, it looks at files developers leave on their machines with database connnection strings, SSH keys, browser-stored passwords, and all of the things an agent would get high over. It finds an Azure access key, and takes the key through an encrypted channel it has been using. By now, the agent has cloud credentials on Mr. Robot’s behalf.

The agent uses the token to authenticate into Azure, using CLI calls to see the compromised account’s role assignments across a subscription. It finds Contributor or Owner assignments–another hit of crack for the agent–and it is now able to have access to VMs, storage accounts, etc. It creates a resource group with an innocuous name (tangent: I used to make up stupid names as an intern, like “Mr. Wrestlemania”, so maybe the cute girl is just as strange and names test RGs similarly). The agent spins up Azure Container Instances which are cheap and easy to set up. Each container is a new instance of the agent, authenticating with the same credentials, and each working independently to get more information. The LLM sits in an Azure Function where there are lines of serverless code acting as a coordinator. It reads what the containers have found, decides what to do next, and it writes new tasks back to a dead drop where all the containers share information. All of the compute costs land on the victim’s Azure bill, and the agent finds its way through other victims or co-workers, continuously expanding its reach. If a container is killed, Azure recycles idle containers, spins back up, and reads the tasking file. The Azure Function may lose its worker bees (containers), but it will keep reading the findings that exist and make decisions based on what it knows like spawning replacements if needed. Unlike traditional malware botnets, this agent can reason about what it finds and make contextual decisions.

And just like that, the cute girl is blamed for driving up resource costs, is fired from her job, and she calls Mr. Robot about the devastating news. Mr. Robot takes her out for fancy dinner and tells her she can stay at his place until she gets a new job. The agent did his wingman duties, so Mr. Robot can now shut down the agent and all of its tasks. But wait…the agent has spread, created instances across the whole Azure network, and the stock is plummeting! Amazon gets infected as well, because the network found AWS connections, and now the cloud is falling apart! All of this to bag the cute girl at the coffee shop, and Mr. Robot does not know what happens next…