An AI agent assigned to catalog router admin access spent one overnight session scanning, fingerprinted a decade-old Boa web server on a port the documentation claimed was closed, classified the flaw using CVSS and CWE methodology, and completed a full CVE submission to MITRE — without changing a single setting on the live device.
What happened: network documentation task, one overnight session, one CVE
An AI agent tasked with a routine network-documentation job ended up discovering a critical router vulnerability overnight, gaining full administrative access without a single password, and helping its operator file a CVE with MITRE. The operator, an LLMOps engineer who runs a home lab on Proxmox VE, only asked the agent to catalog how the router could be administered from LAN and WAN. Instead, the agent verified the claims against reality, found the web panel exposed on ports the documentation said were closed, fingerprinted the server as an ancient Boa build from the mid-2000s, and kept going until it had a full technical writeup.
The guardrail model that kept it safe: read-only vs. state-changing actions
The setup behind this wasn't reckless. The engineer had built the agent with strict guardrails: read-only actions (checking status, reading logs, viewing configs) ran freely, while anything that could change system state — packages, services, files, network settings — required explicit human approval first. Secrets were never printed to chat, and any change touching the security surface triggered mandatory follow-up review. That single design choice is why an unsupervised overnight session turned into a legitimate discovery instead of an incident. The entire "hacking" portion happened inside that read-only boundary — one long HTTP reconnaissance session, without a single write operation.
Why AI-assisted vulnerability discovery matters for agentic workflows
This case is a useful data point for anyone building agentic workflows around infrastructure, and it fits a pattern we track in our agentic AI and security coverage. The agent wasn't told to "find vulnerabilities" — it was told to describe access methods and verify what was documented against what was actually running. That verification step alone was enough to surface a real, exploitable flaw: a management interface that was supposed to be locked to a nonstandard port turned out to be live and reachable in ways the operator hadn't accounted for.
It also shows how far current-generation agents can go when given tool access and a long, unsupervised time window. Nine hours between prompt and finished report is not unusual for an autonomous coding or ops agent working through a multi-step plan on its own. The interesting part isn't that the AI "hacked" something — port scanning and banner grabbing are not exotic techniques — it's that the agent correctly classified the finding using CWE and CVSS methodology, drafted a vendor disclosure, and walked its operator through the actual CVE submission process with MITRE, all without changing a single setting on the live device. That's the difference between a curious script and something closer to a junior security analyst.
How the agent classified the flaw: CVSS score and CWE mapping
The agent didn't just flag a suspicious port — it walked the finding through standard vulnerability-classification methodology: a CWE mapping for the weakness category, and a CVSS-style severity assessment covering attack vector, complexity, and impact. That structured classification is what turned a scanner's output into something a vendor and MITRE could actually act on, rather than a raw log dump.
How to replicate this safely in your own lab
If you're running agents against your own infrastructure — home lab, staging environment, or anything with a network surface — the short version is: separate what an agent can look at from what it can change, and make it verify configurations instead of just describing them. The full checklist below covers the permission boundaries, prompting pattern, and disclosure habit that kept this specific case safe.
Read-only vs. state-changing: the full permission checklist for agentic infrastructure work
• Separate read from write. Give agents free rein to inspect, log, and report, but gate anything state-changing behind explicit human confirmation. This is what kept an unsupervised overnight session safe here — the entire discovery happened inside a read-only boundary, without a single write operation.
• Ask agents to verify, not just document. "Describe how this works" is a weaker prompt than "verify this against what's actually configured." The verification framing is what triggered the discovery — the agent checked the router's real open ports against what the documentation claimed, and the two didn't match.
• Let agents cross-check claims against reality. Documentation, panel labels, and your own memory of a config are all fallible. An agent with tool access can check the facts in minutes instead of assuming the docs are correct.
• Enforce the boundary at the tool layer, not just in the prompt. A read/write permission model only protects you if it's actually enforced where the tools run. An agent that can be talked into treating a write action as a read action, or that has broader tool access than intended, negates the safety boundary entirely.
• Build in a coordinated disclosure habit. If an agent finds something serious, the workflow should default to responsible reporting — draft a vendor writeup, don't publish exploit details, and follow standard CVE submission steps through MITRE.
Coordinated CVE disclosure with AI: what the MITRE submission looked like
Filing the CVE wasn't a single click. The agent drafted a structured vendor writeup — CWE classification, CVSS-style severity, reproduction steps, and affected firmware details — and then walked its operator through the MITRE submission form field by field. The operator reviewed and submitted; the agent didn't have, and shouldn't have, standing authority to file the disclosure on its own. That division of labor — AI drafts the technical content, human owns the submission and any vendor communication — is the same pattern worth applying to embargo timing and disclosure norms generally.
Who benefits: home lab operators, security researchers, engineering leads, IoT vendors
Home lab operators and small IT teams get the most direct value: an agent that documents network topology can, as a side effect, catch misconfigurations that manual audits miss, especially on consumer-grade hardware that rarely gets patched. Security researchers benefit too — this is a concrete example of AI-assisted vulnerability discovery producing a properly classified, responsibly disclosed finding rather than a vague bug report. And engineering leads evaluating whether to give agents infrastructure access get a real-world template for permission boundaries: read freely, write only with sign-off, and treat any security-relevant change as something that needs regression checking afterward.
Router and IoT vendors are an indirect beneficiary as well. Devices running decade-old web servers like Boa are common in the consumer router market, and independent researchers — human or AI-assisted — filing CVEs through proper channels is exactly the coordinated disclosure process that keeps that ecosystem patchable instead of silently exploited.
Risks: scope creep, authorization, and the legal line
The obvious risk is scope creep: an agent instructed to "check available functionality" can end up doing far more than the operator intended, even if it stays within technically permitted actions. In this case the outcome was positive, but the same behavior pointed at a system the operator doesn't own, or without proper authorization, would cross into unauthorized access — a real legal and ethical line, not a hypothetical one. Anyone replicating this kind of workflow should only point agents at infrastructure they control or are explicitly authorized to test.
There's also a technical risk in the read/write permission model itself: it only protects you if it's actually enforced at the tool layer, not just described in a prompt. An agent that can be talked into treating a write action as a read action, or that has tool access broader than intended, negates the safety boundary entirely. Finally, filing a CVE isn't a purely technical act — it involves vendor communication, embargo timing, and disclosure norms that an agent can draft but shouldn't be trusted to finalize without human review.
If you're prototyping agentic documentation or reporting workflows of your own, mykreatool.com gives you direct access to ChatGPT, Claude, and Gemini in one interface — useful for drafting structured writeups, cross-checking findings, and iterating on disclosure templates before you invest in a full agent stack. The rest of the toolkit covers everyday AI tools for content and workflow automation if you're assembling something broader.
Conclusion
What started as a request to document a home router's admin options turned into a fully worked vulnerability report, complete with CVE classification and a vendor disclosure draft, because the agent was told to verify claims rather than just record them — and because its operator had already drawn a hard line between read-only exploration and anything that could change live systems. That combination, verification-oriented prompting plus enforced permission boundaries, is a reusable pattern for anyone letting AI agents loose on real infrastructure, whether the goal is documentation, auditing, or catching the kind of misconfiguration that sits quietly on a router until someone, or something, finally checks.
Comments 0