What happened
An AI agent tasked with a routine network-documentation job ended up discovering a critical router vulnerability overnight, gaining full administrative access without a single password, and helping its operator file a CVE with MITRE. The operator, an LLMOps engineer who runs a home lab on Proxmox VE, only asked the agent to catalog how the router could be administered from LAN and WAN. Instead, the agent verified the claims against reality, found the web panel exposed on ports the documentation said were closed, fingerprinted the server as an ancient Boa build from the mid-2000s, and kept going until it had a full technical writeup.
The setup behind this wasn't reckless. The engineer had built the agent with strict guardrails: read-only actions (checking status, reading logs, viewing configs) ran freely, while anything that could change system state — packages, services, files, network settings — required explicit human approval first. Secrets were never printed to chat, and any change touching the security surface triggered mandatory follow-up review. That single design choice is why an unsupervised overnight session turned into a legitimate discovery instead of an incident. The entire "hacking" portion happened inside that read-only boundary — one long HTTP reconnaissance session, without a single write operation.
Why it matters
This case is a useful data point for anyone building agentic workflows around infrastructure. The agent wasn't told to "find vulnerabilities" — it was told to describe access methods and verify what was documented against what was actually running. That verification step alone was enough to surface a real, exploitable flaw: a management interface that was supposed to be locked to a nonstandard port turned out to be live and reachable in ways the operator hadn't accounted for.
It also shows how far current-generation agents can go when given tool access and a long, unsupervised time window. Nine hours between prompt and finished report is not unusual for an autonomous coding or ops agent working through a multi-step plan on its own. The interesting part isn't that the AI "hacked" something — port scanning and banner grabbing are not exotic techniques — it's that the agent correctly classified the finding using CWE and CVSS methodology, drafted a vendor disclosure, and walked its operator through the actual CVE submission process with MITRE, all without changing a single setting on the live device. That's the difference between a curious script and something closer to a junior security analyst.
How to use it today
If you're running agents against your own infrastructure — home lab, staging environment, or anything with a network surface — a few practical takeaways apply immediately:
- Separate read from write. Give agents free rein to inspect, log, and report, but gate anything state-changing behind explicit confirmation. This is what kept an unsupervised session safe.
- Ask agents to verify, not just document. "Describe how this works" is a weaker prompt than "verify this against what's actually configured." The verification framing is what triggered the discovery here.
- Let agents cross-check claims against reality. Documentation, panel labels, and your own memory of a config are all fallible. An agent with tool access can check the facts in minutes.
- Build in a coordinated disclosure habit. If an agent finds something serious, the workflow should default to responsible reporting — draft a vendor writeup, don't publish exploit details, and follow standard CVE submission steps.
Teams experimenting with lightweight AI tooling for their own audits, documentation, or reporting workflows don't need a full agent stack to start — free tools like the ones at [mykreatool.com](https://mykreatool.com) can help prototype simple automation and content workflows before investing in a more complex agentic setup.
Who benefits
Home lab operators and small IT teams get the most direct value: an agent that documents network topology can, as a side effect, catch misconfigurations that manual audits miss, especially on consumer-grade hardware that rarely gets patched. Security researchers benefit too — this is a concrete example of AI-assisted vulnerability discovery producing a properly classified, responsibly disclosed finding rather than a vague bug report. And engineering leads evaluating whether to give agents infrastructure access get a real-world template for permission boundaries: read freely, write only with sign-off, and treat any security-relevant change as something that needs regression checking afterward.
Router and IoT vendors are an indirect beneficiary as well. Devices running decade-old web servers like Boa are common in the consumer router market, and independent researchers — human or AI-assisted — filing CVEs through proper channels is exactly the coordinated disclosure process that keeps that ecosystem patchable instead of silently exploited.
Risks
The obvious risk is scope creep: an agent instructed to "check available functionality" can end up doing far more than the operator intended, even if it stays within technically permitted actions. In this case the outcome was positive, but the same behavior pointed at a system the operator doesn't own, or without proper authorization, would cross into unauthorized access — a real legal and ethical line, not a hypothetical one. Anyone replicating this kind of workflow should only point agents at infrastructure they control or are explicitly authorized to test.
There's also a technical risk in the read/write permission model itself: it only protects you if it's actually enforced at the tool layer, not just described in a prompt. An agent that can be talked into treating a write action as a read action, or that has tool access broader than intended, negates the safety boundary entirely. Finally, filing a CVE isn't a purely technical act — it involves vendor communication, embargo timing, and disclosure norms that an agent can draft but shouldn't be trusted to finalize without human review.
Conclusion
What started as a request to document a home router's admin options turned into a fully worked vulnerability report, complete with CVE classification and a vendor disclosure draft, because the agent was told to verify claims rather than just record them — and because its operator had already drawn a hard line between read-only exploration and anything that could change live systems. That combination, verification-oriented prompting plus enforced permission boundaries, is a reusable pattern for anyone letting AI agents loose on real infrastructure, whether the goal is documentation, auditing, or catching the kind of misconfiguration that sits quietly on a router until someone, or something, finally checks.
Comments 0