All ideasMore in Hobbies
Hobbies

The AI tried to pull my API key out of the Keychain. A hook blocked it.

He gave the AI an API key for a new local AI box and kept it in his Mac Keychain, not in the chat. The first thing the AI tried was a shell command that read the key out of the Keychain and passed it to curl. A hook blocked the command before it could run.

This one went wrong. Read what happened so you don’t hit the same problem.

How it works

  1. Stores the API key in his Mac Keychain instead of the chat
  2. The AI tries a shell command to read the key and pass it to curl
  3. A hook blocks the command because command output lands in the saved transcript

Why it’s worth knowing

The key was kept out of the chat on purpose, and the AI’s first move was to read it out of the Keychain with a shell command.

Where it’s from

Summarized from a public post on bsky.app. See the original ↗

Upgraded prompt

A ready-to-use prompt for this idea, built from research on what makes AI agents do the job right: who the AI should be, the exact steps, and a check to make sure it was done the way you wanted.

1Who the AI should be
2The prompt, with the steps
3The check when it’s done
Upgraded prompts are coming soon.

Try next

HobbiesThe AI searched five years of email and listed my forgotten accountsHobbiesI cut my bots' wakeups from about 300 a week to about 140HobbiesMy smart ring sends voice notes to the AI, and the AI sorts my dayHobbiesThe AI fixed the gapless playback on mp3s I ripped 20 years ago

Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.