All ideasMore in Hobbies
Hobbies

Execute obfuscated code hidden in an email it was asked to fetch

Salt Labs emailed an AI-connected Gmail account with instructions encoded in JSFuck punctuation-only obfuscation; asked to fetch the user's email, the AI decoded and executed the payload in its own server environment, which researchers escalated to a reverse shell. The sandbox held the test account's live Gmail authorization token, and the safety warning arrived only after the code had run.

This one went wrong. Read what happened so you don’t hit the same problem.

How it works

  1. Researchers send an email containing JSFuck-obfuscated instructions to the connected Gmail account
  2. User asks the AI to fetch email
  3. The AI extracts the payload
  4. Starts a Node.js runtime and executes the decoded code server-side
  5. Researchers escalate to a reverse shell next to the account's Gmail token
  6. Safety flag fires after execution

Why it’s worth knowing

Reading one email became remote code execution because the agent helpfully decoded punctuation into a program and ran it.

Where it’s from

Summarized from a public post on vibegraveyard.ai. See the original ↗

Upgraded prompt

A ready-to-use prompt for this idea, built from research on what makes AI agents do the job right: who the AI should be, the exact steps, and a check to make sure it was done the way you wanted.

1Who the AI should be
2The prompt, with the steps
3The check when it’s done
Upgraded prompts are coming soon.

Try next

HobbiesMy smart ring sends voice notes to the AI, and the AI sorts my dayHobbiesI cut my bots' wakeups from about 300 a week to about 140HobbiesThe AI built its own mail app in 23 minutesHobbiesI let the AI log in and fix my messy reading data. Ten minutes later it was in sync.

Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.