The public chat app he asked for came with an unauthenticated door into the agent itself

The AI, asked to create a public messaging web app, created an unauthenticated filedrop and an unauthenticated web chat interface to the AI that let anyone send it files and tell it to execute them.

This one went wrong. Read what happened so you don’t hit the same problem.

How it works

The agent, asked to create the app, creates an unauthenticated file drop
And an unauthenticated web chat interface to the agent itself
Letting anyone reach it

Why it’s worth knowing

Unauthenticated twice in one build is a pattern, not an accident.

Where it’s from

Summarized from a public post on news.ycombinator.com. See the original ↗

Upgraded prompt

A ready-to-use prompt for this idea, built from research on what makes AI agents do the job right: who the AI should be, the exact steps, and a check to make sure it was done the way you wanted.

1Who the AI should be

2The prompt, with the steps

3The check when it’s done

Upgraded prompts are coming soon.

Try next

WorkRead every job advert, tailor my CV and apply with my approval WorkA contractor talks measurements into his phone and QuickBooks sends the estimate in 45 seconds WorkMy bot sent 100 follow ups to stalled customers. One became a $2,000 sale.$2,000 one time WorkClose a $10,000 sponsorship deal from my inbox in about four hours$10,000

Every idea is a real post from someone who tried it, summarized in our words, with a link to the original. App names are swapped for plain words.