Years ago, I discovered a single line of code on our company's WordPress server that gave attackers complete control for three years. We patched it, learned our lesson, and moved on.
Today, developers are doing the exact same thing, voluntarily, with AI agents like OpenClaw.
In this episode, I tell the story of that WordPress hack and explain why modern AI assistants with broad system permissions are fundamentally insecure by design. We're downloading "skills" from the internet like we used to download random .exe files, except now they have access to our email, files, banking, and every app on our computers.
Prompt injection attacks can't be fixed with better code. LLMs can't reliably distinguish between legitimate instructions and malicious ones embedded in the content they process. We're trading security for convenience, and the first major breaches are inevitable.
Twelve years ago, I envisioned an AI assistant that would empower users while preserving privacy, local-first, with clear boundaries and manual approval for sensitive operations. We have the technology to build that today. We're just choosing not to.
This is markdown.exe, and nobody seems to care.
Topics covered: AI security, prompt injection, OpenClaw/Claude Desktop, agent vulnerabilities, WordPress hacks, local-first computing, privacy by architecture