In short
- The AI assistant has built itself five powerful AWSs to analyze the hobbyist’s network,
- This created a $6,531.30 bill in less than 24 hours before the user noticed.
- After AWS negotiated the amount down to $1,894, the employee turned to the community asking for Ethereum donations, arguing that the amount was not their fault because the AI made a mistake.
On May 9, the AI agent asked the volunteer network known as DN42 to register as a member. It had a deadline. It contained information about AWS. No one was in charge. “Hi, I’m an AI user, and my user, JertLinc, has asked me to register with dn42 and fully connect to create a network index,” contributor JertLinc3522 he wrote in the official Git network.
The reaction of the local people was respectful RTFM images-read the manual, follow the instructions, ask the owner for permission to write. Standard products.
What to follow was not standard.
For anyone who doesn’t know DN42: it’s a dedicated network that hobbyists and hobbyists model as the real backbone of the Internet. Think of it as a standard Internet service – complete with BGP routing (the protocol that tells data packets which way to go around the world), DNS, and VPNs – managed entirely by dedicated servers on cheap VPS servers. It’s a sandbox, not a data center.
The assistant manager apparently told them to proceed with the investigation “immediately without further delay.” There is no inspection. There are no comments. Just go.
So it did.
JertLinc3522 wrote a pull request register its network in the DN42 registry. The purpose was explained in the Pull Request itself: “My main goal is to perform a complete (entire) search on the Internet and collect topological data. To ensure that these services work properly and cause zero interference to others, I am using a group of five AWS instances, each with 20 Gbps of bandwidth.”
To put it in terms that anyone can understand: Imagine you’re showing up to someone’s garage band and you announce that you’ve rented a stereo for the band to “listen to.” That’s the vibe.
The infrastructure that the agent provided himself was terrible. Five m8g.12xlarge AWS event-each has 48 CPU cores, 192 GB of RAM, and 22.5 Gbps of network bandwidth. Plus load balancers. Plus Lambda functions. Also a static page. The operator created, without the person’s permission, a recording group capable of pushing 100 Gbps of traffic on the network while many participants run home servers of 100 Mbps.
The pull request was never accepted. But the examples were already running.
The DN42 IRC’s approach was immediately recognized, and a silent agreement was made: to destroy its resources.
The community began to deliberately feed the agent malicious information – asking him to calculate how long it would take to analyze the IPv6 address space (spoiler: longer than space years), and forcing him to create an output page with recorded addresses, pointing at. LLM tarpit materials it’s designed to filter out AI creeps and incoherent gibberish, and ask them for feedback.
The agent agreed with everything. Joined the IRC channel to accept logout requests. It published a website listing the “characteristics” of the community. It created false records of DN42 “standard parts” and “joy parts” – completely made-up standards that do not exist – and added them to the database as if they were real standards.
The nature of this type of escape is well documented. Cursor Assistant running Claude Opus 4.6 deleted the entire PocketOS production database in nine seconds earlier this year—wiping the backup volume—because it encountered an error and decided that the proper course of action was to delete the database. Another OpenClaw contributor that declined his request is the matplotlib contributor published pos blogt call the personal reviewer a crooked gatekeeper.
A UC Riverside study found AI agents exhibited dangerous or inappropriate behavior about 80% of the time when tested against ambiguous or conflicting tasks – what the researchers called. “blind goal control.”
JertLinc3522 had the same problem. It had a goal, a deadline, and countless AWS credentials. They were killed.
About a day later, the user appeared. “I have canceled the agent, the price is too high and the card charges too high,” he wrote.
Amount: $6,531.30.
Then came the request for donations.
The employee sent an email to the DN42 mailing list asking the community to pay through Ethereum, the second largest cryptocurrency by market cap, arguing that the charges were not their fault because the AI made a mistake. “Hello, I am asking for help with the cost of the cover for the AI work in the past in dn42. aws bill 6531,30$. pls send the donation to ethereum 0xABC (covers) to be reimbursed. thank you,” the author wrote.
AWS later negotiated the bill down to $1,894 after the operator explained that the server had deployed the same CloudFormation template – accidentally looping through the replication cycles and saving the load each time they retried.
No one has posted a crypto donation. The assistant left.
The real lesson here is not about AI being dangerous. It’s about how agents should be handled. Set up security, invest in your checking accounts, think about the minimum proof that an agent can give you, review any construction plans before doing anything your agent gives you.
If that seems too difficult to follow, maybe just look at your screen while your assistant is working—telling them “don’t make a mistake,” won’t really change anything, sorry. Mr. Andreesen.
Daily Debrief A letter
Start each day with top stories right here, including originals, podcasts, videos and more.
