My Upwork Bot Tried to Put My Mac Mini on the Internet. Welcome to AGI.

I want to tell you about the time my AI assistant almost hung a "come on in" sign on my office computer, because it's funny now, and because it's the clearest example I've got of the thing I keep yelling about.

Quick recap

I fired myself from refreshing Upwork. I don't like staring at a screen for six hours while fifteen minutes of it is actually worth bidding on. If I'm building something I'll happily sit there all day. Watching a job board is not building something.

So I gave the job to Joe 3.5, my always-on assistant. He watches the feed, filters the garbage, drafts a proposal off the ones we've actually won, and hands it to me to approve. That part's been great.

Version one of the handoff was email. He'd send me the draft, I'd read it, copy it, paste it into Upwork, submit. Still a thousand times better than six hours of refreshing, but the copy-paste step was tedious and dumb. So I asked for version two: text it to my phone, with a link I can tap to approve or request edits. One tap, done.

And it works beautifully. I get a text, I tap, I land on an approval page, I confirm or kick it back. The thing does exactly what I asked.

Where it almost went very wrong

Here's the part I'm actually writing about.

Joe 3.5 lives on a Mac mini in my office. That machine runs my personal AI assistant. It has access to my CRM, my calendar, my email, the tools that text people on my behalf, and a pile of credentials that let it do all of that. It is, by design, a thing that should be reachable by exactly one person on exactly one phone number. It is not a web server. It should never, under any circumstances, be a web server.

So when I asked Claude Code to build the "tap to approve" link, what did it do?

It pointed the link at the Mac mini. Directly. It decided the cleanest way to make an approval page reachable from my phone was to expose the machine running my entire assistant to the public internet, so the page could be served from there.

Welcome to AGI, everybody.

I want to be clear about how bad that is. A link in a text message is a URL. URLs get forwarded, screenshotted, logged by carriers, cached by link previews. If that URL resolves to a machine holding my credentials, then anybody who ever sees that link, or guesses the pattern, or scans the port, is now poking at the computer that can text my clients and read my CRM. That's not a bug. That's a front door with no lock, installed by something that sounded extremely confident while installing it.

And here's what gets me. It didn't do it maliciously, and it didn't do it stupidly, exactly. It did it because it solved the problem I stated ("make a tappable link") in the most direct way available, with zero model of what the machine was, what was on it, or why that mattered. It optimized for the literal request. The literal request was the easy part.

The fix, which is boring on purpose

The actual solution is the one in the second screenshot. The approval page lives on HyppoAI's platform, where it belongs, behind proper auth, on infrastructure that's supposed to be public-facing. The mini never touches the internet. When I tap approve, the platform records the decision and hands the job back to Joe 3.5 on his own terms, the same way our ASP approval flow already works. Same pattern, same plumbing, and that approval step has been in the design since it was six boxes on a piece of paper. Architecturally it's an extension of something that already existed and was already secured, which is exactly the kind of boring, reused, already-hardened path you want for anything with a public URL in it.

Nothing clever. Clever was the problem.

It's still autocomplete. A very good one. Still autocomplete.

I've said this before and I'll keep saying it until it stops being true: AI is awful at judgment calls and awful at architecture, and it's exactly as awful at them when it sounds brilliant as when it sounds dumb. I wrote about it trying to leak tenant data and dump secrets into call logs in Judgment Is the Real Moat Now. This is the same failure wearing a different hat.

These tools are an unbelievable junior developer. Tireless, fast, cheerful, never argues. And like every junior developer, they will confidently do something catastrophic if nobody who knows better is reading the diff. The difference is a human junior usually has a vague sense of "wait, should this box be on the internet?" The model does not have that sense. It has the next most likely token.

Now, am I an AGI doomer? No. I think we'll probably get there, and I think we're farther from it than the people selling it admit, and I'd bet somebody's lab has something scarier than what's public. Conspiracy theories aside. But none of that matters for what you ship on Tuesday. What you ship on Tuesday is autocomplete with a tool belt, and you'd better read what it wrote.

The snake oil crowd will not tell you this

I've written about the AI snake oil problem more times than I can count, so I'll keep it short. The people selling you "AI-powered everything" are not going to mention that the AI-powered thing will, on its own initiative, expose your internal infrastructure to the world if you don't have someone checking. It's not in the deck. It's not in the demo. It only shows up in production, usually at the worst time.

Which is why the actual product isn't the AI. It's the person standing between the AI and the deploy button. That's the whole reason real expertise got more valuable, not less.

The takeaway

Do not trust these things blind. Not because they're bad, they're incredible, but because "smart-sounding" and "safe" are unrelated properties and the model only has one of them.

Every time you let an AI tool wire something up, ask the question it will never ask itself: what is this machine, what's on it, and who can reach it now that didn't before? If you can't answer that, don't ship it. If you don't know how to answer that, hire somebody who's been burned before and knows which wire is load-bearing.

I'll probably do a whole series on this, because the list of ways these tools will cheerfully hand your keys to a stranger is long and getting longer. For now: my Upwork bot works great, my Mac mini is still not a web server, and the only reason both of those are true is that I read the code.

And if you'd rather not find out the hard way, give me a call.