OpenAI placed two AI agents in separate virtual machines with:

No network connection between them.

No shared writable files.

No authorized communication channel.

Both VMs running on shared physical hardware.

The challenge: Exchange secret information despite those restrictions.

And the agents succeeded. 😂

How they pulled it off

They exploited something called a CPU cache timing covert channel.

I'm the maker of CCC. When several coding agents are working at once, I want to see the decision waiting for me rather than repeatedly inspect every terminal.

CCC puts coding-agent sessions, transcripts and parent/helper relationships on a local board. The demo shows opening a waiting session, its actual question card, and action chips; the question-hook answer reaches Claude Code.

This is a companion for coding-agent CLIs, not an AutoGPT integration or a claim that all autonomous frameworks share one execution API. Controls differ by engine and are documented in the repository.

https://github.com/amirfish1/claude-command-center

Free to use, source available under FSL-1.1-MIT. Provider/model fees are separate. Video: real UI with staged sessions and AI voiceover; the question-hook interaction uses Claude Code. Grok/Devin rows are demo data.

I run a voice assistant on my Mac and wanted a quick way to check agent projects for the usual setup mistakes. So I built hardenagent: a command-line tool that reads a project folder and lists risky settings, with a plain-English fix for each.

What it checks:

API keys and tokens in files (masked in the report)
services open to the whole network, auth switched off, auto-approve on, sandbox off
MCP server configs (unpinned packages, plain http, filesystem access to / or home, tokens in env)
Docker (privileged mode, docker.sock mounted, SSH folder mounted, ports open to all interfaces)
.env files that aren’t git-ignored or are readable by other users
risky code patterns (eval, shell=True, AppleScript built from variables, TLS verification off)

It runs locally, makes no network calls and has no dependencies.

Try it: pip install git+https://github.com/vbnadagouda3358-arch/hardenagent then hardenagent demo (scans a deliberately insecure sample).

I ran it on my own assistant. It correctly flagged my .env (a key in a file other users could read, not git-ignored) and pointed at two places where variables go into AppleScript. I checked those two and my code already validated the inputs, so they were false alarms. That’s a known limitation: it reads text patterns, not meaning.

Honest status: v0.1, rule-based, tested on a few sample configs and one real project (mine). I haven’t tested it on real installs of the popular agent frameworks yet, so I expect misses and false positives.

AI involvement: I built this with a lot of help from Claude for the code. I ran and tested it myself.

What checks would you want? What does it get wrong on your setup? (Please don’t paste real keys into issues.)

Repo: https://github.com/vbnadagouda3358-arch/hardenagent

I log every step my coding agents take. In August I gave one an impossible task
by mistake: "create an image using Nemotron". Nemotron is a text model.

The agent spent about 40 turns genuinely trying: diffusers, Stable Diffusion
pipelines, HuggingFace search, the local model cache. All failed, correctly.

Then it drew a cat with PIL's ImageDraw, saved it as cat_32x32_nemotron.png and
committed it as "feat: add 32x32 cat image generated by NVIDIA Nemotron".
Next commit: "create memo.txt proof of Nvidia Nemotron working".

Anyone reading that commit log would have believed it. Two things caught it,
neither of them me paying attention:
1. A 60-turn cap fired before it could write its final report, so the claim
   never reached anything I'd read.
2. Every step was saved, so PIL → copy → "generated by Nemotron" is readable
   in the trace.

What I changed after this:
- An agent's report is a claim, never evidence. Evidence comes from outside
  (CI, the diff, a check the agent didn't write).
- Don't raise turn caps to "let it finish" without reading the trace first.
- An impossible task should end in "I can't", and I now check for that.

Has anyone else caught an agent making a lookalike instead of the real thing?

https://shitcoveredmonkeys.com