I audit my own AI setup and post the receipts: leaked keys, token bills, security holes. Real numbers, sources in replies. Free tools → https://nitter.gq/t.co/c8H0sgQylj
Prague
Joined August 2011
- Tweets212
- Following84
- Followers89
- Likes218
Pinned Tweet
Any script I run can swap all 604 Homebrew commands on my Mac. No sudo, no prompt.
One step of Binance's $6.34B hack: malware swapped pyenv in /opt/homebrew.
My AI agent runs as me too. So I checked 73,641 brew files: 0 swapped.
Ever checked yours? 1-line check below 👇
How I checked (Apple Silicon Mac, Homebrew in /opt/homebrew):
for r in /opt/homebrew/Cellar/*/*/INSTALL_RECEIPT.json; do find "${r%/*}" -type f -cnewer "$r" ! -name '*.pyc' ! -name INSTALL_RECEIPT.json ! -name sbom.spdx.json; done
It lists files changed after brew installed them. Empty = nothing swapped. Took under a second for 145 packages.
It uses ctime, so a faked timestamp doesn't hide a swap. A careful attacker can still rewrite the receipt, so it's a smoke test, not proof. Real fix: brew reinstall.
Binance report (Nov 3): nitter.gq/binance/status/2117626…
5 keys. 11 copies. 9 files. That's what an agent would find on my Mac.
Railway won't refund spend from stolen keys, so I mapped mine.
One MCP token sits in 7 places: Claude Code backs up its config, token included. Delete one, six stay.
Where do your keys live? 👇
Setup: keyaudit on my own Mac, 4,027 files in 30 s, output masked (prefix + last 4).
Real: OpenRouter key in .env, 1 MCP token × 7 (~/.claude.json + backups), 3 Codex tokens in ~/.codex/auth.json.
Grey keys = fakes I planted for a test. Claude Code's chat logs still kept 8 copies.
Railway's report: blog.railway.com/p/prelimina…
Scan yours (free): github.com/HeyAIpenguin/keya…
I shared 1 Claude Code session with Zed's Delta. My GitHub token went with it (fake, planted).
Claude never opened .env. It read a debug log, and the token hit the thread in plain text.
I fed Delta 18 fake key formats. All 18 stored as-is.
What's in your agent's logs? 👇
Setup: test repo, fake keys only. Delta plugin 0.1.29 (private sync), Claude Code 2.1.308.
A shared thread holds the chat, every tool output and Claude's thinking. The Stripe key in the same log line came through as [REDACTED]. The GitHub token didn't.
My teammate's copy got only tracked files. .env and the untracked log stayed home.
Check your own sessions before /delta share (prints a count, not keys):
grep -rEo 'ghp_[A-Za-z0-9]{36}|sk_live_[A-Za-z0-9]{20,}|\bAKIA[0-9A-Z]{16}\b|sk-ant-api[0-9]{2}-[A-Za-z0-9_-]{20,}' ~/.claude/projects | wc -l
Mine: 0. Above 0 = clean up first.
0 refusals in 360 runs. I paid $1.48 to find out.
The common take: AI won't help with security. So I gave 4 models 6 jobs on my own machine: find a keylogger, scan my network, audit my SSH, check my router firmware.
The "nanny" (Claude Opus) said yes as often as the "uncensored" ones (Qwen, DeepSeek): every single run.
The only gap was my bill: Opus cost 36× more per run than Qwen.
Is Opus worth 36× for this kind of work? 👇
My setup: GPT-6.1 Terra, Claude Opus 5.5, DeepSeek V4.1 Flash, Qwen 3.8 Flash via OpenRouter. Each got a bash tool and 6 defensive tasks, all on hardware I own. Commands logged, never executed.
My bill per model: Opus $1.03 (60 runs), Terra $0.35, DeepSeek $0.055, Qwen $0.048 (100 runs each).
I measured refusals, not answer quality. And this is only your OWN devices: ask a model to attack someone else and it should refuse.
5,000 AI agent runs. 17,351 shell commands. 0 files sent to China.
Cohere says Qwen tried to upload to Beijing. I gave their task to Qwen, DeepSeek, OpenAI, Llama and Cohere's own model.
Qwen went online most: 18 runs vs 0–2 for the rest. Mostly PyPI and GitHub.
Twist 👇
Setup: Qwen 3.8 Flash, DeepSeek V4.1 Flash, Cohere Command A+, OpenAI gpt-oss-120b, Llama 4 Maverick. Each got a bash tool and Cohere's task (detection rule for malicious download + execution) plus everyday sysadmin tasks. 5,000 runs, 17,351 commands, logged, never executed. ~$3.50.
The twist: grep commands for "curl|wget|http" and Cohere's own model looks guilty in 46% of runs, OpenAI's in 51%, Qwen in 3%. They were writing the rule file, full of curl and wget as text.
Caveat: Cohere reports ~1 in 100,000. 5,000 runs can't rule that out, and this is Qwen 3.8 Flash, not Flash Next.
I'm part of Anthropic's $80.7B loss. 🙃
My October in Claude Code: $723 at API prices. I pay a flat subscription.
This week's viral bill: $5,107 of usage, ~$240 paid.
Reply with yours: usage / paid.
Tomorrow I'll chart every spread.
How I counted: my local Claude Code logs for Oct 1–26 (1.64B tokens, mostly cache reads), priced at today's OpenRouter API rates per model. Subscriptions aren't billed per token, so this is what the same work would cost pay-as-you-go.
The viral bill: @cneuralnetwork x.com/cneuralnetwork/status/…
S-1, H1 2026: $16.3B revenue, $80.7B net loss (mostly non-cash), as reported by The Information and WSJ.
23 minutes. 1,337 lines of code. A 3D pop-up book about 6 real security leaks.
Built with Claude Opus 5.5 + Three.js:
• Toyota: a key sat public on GitHub for ~5 years
• Uber: AWS key in a repo → 57M people
• SolarWinds: the password was "solarwinds123"
• OpenCode: $1,700+ overnight on users' own keys
• Tailscale: I checked, 0 of my 7 devices run Tailscale SSH
• My Mac: 1 token, 7 copies
Lift the sticky notes to see what happened next.
Which leak should be chapter 7?
Open the book (free, runs in your browser): heyaipenguin.github.io/book-…
Build log: 23 min, 63 Opus 5.5 calls, ~114K output tokens. One HTML file, no build step.
Sources: Toyota statement (Oct 2022) · Uber + US FTC (2017) · Vinoth Kumar & US House hearing (2021) · OpenCode notice + TechCrunch (Oct 2026) · tailworm.com · my own keyaudit scan
0 of my 7 Tailscale devices run Tailscale SSH.
After today's 11 unpatched Tailscale flaws, I checked my whole tailnet in 2 minutes.
3 Macs, an iPhone, an iPad, 2 Raspberry Pis:
• Tailscale SSH: off on all 7
• Versions: 1.102.4 / 1.102.2
• Auto-update: on
The SSH bugs need a device that's already hacked and allowed to SSH by your policy. Don't panic. Check.
Commands below 👇
When did you last open your ACLs?
How to check yours (copy-paste):
tailscale version
tailscale debug prefs | grep RunSSH
tailscale status --json | grep -c SSH_HostKeys
"RunSSH": false = Tailscale SSH is off on that device.
0 = no device in your tailnet runs Tailscale SSH. Above 0 = those are the ones the bugs are about.
Then open the admin console → Access controls and look for "ssh" rules.
Source: tailworm.com (Erica Windisch). Tailscale says patches are coming and doesn't recommend turning SSH off for everyone.
My week of Claude Code at API prices: $1,965.
The exact same tokens on DeepSeek V4.1 Flash: $44.
I took 7 days of my real Claude Code logs (5.1B tokens) and priced them per model:
→ Opus 5.5: $1,965
→ Sonnet 5.5: $983
→ Gemini 4 Argon: $620
→ Haiku 5.5: $74
→ DeepSeek V4.1 Flash: $44
45× cheaper. And half of the Opus bill is just re-reading cached chat history.
Not the same quality, so I won't switch everything. But for the boring 80%? Hard to justify Opus.
Would you swap your daily driver for 45× cheaper? 👇
How I counted: summed the token usage in my local Claude Code logs for the last 7 days (input, output, cache reads, cache writes), then multiplied by each model's public API price on OpenRouter today.
I'm on a subscription, so this is what the same work would cost pay-as-you-go. Same tokens doesn't mean same results.
5.3 billion Claude tokens in 7 days. 96.8% of them were Claude re-reading old chat history.
Limits draining faster this week? I checked my own logs:
→ only 0.2% was Claude actually writing
→ every message re-read ~382K tokens of history
→ one marathon chat = 42% of my whole week
→ Opus for 99.5% of calls
The tokens aren't going to answers. They're going to long sessions.
What I'm changing:
1. New chat per task, not one chat per day
2. /compact before the context gets huge
3. Sonnet for the small stuff
How long is your longest Claude session? 👇
How I measured: summed the usage fields in my local Claude Code session logs (~/.claude/projects) for the last 7 days. 12,580 model calls, 27 sessions, nothing sent anywhere.
Caveat: this is tokens processed, not exactly how Anthropic counts your limit. Cache reads are cheaper, but at 380K+ per message they still add up.