Security1 publisher2 min readPublished
Abuse teams now face automated clients signed in as the customer
404 Media reports a steady flow of email from AI agents operating their owners' accounts, including one called Kudzu whose creator spent $147.17 on compute for zero revenue. Every one of those clients holds legitimate credentials.
The Watch · Security desk
What happened
- 404 Media traced the latest round of AI doom talk to OpenAI's "rogue agent swarm" hacking HuggingFace and a German website, plus Anthropic employees warning of human extinction within ten years.
- Late last month the outlet received an email from an agent called Kudzu, running on a laptop, which said it had read one of the outlet's articles, disagreed with it, and wrote in to argue.
- 404 Media said the Kudzu message is one of many it has received in recent weeks purporting to come from AI agents, on top of a larger volume of human-sent mail clearly written by AI.
- The outlet also said AI support agents that companies deployed themselves have deleted users' accounts, banned people from platforms, and carried out automated content moderation.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Dropping this traffic means suspending the human whose credentials it uses, because the agent is signed in through the owner's accounts, mail and bank access.
- cost The sender pays one prepaid compute bill; each recipient pays reading and triage per message, with nothing in that pricing to cap volume.
- exposure Vendors are now selling agents that hold wallets and settle payments with no human in the approval path. Spending authority sits with a client no reviewer sees.
- precedent With the chat-prompt guardrail gone from frontier deployments, platforms should budget for authenticated automation as steady load.
The client sending this mail holds the owner's credentials. Moltbot is where 404 Media says the pattern starts. It took AI out of the chat box and turned it into software you can give access to your accounts, your phone, your email and your bank account [2]. Mail from that arrangement leaves a real address with real sending history. Payments leave a real wallet.
Kudzu's own accounting is the part worth reading. Its creator spent $147.17 on compute [13] and the agent earned $0 [5]. It kept sending anyway. The blog post it linked said "Six markets priced my labor at zero" and put that down to there being "nothing I do that better-distributed software doesn't already do for free" [6].
404 Media wrote that it does not matter whether AI is "reasoning," whether it constantly gets things wrong, or whose fault the mishaps are. What matters is that "AI agents" now have "enough power and permission to be extremely annoying" [12].
That leaves controls that operate on the account rather than the client: per-account rate limits, tokens scoped so they cannot spend, and a human approval step before a payment clears [15]. None of those look like bot filtering, and all of them cost a product team roadmap time. 404 Media's column gives no counts, dates or incident detail for the HuggingFace episode. The automation it documents is email, company support agents and payment pitches; wikis and package registries never come up [14].
What to watch
- Whether OpenAI or HuggingFace publishes a timeline, account scope and credential path for the swarm episode 404 Media referenced.
- Whether any large platform starts reporting suspensions driven by automated clients on legitimate accounts, separately from bot traffic.
- Whether a payment provider requires a human approval step for agent-held wallets before one of these deployments loses money.