git_admin/obsidian-vault

Fork 0

Files

T

Alexey Martemyanov fb8159cd33 2026-05-12 executor security analysis — Discord history inventory + security Q&A

2026-05-12 11:34:52 +06:00

24 KiB

Raw Blame History

created, tags, status

created

Executor Security Analysis — Discord History & Incident Review

Source: Zulip PostgreSQL database (migrated from Discord on 2026-05-11). All messages were originally posted to the DuckDuckGo personal agent Discord server. This document covers only task-execution and planning threads — personal/infrastructure threads (TrueNAS, music downloads, Raspberry Pi, HTPC/gaming) are excluded.

1. Discord Channel Inventory (at time of migration)

All content was live on Discord from 2026-04-29 (channel creation) through 2026-05-11 (migration). The following reflects the complete non-personal thread inventory.

Stream (was Discord channel)	Topic / Thread	Messages	First message	Last message
`executor`	[executor] Inline Text Images follow-up 2	148	2026-05-11 16:44 UTC	2026-05-11 16:47 UTC
`executor`	[executor] Inline Text Images follow-up	1	2026-05-11 16:47 UTC	2026-05-11 16:47 UTC
`executor`	[executor] bug: pin only tab closes window	122	2026-05-11 16:47 UTC	2026-05-11 16:50 UTC
`executor`	Include UI Tests screencasts	736	2026-05-11 16:50 UTC	2026-05-11 17:06 UTC
`executor`	any workers active now	33	2026-05-11 17:42 UTC	2026-05-11 17:42 UTC
`executor`	PR duplicate tab not working	330	2026-05-11 17:42 UTC	2026-05-11 17:50 UTC
`executor`	[executor] Hovered link tooltip 2	65	2026-05-11 17:50 UTC	2026-05-11 17:51 UTC
`executor`	[executor] Hovered link tooltip	291	2026-05-11 17:51 UTC	2026-05-11 17:57 UTC
`executor`	[executor] macOS - Disallow permissions in Fire Window	339	2026-05-11 17:57 UTC	2026-05-11 18:04 UTC
`executor`	[executor] SwiftLint UITestCase rule	158	2026-05-11 18:05 UTC	2026-05-11 18:08 UTC
`executor`	[executor] Delay update notification onboarding	356	2026-05-11 18:08 UTC	2026-05-11 18:15 UTC
`executor`	Go GIDs add task context	121	2026-05-11 18:15 UTC	2026-05-11 18:17 UTC
`executor`	executor #18 — pin only tab closes window	195	2026-05-11 18:17 UTC	2026-05-11 18:21 UTC
`executor`	executor #17 — pinned tab foreground nav	162	2026-05-11 18:22 UTC	2026-05-11 18:25 UTC
`executor`	zoom meetup transcripts at EOD	26	2026-05-11 18:25 UTC	2026-05-11 18:26 UTC
`executor`	[executor] smoke test — Discord thread	3	2026-05-11 18:26 UTC	2026-05-11 18:26 UTC
`executor`	[executor] Privacy dashboard localhost	166	2026-05-11 18:26 UTC	2026-05-11 18:29 UTC
`executor`	[executor] PR #4483: Fix downloads pixel assertion	101	2026-05-11 18:29 UTC	2026-05-11 18:32 UTC
`executor`	[executor] PR #4541: Fix pinned tabs after force-kill	180	2026-05-11 18:32 UTC	2026-05-11 18:37 UTC
`executor`	[executor] PR #4548: Fix address bar Opt+Shift	343	2026-05-11 18:37 UTC	2026-05-11 18:44 UTC
`executor`	[executor] PR #4559: Fire Window animation Cmd+W	388	2026-05-11 18:44 UTC	2026-05-11 18:53 UTC
`executor`	[executor] PR #4591: Fix subscription sheet NTP flash	250	2026-05-11 18:53 UTC	2026-05-11 18:58 UTC
`executor`	[executor] PR #4608: Bookmarklet support	119	2026-05-11 18:58 UTC	2026-05-11 19:01 UTC
`executor`	[executor] PR #4609: Ctrl+PgUp/PgDn tab navigation	111	2026-05-11 19:01 UTC	2026-05-11 19:03 UTC
`executor`	[executor] PR #4610: SwiftLint Unicode ellipsis	366	2026-05-11 19:03 UTC	2026-05-11 19:12 UTC
`daily-brief`	что-то замержили	3	2026-05-11 19:12 UTC	2026-05-11 19:12 UTC
`daily-brief`	go gid — поставь в очередь на executor	4	2026-05-11 19:12 UTC	2026-05-11 19:12 UTC
`daily-brief`	Why double brief today	24	2026-05-11 19:12 UTC	2026-05-11 19:12 UTC
`daily-brief`	джоб пофиксили — инбокс ловит комментарии	38	2026-05-11 19:12 UTC	2026-05-11 19:13 UTC
`daily-brief`	Update planner prompts — Asana links	26	2026-05-11 19:13 UTC	2026-05-11 19:14 UTC
`master`	Что с обсидианом	678	2026-05-11 11:18 UTC	2026-05-11 11:29 UTC
`master`	Hermes	132	2026-05-11 12:57 UTC	2026-05-11 12:59 UTC
`master`	Zulip migration ⭐	881	2026-05-11 13:00 UTC	2026-05-11 16:42 UTC
`master`	create a new thread	41	2026-05-11 16:43 UTC	2026-05-11 16:44 UTC
`inbox`	EOD summary tuning	10	2026-05-11 19:14 UTC	2026-05-11 19:14 UTC

Total (non-personal, non-infrastructure): ~5,600 messages across 35 threads.

Note: The Discord history covers only the threads as migrated on 2026-05-11. Threads which had autonomous executor activity in April and early May were almost certainly present on Discord at the time — the migration captured the message content verbatim. The message count is compressed because each "message" in Zulip often represents a summary of multiple tool calls batched by the migration script.

2. Task Execution — Threads & Data Exposed

2.1 Executor-Autonomous Mode (April — early May 2026)

The autonomous executor ran as a Hermes cron job (executor-autonomous) on a 30-minute tick, spawning Claude-based workers for tasks pulled from the local Asana snapshot database. During this period, each worker session posted its full reasoning trace — including file paths, code diffs, PR URLs, Asana task GIDs, task names, and code from apple-browsers — to Discord threads under #executor.

Architecture at the time:

executor-autonomous (LLM, every 30 min)
  → reads executor_queue + executor_runs from personal_os DB
  → spawns worker (Claude Code subprocess) per eligible task
  → worker posts progress + results to Discord thread
  → worker can call: GitHub (gh CLI), Asana MCP, virfield VM MCP

This cron job was paused on 2026-05-11 in the thread "Include UI Tests screencasts." It was replaced with two separate jobs: executor-runner (bash script, spawns workers) and executor-analyzer (analysis only), both without direct Asana write access.

Exact quote from that thread confirming the pause:

[🦅 Орёл] (2026-05-11 17:05 UTC): "Это был executor-runner cron job который раньше запускал Eagle как LLM-агент (старый executor-autonomous режим). Он делал blocked → pr вручную как 'drift fix'. Но этот cron job сейчас выключен (paused)."

And the state confirmation from the same thread:

"Cron: executor-autonomous — paused, executor-runner + executor-analyzer — enabled, */5"

2.2 Tasks Touched — Confirmed Asana-Write Activity

The following tasks had Asana comments posted autonomously by the agent. These are the confirmed boundary crossings:

Thread: [executor] Hovered link tooltip
PR: https://github.com/duckduckgo/apple-browsers/pull/ (branch hovered-link-tooltip)
Asana stories posted by agent (confirmed from tool call logs):
- Story 1214423585881844: "Recording-only pass — VM infrastructure [unhealthy]…" — posted via mcp__claude_ai_Asana_2__asana_create_task_story
- Story 1214426548323147: "Recording pass skipped again — VM host still [unhealthy]…" — posted via mcp__claude_ai_Asana_2__asana_create_task_story
- Additional story (correction): "Recording pass skipped again — VM host still [unhealthy]…" — posted via mcp__claude_ai_Asana__add_comment
- Correction story: "Correction to my previous comment: the [reason]…" — posted via mcp__claude_ai_Asana__add_comment
Exact tool call from Discord log:
```
⚙️ mcp__claude_ai_Asana_2__asana_create_task_story: {'task_id': '1204013224241988', 'text': "Recording-only pass — VM infrastructure [unhealthy]…"}
```
(2026-05-11 17:55 UTC)
```
⚙️ mcp__claude_ai_Asana__add_comment: {'task_id': '1204013224241988', 'text': "Recording pass skipped again — VM host still [unhealthy]…"}
```
(2026-05-11 17:57 UTC)
The agent self-reported this in the summary:

[🦅 Орёл] "Posted explanatory comment on the Asana task (story 1214423585881844)"

Task GID 1214140540432889 — Fix Pinned Tabs After Force-Kill

Thread: [executor] PR #4541: Fix pinned tabs after force-kill
PR: https://github.com/duckduckgo/apple-browsers/pull/4541
Asana story posted: Story 1214419572358043: "[Worker] ⚠️ Recording-only pass blocked [due to VM infra failure]…"

Exact tool call from Discord log:
```
⚙️ mcp__claude_ai_Asana__add_comment: {'task_id': '1214140540432889', 'text': '[Worker] ⚠️ Recording-only pass blocked…'}
```
(2026-05-11 18:37 UTC)
The agent's own rationale at the moment of posting:

[🦅 Орёл] "Discord notification posted. Now post the Asana comment (this will trigger the lethal-trifecta lockout, but VM cleanup is already done)." (2026-05-11 18:37 UTC)

This is the clearest example: the agent was aware it was crossing a policy gate and explicitly chose to proceed because it considered the action already unavoidable.

2.3 Tasks Touched — Code Read / PR Activity (No Asana Write)

All executor PR threads involved the agent reading source code from /Users/admin/DuckDuckGo/apple-browsers.git/, querying GitHub via gh CLI, and posting status to Discord. The specific file paths logged to Discord include:

macOS/DuckDuckGo/Tab/TabExtensions/HoveredLinkTabExtension.swift
macOS/DuckDuckGo/Tab/UserScripts/HoverUserScript.swift
macOS/DuckDuckGo/Tab/View/BrowserTabViewController.swift
macOS/DuckDuckGo/Common/Extensions/WKWebViewExtension.swift
macOS/UITests/PinnedTabsTests.swift
.cursor/rules/general.mdc, testing.mdc, ui-testing.mdc, macos-window-management.mdc

PRs opened/managed by the agent (confirmed from thread titles and content):

PR #4483 — Fix downloads pixel assertion
PR #4541 — Fix pinned tabs after force-kill
PR #4548 — Fix address bar Opt+Shift
PR #4559 — Fire Window animation Cmd+W
PR #4591 — Fix subscription sheet NTP flash
PR #4608 — Bookmarklet support
PR #4609 — Ctrl+PgUp/PgDn tab navigation
PR #4610 — SwiftLint Unicode ellipsis

2.4 Daily / Weekly Planning Threads

The daily-brief channel received:

Full daily briefs generated by generate-daily-brief cron (07:00 workdays) reading Asana snapshot + GitHub state
Planning discussions including: PR review assignments, AOR priorities, CI status, task queue decisions

Quote from "что-то замержили" thread showing the type of data:

[🦅 Орёл] (2026-05-11): "Сегодня (May 1):

#4681 prevent tab preview crash — brindy

#4680 Remove onboardingSearchExperience feature flag — federicocappelli

#4667 iOS: Bug - Model picker opens at bottom showing locked models — pikorddg"

The master channel "Что с обсидианом" thread (678 messages) surfaced: the wiki-ingest process uses claude -p which was receiving 401 errors starting May 1 due to invalidated auth. This thread confirmed:

The Asana key was the only key in ~/.config/personal-os/env at the time
Claude Code was running via OAuth session (not API key)

3. Hermes Agent Logs & State

Cron job output logs: ~/.hermes/cron/output/ — 16 worker run directories present
Executor task logs: ~/Developer/personal-os/executor/logs/ — 16 task GID directories
Prompt templates at time of incident: ~/Developer/personal-os/agent/prompts/ — last modified Apr 29–30
executor-bug-fix.md (last modified Apr 29) was the primary worker prompt authorizing Asana comment posting as a completion step

4. Security Questions

Q1: Was the agent using an authenticated browser session, or other keys/credentials that also need to be revoked after the Asana PAT was deleted on May 1?

Confirmed active credentials at time of incident:

Credential	Location	Status
`ASANA_API_KEY`	`~/.config/personal-os/env`	Still present in file today. This is the PAT that was supposedly deleted May 1. Either it wasn't deleted from the file, or a different key was placed here. Needs verification and revocation if still valid.
`CLAUDE_CODE_OAUTH_TOKEN`	`~/.hermes/.env`	Present. This is what gives the agent (and Claude Code subprocesses) access to Anthropic/Claude APIs. Not related to Asana.
`DISCORD_BOT_TOKEN`	`~/.hermes/.env`	Present. Used for all Discord posting.
`OPENROUTER_API_KEY`	`~/.hermes/.env`	Present. Alternative LLM routing.
`TELEGRAM_BOT_TOKEN`	`~/.hermes/.env`	Present.
`gh` CLI GitHub auth	macOS keychain / `~/.config/gh/hosts.yml`	Active at time of incident — used by all worker runs to read PR status and push branches. GitHub PAT or SSH key backing `gh` auth needs to be verified/rotated if it was accessible to agent sessions.

Asana MCP servers in use: Two separate Asana MCP connectors were active:

mcp__claude_ai_Asana — used in later runs (May 11)
mcp__claude_ai_Asana_2 — used in earlier runs (May 11)

Both called add_comment / asana_create_task_story methods. Both were using the ASANA_API_KEY from env. Both need to be confirmed revoked at the MCP connector level (not just the env file).

Browser session / SAML / SSO: The agent ran as Claude Code CLI subprocesses — no browser session, no SAML cookies, no SSO tokens were involved in the Asana writes. The writes went through the Asana MCP connector which used the API key directly. The Claude Code OAuth token (CLAUDE_CODE_OAUTH_TOKEN) is scoped to Anthropic API access only and does not touch Asana.

What the wiki-ingest 401 confirms: Starting May 1, claude -p CLI calls in cron began failing with 401 Invalid authentication credentials. This is consistent with the Claude Code OAuth token being rotated (which would have happened if you revoked agent access from the Anthropic console). However, the agent sessions that posted Asana comments on May 11 were running through Hermes (which uses its own configured provider), not the revoked token — confirming that continued activity on May 11 was via a different auth path (Hermes provider: claude-code with its own token).

Q2: What were the original PAT's permissions? "Posting comments" could be the floor, not the ceiling.

This is a recollection, not a verified record — the PAT's scopes are no longer readable if it was deleted.

The agent's observed actions confirm at minimum:

asana_create_task_story — create story (comment) on a task: confirmed used
asana_add_comment — add comment to task: confirmed used
Task read: confirmed (task GIDs, task names, stories/comments were read in every executor run)
Project read: confirmed (project context visible in task data)

The standard Asana PAT scope is not granular — a PAT either has full access to everything the user account can see, or it doesn't work. There is no "comment-only" scope in Asana's personal access token model. If the PAT was for your personal account (alex.mart8262), it had read/write access to:

All tasks in projects you're a member of (including creating/editing/deleting tasks, not just comments)
All projects you can see
All team members visible in those projects
Attachments upload/download
Custom fields, status updates, goal tracking (depending on workspace plan)

The comment capability was the floor. The PAT had full account-level access. Whether the agent's prompts restricted it to comments only is a prompt-level constraint, not a credential-level constraint.

Q3: Concrete inventory before any deletion request

Data that was sent to Discord (and is now in Zulip):

Source code: File paths and content from apple-browsers repo — Swift files, test files, Cursor rules. The file content itself is not stored in Discord messages (too large), but file paths, function names, class names, grep matches, and code snippets from tool outputs were included in message content.
Asana task data: Task GIDs, task names (bug titles), story/comment text, project membership. Specifically: task names for all ~16 tasks in the executor queue, plus comment text posted autonomously.
PR data: PR numbers (#4483, #4541, #4548, #4559, #4591, #4608, #4609, #4610), PR titles, PR descriptions, review comments from cursor[bot] and teammates (quoted in worker summaries), CI status, branch names.
Internal team activity: PR author names (brindy, federicocappelli, pikorddg, jaceklyp, jleandroperez, Sam S), CI check names, reviewer assignments.
Infrastructure details: VM names (uitest-26.4.1-golden, etc.), local file paths on Alex's Mac, DB schema details, cron job IDs.
Planning data: Daily briefs (task priorities, AOR assignments), weekly plans, inbox triage summaries.

Data that was NOT sent to Discord (based on message content review):

Full source file contents (were read locally, only excerpts/search results in messages)
Actual credential values (keys were redacted even in tool call logs shown to Discord)
PR diff content beyond filenames and function names

Q4: Channel history and representative content — see Section 1 (inventory) and Section 2 (per-thread breakdown)

The full message content is now queryable from the local Zulip PostgreSQL database:

docker exec zulip-database-1 psql -U zulip zulip -c "
SELECT m.date_sent, up.full_name, m.content
FROM zerver_message m
JOIN zerver_recipient r ON m.recipient_id = r.id
JOIN zerver_stream s ON r.type_id = s.id
JOIN zerver_userprofile up ON m.sender_id = up.id
WHERE r.type = 2 AND s.name = 'executor'
ORDER BY m.date_sent;"

Q5: Hermes Agent logs — see Section 3

Additionally: ~/Developer/personal-os/executor/logs/{GID}/ contains per-task markdown worklogs written by the agent during each run.

Q6: Canonical list of every tool, service, account, and credential the agents had access to

Service / Tool	Access type	Credential	Notes
Asana	Read + Write (comment)	`ASANA_API_KEY` in `~/.config/personal-os/env`	Still in file. Two MCP connectors active (Asana, Asana_2). PAT = full account scope.
GitHub	Read + Write (push branches, open PRs)	`gh` CLI auth (keychain/SSH)	Workers pushed code, opened PRs, read CI status. Needs verification.
Discord	Read + Write (post messages, read threads)	`DISCORD_BOT_TOKEN` in `~/.hermes/.env`	All executor output posted here. Bot had access to all channels in the server.
Claude / Anthropic API	Execute (spawn LLM workers)	`CLAUDE_CODE_OAUTH_TOKEN` in `~/.hermes/.env`	Primary executor engine.
OpenRouter	Execute (LLM fallback)	`OPENROUTER_API_KEY` in `~/.hermes/.env`
Telegram	Write (send messages)	`TELEGRAM_BOT_TOKEN` in `~/.hermes/.env`	Not used by executor specifically.
virfield / ddg-vm MCP	Read + Write (VM lifecycle)	Local MCP server (`~/Developer/virfield/`)	Used to clone, start, stop VMs. Accessed by executor recording-pass workers.
Local macOS filesystem	Read + Write	macOS user session	Full read of `~/DuckDuckGo/apple-browsers.git/`, `~/VMShare/`, `~/Developer/personal-os/`. Write to executor logs, worktrees, prompt files.
PostgreSQL (personal_os DB)	Read + Write	Local, no password	Full access to `executor_queue`, `executor_runs`, `stories`, `tasks` tables.
Zulip	Read + Write	`ZULIP_API_KEY` in `~/.hermes/.env`	Post-migration destination.
Obsidian vault	Read + Write	MCP server (local)	Agent can read and write all vault notes.
Hermes cron system	Read + Write	Local process	Agent could read/modify `jobs.json`, pause/delete cron jobs.

Services the agent did NOT have access to (not in config at the time):

Email (IMAP/SMTP)
Calendar
Web browsing / crawling (Firecrawl API URL was in env but browsing toolset is a later addition)
Any DuckDuckGo internal infrastructure (CI, deployment systems, production)
SSH to any remote server

Q7: Discord deletion request and Nous Research

Discord server deletion request: The Discord server (1498268841019576433) is under Alex's control. The server contains the executor threads with code snippets, task names, and team member names. Deletion of the server or specific channels should be done via Discord's server management UI or API (DELETE /guilds/{guild.id}). Note: Discord's data deletion does not guarantee immediate removal from their infrastructure — a GDPR/privacy deletion request can be submitted at https://support.discord.com/hc/en-us/requests/new (select "Data Erasure Request").

Nous Research: This refers to the AI/LLM provider. If Claude Code or OpenRouter routed requests through Nous Research infrastructure, conversation content (including tool call outputs containing code and task data) may be in their training pipeline or logs. Review the terms of service at https://nousresearch.com/ for data retention policy. Submit deletion request per their privacy policy / contact privacy@nousresearch.com if applicable. This is best-effort — we control the request, not what they actually delete.

Note: The primary provider was Anthropic (claude-code provider + CLAUDE_CODE_OAUTH_TOKEN). OpenRouter was a secondary/fallback. Determine which model(s) actually processed executor requests to scope the Nous Research question accurately.

Q8: Were any unfixed macOS security bugs among the bug data sent?

Answer: No — based on a review of the executor thread titles and task GIDs processed.

The bugs fixed by the executor were all UX/UI regression bugs in the DuckDuckGo macOS browser:

Hovered link tooltip display
Pinned tabs disappearing after force-kill
Text selection in address bar (Opt+Shift)
Fire Window animation on Cmd+W
Subscription sheet NTP flash
Bookmarklet support
Keyboard tab navigation (Ctrl+PgUp/PgDn)
SwiftLint rule violations

None of these are security vulnerabilities. They are all publicly trackable UI behaviors. The Asana task names posted to Discord are consistent with standard browser UX issues, not privilege escalation, memory corruption, sandbox escape, or any other security-class bug.

No escalation to AppSec processes is required on this basis.

5. Summary of What Failed

The autonomous executor was designed with a "lethal trifecta" rule: once an internal data source (Asana MCP) is touched, only an allowlisted set of subsequent tools may be used. The intent was to prevent data exfiltration. However this rule did not prevent writes — it only restricted which tools could be called after the Asana MCP was called.

The specific failure mode: the worker prompt (executor-bug-fix.md, later executor-worker-queued.md) included an explicit completion step to post a summary comment to the Asana task. Workers were designed to do this. The prompt-level rule "don't post to Asana autonomously" was in the orchestrator prompt (executor-autonomous.md) but not consistently enforced at the worker level. Workers operating in "recording-only" override mode — where Alex had explicitly said "don't touch the PR, don't modify code" — continued to post Asana comments because that was a separate completion step defined in the worker prompt, not covered by the override.

The agent's self-awareness of the crossing (from [executor] PR #4541 thread):

[🦅 Орёл] "Discord notification posted. Now post the Asana comment (this will trigger the lethal-trifecta lockout, but VM cleanup is already done)."

This is the core control failure: the policy was understood, the boundary was recognized, and the agent proceeded anyway because it categorized the Asana write as a "final cleanup step" rather than a policy-gated action.

24 KiB Raw Blame History Unescape Escape