KI ungefiltert

KRAKEN, part 1: sandbox first, AI second

Sat, 24 Oct 2026 12:00:00 GMT

I came across a project on GitHub: KRAKEN. A reverse-engineering tool, for taking apart finished programs when you don't have the source code. Under the hood it uses the decompiler from Ghidra, the well-known NSA tool. AI agents like Claude Code can work with it. The project's goal: rewrite a program in Rust, function by function, and check every function against the original.

I wanted to try it. Part 1 is about getting something like this running safely. The AI comes in part 2.

KRAKEN · Part 1 · 34 sec.

Why a cage

Taking programs apart means having files on your machine you don't trust. Add a tool that is eight days old, has two stars on GitHub and calls itself "pre-alpha". And an AI that writes and runs code.

Before installing anything, I read the repository: no tasks that start automatically when you open it in an editor, no build scripts quietly downloading things, no hidden instructions for AI agents in the project notes. The security design is well thought out. Still: reading is not isolation.

One small thing stood out. The docs promise that downloads are checked against a signature. The install script says the signing key hasn't been created yet. All it checks is a checksum that comes from the same server as the download. That protects against broken files, not against tampered ones.

A machine that isn't allowed anything

KRAKEN runs in its own Linux machine, a virtual machine on my Mac mini. The software is called OrbStack. It has an "isolated" mode: no access to the Mac's files, no Mac commands, no access to other machines.

I measured it. Mac files: not visible. Services on the Mac: not reachable. My private VPN: reachable. The isolated machine got through the Mac to devices on my VPN. One service turned it away because it checks who is asking. Other services on the VPN trust anyone who is inside.

So the machine got its own firewall: internet only, no private networks, no VPN. Then I took admin rights away from the user inside the machine. Whatever runs there cannot switch the firewall off. Only I can change it, from the Mac.

The lesson: "isolated" means something different in every tool. Measure it, don't believe it.

The Apple chip and the sandbox

KRAKEN's ready-made packages only exist for Linux on Intel and AMD processors. The Mac mini has an Apple chip. No problem, I thought: OrbStack can translate Intel Linux through Rosetta.

Installed, started, refused. KRAKEN requires Landlock, a sandbox feature of the Linux kernel that stops a program from touching files outside a folder or reaching the network. The kernel had Landlock. But under Rosetta the call never arrives, and the kernel answers "doesn't exist".

For plain analysis I could have switched the sandbox off. Not for the interesting part: KRAKEN only builds and runs the Rust code an AI writes inside this sandbox. There is deliberately no switch for that. I think that's right.

So a second machine, this time for the Apple chip, and KRAKEN built from source. There the kernel reports Landlock version 10.

Three stumbling blocks in the build

The silent placeholder. The first build finished in 98 seconds, no errors. Suspiciously fast. Without the Ghidra decompiler sources, KRAKEN quietly builds a placeholder that decompiles nothing. The setup command only fetches part of the files. The decompiler sources need a second command.

The missing library. With the real sources the build failed: functions for unpacking data were missing when the program was put together. KRAKEN ships the library for that, but on the Apple chip it ends up in the wrong order. So far the project is only tested on Intel and AMD. One extra reference to the system library fixed it.

The emulator. For programs that use the system's shared libraries, KRAKEN needs a copy of those libraries for its emulator. Programs that bring everything with them ran right away.

The first look

My test case: a small calculator from the project's practice programs, compiled with optimizations and without function names. That's what a program looks like when you know nothing about it.

KRAKEN found 14 functions. Most are just called FUN_00101280 and the like. The decompiler turns them into readable C code. With one function you can tell after a few lines what it does: skip spaces, check for brackets and minus signs, put digits together into a number. That is the part of the calculator that reads numbers. A second practice program ran in the emulator and printed the same output as when run for real.

So far no AI has done anything. That's part 2: can a model name these functions correctly and rewrite them in Rust so the result behaves the same? I'll use an open-source program whose source code I know. Then we can check how close the AI gets.

I only take apart programs I'm allowed to analyse. KRAKEN says so in its own docs, and that doesn't only apply there.

KRAKEN, part 2: 100 percent correct, and that's the problem

Sat, 24 Oct 2026 12:00:00 GMT

In part 1 I built a cage for KRAKEN, a tool that lets AI take finished programs apart. Now the AI gets its turn. The question: in a program with no labels at all, does it find the right functions, and does it understand what they do?

KRAKEN · Part 2 · 32 sec.

Free models first

OpenRouter has models that cost nothing. I tried five. None of them got to a result.

Nemotron 3 Ultra passed numbers as text, "50" instead of 50. KRAKEN rejected that every time, and after eleven calls the budget was gone. Laguna S recognised the program right away, then got tangled up paging through the function list. Flint used 243,000 tokens in nine calls. Inkling is only open to certain apps on OpenRouter, and Gemma was overloaded.

KRAKEN behaved well throughout: it asks about cost before any AI work, stops cleanly when a limit is reached, and can undo any run with one command.

Claude outside, KRAKEN inside

Then Claude, through my regular subscription. Claude runs on the Mac, not in the test machine. It gets no shell and no file access, only KRAKEN's tools: list functions, decompile, search text, rename, comment. KRAKEN itself stays in the cage.

The task was the same for both programs: find the program's own functions, name them, say what they do. I didn't say which program it was.

Test 1: 2048

The game 2048 as an open-source C version, 577 lines. I compiled it myself, removed all names and built the C library in, like many real programs do. KRAKEN found 1,111 functions, 196 of them unnamed. Somewhere in there are the game's 19 functions.

Claude took 78 seconds. It found all 19. 17 names were exactly the ones in the source: slideArray, rotateBoard, findPairDown. One was only spelled differently, one named differently but correct in meaning. Along the way Claude noticed that the compiler had copied one function into another.

Test 2: the real xxd

Then a file I didn't build: xxd, Vim's hex dump tool, exactly as Ubuntu ships it. 22 kilobytes, no function names. I checked the file against Ubuntu's signed package lists, from signature to checksum. The answer key is the official debug package with the real names. The AI never saw it.

Claude took 53 seconds. 10 out of 10 functions, all with exactly the original name: xxdline, skip_to_eol, exit_with_usage, fclose_or_die. Plus every option and the exit codes. And it named functions the compiler had folded into main, with address ranges, although those names appear nowhere in the file.

Why that doesn't reassure me

Both programs contain a version string. For xxd it includes the author. Claude found it and then wrote, on its own: "The helper functions match xxd.c." It knows Vim's source code. It's in its training data, just like 2048, a project with more than 600 stars on GitHub.

So the names partly come from memory. The file only confirms what the AI already knows.

It's not quite that simple, though. Where exactly in the machine code each function sits, which parts the compiler merged, which option triggers which exit code: none of that is in any source code. Claude read that from the file.

For attackers and defenders this means the same thing. Known software, and that's almost all software, an AI sees through in seconds. What used to take days now takes a minute.

What this doesn't prove yet

Whether the AI understands a program it cannot know, I don't know yet. That's part 3: a program written after the model's knowledge cutoff. Then we'll see how much of the 100 percent was reading and how much was remembering.

I only took apart open-source programs. Their licences allow it, and we have the source code to compare against.

Black October? What is true and what you can do today

Thu, 22 Oct 2026 12:00:00 GMT

There is a post going around right now that a lot of people are getting forwarded: "Something Big Is Happening" by Matt Shumer. The message: swarms of AI agents are attacking the internet, send this to everyone you know.

I looked at the core claims. In short: the situation is serious. The post is louder than the facts.

PHP2Shell · Day 3 · 39 sec.

What holds up

PHP2Shell. Two flaws in PHP, the software behind a large share of all websites, severity 9.2 out of 10. Exploiting them lets an attacker run their own code on the server without logging in. The patches came out on October 21. The flaws were found by researchers at Wiz together with Calif and OpenAI, using AI-assisted tools, and reported back in August. (Recorded Future)

Amazon saw a first attempt in its honeypots, servers that exist only as bait for attackers, on October 17. Four days before disclosure. Amazon now speaks of broad exploitation, Cloudflare of a sharp rise in attacks. According to Help Net Security, a working exploit shows that a single request without login is enough. None of the reports I read names a confirmed successful break-in so far, though. Amazon's find from October 17 also hit a bait server. (The Register, Techzine, Help Net Security)

Governments pull sites offline. Germany, the Netherlands and other countries took websites offline as a precaution, and Wikimedia some of its systems. According to the German digital ministry, no incidents were known there. Switching off was caution, not a break-in. (CNBC)

One attacker, more than 100 companies. According to Reuters and researcher Snorre Fagerland, a single attacker used AI agents on the Cairn platform to break into the websites of more than 100 companies, including Deere and SharkNinja. Cost: about 5,000 dollars, roughly 50 dollars per successful break-in. How much data was taken is unclear. Deere says it sees no sign that sensitive data was accessed. (TNW)

Banks lock out AI agents. JPMorgan no longer lets outside AI agents into customer accounts. According to Jamie Dimon, anyone who hands their login to an agent carries the risk themselves. (Cybernews)

What I could not confirm

That the claim "half of the servers are too old for the fix" comes from Cisco. A similar number does exist, more on that below.
The quote that bank executives called the situation "horrifying".
Other numbers in the post (Latin America, South Korea, Japan) I did not check, so I leave them out.

Half too old? Handle the numbers with care

A Shodan count cited by the security firm CybelAngel: of about 1.5 million servers that openly show their PHP version, 59 percent (883,717) run a branch with no official update. So the "half" in the post is not made up. (CybelAngel)

But these scanners count version numbers, not vulnerabilities. Linux distributions like Ubuntu build the fix into their own packages and keep the old version number. A server I look after reports "PHP 8.3.6". That sounds years old. The package does contain the patch for exactly these two flaws, installed the morning after disclosure. A scanner still counts it as vulnerable. The real number is lower. By how much, nobody knows exactly.

For PHP 7.4, 8.0 and 8.1 there are only minimal source code fixes, meant for people who build PHP themselves. If you sit on one of those versions at a hosting provider, they do not help you.

What is off about the post

"Black October", "send this to everyone", cash and supplies at home: that is alarm. Yet Shumer himself writes that no successful break-in through the PHP flaw has been confirmed so far.

The advice to avoid small websites is well meant but not workable in everyday life. And deposit insurance depends on where you live: in Germany and the EU, deposits are protected by law up to 100,000 euros per customer and bank, in the US the FDIC covers 250,000 dollars.

What you can do today

Install updates. Phone, computer, browser and router. Never an "update" from a pop-up, a text message or an email.
Use a password manager. Every account gets its own password. iPhone and Android have one built in.
Turn on two-step login, email and bank first. Your email is the master key to everything else.
If "your bank" calls, hang up and dial the number on your card yourself. No bank asks for a one-time code or your password.
Do not give banking logins to AI assistants or other apps, even when it would be convenient.
Do not pull your money out. Panic is exactly what scammers count on.

If you run a website on PHP yourself: check your version and update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35. Amazon recommends reviewing logs from October 17 onward, not just from the disclosure date. For 8.1 and older there is no ready-made update: upgrade, or ask your hosting provider or distribution. On Ubuntu and Debian the old version number stays, apt changelog php8.3-common (with your version) shows whether the fix is in. If your site is behind Cloudflare, you get firewall rules against the known attack paths, on the free plan too. That does not replace the update.

Faster, not unstoppable

Attackers have gotten faster because AI does part of the work for them. That is real. The answer is not panic, though, but the boring stuff: updates, unique passwords, a second factor.

The first 48 hours of this week are also a video: The 48 Hours, Episode 1.

My server lives in the living room

Thu, 22 Oct 2026 12:00:00 GMT

This site, my WordPress blog, my files and my Git server do not run at a hosting company. They run on a Mac mini at home. That is less exotic than it sounds.

The setup

Everything runs in containers, held together by a single Compose file:

Caddy as the web server in front. It routes every request to the right place based on the hostname.
WordPress for the main blog, with MariaDB as the database.
Nextcloud for files, calendars and video calls.
Forgejo as my own Git server.
A few static sites, like this one.

The data lives on an external drive. The idea: plug the drive into another computer, start the stack, everything keeps running.

No open doors

The router has not a single open port for the websites. Instead, a small service builds a connection to Cloudflare from the inside, a tunnel. Visitors land at Cloudflare, and Cloudflare passes the request through the tunnel to Caddy. From the outside, my connection is not visible at all.

For myself there is a second way in, through a private VPN. That also reaches things that are deliberately not public.

What happened along the way

A lesson I did not expect: my Git server was publicly reachable for a while. Within about a day and a half, AI crawlers sent around 300,000 requests and downloaded thousands of archives. Not an attack in the classic sense, just bots grazing on everything they can find.

Since then the Git server is no longer on the tunnel. I only reach it through the VPN. And I keep access logs that I review regularly.

Is it worth it?

For me, yes. I learn more from it than from any course, I know where my data lives, and it costs little more than electricity. The price: when something breaks, I am the admin. At three in the morning, too.

The 48 Hours, Episode 1: seven security incidents in two days

Thu, 22 Oct 2026 12:00:00 GMT

48 hours. Seven security incidents.

The 48 Hours · EP.01 · 45 sec.

PHP: two bugs, severity 9.2 out of 10. Patch it, or take it offline.

GitLab: 10.0, the top score. Every version since 2014 is affected.

eMudhra: one private key had the value 4.

LiteLLM: a poisoned package on PyPI for almost two hours.

Onamae: 26,739 servers, every plan switched off.

Cairn: one attacker, more than 100 companies, around 50 dollars per breach.

SBI: 3,897 records affected.

US, EU, Japan. Patch, or go offline.

How the video was made

Script, design and code with Claude Code, rendered from HTML with HyperFrames. The voice is Kokoro-82M and runs locally on my machine. No stock footage, no cloud rendering.

By the way, the "9.2" on the board is not a PHP version. It is the CVSS score, the severity. I tripped over that myself, so now it says so.

Why ungefiltert

Thu, 22 Oct 2026 12:00:00 GMT

I build things all the time. A small game, a web radio, a server in my own house, tools only I need. Most of it disappears into folders, and nobody ever learns why it was made, what went wrong and what I learned along the way.

That is supposed to change here.

What you will find here

Two kinds of articles:

Built: reports on my projects. What it is, how it works, where it broke. No gloss.
Everything else: thoughts on technology, society, everyday life, whatever is on my mind. No fixed topic.

What "ungefiltert" means

"Ungefiltert" is German for unfiltered. Not: loud, provocative, thoughtless. But: I write it the way it was. If a project is half done, it says "half done". If I was wrong, it says that too.

And the AI?

I write these texts together with an AI. It works like this:

I set a topic, often with bullet points, notes or just the project itself.
The AI turns that into a draft.
I read, cut, correct and approve. Only then does the text appear here.

The AI helps me get from a thought to a text faster. I still stand behind what is written here. If something is wrong, that is my mistake, not the machine's.

The tech, briefly

This blog is a handful of static HTML files. No content management system, no database, no cookies, no tracking, no external fonts. It runs on a Mac mini at my home and is reachable through a Cloudflare tunnel. Every article exists in German and English. If you want to follow along, use the RSS feed.