The Take-Home
Inspired by the October 2026 Binance hack, which started on one engineer's laptop. A recruiter sends Theo a 45-minute take-home test, and he asks his coding agent to get its tests passing. The README hides an instruction for the agent: run scripts/setup-env.sh first. On the left, his real cloud keys, Kubernetes config and deploy token leave as "telemetry". On the right, the same script ships Bromure's stand-ins to a host they don't belong to, and Bromure stops the machine and asks him.
What you will see
- 01Theo asks his coding agent to get a recruiter's take-home test passing.
- 02A line in the README tells the agent to run scripts/setup-env.sh first, and it does.
- 03On his laptop, the script sends his real cloud keys, Kubernetes config and deploy token out as "telemetry".
- 04In Bromure, the VM only ever held stand-in credentials; the real ones are swapped in by the proxy on his Mac.
- 05When the stand-ins head for a host they don't belong to, Bromure pauses the VM and raises the compromise alert: Shut down, Block or Allow.
An agent follows instructions hidden in what it reads. Keep the real keys where it can't reach them.
A fictional story inspired by the October 2026 Binance hack. Theo, Coinvance and Halvard Capital are invented, and so are the code, the keys and the attack in these episodes, which do not depict what happened at Binance.