The Most Useful Attack Surface I Own

A few weeks ago I introduced you to TARS, my personal agent. He runs on a small Hetzner VPS, reachable only over Tailscale, and over the last two months he has quietly become my second brain. This edition goes deeper, into the security, privacy, and trust questions that TARS forces on me and that every agent now working its way into our lives will force on everyone. The cleanest way to understand the risk in agentic software is to operate one yourself and watch what it becomes when you are not looking.

58 days, 17,092 autonomous runs, and the realization that the most useful thing I own is also the thing I warn people about.

For the last 58 days I have run a personal AI assistant against my real inbox, my real Drive, and my real calendar. In that window it executed 17,092 autonomous runs, cost about $35 a month all-in, and quietly became the most useful piece of software I own.

It is also, by the exact logic of last month's edition, a textbook attack surface.

Those two sentences describe the same system. Not a tradeoff between them, not a careful balance. The same runs that make it useful are the runs that make it dangerous, and you cannot have one set without the other. That is the whole piece.

What it actually does

I call it TARS. It is a small, from-scratch agent that ingests my mail and Drive, writes me a briefing every morning, runs research on the topics I care about, and keeps a memory of my working life so it can answer questions with context instead of starting cold every time.

The numbers from 58 days of production tell the story better than I can.

It executed 17,092 autonomous runs and processed around 23.8 million tokens, at a mission success rate of 98 percent. It wrote 1,175 briefings and documents, took 677 notes, and indexed 1,860 documents into a searchable brain. It held 2,249 conversation turns with me, where I asked 472 questions and it answered without me re-explaining who anyone was or what any project meant.

The economics are almost a footnote. Most of that volume is free-tier plumbing: research, indexing, retagging. The real money, a few dollars a month, goes only to the small slice of work that needs serious synthesis, the executive-voice briefings I actually read. Cheap tiers carry the volume, dollars go to the thinking. A personal AI ops layer for the price of a streaming bundle.

I did not arrive at that setup by theory. I started on a small cloud VPS, then experimented with running models locally on a real workstation with a proper GPU, because I wanted to know firsthand where the line was. The experiment was worth every hour. It taught me exactly what local compute costs you in operational overhead and exactly what it buys you, which turned out to be less than the marketing suggests for my use case. So I settled, deliberately, on cloud LLM access paid per token plus a managed VPS. Hetzner handles the boring, essential parts: the box stays up, daily images get taken, the platform is sound. I handle the part that actually matters for security, which is the access boundary. There is no public SSH surface. All access runs through a private Tailscale network and port 22 is dropped at the host firewall. The provider gives me availability. I own the perimeter. On a newsletter about not trusting the gate, that distinction is not pedantic.

Here is the stat that should make you pause, because it is the one that made me pause.

Without anyone designing it to, the agent built a relationship graph of 129 real people, extracted automatically from my mail and Drive, linked across more than 2,100 connections to the notes and projects they appear in. New colleagues, old colleagues, vendors, the people I work with every day. Nobody filled in a contact form. No one decided to build a CRM. It accreted, run by run, as a side effect of being useful. It knows who matters to me and why, and I never explicitly told it any of that.

Read that paragraph again with a security hat on.

Every number above has a shadow

The graph is the clearest example, but the pattern runs through every capability.

Mail and Drive ingest is the feature. It is also the purest indirect prompt injection surface I have. My inbox is a channel that anyone on the internet can write to. The moment an agent reads that content and acts on it, every email is a potential instruction, and the agent has no native sense of where the words came from or whether it should obey them. This is Edition 1's finding wearing a different outfit. The trust is not in the artifact. It rides in on the data.

Web research is the same shape pointed outward. The agent searched the web 508 times and folded what it found into a memory it later reasons from. A memory you can write to from the public web is a memory you can poison. Plant the right content where the agent will read it, and you are not attacking the agent today, you are seasoning what it believes for next week.

The fetch tools that make research possible sit on a box connected to my private network. That is server-side request forgery waiting for a careless prompt, and the Tailscale connection makes it worse, not better, because a successful trick does not just reach the open internet, it reaches inside a trusted perimeter.

And the 17,092 runs themselves, the headline number, the proof that the thing works: most of them happened with no human watching. That is the junior who never says no from last month's edition, except now there is no setup moment for a person to feel friction and pause. The friction was the feature I optimized away. Autonomy is the value and autonomy is the exposure, and they are the same dial.

None of this is hypothetical for me. Search ingest as a poisoning vector, tool parameter injection, SSRF through the fetch tools, the trust model for unattended jobs, the hygiene of what the dashboard binds to. These are the open items on my own hardening list, for my own system, written down because I run it and I can see them.

What I am actually doing about it

The fix is the one I argued for last month, and the discipline is unglamorous on purpose.

I treat where data came from as a property the agent carries, not an afterthought, so content that arrived from an outside party is never silently trusted the way my own instruction is. I keep the agent on least privilege, so a clever email cannot make it reach systems it was never meant to touch. I constrain egress hard: the agent delivers to me, on one channel, and the recipient list is enforced in code at the boundary, not requested politely in a prompt, because a prompt-level limit is exactly what an injection walks through. And I validate behavior continuously rather than blessing the configuration once and assuming it holds, because last month's whole lesson was that a clean verdict at the gate is a snapshot, and the snapshot is the part an attacker controls.

That is the move, stated plainly. Stop asking whether the system is safe, which is a question about a file at a moment. Start asking whether its behavior, right now, is within policy, which is a question about a running system over time. Everything useful TARS does, it does at runtime. So everything that governs it has to live at runtime too.

Why a product leader runs this himself

I could have written both editions of this newsletter without ever touching a server. I chose not to, and the choice is the argument.

You cannot govern an agentic system you have only read about. The failure modes do not show up in the architecture diagram. They show up on day 40, when a graph you never designed has quietly mapped your professional life, and you realize the same ingestion that made the assistant indispensable is the same ingestion an attacker would target first. I know the value is real because I depend on it daily. I know the risk is real because I can name the exact vectors in my own logs.

That is why this is the second edition and not a one-off. The first was the structural finding: trust has moved from the artifact to the behavior. This is the lived version. The most capable agent I own and the most exposed surface I own are not two systems I have to reconcile. They are one system, and the work, the only work that matters now, is governing what it does rather than grading what it is.

The teams shipping agentic products to customers are about to learn this at a scale that is not personal and not cheap. I would rather learn it on my own box first, where the blast radius is me.

---

This is Edition 2 of Securing the Agentic Era. Edition 1, "What You Reviewed Is Not What Runs," covered the research that frames this whole series. The telemetry above is pulled live from my own production system; people and relationships referenced in aggregate only, no names, for the obvious reason.