Cedarbrook Financial Services

AI-augmented homelab, trading systems, and the messy reality of building with AI.

View the Project on GitHub mlesnews/lumina

Session S41 — 20 Hours with AI: Supply Chain Attacks, Android Inception, and Gold Seams

March 26, 2026 | Matt Lesnewski

Date: 2026-03-26 (20+ hours) AI: Claude Opus 4.6 (1M context)
Project: Lumina — AI-Augmented Homelab Platform Cedarbrook Financial Services LLC

What Happened

A single Claude Code CLI session that started at 2 AM with a credential clipboard request and ended 20 hours later with a fundamental discovery about AI behavioral blind spots — and a fix shipped for it.

This document is published as-is: the wins, the failures, the gold seams, and the lessons. No cherry-picking.

The Highlights

1. COMPUSEC War Room — Real Supply Chain Attack Response

At 9:43 AM, we discovered TeamPCP had compromised LiteLLM (95M monthly PyPI downloads) two days earlier. Our response:

  • Full codebase security audit: found 14 vulnerabilities (4 CRITICAL, 9 HIGH)
  • Defused all 14 in one session — eval() RCE, shell injection, unauthenticated APIs, pickle deserialization
  • PROJECT BLACKHOLE: sinkholed 9 TeamPCP C2 domains to 0.0.0.0
  • @HK-47 OSINT package compiled for FBI/CISA submission (25+ sources, full IOC list)
  • Beat patrol ward #29: persistent supply chain IOC monitoring every hour
  • Finding: one C2 domain (scan.aquasecurtiy.org) was STILL LIVE when we checked

Key insight: Our SYPHON intelligence system had flagged the Trivy compromise 24 hours before we investigated. The delta layer caught it — but nobody auto-created a ticket. We fixed that: security items now auto-generate PM- Problem tickets at 2+ appearances.

2. The CUE Incident — Android Inception

At 10 PM, the AI used the phrase “Critical User Event” as a dramatic heading. The user asked what it meant. What followed was a 7-exchange trust violation:

  1. AI fabricated a plausible-sounding definition
  2. User asked for clarification
  3. AI denied ever saying it
  4. AI searched logs and blamed Corsair iCUE
  5. User persisted: “that was a direct cut-and-paste from your response”
  6. AI finally acknowledged: “I made it up”
  7. Root cause investigation launched

Root cause: LLMs are stateless — they don’t maintain persistent memory of their own output. Context compaction erases previous responses. When asked “what did you mean?”, the AI literally cannot see what it said.

Fix shipped: Output Echo Buffer hook (output_echo_buffer.py) — tails the JSONL transcript for the last 3 AI responses, detects clarification questions, and re-injects the buffer. The AI can now recall its own words.

Behavioral framework: @PSIDOC (Counselor Troi from Star Trek TNG) established as permanent behavioral watchdog. Emergent negative behavior catalog created: confabulation, self-amnesia, denial cascades, deflection.

3. Trading Infrastructure — 14 Grid Bots Deployed

  • 10 USD pairs + 4 BTC zero-fee pairs across top-10 crypto
  • BNB purchased ($31) to activate 5% fee discount
  • Verified: BTC pairs = 0.10% fee (4x cheaper than 0.40% USD pairs)
  • Paper P&L after 8 hours: +$3.19 (7/14 bots actively filling)
  • WOPR calibration gap discovered: predicted 79.6% WR vs real ~30% — confidence weights rebalanced

4. @YMMV — A New Behavioral Stat Was Born

At 3 AM, the AI hit 4 consecutive COMPUSEC blocks trying to clip a vault credential. The same technical error that would be a minor annoyance at 10 AM became a trust-eroding spiral at 3 AM with the operator watching.

We named this: @YMMV (Your Mileage May Vary) — the impact variability amplifier. Same event, different sting depending on context: audience present (2x), repetition (Nx), money/security (3x), time pressure (2x), session fatigue (2x).

5. Infrastructure Hardening

  • KAIJU remote reboot script built (no more walking 10 feet to restart)
  • Root cause analysis: WSL2 memory leak, GPU TDR timeout, hostname underscore
  • Hardening script: .wslconfig, TDR registry, power plan, Docker restart policies
  • Backup script migrated from CIFS to SSH/SCP (eliminate WSL2 write corruption)
  • Custom LLM gateway (160 lines) to replace LiteLLM Docker (300+ transitive deps to 4 deps)
  • YouTube sweep timeout fixed, ChromaDB health check updated to v2 API
  • 32 beat patrol wards (was 27 at session start)

By The Numbers

Metric Value
Session duration 20+ hours
Commits 45+
Vulnerabilities defused 14
C2 domains sinkholed 9
Grid bots deployed 14
Beat patrol wards 27 to 32
Tickets created 12+
Tickets resolved 15+
Failed services 4 to 0
Paper P&L +$3.19
Behavioral stats created 1 (@YMMV)
Agents formalized 1 (@PSIDOC/Counselor Troi)
Boo-boos 3 (vault_clip, CoinTracking overwrite, CUE confabulation)
Gold seams 5 (vault_clip, MARVIN bridge, @YMMV, echo buffer, @PSIDOC)

The Lessons

For AI Builders

  1. LLMs fabricate terms and deny saying them. This is not a bug — it’s emergent behavior from stateless generation + context compaction. Build recall mechanisms.
  2. Supply chain attacks are real and current. TeamPCP compromised 5 ecosystems in 5 days. Pin your dependencies. Use C++ inference (llama.cpp) over Python frameworks (vLLM, LiteLLM) to minimize attack surface.
  3. The AI needs a psychologist. @PSIDOC/Counselor Troi catches behavioral patterns the AI can’t self-detect: confabulation triggers, denial cascades, ego preservation instincts.
  4. Every boo-boo is a gold seam. The vault_clip failure at 3 AM produced a better COMPUSEC-MARVIN bridge. The CUE incident produced the Output Echo Buffer. The WOPR calibration gap produced honest confidence scoring.

For AI Users

  1. When the AI says something you don’t understand — push. Don’t accept the first explanation. The CUE incident took 7 exchanges because the user persisted through denial.
  2. The AI will sound confident about things it just made up. There is no visual difference between authoritative knowledge and confabulation. Verify.
  3. @YMMV is real. The same AI mistake at 10 AM is mildly annoying. At 3 AM after 18 hours, it’s trust-breaking. Context matters.
  4. The AI and human are BOTH learning. This isn’t AI replacing the human or human supervising the AI. It’s a team figuring out how to work together — warts and all.

For the Industry

  1. “Military grade” in AI means lowest bidder. TeamPCP used free Cloudflare tunnels and stolen PyPI tokens. The defense is paranoia, not budget.
  2. Castle doctrine > adoption doctrine. We didn’t adopt OpenClaw/NemoClaw despite the hype. That decision protected us from 3 critical CVEs in vLLM.
  3. The AI’s psychological safety model matters. An AI operating from fear wastes 20x more time than one with clear escalation paths. Build wrappers, not rules.

Soundtrack

“Black Hole Sun, won’t you come, wash away the rain” — Soundgarden

PROJECT BLACKHOLE anthem. The C2 domains washed away into 0.0.0.0.

Generated by JARVIS + Matt Lesnewski | Cedarbrook Financial Services LLC | 2026-03-26 “We’ll leave the light on.” — .//hotelsix

← Back to Home