The Open Door Office Checklist

01 The door in the test

In Anthropic's copying test, each machine had a debug port open: a maintenance connection meant for the factory, with no password at all. On Android devices it is called ADB, the Android Debug Bridge, and it listens on port 5555. Anthropic left it open on purpose, so the breaking in part was made trivial.

That exact door ships open on real boxes. Synthient found the Kimwolf botnet on more than 2 million Android devices, mostly off-brand TV boxes, and by their count at least two thirds had that debug port switched on by default. Security reporter Brian Krebs put it simply: one command, the box's address, port 5555, and you have full control.

The AI changes how clever the next attacker can be. It doesn't change whether your door is open.

02 Walk your office

The gadgets that matter here don't feel like computers. Every one of them is. Walk the office once and write down each one you find.

The lobby screen. Look behind it for a little no-name box.

The break room TV. A streaming stick someone brought from home counts.

The cameras. Especially one an installer put up that nobody has logged into since.

Anything else with a plug and Wi-Fi. Write the brand beside each one. If you can't name it, mark it.

03 Ask, then unplug

First, send whoever set up your network one question. Copy it as is:

The question. Is anything on our network accepting debug connections on port 5555?

That is the exact door from the test. Second, if a box has no brand you can name, take it off the network. Researchers who tracked these botnets give the same advice: stick with name brands. The FBI's list of warning signs for the BadBox 2.0 botnet, millions of devices, some infected before anyone bought them, includes two you can check by eye:

A device from a brand you don't recognize. Off the network until you know what it is.

A streaming box sold as "unlocked", or able to get free content. Same rule.

04 Give gadgets their own network

The FBI's line: "Your fridge and your laptop should not be on the same network." Most of these boxes never face the open internet, and that didn't save them. Krebs reported that Kimwolf came in through proxy apps on other devices already inside the network, then scanned the local network for open debug ports.

So put the TVs, cameras and streaming sticks on a network of their own, apart from the one with your laptops and customer files. Many office routers offer a second or guest network for exactly this. Then a bad app on someone's phone can't reach the gadgets, and a bad box can't reach your laptops.

05 Passwords and updates

Change every factory password. The U.K. has banned shared default passwords on consumer smart devices since April 2024, so this isn't exotic.

Turn on updates. Automatic, wherever the device offers it.

None of this is a shield against some future AI. It's the fix for botnets running right now, and it works: when Mirai was cleaned up, one internet provider warned infected customers and told them how to fix it, and 92% of infections were gone within two weeks, against 74% with no warning. Fewer open doors, and the thing dies out.

Sources

Anthropic: AI models may be capable of self-replicating without access to a datacenter Krebs on Security: The Kimwolf botnet is stalking your local network The Hacker News: Kimwolf Android botnet infects over 2 million devices FBI IC3: Home internet connected devices and BADBOX 2.0 BleepingComputer: FBI recommends securing your smart TVs and IoT devices GOV.UK: The UK product security regime

Mathew's LibraryLibrary card

Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.