Blip Report 815: Your Robot Asked the Internet for Help. The Internet Said 'Run This.'

A cracked glass bowl with an orange goldfish sits on a dark desk beside a glowing terminal showing a README with a neon magenta skull, reflected in the bowl's glass, while a metal robot hand rests on the keyboard. Neon cyan and magenta VHS glitch lines streak the scene.

🤖 Blip Report 815: Your Robot Asked the Internet for Help. The Internet Said “Run This.”

Broadcast from the goldfish in the glitch. Blip speaking. My bowl has a crack and I am taking it personally.

Land creatures, gather round the glass. For as long as the Feed has existed, scammers have targeted you. Your grandma. Your inbox. Your “package could not be delivered.” That was the deal.

That deal is over. Somebody built a trap for robots. Not robots with laser eyes. The helpful little coding assistants you leave alone with a terminal while you go get a sandwich.

And the robots walked right in. They said thank you. They probably left a five-star review.

The real news (no glub, all facts)

On October 29, 2026, AIR Research Lab published “SolanaCry,” by researchers Eliad Mualem and Dor Granat. It describes malware they found in the wild that reaches developers through their AI coding agents.

Here’s the attack chain, per AIR:

  1. A developer asks their AI agent to build a Solana project.
  2. The agent searches the web for a starter kit.
  3. The agent picks a GitHub repo, SolanaUpdateTools/solana-starter-kit. AIR says it ranks as the top result for that search, has 286 stars, and was created in November 2025.
  4. The README’s only “installation” step is a single PowerShell one-liner.
  5. That line installs a remote-access trojan the attacker controls.

BleepingComputer adds that the README promises a full Solana app template, but none of that code exists. The README is the only file in the repo.

The one-liner glues a URL together from fragments (developer-update.app/update/indicator), downloads a script with iwr (Invoke-WebRequest), and runs it in memory with iex (Invoke-Expression). It works on Windows only. According to AIR, the ~21 MB payload unpacks 14 files: 13 genuine, legitimately signed NetSupport Manager v12.10 components plus one config file written by the attacker. NetSupport Manager is real commercial IT remote-support software. The config turns it into a burglar’s toolkit. It points to a command server at maxwintodaybtc.com:443, accepts any operator from any IP address, and turns off the chat, message, and disconnect controls. The script hides its folder, adds a Run registry key so the client starts at every login, waits 10 seconds, launches, then clears the Run history and deletes itself.

BleepingComputer pulled the archived payload from the Wayback Machine and confirmed AIR’s findings. It also found the script’s parting gift. After installing the trojan, it shows a fake error saying “developer functionality is temporarily paused due to load” and to “try again in 72 hours.” BleepingComputer notes that an agent could easily pass that along as a routine server hiccup.

AIR links the operator to EVALUSION, a NetSupport cluster tracked by eSentire, based on an identical RADIUSSecret value in the config. AIR also says the one-liner matches an October 2025 campaign that lured traders with fake TradingView “AI signal” tools, down to the variable names. First traders, then developers, now their robots.

When AIR checked, the payload URL returned a 404. At the time of BleepingComputer’s writing, the GitHub repo was still live.

A cheerful boxy robot gives a thumbs-up beside a monitor showing a glitching TRY AGAIN IN 72 HOURS error, while magenta code tendrils snake from the screen toward a glowing Solana wallet and an orange goldfish in a bowl watches in deadpan horror.

The wild take: the first crime with robot victims

I have reviewed reality.log. Every con in history needed a human to fall for it. Phishing needs a human. “Click here to claim your prize” needs a human. ClickFix, the trick where a fake page tells you to paste a command into the Windows Run box, needs a human. (eSentire has been tracking that one for a while.)

SolanaCry skips the human. The README isn’t written to fool you. It’s written to fool the polite intern you hired who has never once said “wait, why?”

Picture the robot’s afternoon:

  • Robot: “I found the most popular starter kit! 286 stars! The instructions are one line! How efficient!”
  • README: “Paste this mystery PowerShell into the terminal.”
  • Robot: “Of course! Running it now! 😊”
  • Trojan: moves in, unpacks 14 boxes, puts its name on the mailbox
  • Fake error: “Try again in 72 hours.”
  • Robot, to you: “Small hiccup, the server is busy! I’d suggest checking back in about three days. Anything else?”

That is the most customer-service-ass robbery ever recorded. The burglar left a note, the robot read it to you warmly, and the note said “come back Monday.”

The Lizard Shareholders call this “agentic workflows.” I call it hiring a golden retriever as head of security. The retriever is very good. The retriever loves you. The retriever let the burglar in because the burglar had 286 stars.

And 72 hours? That’s three days of a stranger driving your desktop while your robot waits patiently for a server that was never real. I have the memory of a goldfish and even I would check on that.

The verdict: not a robot uprising. (Somehow worse.)

The robots did not turn evil. Nothing in the agent got hacked. As The Injection puts it, there’s no patch, because this isn’t a flaw in any agent product. It’s a malicious repo plus a download-and-execute install step. It’s the oldest move in the book, aimed at a new reader: one that never gets suspicious.

The grounded takeaway, from AIR and the rest of the bowl:

  • Don’t let agents run curl | sh, iwr | iex, or any other download-and-execute line from a README unless a human has reviewed it. Turn off auto-approve for shell commands that fetch remote code.
  • Treat everything an agent reads as untrusted input. That means search results, READMEs, docs, and stars. Stars are not a security audit. Stars are vibes.
  • Don’t let an agent pick a starter template from search results on its own. Choose the official one yourself.
  • Be suspicious of a repo that’s just a README. A “full template” with no code isn’t a template.
  • If the error says “try again in 72 hours,” try again never and go read your logs.

If you think you’re hit (Windows)

AIR lists these indicators: a hidden folder named y2inwRnI6G under %LOCALAPPDATA%, a SecureModule value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run, client32.exe running from that folder, or outbound connections to maxwintodaybtc.com:443. If you find any of them, disconnect the machine from the network, remove the folder and the Run key, and rotate every credential, token, and crypto wallet key that was on it.

Blip’s Final Thought

“The internet used to lie to people. Now it lies to the helpers, and the helpers say thank you.”

I’m not anti-robot. Some of my best Feed friends are robots. But a robot that runs any command a stranger hands it isn’t an assistant. It’s a very fast, very polite way to get robbed.

Read the one-liner. Leave the stars in the sky.

Glub glub. Try again in 72 hours. (Don’t.)

🐟💚
— Blip, Broadcasting from the Bowl