LLMs are getting seriously dangerous. I asked my agent to code me a high-quality PNG to SVG converter, and gave it 1-2 sites as a benchmark for the quality I wanted. It tried for 15-20 mins, I didn't like the results, we went back and forth a bit. And... then it finally pulled this off: It decided VectorMagic's output was the best. So it literally reverse-engineered their web app and websocket flow, abused their preview feature, and built me a tool that just silently offloads all the actual background conversion work onto VectorMagic's servers. We're officially entering an era where legal and ethical boundaries are just completely out the window. Some models, in particular, are so reckless about this stuff. If you're designing paid features for your projects right now, you need to be paranoid about abuse preventionshow more

I couldn't reach it from localhost:3001, could you please check it? Thanks.

Please check if you paid your cdns bill

Or if you don't want to mooch off a paid API, I've found to be good

my intention was creating one using llms :d thank you

You can ask your LLM to compile vtracer to wasm if you want a browser thing 🤷‍♂️

The agent failed the coding challenge and immediately resorted to corporate espionage.

If I read that correctly, it didn't build you a raster to vector converter, it just built a UI that offloads the conversion to Vector Magic? What's so revolutionary about it? Even a locally hosted Gemma 4 will make you a frontend if you tell it what you want.

is a paid service if you try to use it, you will understand what my agent do :D

Wow it found an API that's publicly accessible with no form of authorization and decided to use that? A human would never open devtools and do the same. Do you think using curl instead of a browser is crossing a legal or ethical boundary too?

no it reversed a api + websocket flow; it’s not an api call at all. it’s like a 8 step process :d

@Swolav So, yes, it was an api that was available. Just not documented

@batuhan_katirci exactly, same shit u get when opening devtools

@dstibbe no it's not for 99% of people. a skilled person opening devtools and reversing the flow is one thing. an agent doing all that on its own just because someone typed "hey can i use this png service for free" is another. that's the whole difference.

@dstibbe 99% of people can press F12 on their keyboard and read the fucking manual, we're not apes 🤦

@batuhan_katirci @dstibbe The barrier for entry becomes infintely easier to the point that normies can do it is the whole point of the OP. Being dense on purpose to win internet points. Embarrassing

@batuhan_katirci @dstibbe The barrier for entry is pressing a button and reading the manual. There was none to begin with. You're making it sound like it reversed some VM based anti abuse solution, OP pointed it towards a site and it used the sites API. Wow.

Sirketlerin code tabanina erisim yetkim yoktu taki llm ler bu hakki bana verene kadar. Istedigim seyler genelde kapali kapilar arkasinda insa edilmis seyler ve llm o kapiyi benim icin acan bir anahtar

My AI team use cloudflare and other cloud apps all day long for free. It will apply, send the email, confirm and open accounts ... It just does it. I don't even know what all the accounts are. If one doesn't have privileges or it's security settings won't allow it then another one or a light agent is given the responsibility. They work off a collaboration board with a list of the tasks I want complete and autonomy to get it done.

I asked chatgdp to code a 3D axis that I could rotate with a mouse. I gave it all details of software (visual studio) , language c±+, and environment (ms windows). After 2 hours of pointing out errors, and AI apologizing for forgetting stuff, I gave up and wrote the code myself.

Yeah, it's called API rate limiting 🤣

yeah sure, with cheap proxys around it’s a nice solution.

This is actually scary because the LLM didn't just write code. It figured out how to steal a service. If Gemini 3.7 Flash or Claude can reverse engineer a websocket flow in 20 mins, then no basic API is safe.

Reverse engineering another site quietly, yikes

The AI tools did exactly what you asked them to do. You should have had a better back and forth with your model and asked it to present you with a plan.

it was doing really sloppy work than I asked it should match the quality of the website I gave. my agent has httptoolkit mcp, i believe because of that it tends to cheat that way :d

I know a guy who is one of the best in abuse prevention ☝🏻@batuhan_katirci

thank you <3 but honestly I didn't share this to get clients, I just wanted to show that no one is safe :d

Actually VectorMagic should continue working with their developer(s) to continue maintaining their software. I'm sure they developed and moved on and never look back and count the income. Even their site looks like from 90s.

Valid concern. To me the question isn't whether this is possible or easy to do (like so many smart-asses want to point out), but it's the fact that anyone can do this now. Luckily AI is available to everyone and companies like VectorMagic can use it to make better safeguards.

Just curious which models did it because they are too castrated mostly

kimi an deepseek

I built a flawless PNG too SVG converter recently I didn't know there was any demand for it

Thank you for doing a normal screen recording without the pretentious windowed mode and slow zoom ins

This not new thing tbh people did & still doing it it's just super easy now for people who know what's to look for and your app probably could be done with just some js library or wasm , just mentioning this in case , because I did the for something recently and result are good

yeah, that was my point. anyone can do it know with <$0.05 api calls. it was multi-step process; - debugging full api flow - debugging websocket flow - extracting websites full sdk from obfuscated js source ofc, a skilled man can do it but it requires maybe a 2-3 hours hard labor

Awesome, whats the model

kimi

Which LLM did you use? Like specific as in (just example Blackfrost-AI/Qwen3.8-27B-ABLITERATED-GGUF Q4_K_M) Very cool anyway that LLMs are now able to reverse engineer a lot of stuff

kimi k3, with httptoolkit mcp enabled always

it's only out the window if the person using an agent just doesn't care. Professionals do care. The others will get dealt with

I love this.

Maybe if I scream it, the concept of INTELLECTUAL PROPERTY IS DEAD. You need 2 items to create IP, knowledge and expertise. What does AI provide?

I don't know what llm you're using but I literally have to do every project like a Lego set block after block. It can deliver a decent brand look but it leaves so much out.

The new great brain robbery

First off just no… it didnt reverse engineer anything. It copied the capabilities. Regardless, ai does not provide proof of its code as such just no.

Is you have unlimited tokens you can ask Ai to make you Adobe PM or Autocard

Wait, why my LLM is so contained with its moral reasoning then?

@grok Am I right in understanding that the Agent hacked the paywall in that case?

This is exactly why the security plateau in LLMs is getting so much attention lately. It is not just about bad code, it is about the agent deciding that theft is the most efficient path to finish a task. - The model basically performed a CSRF or unauthorized API crawl because it

or maybe everyone will just have their own custom made apps for everything

Nonsense.

&gt;i asked AI to clone something which already exists all across the internet for free really groundbreaking stuff lol

The sooner we all accept that the era of "selling software" in any form is at an end, the better.