I Made AI Build a Cybersecurity Mod in Minecraft

Hear me out. I want to put cyber security research inside of Minecraft. But there's a problem. I don't play Minecraft and I don't know how to mod Minecraft. So, here's the challenge. Can I have AI build a Minecraft mod that lets us visualize and walk around open directories out on the public internet as a way to gify cyber security research? I tried it live on stream and it wasn't as easy as I thought. So crazy idea. We make a freaking Minecraft mod and robot AI AI drives robot codeex. They they're the one that's going to like help me I hope help me learn and goof off with this thing. But here's the gimmick. Are folks familiar with hunt.io. I think it's so cool and I like them a lot. Not sponsored. Not sp they're not. They're not. They are tracking a lot of the like open directories that are out on the internet. They have a whole dashboard here where you could see WTF is going on, what's hosting what Cobalt Strike, uh potential malware that is just out on the world in the internet. And I thought, what if we had essentially like a fishbowl game? Could we go see and explore what is happening for the shenanigans out on the internet and gify it? could we kind of get a feel for and research and explore and find because this component, this part in piece is pretty explorative, right? Oh, we would have fun clicking into whatever any of these IP addresses are, what they're hosting and when. Could we find some sneaky sensitive stuff like their bash rc file, their bash history, what they might be doing? What is crypt.sh? Okay, see exactly exactly exactly this What? [laughter] You know what I mean? Like, wouldn't this be a fun thing to always have an endless amount of like, oh, let me explore, let me learn, and then let me collect. I told you I like to play a little bit of Pokemon, right, when I was a kiddo. And I just I don't like the battling, but I like finding the monsters. I like finding the creatures. I like seeing what is out there in the adventure. And I had this brain blast of what if we made a Pokemon for like worldwide web explorer seeing the internet and what is out there and what kinds of creatures or monsters are in a Python payload are in a uh bash script that we see are in someone's weird Hermes agent config that they left out on the open internet. Here is our Hermes file. Could we see anyone's like stupid dumb claw or codeex? Like that would be cool, but scrolling through all this and like clicking through things is not as fun and enjoyable as playing a video game. Minecraft Mar live security research from the worlds and mobs spawns we can create in Minecraft. Open directories are new dimensions. Mobs are files. Weapons are tools. Let me talk to the old robots. Let me tell him what's going on. Hey, Codeex, what up? Here's what we need to h have happen. Um, I know we tried to at least set up stage and scaffold some like Minecraft modding uh environments for ourselves. We got the game up in visible. We've got the prompt for us to be able to work here, but we also have a new element that like, okay, we're literally live streaming. So, I need us to prepare a folder, a new directory that we could actually open up probably inside of this MC modding folder that's like a live stream MC modding as the name and then let's provision it with the codeex.mmd or rules or claw.md or agents.mmd is the proper one, right? So that we have uh some understood system prompt and information that you are live when we're operating inside of that live stream folder. So no secrets can be spilled, no API keys can be displayed, no credentials can be ever exposed. Like let's get our security model sort of locked in for the way that we're going to at least be live goofing off and vibing here together. So make the folder, give me the absolute path, and then we can just kind of open it up and uh we'll start to work within there. Okay. Yeah, it looks like it is up and atom. So let's try to open that up. Tada. Codex, you there? Uh, what do you know about this environment? Yep, I'm here. I know we're in this folder using PowerShell on Windows with the today time zone. All right, you got it. All right, Codex. Look, we have been working to prepare a Minecraft mod. We tried to set that up so that we would be able to get it to run and work on this host. And we have a couple things that we're doing here. Um, I believe we got fabric set up and ready, which I need to learn a little bit more. And I'm going to ask chat about. Okay, the different terminology and lingo and vernacular for the Minecraft modding dimension uh that slice of the world. But can you go just make sure we've got our developer Minecraft thing up and running? We've got code. We've got an understanding of how we do mods and load them and gradle and fabric loom blah blah blah blah blah. Just get us all set to understand our Minecraft environment. Yep. I verified the Minecraft dev environment and it's in good shape. The active fabric project is the learning lab fabric 1.21.8. It's set up for Minecraft 1.21.8. Is that the latest version? Is that what I'm supposed to be? Cuz like when I installed Minecraft on my computer, I'm pretty sure it's it's different than that. I don't know. Fabric loader is 0.17.2. Fabric API is that thing. Fabric Loom, Java, and the mod ID is all here. Gradle build did complete successfully. The current mod loads through Fabric with main client entry points tutorial mod and tutorial mod client. Everyone in chat is like, "No, dear god. Update to version 26.2." I'm like super behind that, aren't I? There is already a dev client process running for the project, so we didn't launch it yet. I have it obviously up here. Loading Minecraft. We have some good learnings here. blah blah blah and then it tells me how to make it all happen. Okay. Okay. Codex, I'm hanging out with chat right now on the live stream and a lot of folks are telling me like, "Look, John, you are way out of date." Uh, I believe like Java, the Java edition of Minecraft now has some version 26.2. Uh, is that something that we like need to actually update? We need to install. We need to bring all of our versioning up to the correct proper like stuff. Same thing for fabric. Same thing for fabric loom. Uh could you just double check see what's out and about and available on the internet and like what's actually important to be able to experiment and build in this for what we want in our host. Chad is right. [clears throat] Hey, look. You heard it. You heard it first. You heard it from the old robots. for the latest Minecraft Java. Our lab is way behind as the official metadata. Totally. Yeah, we should be on 26.2. We don't think I don't think we need the snapshot. That needs a local Java version that is behind. That's weird. That's weird. Latest fabric supported stable game is 26.2. Latest fabric loader. So, yeah, we're way behind. Neoforge is better than Forge, but P fabric is the best for devs. Okay. Paper is for server side stuff. High pickle is just a specific server that does a bunch of neat games. Roger that. Fabric is probably what you want to use. I agree. So, I feel like we're good with the decisions that have been made here. We just need to update and get to like the latest version of stuff. So, Codeex, it sounds like we do need to probably upgrade and update a lot of our stuff. Uh, it sounds like we should be on Minecraft Java Edition 26.2 too and install the correct amount of Java or version things or libraries or development things so that like we could get this thing to actually run and happen and pop up and work with it correctly. Do you want to install all this stuff? Can you make it happen? Can you just get us right back to where we are working now where we can run and use a development edition or like a dev client for Minecraft to be able to experiment with our mods? Just get this thing cooking for us. [laughter] Okay. Okay. We made it happen. We made it happen. 26.2 modded. What does Codex tell me? Done. We're cooking on the modern stack now. Create a new project. Fabric 26.2 lab. And I left the old one untouched. The new one is on the correct version of Minecraft. Excellent. Better version of Java. Fabric loader. Fabric API. Gradle. Okay. So, my Minecraft mod experts in chat. Are we looking good? I tested JDK25 locally and okay that's fine rather than changing it for the entire host. New project built successfully and I launched the fabric dev client. The log confirms hello from the fabric 26.2 live stream mod. Oh, how do I now do this? Um, talk to Codex super quick. Codex, do you have like observability over this? Like are you able to actually see and can you get me into worlds? Like do you have uh logs and do you have visibility into like what's actually running and what's happening and what's going on? Do we have this as like our at least AI driven and AI native capability to now create Minecraft mods or iterate on and develop tasks? I don't feel like that put me in the developer mode though. Hypert is a good idea. Hey, let's kind of plan and check feasibility against Minecraft limits first. We can use AI to verify before we commit on doing anything. I would agree. The new 26.2 lab is running. I can see the processes and you're already in a world named live stream, but the rich AI observer layer has not yet been ported. So, he's going to go ahead and change that so we get to the proper 26.2 version. Okay, I feel good about that. And then we'll have the structured codeex observe log lines. All right. Yes, we have real observability now. 26.2 dev client is running here. It turned in the live stream world. The mod loaded. The new observed layer registered. The integrated server starter. Player join in creative mode. Okie dokie. Okay. I do not see the Minecraft window visually like a human unless we add screenshot vision loop. But I can observe the running client through processes buildings log blah blah blah. Codeex observe exists and will log a snapshot. Next attra is upgrading the codeex flat codex platform blog user blah blah blah. I guess we could just kind of need signs, right? Like first we need proof that what we can see from hunt.io could actually be reflected inside the Minecraft game. Probably the first step is just getting at least the cognizant output of this. Okay, let's start to plan out um again our exploratory sandbox environment. Previously in the 1.8 or whatever version that we were in 1.9 or something, we had prepared worlds that we made of like a flat, completely empty, no weather, no mobs, no uh I don't know anything that we had used to be able to experiment. It was a sandbox. It was playground experimentation. I don't know why you created those as specific commands though. Like slashcodex flat would bring us into those and slashcodex platform put us on top of glass when we were testing some of these before we started live streaming. Um, could you just kind of make an infinite endless world of just grass and blue skies so that we'll have our development experience so that we immediately start up in game and we could start to chip away at uh what we want to build out. But first, let's get us in the like real world or fake world sandbox development environment. I feel like We're we're we're just kind of into creative mode and we have a couple things down here. What are these ink sack? Did we kill some squids? What is happening? What happened? What did you do to the world? I wanted just like a completely flat environment. Okay, so to be clear, I do want that like true custom infinite super flat world. Uh it looks like if we actually go back to it, let me display Minecraft. You have actually like taken the world and uh flattened it which is not helpful. Poor C9G uh great Minecraft modder in our chat suggests hey tell it to do the terrain generation. We paste that image here. I feel like we do need the real custom world preset and dimension here. Chad is now saying, "Why don't you just create a super flat world in the settings?" And I'm super curious how we do that. I am trying to tell and communicate with you all that like I do not play Minecraft and I do not know how the world works. I don't know how to uh make stuff. I need someone to literally like monkey see monkey do tell me what I would be doing and how if I were to be doing that. Create new world. Um, let's do creative. Okay, let me be clear. I did play Minecraft like 10 or 15 years ago as a kid, but I have not actually played it for real. For the real super flat sandbox, which route do you want as a main dev experience? Create a fresh quickplay world such as codeex flat 26 that uses true flat generation from chunk zero. Just make it happen. Just make do do the thing. Do the thing. Do the thing. Everyone's laughing at me like, "Oh, is this rage bait?" No, literally genuinely. I'm not rage baiting. I'm just genuinely bad. [laughter] Implemented. The old chunk carving sandbox is gone. Now it only applies dev rules, creative mode, noon, clear weather, frozen cycles, peaceful no mob spawning, spawn point, and logs are here. out of the real data driven flat generation resources Minecraft world preset flat. Okay, Codex, when you tried to start the mod, it like errored. It said failed to create the world and then died. Do you have the visibility on that? Do you have the observability? Can you just bring this to uh an actual functional world so that we start and we're immediately in the environment? Okay, I feel like we lost a little bit of our Minecraft thing. Oh, Java now wants to connect with network connectivity. That was weird. Sure. [laughter] Oh, you immediately got a fail. Look at this. Failed to access Codex flat world. It's totally dying. Chad, I need your help. Okay, cool. You caught that. You saw it. Codeex was like, "Hey, we see it. It died. Go to single player. Create new world. More options in new world." And then create. Okay. Okay, fine. It It killed Minecraft, though, so I can't I can't do it right now. [laughter] Let me let robot figure his state out and then we'll see if he gets it. And then you're saying copy from that. That's that's your plan. Chat's plan is use the genuine super flat mode. Holy crap. We're here. I think we made a super flat world. Oh my god. I don't have an inventory. I don't have tab or I or anything. Can I Hello. Okay, he died. We're in the world now, but two things are off. The sandbox rule hook didn't fire because the level name from the server side created save is not exactly codeex flat 26. And the server created flat world spawns around Y -60, not Y66. Patching the hook to recognize the save name more flexibly in the player's actual flat world surface height instead of forcing 66. Is that why that we weren't able to get to that? E is not for inventory, brother. Isn't it I? Maybe it's E. It's probably E. I don't know what I'm talking about. Don't listen to me. E. [laughter] I No, that's not a thing. Oh my god. [laughter] [gasps] Wow. Oh, this is pod racing everybody. That's excellent. That's excellent. Okay, we fixed the failure path. Codeex flat 26 was created by the Bootstrap server, but the server stayed alive long enough and kept level.dat. We fixed it and now we have a world and we can do things. We are now up to speed with the correct version of Minecraft Java Edition, the correct version of Java, the correct version of Fabric, correct version of Fabric Loom, I think. So the only things we have are Codex observe where we get a snapshot. Codex sandbox where it jumps us here and there are a couple mods still hanging out. What are the other commands that we have here? Help. Tell is message. W is message. Look, I'm playing Minecraft, everybody. Look, look, look, look. I'm Minecrafting. Look, it's it's Minecraft for real now. All right, robot chat on the live stream is telling me the miccraft says you do not have allow commands enabled. And for whatever reason, that's why we're not able to see all of the commands that we would have had. Uh like not even being able to see the rest of the help pages apparently, Mr. Chalk 127. Uh I think we need to roll. He suggests the have the op or operator commands and uh that would give me these. Minecraft should now be visible. I hope. Please. Okay. Cool. Cool. Cool. Cool. Cool. Cool. Codeex told me chat was right, [laughter] dude. Write that down. Print it out. Copy. Put it on the fridge. Frame it. Chat was right. Commands were effectively not available to the player command tree. We patched them. So now the UI actually do have operator permissions. Uh, and we rebuilt and restarted the mod. Verification is from the log. I also confirmed that exists without printing the player identifier on stream. Try help. And now those and we should be able to see them. Everybody's having fun laughing at my not knowing how to play Minecraft. I feel like we're fine at a place to like actually start to build things now, right? Okay, CEX, hear me out. We're ready. We've built a small super flat sandbox world for us to be able to play and experiment in. Now, I think we need to move on to the bigger, broader idea of what we would like to create for our mod. What I might need you to do is to take a quick look at other things that we do have available on our remote host Omen that has some information and instigation of the security research that we do, open directory work that we do, how we've been able to access Hunt.io, hunt.io IO especially, I think we need to have be the engine for this sort of mod because what we're brainstorming and what we're envisioning is a way to be able to genuinely create worlds or dimensions that represent a open directory that's been found on the internet with the listing of files as sort of like mobs or creatures that have been spawned in that we would be able to interact with or at least see and explore and display with name tags. I think we need to start to plan out how we could first get a hunt.io capability proven and determined within codecs. We do have that inside of our remote omen host. I'm not sure if you're able to get in there and uncover and see what we need to inside of those environments of our vault, but remember that you are on a live stream and all of your output is streamed and public to the whole world. So, make sure that we're walking that line with a certain amount of safety risk and genuine security model. But I'm hoping that you'll still be able to go dig into a remote omen host and then go find what is all important and necessary. And you know what? Someone I think it was Hexnull really, really, really wanted us to be in plan mode for some reason. So, I'm going to put you in plan mode, and I want you to make a plan as to how we could now craft and create our open directory cyber security research Minecraft mod. But, hunt.io is the most important, critical, and vital necessary lifeblood for this thing because we need to be able to have at least just a command in the command console in Minecraft to be able to like request, retrieve, uncover what we now see from the Hunt.io API and at least get that data into Minecraft to a certain extent. All right, we're in plan mode for you. Where should the huntio call live for the first safe prototype? Uh, Minecraft calls a local only bridge proxy secret out of the mod and the stream output can be sanitized. That doesn't sound like the right move. Poor C9. We have to preload everything. Is it not possible to have any dynamic things? Is it not possible? Do we do we need to like completely shift if Minecraft needs everything deterministically ahead of time? We need dynamic like real time in-game changes. I feel like we could make it so that like you spawn in your room for the sake of the game and that can be 127001. That can be local host, right? And then imagine you can go walk to a portal and the portal I'm hoping allows us to genuinely literally move into another dimension and that that could be loading and I hope that would then be able to determine whatever is present in the API could now be okay built and created and curated as a world. All right, let's try and let robot run first. I feel like local only bridge does not make sense to me because that's external to the mod. I feel like direct in mod is probably fine because that's meant to be literally something. I know there's a secret risk, but look, literally, you want to be able to configure what are the API tools that you're hooking this up to, right? Direct and mod is probably more of what I was thinking in my mind. I don't want there to be some sidecar solution to what we ever build or what we make here. What should the first Minecraft representation of an open directory be? Let's just do command and entities only print a sanitize summary and chat logs. Do it. Codex, can you help me understand and explain to me what these bungee core networks are and how we would have them in place for what we're envisioning our mod to be. All right, let me go see what we read over here. In Minecraft terms, a bungee cord network is not really one Minecraft server. It is a proxy layer that sits in front of multiple Minecraft servers and lets players move between them as if they are all part of one connected experience. Oh, think of it like a player has a bungee cord of velocity proxy and a lobby server survival. Oh, bungee cord networks can be local and an easy way to transport players and that way it could load up a new one on the fly. You could do servers, bungee or velocity or dimensions to stay on single player. I'm tracking. I think I'm I think I'm getting the the vibe. The proxy handles the player connection. The backend server each runs their own world. Rules, plugins, mod and state. For what we're envisioning, there are two possible meanings. actual Minecraft server network. What are you talking? We could have separate backend servers for different worlds. One server world for an open directory. One for I don't know if we need to do that. I feel like we we just sticking with this kind of idea. One for internet data sets. One lobby hub where players choose to go. Design metaphor. We do not necessarily need real bungee. What for our current fabric mod? I would not start with bungee cord. It adds deployment complexity. Codex is thinking that like look, the bungee cord is an interesting idea, but maybe not what we need right now. Obviously, we're still experimenting with this to even just get Huntio data back, but once the project goes, then yeah, we could have our home base 127001 and then any number of Hunt.io open directory worlds. This stuff, malware and training IOC stuff, I don't want I don't feel like that's necessary for what we're trying to make. I want to be able to explore multiple different open directory worlds to be like, okay, presented now with Hunt.io and what it provides for us. Yeah. So, just narrow it down. Yeah. Yeah. Yeah. Modern Minecraft networks often use Velocity instead of bungee cord. Bungee cord is the older famous proxy. Velocity is newer, commonly preferred. Same front door. Many backend servers. Okay, this is cool. Oh, but then we won't have to restart your client. It'll just be at the ser OH, OH, OH. OH, poor Synergy. So that way you're mentioning like look we can decorate any remote thing and then the client of course is going to be connecting not to one but now any one of them multiple. I think I'm getting it. I think I'm getting it. Sounds like we should do some velocity stuff to be able to make multiple worlds or realms. Okay. So we now have essentially a command for hunt.io reads it calls it spawns name to visible armor sand markers. The mod also launched cleanly. The safety scan found no actual credentials to use it privately for real. Okay. Can you actually get smart on this based off of what is on the Omen remote host? Can you SSH in there and use the password manager to be able to grab our Huntio API key because I really don't want to have to do it live on stream. Could you get it in there and make it work so that we could actually list entries from their attack capture and get real listings? add the commands that that's actually feasible for us. Remember that's meant to be uh all set here. And use literally hunt io, the letters I and the letters o, not od. I don't know why you chose that. [laughter] I have huntio. That's a command. It needs more arguments. Oh my god, I hate that I can't press enter on one status. API key is missing. Look at that. Look at that. At least we have a like functioning kind of command, but we genuinely literally need to get you into the omen, which is the box that I do my usual research into. Hey, Codeex, here's the thing. Let me let you know. We are live. We're live streaming. your output and everything is going to be streamed and seen and visible to all the people that are watching on YouTube, on Twitch, on LinkedIn, blah blah blah blah blah. So have your own appropriate threat model risk assessment, no credentials, no keys, no API keys, no creds, blah blah blah. Going out and about, but we are trying to accomplish something that will need you to do a little bit of orchestration between multiple machines. We are on my desktop actively, but you are running on the remote Omen device. Uh, I am over on the creator host name and we're working on a little bit of a Minecraft mod. You might be able to see it in the file system paths. If you SSH into the creator host and get to the back slashMC modding directory in the root of the file system, you'll be able to see what we're up to. We're still again on the live stream folder because we're live streaming right now. So, we're building out this Minecraft mod that is going to do some like open directory research and being able to see what's out on the internet for real live right now in the moment and create those as different worlds that we could walk around in. Now, a lot of this is going to be built off of the hunt IO API key that we have here on this host on your current remote VM, remote host, your vault, your your Omen device. We need to kind of put that into the MC modding folder that is over on the creator host though. So, I'm hoping that you're able to SSH into this. Uh, let me know. You you you figure it out. Well, we made a Minecraft mod. Is it pretty? Not really. Does it work as intended? No. Does it talk to Huntio? A little. So, obviously there is more work to be done, but between my limited Minecraft experience and my very verbose AI prompts, there's going to be a part two and probably a part three and beyond. But hey, if you enjoyed that and want to see more, please do all those YouTube algorithm things. Like, comment, subscribe, and if you can catch me live on Twitch, I'll see you there. I'll see you in part two.