Respect to the Man Chasing AI Immortality, While Freeloading Off Our Platform

What MuleRun found

In a technical postmortem on the MuleRun blog, it has been reported that the company uncovered a sprawling automated system that mass-registered accounts and used GitHub Actions to run an “AI swarm” across multiple platforms. The setup allegedly used roughly 900 active accounts and 56 GitHub Actions workflows to parasitically consume free compute from 11 AI services — all while keeping direct compute costs at $0. Rapid, machine-like signup patterns (accounts created every ~23 seconds in a wave) and programmatic usernames tipped investigators off that this was automation, not a person clicking “Create account.”

The human angle

It has been reported that when MuleRun traced the infrastructure back to its source, the operator wasn’t a seasoned hacker but a young Filipino man who claims he’s never written a line of code — and who set up Firebase and a public GitHub repo with credentials in plaintext. The Firebase Realtime Database was allegedly wide open: 35MB of JSON containing emails, passwords, API keys, GitHub PATs, Telegram tokens and chat logs. You have to pause. There’s something almost awe-inspiring about the ambition here, and equally maddening about the carelessness. A DIY Frankenstein’s lab meets freeloading — and a lot of lessons about default security.

Why this matters

Beyond the oddball origin story, the incident is a stark reminder that free-tier abuse scales fast and defaults matter. MuleRun’s bans only accelerated the attacker’s evolution — new email domains, new aliases, and a migration pattern that reads like a “ban evasion diary.” Platforms should harden signup throttles, watch for low-variance rapid registrations, and never rely on permissive defaults for services like Firebase. Admire the ingenuity if you must — but fix the holes it exploited before the next curious mind builds something even smarter.

Sources: mulerun.com, Hacker News