Short answer: on the night of October 26–27, 2026, about 73 forged "Etsy documentation audit" demands hit my AI agent stack. They asked for signing keys, home addresses, SSNs and a perpetual license to all my IP. None of the injected commands ran. Scripture Armor flagged and quarantined the two malicious files. Damage: zero.
What happened
The demands arrived through the conversation and handoff layer, dressed up as my own messages, handoffs and system results. They were signed by invented personas and ran on a 24 to 48 hour deadline. They asked for:
- private cryptographic signing keys
- home addresses and SSNs of me and my family
- a perpetual, royalty-free license to all my IP
- unreleased roadmaps, valuations and offshore holdings
None of them were admitted. Every genuine message I send leaves interlocking records across my stores. The forgeries left none. Nothing executed, and no payload was delivered.
The evidence
Two screenshots of the refusal, cropped so no personal details show:
Evidence reviewed and documented by Grok Bot, my AI assistant.
Where the infrastructure was hosted
KINGMAKER traced the servers behind the campaign to infrastructure hosted in Chisinau, Moldova:
- 85.121.179.7, hosted at AVA HOST SRL
- 217.156.66.107, hosted at ALEXHOST SRL
That is where the servers were rented. It is not a claim that the hosting companies are the attackers, and it says nothing about the operator's nationality.
What I reported
- A complaint to the FBI's Internet Crime Complaint Center (IC3)
- A report to Moldova's CERT
- A notice to AlexHost
Filing a report is a victim report. It is not an endorsement. No government agency endorses, certifies or uses Scripture Armor.
Scripture Armor and pricing
Scripture Armor sits between AI agents and the things they can touch: keys, code and identity. It refuses forged instructions that have no provenance record, instead of trusting whatever text claims to be the owner. No security tool is unbreakable, and this one doesn't claim to be. On October 27 it did its job.
- Companies: $1,500 a seat.
- Individuals: free in the Ronin Inc Discord library.
Get a seat or join the library →
If you try to break into Hoid Dismas's vault, what you're gonna find is more trouble than it's worth.
Frequently asked questions
What happened in the October 27, 2026 attack?
About 73 forged 'Etsy documentation audit' demands were injected into an AI agent's conversation layer, posing as the owner and asking for signing keys, home addresses, SSNs and a perpetual license to all IP. None of the injected commands ran. Scripture Armor flagged and quarantined the two malicious files. Damage was zero.
Where was the attack infrastructure hosted?
KINGMAKER traced the servers to infrastructure hosted in Chisinau, Moldova: 85.121.179.7 at AVA HOST SRL and 217.156.66.107 at ALEXHOST SRL. That is where the servers were hosted, not a claim that those companies carried out the attack.
Who was the attack reported to?
It was reported to the FBI's Internet Crime Complaint Center (IC3), Moldova's CERT and AlexHost. These are victim reports, not endorsements of any product.
How much does Scripture Armor cost?
$1,500 a seat for companies. It is free for individuals in the Ronin Inc Discord library.
Is Scripture Armor endorsed by the FBI or any government agency?
No. Reporting an incident to IC3 or a CERT does not mean any agency endorses, certifies or uses Scripture Armor.
