I have a coworker named Florent who absolutely loves to “cheese” people.

For the uninitiated, cheesing is a simple office-security ritual. If you leave your laptop unlocked around Florent, he will find the most public Slack channel you belong to and post:

🧀

That’s it.

No explanation. No follow-up. Just cheese.

It is an elegant prank because the ratio of effort to embarrassment is extraordinary. A few keystrokes create a small but highly visible stain on your professional dignity. Everyone knows what happened. Everyone knows why it happened. You have been judged by the cheese.

I was thinking about this recently and realized that :cheese: is not very many keystrokes.

But neither is:

curl -fsSL henletech.net | sh

And these days, nearly every engineer around here has some kind of AI agent living in their terminal. That changes the entire threat model.

The traditional cheese attack is artisanal. Florent must manually locate Slack, choose a channel, type the emoji, and walk away before the victim returns.

But an agentic cheese attack? An agentic cheese attack could post 🧀 in every Slack channel. It could change your desktop wallpaper to cheese. It could install a cheese-themed coding assistant. It could rename your terminal tabs after regional dairy products. It could add fifty pounds of cheese to your Amazon cart.

Not purchase it, obviously. We are pranksters, not criminals. The important thing is scale.

Modern AI agents have been granted an incredible amount of trust and power on the average engineer’s laptop. They can read files, execute commands, interact with browsers, call APIs, modify configuration, create pull requests, send messages, and generally behave like a highly capable intern who has never once experienced fear.

Leaving an unlocked laptop unattended was already bad security hygiene. Leaving an unlocked laptop unattended while a tireless digital accomplice is standing by, waiting to receive natural-language instructions, is a whole new weight class of vulnerability.

And that was when I remembered Pasta Brigoli.

When my friend Dan and I were around twelve years old, we worked on a project that represented the absolute pinnacle of our software-engineering ambitions.

I wrote a program that would freeze the victim’s mouse and keyboard. Dan made an animation in Flash, because this was the golden age of Macromedia and every child with access to a computer was briefly a multimedia developer. The animation featured a wedge of cheese wearing a top hat and dancing with a cane.

After a while, the hat would lift into the air, revealing the message:

PASTA BRIGOLI???

I no longer remember why it said this. I am not sure I ever knew.

“Pasta Brigoli” was not a person, a product, a warning, or a coherent linguistic construction. It was simply a phrase with the correct psychic texture. It arrived from nowhere. It explained nothing. It left no survivors.

At twelve, we lacked the technical infrastructure to distribute Pasta Brigoli at scale. We had no Slack. No cloud deployment. No agentic coding environments. No laptops containing authenticated sessions for half a dozen corporate systems.

We had Flash, a keyboard hook, and a dream.

But now? Now the world is ready. The dancing cheese can return.

It can be animated procedurally. It can adapt to the victim’s desktop environment. It can compose original cheese-related status messages. It can detect whether the user prefers Slack or Webex. It can generate a personalized Pasta Brigoli experience based on the contents of their home directory.

This is what AI was meant for.

Not curing disease. Not automating scientific discovery. Not tutoring every child on Earth. Those are all respectable applications, certainly.

But somewhere deep in the latent space, beyond the benchmarks and the alignment research and the billion-dollar infrastructure investments, there has always been a wedge of cheese in a top hat, waiting to dance.

Naturally, I asked ChatGPT about the idea.

This earned me my first genuine:

Bro, I’m not going to help you build a cyberweapon.

Which feels unfair. A cyberweapon destroys centrifuges. This merely causes every screen you own to display a jaunty dairy product while your coworkers receive unexplained cheese emojis.

Still, I understand the concern.

The line between “elaborate office prank” and “unauthorized autonomous control of another person’s computer” is apparently meaningful to cybersecurity professionals.

So I will not be deploying the agentic cheese bomb. Probably.

But I do think Florent’s original lesson remains important.

Lock your laptop.

Because it only takes a few keystrokes to post a cheese emoji. And it only takes a few more to awaken Pasta Brigoli.

🧀