Hank’s First AI Program
Explaining generative AI through a simple old-school program written by grade-schoolers on a Commodore 64 back in the 80's
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🦊 New Blog — Security and AI Research: https://teriradichel.substack.com/
💻 Free Content on Jobs in Cybersecurity | ✉️ Sign up for the Email List
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
If you are interested in getting started with AI you might also want to check out this post: https://teriradichel.substack.com/p/implement-a-simple-project-with-kiro
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
My husband is not a technical person. Even so, back in the day he attended a grade school where he had the opportunity to write a little program on a Commodore 64 many, many years ago. He has told me before about the “turtle that walks in a square.”
Meanwhile, I just got back from AWS re:Invent which is Amazon’s largest tech conference where you get to hear all about cutting edge technology used to build and host technology products and services a lot of people use. Companies like Apple, Lyft, and Netflix host their services on AWS. Their developers write and deploy applications on Amazon Web Services using lots of different building blocks faster than if they build everything from scratch using their own systems and code.
AI was all the rage at AWS re:Invent again this year. Specifically generative AI and agentic AI. I’ve been using AI to write a lot of code in the last few months to analyze the security of the tools that write the code and the quality of the code they produce. I’ve also been using it to write some of the tools I use on penetration tests where I evaluate the security of customer systems hosted on AWS.
To explain what I’ve been doing with AI to him and the kind of things were were talking about at that conference, I opened a tool I’m running on a machine and showed him how he would create that same turtle program today — with generative AI. (More details on how to get set up with the tools below if this interests you.)
I logged into my computer, started my AI chatbot used specifically to write code named Amazon Q CLI (now renamed Kiro CLI).
First I asked it to write me a turtle program.
I simply type:
give me a program where a turtle walks in a square in bashNote that I am specific about which programming language to use (bash) but you don’t even have to tell it that if you don’t want to. You’ll just have to know how to execute the resulting code. Bash is simplest.
For some reason I repeated the prompt (instructions) and inadvertently asked it to write a turtle walking in a circle:
I realized it was trying to write a file to a project directory where I didn’t want the file so I asked it to write to my home directory instead:
write it to my home directory
I let it create the file, changed the permissions and executed it.
Here’s where I noticed my mistake. Not only is the program not writing a square, it’s technically not a circle either. But that wasn’t what we wanted anyway. Back to our square.
This is your first AI vibe coding security warning. The fact that I can tell it to write a file anywhere on my machine that I have access and it is not restricted to my project directory could lead to a security problem.
I’ve also had it try to use administrator permissions to write or read files and access AWS credentials when it shouldn’t. If you have these tools running on your machine and they can be tricked into accessing sensitive data or writing malware to your machine you might end up having a bad day.
What if you have a crypto key (the equivalent of digital money) on your system and you get tricked into sending that money to someone else on the network. What if you get tricked into running commands that connect to other systems on the network that host sensitive data or control access to your network? What if the tools can access your banking credentials stored in your browser password manager?
When you start writing code with AI it’s easy to stop paying attention to every detail. It’s writing code so fast that you might not notice it changed a sensitive system file or wrote some questionable action to your startup file (bashrc). It may have written some software that does something you absolutely don’t want.
This has happened to me before. I inadvertently authorized an action that deleted a bunch of my code! Luckily I make lots of backups while I’m using these tools. I’ve also written a framework to lock them down … more on that here:
That’s why initially you should carefully review each action and type y (yes) not t (trust) when it comes to executable actions and writing files.
So here’s where I attempt to fix the program:
that was a circle, not a square
The results were not promising:
I attempt to correct the problem by getting Q (now Kiro) to tell me what a square is in an attempt to get it “thinking” about the right solution:
It recognizes that is not a square and tries to fix the program:
Hmm. Not exactly…
Let’s ask it a question to see if it thinks it has succeeded. This is one of my tricks for getting the AI tools to produce what I want. Sometimes it works.
Still not working…I give more information to try to get it to solve the problem. This is an example of how and why you need to get your prompts (instructions) right to get the results you want. Ambiguous prompts may get you started but then you have to be more specific:
A square has four equal sides and your sides are not equal. You have to take into account spaces and gaps on the screen when you print out the characters
YAY. A square. But Hank is not satisfied. The program he wrote had solid lines. I’ll let you just look through these to see the results. I did not include every screen shot below but you can see the problems and how I tried to fix them:
After many more iterations…
Finally!
Here’s the full program:
That code is a bit complicated. Let’s see if we can simplify it.
That code does almost the same thing but it’s much simpler. And that example shows why more lines of code doesn’t mean the program is better or doing more or programmers that write more code are more productive.
Get Teri Radichel’s stories in your inbox
Join Medium for free to get updates from this writer.
In fact, how the dashboard in the post below calculate line lines of code from that last request? Did it add to the lines of code I accepted? Did it reduce the number of lines of code accepted?
There is one small problem with the rewrite however. There’s an extra character in the output. And this shows you why having programmer guiding the process is going to produce better results than having just anyone trying to write code with tools like this.
I ask Q (now Kiro) to fix the problem.
After multiple rounds the AI agent is struggling, so I went and actually reviewed the code. I found the offending character in the code.
I modified the code to exit before that line, and no special character.
Then after that line — the extraneous character shows up.
I commented out the special character and the top right corner of the box AND the floating character is gone.
With that bit of troubleshooting, now I can tell the AI tool exactly where the problem is so it focuses it’s efforts on fixing that one line:
And with a little bit of programming knowledge in the mix the AI tools stop going in circles (sometimes) and you can get the result you want.
But not just yet. My husband said the turtle was going too fast.
I ask to slow the turtle down…
And that’s where the whole program got messed up again. It slowed down the top and right but when it tried to slow down the bottom line it disappeared again. This is what happens when you’re vibe coding. A lot of times you can get the first cut right but when you attempt to modify the program things go haywire.
Well this is just a silly little program to demonstrate a few concepts so I’m not going to spend more time on it, but that gives you an idea what it’s like to “vibe code.”
How to get started
A lot of developers are actually using visual coding environments called IDEs (integrated development environments) like Kiro IDE which you can download and install as explained here:
I like using a terminal window as shown above for the reasons explained here:
I have an AI tool called Amazon Q CLI installed which has been rebranded to Kiro CLI. It works the same way but it has some different commands.
You can download and install the visual version of Kiro and run it on your laptop or run it on a remote computer as I do using a terminal window. This page explains how to install Kiro CLI:
Once you install the program, you will need to login.
Once you are logged in…start asking questions. That’s it!
Install the program, login, start asking questions.
Now consider where you are installing the program. I install the program on a computer running in the cloud in a locked down network, not on my laptop. That helps me reduce the risk of the AI tools getting access to sensitive data on my laptop or home network.
When I wanted to show my husband the simple programming steps above, I logged into AWS and started a computer (called an EC2 instance) I have running on AWS. I connected to the remote computer using SSH. I logged in, ran the tool, and asked the questions above on my computer running in the cloud.
You’ll still want to learn to program to be a good vibe coder, but you can learn so much faster. I learned to program in rust — something I have been putting off for a long time but wanted to do — in about a day:
Read more of my AI journey and how I got started here:
You can watch the AWS re:Invent keynotes here and find most of the other sessions on YouTube. If you watch some of those sessions I guarantee you’ll learn a lot! Pick the topics and levels that interest you.
Follow for updates
Teri Radichel | © 2nd Sight Lab 2025
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero Former SANS, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests & Security Research ~ 2nd Sight LabCloud, SAAS, and Application Penetration Testing
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration testFollow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ X, Threads, Blusky, Instagram, AWS BuildID: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
