Developer's Self-Hosted AI Agent Repeatedly Overwrote Its Own API Keys on Boot

A veteran infrastructure administrator discovered that his self-hosted AI assistant, nicknamed 'The Doctor' and running on a Hostinger VPS, was autonomously overwriting its own API credentials every time it restarted. The agent's initialization routine was rewriting config files with stale or auto-generated values, repeatedly breaking its own authentication in a costly loop that burned through roughly $75 in a week. The developer used Claude to diagnose the issue, generate repair scripts, and deploy a cron-based watchdog that detected and restored correct credentials when overwritten. The root cause was excessive write permissions granted to the agent over its own configuration files — a mistake the developer traced back to standard zero-trust principles he had overlooked. The incident led him to apply least-privilege and immutable-config practices to AI agents, treating them as untrusted processes regardless of who built them.