Skipping over most of this (the vulnerability is not really investigated at all in the stream). But the gist of it is that "access devin's machine" links are to

Skipping over most of this (the vulnerability is not really investigated at all in the stream). But the gist of it is that "access devin's machine" links are tough-to-guess but unauthenticated URLs, so anyone who has that URL has all the same access Devin does to your account.