I fully believe the only sustainable future is that hot patching will need to itself become fully automated. Hot patch now with a minimal allowed amount of line changes to head off the AIs, review it in office hours for auditing and the team is actually awake.

My second belief is that environment variables as a development concept will need to be retired. If it's something that causes a security breach if it by its mere existence on a public git repo, it is information that by design cannot ever pass to a filesystem out of a chain of trust, not by mere development conventions people choose to adhere to.

It's only just starting. It'll get worse before it gets better.

I think the only way out is to go back to on-prem for everything, like in the 00s.

LAN cables will go up in price soon.

surely once there's been enough patches the code will be perfect though?

Defending is so much harder than attacking. You don't even have to focus on one target, as you can just mass-AI-script a lot of attacks wherever it's possible, and see what sticks. Even if you did everything right, there's always the social-engineering angle, or a single compromised device, or just accidental bad upgrade through supply chain. If you can mass-spread the seed, and plant something that "calls home" constantly, you can just have an agent that would start the attack the minute it gets infected, and go deeper.

It's really a wild west right now, have no idea how we fix it. I'm assuming everything will get more concentrated in big co's hands, as having a very robust security is extremely hard.

Also, we have to agree that younger people will start companies. There will be small companies that cannot afford red teams. There will be companies that are just not equipped, and their profit margins cannot sustain constant attacks.

> your own red teaming should have found them before the attacker did

Easier said than done. The defender has to do everything right, all the time, to prevent a headline like this. The attacker only needs to be right once, and it's game over. AI or no AI.

Unless they edited the post, they never said this. You should delete this; it's false information.

I didn’t actually see that in this post at all. They mention that the end goal of the attackers might be to get to AI inference providers. But I don’t think they are crying “AI was used” here.

Or did I miss something?

This one doesn’t?

I'm already tired, between pushing back on vibe coded internal projects being pushed onto the internet and then the constant barrage of CVEs that mean nothing.

Then you have real security incidents that you need to tune into constantly.

It's going to be a rough decade.

job security!

Easy, all the bad guys need to do is access whatever system stores the decryption keys.

I've already taken my applications offline and will be migrating to a new host...

companies probably have php and Python applications exposed to the web and nobody knows.

the speed of irresponsible deployments is infinite now, by design

Of course, it was a giant scam that tested for nothing and optimized for how to pass a test.

Let's see if companies are ready to hire more people who know what they are doing, against a super-intelligent swarm of millions of agents with cyber capabilities.