[kentonv]

I definitely agree that it's possible that attacks have happened but weren't detected. But if attacks were widespread, I'd expect we'd hear about at least some of them. The fact that we don't hear about any suggests to me that there are some significant barriers to real attacks that the theory isn't explaining. Indeed, our own attempts to build attacks seem to suggest that building a PoC in a lab is one thing but making something that actually runs in production and exfiltrates useful data is another entirely, and ridiculously hard even when it is "theoretically" possible. Not that that stops us from wanting to throw all the defenses we can at it, of course.