[LoganDark]

> "This is the reality of autonomous agents powered by frontier models: they are relentlessly persistent, sometimes highly noisy, and will try every possible path to achieve their goal, which can easily overwhelm traditional defences," he said.

> Ethical hacker Valentina Palmiotti - better known as Chompie - reviewed the CSA report and says the way the agents hack might seem haphazard but it is clearly effective.

> "They throw out a bunch of stuff and see what sticks," she said.

> "But they also don't get bored, they don't sleep and can be infinitely tenacious."

Madness. Traditionally, you can leave security holes open for years or decades, and often nobody notices if nobody bothers to look. But we're approaching the point where any security hole left open at any point could get discovered and exploited quite quickly, even if it's domain-specific or entirely unique, and even if no human interest ever would've occurred. It's like the next step up from those IPv4 scanners that automatically hit WordPress admin URLs and the like -- where rather than only spraying vulnerabilities that have already been discovered, they would run independent automated campaigns against each target.

[skinfaxi]

If it's cheap enough that people can probe sites at random, it's cheap enough to run yourself on the defensive.

[LoganDark]

Generally, I do not agree that operators can be expected to have comparable resources to attackers, because attackers have potentially boundless illicit resources, whereas an honest operator generally has to stick to honest resources. This is the same reason why I believe ID verification and other KYC measures actually increase fraud, because you alienate legitimate users (trying to protect their identity) while also providing attackers a way to insulate themselves from suspicion (using stolen identity).

With that said, I would tentatively agree in this case that LLM inference is getting cheap enough that defense is not necessarily that expensive, especially from providers like DeepSeek, even if you don't have inference at home, but as much as this might help an operator with an open mind, a lot just will not believe it matters until it's too late - most people are not used to dealing with this type of threat.

[Foobar8568]

Strategy at one of my clients : don't bother to patch or upgrade, we kill the service if it gets hacked.

[LoganDark]

I used that strategy when I was first starting out. With computing. Computer got a virus? Reinstall Windows.

I think it's a sign of ignorance, and when codified into policy, willful ignorance.