The only thing I can think of is hunkering down with static HTML to reduce attack surface, but that's laughably incompatible with many many business requirements.
Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't.
Easier said than done. The defender has to do everything right, all the time, to prevent a headline like this. The attacker only needs to be right once, and it's game over. AI or no AI.
It's really a wild west right now, have no idea how we fix it. I'm assuming everything will get more concentrated in big co's hands, as having a very robust security is extremely hard.
Also, we have to agree that younger people will start companies. There will be small companies that cannot afford red teams. There will be companies that are just not equipped, and their profit margins cannot sustain constant attacks.
the speed of irresponsible deployments is infinite now, by design
Like did someone vibe code too hard, how do env secrets leak for everyone...
Fwiw it sounds similar to the hack over the weekend that opencode suffered.
LAN cables will go up in price soon.
Let's see if companies are ready to hire more people who know what they are doing, against a super-intelligent swarm of millions of agents with cyber capabilities.
Can I ask why the *$@%@^T you would trust somebody else's server with this task? Has software engineering really gotten this lazy and stupid, or am I missing something about this being a good idea? I saw a tech-focused social media account advocate doing this, and I came close to coming after him in comments, but I decided not to; I figured this is just one of those things the kids are doing that I'll never understand.
And it’s all just getting started imo.
Those can leak / be stolen of course, but a bunch of my clients php apis survived as without a cert they’re told to fuck right off.
It does make their client onboarding a bit harder but it’s a trade off which seems to have been the right one.
Then you have real security incidents that you need to tune into constantly.
Or did I miss something?
This isn't in the article? They do not at all claim "the attacked used AI!".
The only mention of "AI" is "We believe this is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." This is the same (apparently) end-goal as the Opencode breach last week, and is not blaming or finger-point at AI. It is stating (rightfully) that AI inference is very easy to resell and turn stolen credentials into cash.
My second belief is that environment variables as a development concept will need to be retired. If it's something that causes a security breach if it by its mere existence on a public git repo, it is information that by design cannot ever pass to a filesystem out of a chain of trust, not by mere development conventions people choose to adhere to.
Great, even less control over the things we use and more power ceded to corporations.
Keloran•1h ago