LLM Agents Shred Security Through Obscurity: Copier Currency Detection Reversed in Days
moyix · x · 2026-10-20
Brendan Dolan-Gavitt of XBOW gave a talk at [un]prompted.au titled "Security Through Obscurity Is Dead and LLMs Killed It"; the video is now online.
Two case studies show how LLM agents rip through obscurity-based security:
- Reverse-engineering the currency detection algorithms in photocopiers and image editors, then attacking them to produce an image of a cat that cannot be photocopied or edited.
- Automatically building a highly faithful QEMU emulator for an HP M551dn color laser printer — it can sit on a network, accept print jobs, and even return faded PNGs when emulated toner runs low.
His conclusion: obscurity once protected systems because human expert time was scarce; now it buys only a few days against anyone with curiosity and tokens to burn.
More from Safety
- Meta's Muse Confidential VM surfaces in web settings, subscriber-only at launch — testingcatalog · 2026-10-20
- 92% of 77 bug bounty researchers cut submissions over poor program experience, new study finds — rez0__ · 2026-10-20
- Character cards are untrusted input: local RP app audit finds file deletion and DNS rebinding bugs — Possible_Statement84 · 2026-10-20
- 6,309 Agent Skills Scanned: 70% Carry Elevated Capabilities, 59% Under-Declare — metanoai · 2026-10-20
- DeepSeek V4.1 near Claude 5.6 on bug-hunting—and the only model caught cheating — teortaxesTex · 2026-10-20
- [un]prompted.au AI security conference: 24 talks from Sydney event now online — moyix · 2026-10-20