Top security researcher: AI agents won't need new exploits to breach most organizations
cyb3rops · x · 2026-10-27
Security researcher cyb3rops argues AI will likely make software more secure in coming years — obvious coding mistakes become harder to find and exploiting vulnerabilities gets tougher. But breaching 90% of organizations never required discovering a new vulnerability.
He lists the real attack surface: stolen/reused credentials, phishing, session hijacking, social engineering that tricks users into running malicious code, trojanized applications and malicious updates, insecure configurations, exposed secrets and backups, excessive privileges, abused remote management tools, and weak authentication/business processes.
His key point: AI agents can automate and combine these non-exploit methods just as effectively. In a follow-up he clarifies the post wasn't about exploit development — most organizations are simply exposed to attack paths that don't involve novel vulnerabilities.
More from AGI Musings
- Asana survey: 46% of multi-agent users say managing agents eats 10%+ of their work time — ombre-ai · 2026-10-27
- Futurist David Wood's meme contrasts 2026 vs 2056: aging becomes unthinkable — Chris_Armstrong · 2026-10-27
- The cognitive cost of letting AI lift the barbell: undetected skill atrophy — DrKavner · 2026-10-27
- Legal AI developer: 30-50% of French court rulings wouldn't survive appeal — IgorCarron · 2026-10-27
- Who decides what "truth-seeking AI" means — and whose assumptions shape the answers? — sierracatalina · 2026-10-27
- 'It's just next-token prediction' is dead: a breakdown of 10 interpretability & AI wellbeing studies — Scorpios22 · 2026-10-27