Red teamer: agentic attacks don't need zero-days, they exploit your security debt
AccBalanced · x · 2026-11-03
Security researcher cglyer (retweeted by AccBalanced) argues that current agentic attacks won't dazzle you with l33t zero-days — instead they check every possible "door handle" to find the one you forgot to lock.
He asks how many organizations have had red team assessments that found reams of credentials, secrets and tokens in internal knowledge repos or file shares, only to respond with a collective shrug and fix nothing.
Key point: agentic attacks target the security tech debt that has always existed in every organization — it just hasn't been abused by an external attacker yet.
More from Safety
- CPS prosecutor cited imaginary legal case in high court after AI search, Guardian reports — nordicinst · 2026-11-03
- If an agent can edit its own spending cap, was it ever a cap? — quiet_flare · 2026-11-03
- OpenAI quadruples bug bounty payouts, tops out at $172,000 per vulnerability — The Decoder · 2026-11-03
- AI safety researcher: technical 'AI Safety' work has been product work empowering big labs — j_foerst · 2026-11-03
- CJEU advocate general: chatbots' real-time reuse of press content can infringe publishers' rights — Loo_Atreides · 2026-11-03
- Face quality scores can backfire: higher quality often signals a morphing attack — FraunhoferIGD · 2026-11-03