@briankrebs__dup_6@infosec.exchange
2026-02-25 20:04 UTC
Replies (18)
-
@briankrebs@infosec.exchange 2026-02-25 20:19
I'd argue that very few companies have any real appreciation for how many of their employees are already feeding API keys and other stuff into fairly new and questionable agentic AI tools or platforms. So many companies are like, oh we're taking a wait-and-see approach to adopting AI. Meanwhile, half their dev team is doing critical development work on shared servers that have no authentication or limited (no 2fa) auth.
-
@UntaggedTransmitter@aberrantwinds.bond 2026-02-25 20:07
@briankrebs This tracks, the only people excited about them seem to be the same cost-cutting and condescending managers that cause shadow IT in the first place.
-
@Viss@mastodon.social 2026-02-25 20:11
@briankrebs im actively pitching a talk called 'claude is your insider threat now'
-
@amarok3@mastodon.social 2026-02-25 20:15
@briankrebs shadow IT usually originates from actual requirements that can’t be fulfilled by the IT. Meaning it solves someone’s real problems, but in a wrong way. AI agents don’t solve anyone’s real problems (yet). They basically only create problems in any possible way.
-
@michael@westergaard.social 2026-02-25 20:16
Yeah, they finally invented macros. Or IFTTT as the kids call it.
-
@grumpasaurus@infosec.exchange 2026-02-25 20:20
@briankrebs let's be honest tho shadowit.ai sounds pretty bad ass
-
@katzenberger@tldr.nettime.org 2026-02-25 21:08
@briankrebs I'm a bit old school, so: do you have the Excel sheets to prove it?
-
@danielkennedy74@infosec.exchange 2026-02-25 21:14
@briankrebs I mean, when the shadow outshines the object, is it a shadow anymore?
-
@sindarina@ngmx.com 2026-02-25 21:15
@briankrebs Why? You are correct 😄
-
@coldfish@sfba.social 2026-02-25 21:27
@briankrebs I have to admit.... earlier this week I spent like 5 hours trying to get this Ubiquiti camera system to work. I tried everything I could think of. finally, I just gave ssh access to claude code, set it on no-permission-necessary and told it to keep trying to get those cameras online until they work. then went out and had a nice dinner with my wife, a couple glasses of wine. Came back to shut the thing off.... all set worked perfectly. Still running. so. If you folks don't think you can be replaced (at least partially) with AI, think again.
-
@elricofmelnibone@mastodon.social 2026-02-25 21:33
@briankrebs Was recently forced to sit through an AI booster presentation at work, where the presenter kept demonstrating the use of tools that are banned as per corporate policy. Lots of management and IT in the meeting. No one spoke up. Security is deader than satire.
-
@OtterlySensible@techhub.social 2026-02-25 22:39
@briankrebs True, true. Just had this conversation. Without a solid understanding and policy, it’s Wild West. We need to find a way to give them what they want before they just start really feeding random secrets into other LLMs. And yes, blocking or stopping access will just result in Gmail exfil of data, sneakernet (remember me!), or using random “project” sites to bypass blockers.
-
@ferricoxide@blahaj.zone 2026-02-25 20:06
@briankrebs@infosec.exchange They're the new "scatter my credentials everywhere so that I forget about them until something blows up using my permissions".
-
@Orca@nya.one 2026-02-25 22:55
@briankrebs@infosec.exchange No? We did a better job than slop machines.
-
@kboyd@phpc.social 2026-02-26 00:02
@briankrebs@infosec.exchange I think it depends on perspective. But specifically for cyber-security threat modelling? Absolutely.
-
@SpaceLifeForm@infosec.exchange 2026-02-26 00:11
@briankrebs@infosec.exchange Representative Representative Representative. This is bullshit. Plesse hold. Your call is important to us. Bullshit. Connecting you to a real human ...
-
@mikebabcock@floss.social 2026-02-26 00:38
@briankrebs@infosec.exchange I think "shadow IT" is the wrong moniker but I do understand what you mean.
-
@gnomon@mastodon.social 2026-02-26 03:31
@briankrebs@infosec.exchange @hacks4pancakes@infosec.exchange in all seriousness I feel like this is unfair to shadow IT. Most shadow IT exists due to (perceived) necessity and a (perceived) inability to tap into necessary services through existing org structures. It's usually built with good intentions to solve real problems by people whose job does not include knowing better. Agentic AI-based services are almost all being built by people whose job *does* include knowing better. They should.