2026-02-25 20:19 UTC
Replies (18)
-
@wordshaper@weatherishappening.network 2026-02-25 20:22
@briankrebs I am also really curious how many people have aggressively violated various privacy laws by feeding stuff into various LLMs for "summary" and "analysis". Frankly it should be a much larger compliance nightmare than it is. (Or, I suppose, it *is* a ginormous compliance nightmare and just right now everyone's thinking it isn't. Incorrectly)
-
@SecureOwl@infosec.exchange 2026-02-25 20:25
@briankrebs In several pen tests I've done across the last 18 months, one of the most interesting trends has been the sudden increase in the number of examples I've found of people who have thrown those API keys, and in some cases raw data, into accidentally public GitHub repos while attempting to glue AI to things to 'see what it can do'. Few weeks ago I found a GitHub repo that a developer had trained on a dump of their own corporate emails, and all those emails where just in public, on Github, and contained lots of things like vendor SFTP creds. It's a free for all.
-
@kgndiue@mastodon.social 2026-02-25 20:36
@briankrebs oh we dont even have 2fa because because. Have i mentioned we have a gigantic bloated mess of it bureaucracy but nobody cares we dont have a secure image repo? But somebody had the idea to write safe dev guidelines because paper is what keeps us safe, not patching vulns.
-
@Epic_Null@infosec.exchange 2026-02-25 20:52
@briankrebs that sounds more like part of shadow-IT than a new version of it.
-
@zackwhittaker@mastodon.social 2026-02-25 21:42
@briankrebs 100%!
-
@rootwyrm@weird.autos 2026-02-25 21:51
@briankrebs I have personally witnessed people just blindly feeding secrets and sensitive data right into systems where they straight up say "we're gonna hoover up literally everything you feed us as data for 'training' and might spit it out verbatim to anyone who asks." In an organization that basically threatened Very Bad Things would happen to anyone who even *hinted* at information they deemed 'confidential' to anyone else.
-
@elle@weathered-steel.social 2026-02-25 21:58
@briankrebs it's almost like those AI tools were purpose-built for data exfiltration...
-
@nemokamui@infosec.exchange 2026-02-25 22:10
@briankrebs how about the ones using bypass methods to do their work without realizing they’re using a file transfer service that doesn’t delete the data they’re exfiling allowing any rando to download the company source code with no tracking
-
@flashesofpanic@ruby.social 2026-02-25 22:32
@briankrebs just this afternoon a colleague and I were questioning whether the real “AI is coming for your job” was not “AI will replace you” but “idiots with AI are going to tank your company and you’re all getting laid off when it collapses”.
-
@claus@hachyderm.io 2026-02-25 22:35
@briankrebs more disturbingly, there are also cases where users throw API keys at their agents, and then have the agents automatically generate/refresh access tokens for them because the user cannot be arsed to do the daily login/2FA dance.
-
@ftp_alun@infosec.exchange 2026-02-26 00:01
@briankrebs when I interview for appsec positions, I like to ask "what would it take for you to fire a developer for a security lapse?" Interesting conversations ensue. I don't think anyone actually ever fires developers for security failings, including failure to learn from repeated blunders.
-
@masek@infosec.exchange 2026-02-26 06:08
@briankrebs Installation of OpenClaw has been the #1 alert for the SOC team lately.
-
@glyph@mastodon.social 2026-02-26 07:02
@briankrebs I'm… skeptical, but not enough to argue. my experience of companies' relationship to AI is that there are aggressive mandates to use this tech and relatively tepid interest from workers. not zero, but not the widespread DIY enthusiasm that shadow IT derived from. I don't have any real data to back this up though, so I would be very curious if you do some reporting on this.
-
@mweiss@infosec.exchange 2026-02-26 15:13
@briankrebs this was literally my very first concern about LLMs when ChatGPT started getting traction about three years ago. Agents just make the problem an order of magnitude worse.
-
@mweiss@infosec.exchange 2026-02-26 15:13
@briankrebs this was literally my very first concern about LLMs when ChatGPT started getting traction about three years ago. Agents just make the problem an order of magnitude worse.
-
@alexr@mastodon.online 2026-02-26 18:32
@briankrebs It certainly takes some effort to correctly instruct an LLM that it cannot read any secrets directly because that’s exfiltrating data. And then as context fills, it’ll forget that directive.
-
@svw@fosstodon.org 2026-02-26 20:17
@briankrebs ...or just python in Excel. The amount of "internal only" data that is unknowingly shipped off to a Microsoft Coud environment. 🤦♂️
-
@ferricoxide@blahaj.zone 2026-02-25 20:24
@briankrebs@infosec.exchange On the plus side, step #1 of setting up things like an #AWS/#Azure/#GCP account — especially production ones — is to disable the ability to create IAM users (forcing the use of IAM-roles that are 2FA authenticated via a service like #Okta) …and the role-based authentication-tokens are typically TTLed to a couple hours. Still, a "good" (suspicious-quotes) agent-setup would be pretty trivial to configure to snarf credentials from the relevant token-services. That triviality likely applies more broadly.