I just read an article about someone abusing a gym class reservation system with Claude, and more than anything, it points out that cybersecurity is at an inflection point. As an aside, I was initially under the impression that the article was about OpenClaw, and it began with a lobster claw image, but then it was referring to Claude, so I’m confused by that, but the point here stands whether we’re talking Claude or OpenClaw. In essence, the tools available for infosec have changed, which has significant ramifications for attackers and defenders, alike.
The articles about tools like Claude and OpenAI are very frantic and use innuendo to imply the tools are going to carelessly unravel the web. I assume for a fee, someone will even mail out pearls to clutch. 🙄 In any case, if you read these articles carefully, what you quickly realize is that these chat bots are exploiting trivial security vulnerabilities that have been previously undiscovered or overlooked. And so they’re getting exploited.
Part of me is like, “patch your fuckin vulns, site operators!” What these stories reveal is that the web has a lot of sites that are simply not getting exploited because they are not getting targeted. That, my friend, is not security. In fact, I think there’s a name for it. I think that is called “security through obscurity.” That is no say to live. Rather than persist in this way, conditions have changed. The path forward is gonna demand more diligence than the path that led here.
There is plenty about “AI” chat bots that bothers me, but I find these stories about its infosec capabilities quite illuminating. I could make an extensive list about all the facets that bug me, but this ain’t one. Rather, site operators should focus on serving secure software. I feel like “AI hacked my site” stories to imply that bugs should go unpatched. In my opinion that is a terrible opinion and will merely lead to abuse that is more difficult to detect. Rather than be at odds with our shared reality, people should patch their shit!