How Are AI Agents Finding Major Security Holes?

Dane Knecht says AI is now finding serious internet holes on a weekly rhythm, including a cryptographic key whose seed was the number four.

Log4j-scale incidents used to show up about once a year, and Cloudflare treated each one as all hands on deck for paying customers and free customers, because it sees that protection as a public good. Those incidents now happen weekly. One key that protects TLS and web PKI connections was created from the seed four. Cryptography needs randomness. Cloudflare keeps lava lamps so its own keys get real randomness. A key that starts from a single number can be reverse engineered, and a model does not sleep the way one red-team engineer does. Knecht says he thinks OpenAI recently found the seeds for the NIST curves released in 2000. The models are getting better at this, and so are the harnesses people wrap around them.

The largest recent holes are not all from nation-states. Some are high school students who used to live in capture-the-flag contests. Sarah Guo calls them agent kitties. They point agents at a target and collect bug-bounty payouts. Tools that governments kept for a long time are now in ordinary hands.