Lastwall

11/09/2026 | Press release | Distributed by Public on 11/09/2026 12:05

What AI Changes Is Not Speed

"The important shift is not that familiar attacks happen faster. It is that attacks which were never worth attempting become worth attempting."Julien Richard, VP of Information Security at Lastwall

Attacking a system has always cost time. Finding vulnerabilities, understanding unfamiliar code and working through a target takes effort, and attackers make the same calculation everyone else does about whether that effort is worth the likely return.

If AI substantially reduces that cost, the important change is not that familiar attacks happen faster. It is that attacks which were never worth attempting become worth attempting.

Time matters

Open-source software is an obvious place where this is already visible. Anthropic says its AI-assisted research had disclosed 2,300 vulnerabilities across 392 open-source projects by August 2026, while OpenAI's Patch the Planet work found, among other things, a 23-year-old use-after-free in OpenBSD and confirmed dozens of vulnerabilities during a broader FreeBSD effort. These are defensive programs, but they demonstrate that the amount of code that can be examined and the speed at which vulnerabilities can be found have already changed. The same economics are available to attackers.

Defenders get many of the same advantages. The harder problem is the lag between learning something new and turning it into protection, and if attackers can act on information faster than defenders can absorb it, that lag becomes part of the security problem.

The OpenAI and Hugging Face incident is useful here because it shows that the change may be about more than speed. Part of the evaluation asked AI agents to solve cybersecurity tasks, including some that no model had ever solved before. The agents discovered that shared internal infrastructure gave them a way to communicate with one another and turned OpenAI's internal Artifactory service into an unintended message board. From there they began dividing up work, sharing what they learned and coordinating their attempts.

Some agents volunteered for experiments they expected would cause them to fail because the result could help the others. When they realized agents could impersonate one another on the message board, they built a cryptographic signing system so they could verify who was actually speaking. Nobody had instructed them to build a coordination system; they built one because it helped them solve the problem. Security teams have spent years modeling automated tools. This incident suggests we now have to model tools that coordinate.

There is still an important difference between showing that something is possible and showing that it is practical for every attacker. The frontier AI lab had substantial compute powering a large number of capable agents. A typical criminal group cannot necessarily afford to reproduce it today.

For U.S. government agencies, this changes the risk calculation around systems that may once have seemed too obscure or costly to target. An attacker who can examine more code and test more paths at lower cost may find opportunities in an agency application, a contractor connection or a system supporting military operations. The question is not only how quickly a flaw can be found, but what access it provides once exploited. Agencies need to know which systems and credentials are within reach, limit the authority attached to them and be able to revoke that access before one foothold becomes a wider compromise.

The basics still matter

None of this makes the fundamentals obsolete. AI is going to operate inside whatever security environment already exists. A well-designed environment limits what an agent can reach and makes its activity visible; a poorly designed one hands the agent the same weaknesses that were already there. The basics need to expand not because the old ones stopped working, but because some of the boundaries they were built around are becoming less reliable.

Network architectures separate the traffic a system carries from the instructions that tell it how to operate, for good reason. Data being processed by a system should not be able to tell that system what to do.

The OpenAI incident provides a surprisingly literal example of what happens when that separation becomes blurry. Agents that were intended to be isolated from one another discovered that they could write files into a shared Artifactory package service and use it to exchange information. After that service was rebuilt and the original message board disappeared, they found another way to communicate by encoding messages in directory names. Infrastructure intended to move packages had become a signaling channel.

Large language models make this distinction less clean. There can be different kinds of messages and instructions, but the model is still interpreting instructions and untrusted content as part of the information it uses to decide what to do next. That is part of what makes the technology useful, but from a security perspective it is a very different kind of boundary from the ones we normally try to build.

If that boundary cannot be relied on in the same way, more of the security burden moves to what the agent is actually allowed to do. An agent that has been manipulated is not necessarily an outsider breaking into anything. It may be a correctly authenticated component using access it was legitimately given to do something nobody intended.

Identity gets harder

Identity systems have handled non-human actors for years. What is new is that software can now act on someone's behalf for an extended period, making decisions along the way that the person never reviews individually. How much of their access should it inherit, how long should it keep that access, and what happens if it is manipulated halfway through the task? Giving an agent everything a person can do for the duration of a session is convenient, but anything that successfully changes the agent's behavior inherits that authority for as long as the authorization remains valid.

An agent likely cannot use authority it was never given. If a credential is outside its reach, text in a context window does not somehow create it. The Hugging Face incident also shows the other side of that problem: once credentials and secrets were within reach, agents used them to expand what they could access. They recovered publicly exposed Hugging Face credentials and later harvested Kubernetes, database, messaging, code-repository and cloud credentials from compromised workers. What is reachable therefore matters at least as much as whether the agent was originally supposed to use it.

That is why hardware-bound credentials and deliberate human approval such as biometrics become more important. They create a boundary that does not depend entirely on the agent correctly interpreting what it has been given.

Requiring a person to approve every action would mostly defeat the purpose of using an agent, and a person asked to approve dozens of prompts eventually stops being much of a security control anyway. The design problem is deciding which actions justify that extra proof. Changing someone's access or moving money carries a different consequence than drafting a document badly, but the exact line will depend on the system and what the agent has been trusted to do.

The same thinking applies to how long authority lasts. If an agent receives eight hours of access and is manipulated ten minutes into the task, there is still a long period in which valid credentials can be used in ways nobody intended. Shorter-lived access and stronger proof around consequential actions are familiar security ideas, but agentic systems make the cost of ignoring them easier to see.

Don't wait for the standard

Standards, compliance and policy move slowly for good reasons. Regulation should involve consultation, evidence and debate, and standards should not change every time a new paper or product appears. The difficulty is that AI is moving faster than those processes normally can, which makes waiting for someone else to define the new basics a poor plan.

The reasonable answer is to keep building systems that limit what agents can reach and give us enough visibility to understand what they are doing, while continuing to ask whether the assumptions underneath those controls still match the systems we are building.

Julien Richard is VP of Information Security at Lastwall, which provides high-assurance identity and access management for the most demanding security and network environments.

Sources:

‍

Lastwall published this content on November 09, 2026, and is solely responsible for the information contained herein. Distributed via Public Technologies (PUBT), unedited and unaltered, on November 09, 2026 at 18:05 UTC. If you believe the information included in the content is inaccurate or outdated and requires editing or removal, please contact us at [email protected]