Reverse engineering a $1B Legal AI tool exposed 100k+ confidential files

Re:Reverse engineering a $1B Legal AI tool exposed 100k+ con... by canopi on Wednesday December 03, 2025 @01:10PM (#46137862)

The first thing that comes to my mind is SOC2 HIPAA and the whole security theater.

I am one of the engineers that had to suffer through countless screenshots and forms to get these because they show that you are compliant and safe. While the real impactful things are ignored

[ Parent | on HN ]

Re:Reverse engineering a $1B Legal AI tool exposed 100k+ con... by latchkey on Wednesday December 03, 2025 @06:43PM (#46141870)

SemiAnalysis made this a base requirement for being appropriately ranked on their ClusterMAX report, telling me it is akin to FAA certifications, and then getting hacked themselves for not enforcing simple security controls.

https://jon4hotaisle.substack.com/i/180360455/anatomy-of-the...

It is crazy how this gets perpetuated in the industry as actually having security value, when in reality, it is just a pay-to-play checkbox.

[ Parent | on HN ]

Re:Reverse engineering a $1B Legal AI tool exposed 100k+ con... by chickensong on Wednesday December 03, 2025 @07:53PM (#46142463)

You have to start somewhere though. Security theater sucks, and it's not like compliance is a silver bullet, but at least it's something. Having been through implementing standards compliance, it did help the company in some areas. Was it perfect? Definitely not. Was it driven by financial goals? Absolutely. It did tighten up some weak spots though.

If the options mainly consist of "trust me bro" vs "we can demonstrate that we put in some effort", the latter seems more preferable, even if it's not perfect.

[ Parent | on HN ]