Re:After 7 Months, Glasswing Overwelms Maintainers with Unde...
by varenc on Tuesday November 10, 2026 @10:06PM
(#50449323)
> The broad issue is that you can turn DeepSeek-v6-unhinged loose on an arbitrary IP and exploit ~everything that is not developed and actively maintained by a billion-dollar company
Agreed. My fairly obscure company got hit by something like this last weekend. What stood out was the speed of the loop: it found something small, used it to uncover something else, and pivoted to clever exploits for the new thing within minutes. It hit a dozen of our apps in parallel across within the span of a day, from a rotating pool of residential proxies, Tor, GCP and Cloudflare IPs.
I'm fairly confident it was LLM-driven. The payloads and throwaway accounts had names like "PT59553 TEST IGNORE" and "PocCorp1659r2", and it adapted to error messages the way a person reading them would, just never sleeping. A non-tech company with 1000x the surface area and less monitoring could be in big trouble.
Of course I used LLMs for the defense too, and they were amazing at log forensics and fixes. The annoying part: when I asked Opus 5.5 for clear repro cases of exactly what the attackers did, I hit the cyber safeguards. It felt like Opus was intentionally trying to keep the exact exploits for my own bespoke applications away from me, though it was happy to point out how to fix it.
Agreed. My fairly obscure company got hit by something like this last weekend. What stood out was the speed of the loop: it found something small, used it to uncover something else, and pivoted to clever exploits for the new thing within minutes. It hit a dozen of our apps in parallel across within the span of a day, from a rotating pool of residential proxies, Tor, GCP and Cloudflare IPs.
I'm fairly confident it was LLM-driven. The payloads and throwaway accounts had names like "PT59553 TEST IGNORE" and "PocCorp1659r2", and it adapted to error messages the way a person reading them would, just never sleeping. A non-tech company with 1000x the surface area and less monitoring could be in big trouble.
Of course I used LLMs for the defense too, and they were amazing at log forensics and fixes. The annoying part: when I asked Opus 5.5 for clear repro cases of exactly what the attackers did, I hit the cyber safeguards. It felt like Opus was intentionally trying to keep the exact exploits for my own bespoke applications away from me, though it was happy to point out how to fix it.