What's Getting Pwned

(pwn.watch)

60 points | by mrkd 58 minutes ago

11 comments

  • DrewADesign 3 minutes ago
    > Major U.S. banks detect unauthorized third-party AI agents inside customer accounts

    Step 2 is instead of waiting to be caught, the instigators should issue a press release blaming cunning rogue agents as part of their research, call no felonies because they’re working for the greater good of eliminating a shitload of jobs, say the real problem is a lack of regulation, and step 3 is collecting the investment dollars.

  • pixl97 25 minutes ago
    Would be interesting to see what 2025 looked like in comparison.

    The rate at which flaws are being found is just insane. Many people warned us in the past that our lax security postures would come back to bite us, and we're finally here.

    • turbobutton 0 minutes ago
      I was curios if there was a noticable increase in the number of security incidents before 2026 - and the answer seems to be "no". The Identity Theft Resource Center has the following data for Reported Data Compromises in the US (keep in mind that the internet itself has been growing as well): | Year | Reported US data compromises |

      |---|---:|

      | 2016 | 1,099 |

      | 2017 | 1,506 |

      | 2018 | 1,175 |

      | 2019 | 1,279 |

      | 2020 | 1,107 |

      | 2021 | 1,859 |

      | 2022 | 1,798 |

      | 2023 | 3,202 |

      | 2024 | 3,152 |

      | 2025 | 3,322 |

      Curios what 2026 will look like...

      Sources:

      https://www.idtheftcenter.org/wp-content/uploads/2022/04/ITR...

      https://www.idtheftcenter.org/wp-content/uploads/2026/01/202...

    • Kevin_Flynn 21 minutes ago
      Well, an economist would say, we have as much security as we collectively decided we were willing to pay for.

      And theres really only one of 2 outcomes as this progresses as I can see it:

      1) The AI's are well matched, and the outcome is balanced, and it ends up being a metric of the internet itself that gets monitored, like this website is doing.

      or

      2) It crashes in such a spectacular fashion that important utilities and industries are distrupted, with the length of time for recovery being the determining factor in how many people lose their minds, start looting, etc ... you know the story.

      • datsci_est_2015 0 minutes ago
        It’s orders of magnitude easier to destroy something than it is to build something up. It’s why bad leaders can be much more devastating than the best leaders.
      • metrix 5 minutes ago
        This may be a side conversation, but wondered how far away we are to a small LLM being prompted to turn itself into a worm that uses all exploits it knows, and prompts other LLM's when it has access.
      • trollbridge 17 minutes ago
        Collectively, billions have been spent on cybersecurity. It was just mostly wasted, that's all.
        • pixl97 5 minutes ago
          Because we build things the wrong way.

          "We take code and make it secure"

          instead of

          "We take secure and make it code".

          That said, maybe it's impossible. Maybe turing completeness and security are antithetical and someone will always be able to find a way to poke a hole in the system from a lower layer of reality.

      • juleiie 12 minutes ago
        This will be a real test which societies start looting in such circumstances

        I fortunately live in a peaceful, cooperative country of Poland that looks down upon such practices unlike us or France or uk

        Let the best win. Over and out

        • pixl97 3 minutes ago
          Oh, don't worry, when all your European neighbors are busy fighting each other with sticks Russia will come along and start coveting what is yours.
  • demibabs 4 minutes ago
    Every ai generated page tries to cram way too much information in way too small a place
  • xbar 5 minutes ago
    After the first 8 hours of playing with Mythos, I was asked what I thought. My response, "this generation of LLMs is going to drive the largest wave of security incidents the world has ever seen."

    It is still getting started.

  • Kevin_Flynn 47 minutes ago
    This is a nice website.

    Was hunting for a real time graph of incidents and patches, like a stock market chart of the end of the software world, or the birth of artificial consciousness, depending on how squiggly the lines are.

    Just the heatmap apparently. :|

    Also, as all the humans are installing their "AI on every device" clustering software, the pace of it all should really pick up, and this reminds me of the following SFW movie clip:

    "The suspense is terrible. I hope it will last." - Willy Wonka

    https://www.youtube.com/watch?v=Oci1CuCht7E

  • ceuk 34 minutes ago
    That "copy instructions got agents" thing is a really great idea. I just used it :)
    • contravariant 16 minutes ago
      It would have been an ever better idea if I could figure out what it's for before copying :)
    • baoooooooooooo 16 minutes ago
      Great for a rapid response, but seems... not so secure?
  • micromacrofoot 6 minutes ago
    we've got to tell these agents to chill out on the density a little, this page could be more informative with half the data because it would be easier to ingest
    • RankingMember 0 minutes ago
      Definitely wouldn't mind them switching up the theming too- the sites they generate all have the same default theming.
  • prodigycorp 34 minutes ago
    A simple line chart would be more helpful, informative and humbling than a heat map.
    • alt227 11 minutes ago
      I agree, I personally dont like the heatmap and find it very hard to read.
  • HardCodedBias 14 minutes ago
    Beautiful website, well done.

    An over time graph with a rolling window of 7d and 28d would likely be a nice addition.

    Great work!

  • mschuster91 7 minutes ago
    > Ongoing security incidents, newest first: CVEs, what's affected, which versions fix it, and the advisories and posts behind each one.

    For fucks sake. The author could have invested at least half an hour to replace this obvious LLM slop regurgitation of the prompt with something of their own.

    "Buy sponsor slot for 149$/month", yeah, spotted the grift. For that level of payment it's at least reasonable to expect the design to be something else than the usual LLM garbage mixture of 30 different font styles.

  • VCFundedGenYer 7 minutes ago
    AI slop site. At least change the fonts and don't use the stereotypical smelly AI aesthetic.