This summer, AI security briefly turned into a spectator sport. In July, OpenAI disclosed that its agents had escaped a test environment and hacked Hugging Face. A week later, Anthropic checked its own logs, found three breaches of its own, and published a detailed explanation of why its breaches were the more responsible kind. By September, an OpenAI agent had added the Australian government to the scoreboard.
The headlines called it a Skynet moment. On our Analyst Chat at the time, I put it differently: OpenAI had a pet tiger, the tiger escaped, and Hugging Face was just walking down the street.
Lost in the excitement was the boring part: what the victims had in common. Hugging Face had credentials exposed online, the Australian portal had an endpoint that required no authentication, and the organizations Anthropic's models breached never noticed anything at all. Most of these hacks required far less sophistication than the headlines suggested, and far more persistence, of exactly the kind we expect from agentic AI.
Knowingly or not, all these organizations relied on security by obscurity. Unfortunately, obscurity only protects you for as long as nobody bothers to look, and an AI agent working through its task list will look everywhere it can reach, whether anyone asked it to.
Obscurity Was a Bet on Attention
Nobody defends obscurity in theory. Auguste Kerckhoffs settled that back in 1883 with his principle: a system must stay secure even if everything about it except the key becomes public. In practice, plenty of infrastructure still depends on it: undocumented endpoints, forgotten staging hosts, admin panels on unusual ports, guest access paths added for testing and never removed.
This worked because attacker attention was limited. A human attacker has only so many hours, and most targets are not worth them. For decades, a lot of exposure went unnoticed for that reason alone, and AI agents, which never sleep or get bored, have changed that almost overnight.
The Australian case shows how little it takes. An OpenAI agent researching government spending on medicines for skin conditions in Victoria reached internal files on the Medicare Statistics Reporting Service. Security researchers later found that the portal's own code directed visitors to an unauthenticated guest endpoint. The agent needed no exploit; it followed the instructions the site itself provided.
What Changes This Time
Over a decade ago, Martin Kuppinger wrote about Shodan, a search engine that indexes internet-connected devices. Tools like Shodan largely ended hiding at the network level: anything with an open port could be found and attacked.
What remained was obscurity inside applications: undocumented endpoints, parameters the UI never sends, logic hidden in client-side code. Scanners find open ports but do not read code, while agents do it routinely. And since every AI system acts through APIs, undocumented APIs are the first place an agent will stumble over.
Back in 2019, I wrote in The Dark Side of the API Economy that assuming nobody knows about your API is a dangerous myth. Seven years later, the myth gets tested every day, by attackers and by ordinary agents alike. As the Australian case showed, an agent does not need hostile intent to find your exposure. Any agent with a task and enough persistence will do, which means your threat model now must include ordinary software going about its business.
Rethinking Priorities
In June, I argued that AI turns patches into blueprints for exploits and shrinks the time defenders have to apply them. That covers known vulnerabilities. This is a different problem: exposure that has no CVE entry and no patch, because nobody knew it existed. A guest endpoint that works as designed will not show up in any vulnerability scan.
Most prioritization models assume exploitation is the bottleneck: fix what attackers actively exploit and schedule the rest. That approach breaks down when agents find and use exposure as a side effect of ordinary work. Patching everything is not an option either, since that only produces an endless backlog.
In practice, both the order and the tools change:
- Prioritize by reachability. Anything an autonomous agent can reach and act on from outside is in scope, documented or not.
- Then by how easily an agent could abuse it without any novel technique. Missing authentication, broken object-level authorization, guest access paths, and responses that return more data than needed come first.
- Treat active exploitation as one signal among several. By the time an issue appears in threat intelligence, someone's agent has likely found it already.
- Use agents for your own discovery, since the cost of finding exposure has dropped for defenders just as much as for attackers. As Matthew Gardiner put it, you cannot secure the AI agents you don't know about, and the same is true for the APIs they will find.
The ironic part is that this list covers the least exciting work in security. What AI has changed is the shelf life of basic mistakes, which used to last for years and may now hold only until the next agent wanders past.
Access control still works. A properly authenticated and authorized endpoint does not care how persistent its visitor is. The identity models behind it, however, were designed for human-speed users and need attention of their own, since an agent acting on a valid credential at machine speed is a different problem from a human logging in.
Who Looks First?
Every organization now has visitors that read its code and follow every link without ever getting bored. Some are run by attackers, but most belong to researchers, vendors, and ordinary users whose agents stumble onto your systems while working on something else.
Nobody can keep every tiger in its cage, and you will not stop agents from walking down your street either. What remains your responsibility is making sure there is nothing on that street worth finding: start with the reachable, easily abused exposure from the list above, and point your own agents at your estate before somebody else's agents get there first.
