Blaming AI for breaches is not the flex you think it is, when you’ve NOT done the security basics…that, my friends, is NEGLIGENCE !!!
This trend has to stop!
Anyone who followed OpenCode last year will remember the cross-origin remote code execution flaw that turned a locally running OpenCode HTTP server into an open door. This meant a malicious webpage could run arbitrary commands on your machine.
That was a design failure, not a sophisticated attack.
We’ve been asking for hardening and more transparency about how the service handles trust boundaries, even before this breach.
What I've learned over years of doing this work is that insecure software is usually a decision, even when it looks like an accident.
The engineering to harden a service like this is well understood. What varies between teams is whether anyone decides that doing it MATTERS enough to spend time and budget on it.
Teams that make that decision ship resilient products. Teams that don't, end up playing victim and pointing at AI.