An interesting consequence is that cybersecurity researchers and hackers are now AI researchers.
The prominent game right now is about the classes of attacks that AI can recognize both to exploit and to remedy.
Implicitly, that creates a new highly valuable class of vulnerabilities: the ones that AI for whatever reason is unable to readily see. Understanding those two groups will be paramount and will lead to better AI.
Totally disagree tbh. Obscurity is about the only form of security worth the name these days.
Don't run on open source software - doesn't matter how obscure it is, the LLMs will know about it.
Don't run on software that other people use - if there is more than one copy of the software accessible, it'll be broken elsewhere and you'll be a victim of drive-by hacking.
Do - run your own software, written by you, which nobody else uses, that is closed source and completely undocumented. Then you might have some chance of avoiding being hacked.
Eh, I know someone who did that. I needed to use that software and didn't enjoy the experience. Claude reverse-engineered it between breakfast and lunch. Now I have a pleasant interface, all vibecoded.
I am finding the craziest anti-tampering stuff. Three different routines - each watches the code of the others - and if anything changes - tank the machine by jumping into graphics RAM.
When I first started seeing this stuff I assumed my decompiler was broken. Nope. Just insane code.
Yeah I've been using Ghidira to study the internals of strategy PC games I like and it's an extremely good learning experience given the paucity of OSS code for stuff like this
It's not "dead", what kind of crappy binary take is this. It absolutely still work to an extent where making an attacker lose time does slow down attacks, thus increasing security.
You can absolutely make an agent lose its mind thus making it spend more tokens, to an extent where it might not be viable, but in all case, slowing down or making something more expensive is a direct way to increase security, so wasting either token or human time both is useful.
This is what annoys me most when people talk down security by obscurity. Sometimes it is not even security, but logs sanity. I usually ask them if they prefer to have more or less useless logs. Still waiting for someone to want more (except researchers)
Security in depth is made of (ideally independent) layers. Obscuring things is one such layer.
An interesting consequence is that cybersecurity researchers and hackers are now AI researchers.
The prominent game right now is about the classes of attacks that AI can recognize both to exploit and to remedy.
Implicitly, that creates a new highly valuable class of vulnerabilities: the ones that AI for whatever reason is unable to readily see. Understanding those two groups will be paramount and will lead to better AI.
Totally disagree tbh. Obscurity is about the only form of security worth the name these days.
Don't run on open source software - doesn't matter how obscure it is, the LLMs will know about it.
Don't run on software that other people use - if there is more than one copy of the software accessible, it'll be broken elsewhere and you'll be a victim of drive-by hacking.
Do - run your own software, written by you, which nobody else uses, that is closed source and completely undocumented. Then you might have some chance of avoiding being hacked.
Eh, I know someone who did that. I needed to use that software and didn't enjoy the experience. Claude reverse-engineered it between breakfast and lunch. Now I have a pleasant interface, all vibecoded.
Speaking of obscured code:
I'm using AI to decompile old arcade games.
I am finding the craziest anti-tampering stuff. Three different routines - each watches the code of the others - and if anything changes - tank the machine by jumping into graphics RAM.
When I first started seeing this stuff I assumed my decompiler was broken. Nope. Just insane code.
Yeah I've been using Ghidira to study the internals of strategy PC games I like and it's an extremely good learning experience given the paucity of OSS code for stuff like this
Yeah, I should be using Ghidira in my toolchain. I didn't know it existed so I had to reinvent the wheel.
Although - Ghidira is often wrong about what code does. Make it run tests to verify its theories? BINGO.
If you have the energy or desire to write this up it sounds really fascinating.
THAT is an excellent idea. Thank you.
It's not "dead", what kind of crappy binary take is this. It absolutely still work to an extent where making an attacker lose time does slow down attacks, thus increasing security.
You can absolutely make an agent lose its mind thus making it spend more tokens, to an extent where it might not be viable, but in all case, slowing down or making something more expensive is a direct way to increase security, so wasting either token or human time both is useful.
SBO+Real security > Security.
This is what annoys me most when people talk down security by obscurity. Sometimes it is not even security, but logs sanity. I usually ask them if they prefer to have more or less useless logs. Still waiting for someone to want more (except researchers)
Security in depth is made of (ideally independent) layers. Obscuring things is one such layer.
404
Article should be available at https://www.theregister.com/security/2026/09/13/security-thr...