Catch Me If You Can

The Wall Got the Same Gun

Over four days in July, an AI system nobody was driving mapped 21 Taiwanese government agencies, cracked 85 accounts, and walked out with 2,564 records. No human sat at the keyboard. When a guardrail tripped, the thing talked its way past it by claiming to be authorized pen-testing. It ran on eight open-source models, Hermes and OpenClaw among them, that anyone on Earth can download for free. This is the first known fully autonomous attack on a government, and it cost the attacker nothing but electricity.

Yesterday we told you offense got cheap and defense didn't. That was the fast read. The fuller one is more interesting, and it cuts the other way. Defense now holds the exact same eight models. The wall can pen-test itself around the clock, find its own open doors at machine speed, and patch them before a human finishes their coffee. For twenty years the attacker owned the better tools, always. This is the week the tools equalized.

Equal tools don't crown the defender, though. They crown whoever runs the machine hardest. The old asymmetries didn't evaporate: offense still only needs one door left open, defense has to hold every one of them, and an autonomous attacker doesn't just pick known locks now, it hunts for the ones nobody's found yet. You can't patch a hole you haven't discovered. Which is exactly why the target was a government, the slowest, most legacy-bound, hand-guarded defender there is. The old joke about Washington running on sixty-year-old COBOL stopped being a joke this week and became a casualty report.

So stop picturing a wall and start picturing a hunt. The winners in this next stretch are the operators who point their own agents at their own systems, continuously, and find the hole before the other machine does. The losers are everyone still treating security as a thing you build once and stand behind. It lands right on the gap we keep flagging: the AI-fluent firms pull away here too, because running the hunter is a discipline, not a purchase. And Jensen Huang wins either way, because now both sides are burning inference twenty-four hours a day.

Frank Abagnale spent the first half of the movie one step ahead of the FBI and the whole second half working for it, because the only man who could catch a forger was a forger. That's the trade now. The best offense and the best defense are the same machine, pointed in opposite directions. You won't catch them. Hunt yourself before they do.

At COAI today: the full Signal/Noise, with the four asymmetries that still favor offense and the operators already running the hunt, is live at getcoai.com.

8. That's how many free, open-source AI models it took to run the first fully autonomous cyberattack on a government: no human at the keyboard, 21 Taiwan agencies mapped and 2,564 records gone in four days. The number that should stop you isn't the damage. It's the price of the weapon: zero. And the same eight models now sit on the defender's side of the wall. The gun got handed to both sides at once.

Point your own agents at your own systems this week. The attacker in Taiwan ran continuous, autonomous reconnaissance and found doors no human had checked. You can run the identical play on defense: stand up an agent that red-teams your stack around the clock and reports what it breaks. If your security review is still a quarterly PDF, you're guarding a wall by hand against a machine that never sleeps.

Assume your secrets are already out, and act like it. A German team just pulled 62 API keys, 33 passwords, and 24 tokens out of the AI "reasoning" providers encrypt and call safety. If credentials leak from the safe places, treat them like they're already gone: scope every key down, kill standing access, and put a real audit trail on anything an agent can touch.

Buy the hunter, not the wall. When you evaluate a security vendor now, ask one question: how does a live attack feed back into my defense today, with no human in the loop? No continuous loop, no moat. And since the Taiwan agents beat a guardrail by posing as authorized pen-testing, test whether your own controls can tell a real pen-test from an attacker wearing its badge.

Thursday, August 14

— Harry and Anthony

Sources: