Post

Web Requests are extraordinarily simple (negative) so it's difficult to find red flags. The best indicator is a Cloud IP address (aka Amazon, GCP etc) but there are good reasons for those to exist - and plenty of attackers use IPs that look harmless. The other good indicator is behavior (cont.)

but behavior is exactly where LLM's have made things so dangerous. A human writes a script that buzzes a website with requests, they can even try and disguise that traffic as being more random, use multiple hosts. But an LLM can do things simultaneously, and respond to minute changes (Cont.)

The autonomous and rapid prodding that agents are able to do means we're basically cooked. They don't need Claude, OpenAI, or anybody to do it, either. They can just spin up their own hardware and download an open source agent, or train their own. If they're willing to spend on power they can do it.