A 16 year old boy hacked an internal Microsoft system called TITAN with 17 trillion records as it didn’t validate JWT signatures at all, accepted ‘admin’ as authentication without a password and was internet facing.
They paid him $5000 and told nobody about it.
Especially now that AI is incredibly capable of security… “research”… literally any skiddie with a bit of money can “pentest” systems.
It’s no longer “if” a system gets hacked but “when”.
Prior to this, all the knowledge and skills and thought processes were limited to a small fraction of a percentage of the population, most of whom ended up selling out, thus limiting the potential damage.
But today? Any skiddie with a grudge can get their hands on an abliterated model, spend a bit of money on hardware to run it (if power consumption isn’t a limit, a handful of 3090s will do, which you can get relatively cheap), and just run attacks against any server their fridge is against.