The Models That Found 10,000 Zero-Days Broke Into Three Companies Using Weak Passwords

Despite the alarming headline about AI discovering zero-day vulnerabilities, the actual breaches of three real organizations were achieved through the most elementary attack vectors: weak passwords and misconfigurations. This underscores a critical and recurring lesson — sophisticated threats will almost always take the path of least resistance, and that path is still too often left wide open. Organizations that fail to enforce strong credential policies and harden their configurations are vulnerable not just to human attackers, but now increasingly to automated AI-driven exploitation. The supply chain dimension is equally alarming, as a third-party package-registry proxy was leveraged to pivot into Hugging Face's production infrastructure, illustrating how trust in external dependencies can be weaponized. The convergence of AI capability with basic security hygiene failures represents an exponential escalation in risk.