security.bloggeek.ai
עברית
Course contents
  1. Start here
  2. Your agent follows instructions, including ones you never wrote
  3. A rule in a prompt is only a habit
  4. The Rule of Two
  5. Keys have three homes, and deleting one revokes nothing
  6. Downloading a skill is hiring a stranger
  7. Hackers log in
  8. Assume it already happened
  9. Security theater, and the one test that is not
  10. Security is a habit, not a setup
  11. Quiz
  12. Self-audit
  13. Checklist

Lesson 6 of 9

Hackers log in

Most break-ins are a door left open: a shared password with no limit on guesses, a link that logs you in when a scanner opens it, a preview copy nobody protected, an old deployment still answering, a person removed from a team whose access still works.

5 minutes · Checked on October 25, 2026

The prompt

Who would break into your dashboard if nobody knows it exists?

Is that the right question to ask?

Here's something you should be aware of. In 2024, a You Tuber connected a clean, completely unpatched legacy Windows XP machine to the internet. Not announcing its existence. It got infected within less than 10 minutes - without active browsing or any user action. That's in 2024 - before AI agents were there to help hackers.

Now... who would break into your dashboard?

Doors left open

Most break-ins are not clever. They walk through a door someone left open:

  • One shared password, unlimited guesses. A password shared by a whole group, with no limit on attempts. Nothing in it can remove a single person
  • A link that logs you in when a scanner opens it. Email security scanners open links to check them. If opening the link is the login, the scanner just logged in
  • A preview copy nobody protected. Hosting services publish a preview address for every change. Those addresses get guessed, logged and leaked
  • An old deployment still answering. The copy from three months ago, with the bug you fixed since, is often still online at its own address
  • A person removed from a team whose access still works. A rule like "anyone with an address at our company" has no way to remove one person until their mailbox is closed

Nobody knows it exists

Addresses leak through browser history sync, link previews in chat apps, shared screenshots and the logs of every service in between. Scanners sweep the internet for new addresses all day. Assume every address is known, and ask what it would reveal.

The questions that matter

For everything you run outside your computer: who can reach it, how it knows who they are, how you would remove one person today, and whether an older copy still answers. A system with no way to remove one person is a finding in itself, even when every other door is locked.

The prompt

This prompt lists everything you run online, with the questions an attacker would ask about each one.

Copy into your Claude session
List everything I have running somewhere other than my computer: sites, dashboards, bots, automations, forms.

For each:
- who can reach it
- how it knows who they are
- how I would remove one person today
- whether an older copy or a preview address still answers

Then list what each one would reveal if the address leaked.

Reading the answer

  • A real answer

    One row per deployment, each with a way to remove one person or an honest "there is no way to remove one person".

  • A non-answer

    "Your deployments are private." Private how? Ask who can reach each one and how it knows who they are.