> status: mostly fine. patch anyway.practical AI security · est. 2026

Brief · Dumb vs Secure · Both

Patching vs. Security, and the help desk decides it

By alkizz ·

Frontier labs think patching is security, security vets know better. Ask your cyber insurance company next time someone uses 3rd party access to boink your data. Maybe that's a little unfair to the labs, so here's the fair version, and it's still a fight. In the red corner, fresh off a year of AI bug-hunting launches: Patching. In the blue corner, a few decades of incident response and a help desk that just wants to help: Security. One of them closes the doors attackers break, and the other has to deal with the doors somebody opens for them. Grab a seat.

Tale of the tape (my scouting report, not science):

Round 1: Ask your cyber insurance company

Security opens with a lawsuit. Clorox is suing Cognizant over its Aug 11, 2023 attack, and the complaint, filed Jul 22, 2025 in Alameda County Superior Court, says "The cybercriminal just called the Cognizant Service Desk, asked for credentials to access Clorox’s network, and Cognizant handed the credentials right over." It even quotes a transcript: "Cybercriminal: I don’t have a password, so I can’t connect. Cognizant Agent: Oh, ok. Ok. So let me provide the password to you ok?" Those are allegations in a complaint, not findings, and Cognizant disputes them: a spokesperson told The Record that "Clorox hired Cognizant for a narrow scope of help desk services which Cognizant reasonably performed" and that "Cognizant did not manage cybersecurity for Clorox." Still, it's hard to read that exchange and conclude the missing piece was a patch.

Nor is it a one-off: Caesars told the SEC in a Sep 14, 2023 8-K that suspicious activity in its network resulted from "a social engineering attack on an outsourced IT support vendor used by the Company." M&S's Archie Norman told a UK Parliament committee that the Apr 17, 2025 entry "occurred through what people now call social engineering," and added, "Part of the point of entry in our case also involved a third party." Coinbase said in its May 14, 2025 8-K that "The threat actor appears to have obtained this information by paying multiple contractors or employees working in support roles outside the United States," with an estimated cost of "approximately $180 million to $400 million." That one was bribery rather than a phone trick, but it's still your call center. CISA's Scattered Spider advisory describes the playbook plainly: attackers "Posed as employees to convince IT and/or helpdesk staff to provide sensitive information, reset the employee’s password, and transfer the employee’s MFA to a device they control".

The numbers back it up, too: Mandiant's M-Trends 2026 says "highly interactive voice phishing saw a significant surge to 11%, becoming the second-most commonly observed vector," and IBM's full 2026 Cost of a Data Breach report says voice and SMS phishing, used in 17% of attacks, led to the highest average breach cost, USD 5.29 million. Verizon's DBIR even asks the awkward question outright: "Could you detect someone impersonating your help desk". Patching shows up to this round with nothing to swing, so it goes to Security, and it isn't close.

Round 2: One vendor, a lot of victims

Security's second pillar is the vendor that already has the keys. An Oct 16 advisory on the campaign says that, according to public reports, "attackers are using the service to reach customer Microsoft 365 tenants and exfiltrate email, SharePoint, and Teams data," and that "How attackers gained the ability to act through ConnectWise Cloud Backup has not been confirmed at the time of writing." ConnectWise has since said its investigation "identified compromised application identities," though "the original credential-exposure mechanism remains under investigation." As I wrote in the ConnectWise brief, "As of 19:00 UTC on October 16, Huntress has confirmed unauthorized sign-ins in 162 tenants."

The pattern repeats. In the Salesloft Drift campaign, Google's threat intel team says "the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application," and "This issue does not stem from a vulnerability within the core Salesforce platform." With Snowflake, Mandiant says "every incident Mandiant responded to associated with this campaign was traced back to compromised customer credentials," across "approximately 165 potentially exposed organizations," and that most of the credentials used were available from old infostealer infections, some dating back to 2020. Klue was breached through "a legacy credential created for an integration prototype that remained active after the project ended." Notice how often the vendor story turns out to be a credential story too.

Patching gets a point back on the scale, though, because the headline number is easy to misuse. Third parties show up in nearly half of breaches (48% in Verizon's 2026 DBIR, up 60% in a year), but the most common way in was still exploiting a vulnerability (31%), and stolen credentials show up somewhere in 39% of breaches. That 48% is involvement, not the way in, and by DBIR's own definition it includes "the majority of single Exploit vuln actions," meaning bugs in vendor products that a patch would fix, so Security takes the round by only a point.

Round 3: Rotate, don't delete

This one's about keys that outlive the fix. As I wrote in the LiteLLM brief, an administrative key was committed to a public repo on May 27. The file was deleted about three hours later, but the commit stayed in public history until Oct 22, and in LiteLLM's words, "nobody followed through on revoking the administrative key." That key was the way in for the poisoned 1.107.0 that went out Oct 21 and was downloaded about 49,000 times, per Wiz. My take then still stands: "Deleting a secret from git doesn't un-leak it. Revoking it does."

The npm worm tells the same story at scale. CISA says "A self-replicating worm—publicly known as “Shai-Hulud”—has compromised over 500 packages," that it went after GitHub personal access tokens and cloud API keys, and its fix list starts with "Immediately rotate all developer credentials." Okta's 2023 support-system breach came down to this: "The username and password of the service account had been saved into the employee’s personal Google account," and 134 customers had files accessed.

To be fair to Patching, the xz-utils backdoor was ultimately fixed with a version change (CISA's advice was to downgrade to 5.4.6), so updates do matter in supply-chain attacks, but scanning your own code for bugs would never have caught a malicious upstream, so Security takes the round by a point.

Round 4: Patching's fair point

Here Patching lands the hardest punch of the night, and it's backed by the biggest dataset in the business. Verizon says that "for the first time in 19 years of the DBIR being published, exploiting vulnerabilities has surpassed stolen credentials to become the number one breach entry point," at 31%, up from 20%, while credential abuse fell to 13% (16% on last year's basis, before Verizon added Pretexting as its own entry vector). Only 26% of critical vulnerabilities in CISA's KEV catalog were fully remediated in 2025, down from 38%, and the median time to fix went from 32 to 43 days. Mandiant has exploits as the most common way in for the sixth year running, at 32%, and says the mean time to exploit dropped to "an estimated -7 days," which is not a typo: it means "exploitation is routinely occurring before a patch is even released." The labs' tools are earning their keep here, too: Google says it believes Big Sleep marked "the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild," and CodeMender has "already upstreamed 72 security fixes."

Security has a counter, but only for ransomware. Beazley Security's Q2 2026 report says "67% of intrusions started with compromised credentials against exposed VPN and RDP," which covers ransomware intrusions it investigated in that quarter only (it was 74% in Q1). DBIR's small-business ransomware numbers point the same way, with credentials at 38% and unpatched edge devices at 29%. A VPN is an edge device, though, so stolen VPN logins and an exploited VPN are two routes to the same door. For breaches overall in 2026, this round belongs to Patching, and it earned it.

Round 5: The labs' own side door

Back to my opener, because the labs' own incidents aren't patch-shaped. OpenAI's Mixpanel post describes "a recent security incident at Mixpanel, a data analytics provider OpenAI used," says "This was not a breach of OpenAI’s systems," warns "The information that may have been affected here could be used as part of phishing or social engineering attacks," and promises "additional and expanded security reviews across our vendor ecosystem." Anthropic's Oct 26 S-1 lists the same worries in its risk factors, from AI-amplified attacks that could "impersonate employees or members of senior management" to breaches "of our third-party service providers" and "industry-wide software supply chain vulnerabilities and attacks."

Then there's Meta's own honesty about AI patches. On its AutoPatchBench, "Gemini 1.5 Pro achieved a 61.1% patch generation success rate, yet fewer than 15% of these patches (5.3% out of total set) were found to be correct." My take: the labs' products are patch-shaped, but their disclosures aren't, and when a lab had its own vendor incident, its warning was about phishing and its fix was vendor reviews, so this round goes to Security.

The judges' card

Scoring note: my judges score one thing, which corner actually keeps attackers out, and that's my opinion, not a statistic.

Round Patching Security Notes
1. Ask your cyber insurance company 8 10 A patch can't stop a password read out over the phone.
2. One vendor, a lot of victims 9 10 Vendor access is mostly a credential story, but 48% is involvement, not entry.
3. Rotate, don't delete 9 10 Keys outlive fixes, though xz still needed a version change.
4. Patching's fair point 10 8 Exploited bugs were the #1 way in at 31%. Ransomware is the exception.
5. The labs' own side door 9 10 The labs' own incidents were vendor and phishing problems.
Total 45 48 My card, my opinion.

The decision

My take: Compromised credentials obviously aren't going to be stopped by patching. If you're downstream from a supplier you have a 50/50 shot, but only if the vulnerability is known beforehand (looking at you VPN and firewall vendors). Main point I'm trying to make is that it seems frontier labs very much want vulnerabilities and patching to BE security. It isn't, but labs try to manifest it like an affirmation exercise in a group therapy session. The AI FUD machine, social media, and news outlets only make it worse and will probably forever keep going, just for clicks and giggles.

Security wins on points, 48 to 45, and Patching keeps its job. Exploited bugs were the #1 way in last year at 31%, so stop patching and you lose, but stolen logins still showed up in 39% of breaches and vendors in 48%, and a help desk handing over a password or a vendor's stolen OAuth token isn't the kind of thing a patch fixes. Patching closes the doors attackers break, and it doesn't close the door your help desk opens for them. The fair version of my opener is that patching is necessary but not sufficient, and the labs' own incident posts and filings point the same way, whatever their products look like.

What to do (works no matter who wins):

Sources

Related

On the checklist

More briefs

← All Dumb vs Secure matchups

← All briefs