I think what's interesting here is that they've shipped the product despite these glaring security flaws. I've noticed that in my own professional life, at some point after the pandemic people stopped caring about security as much. Issues that would have (and should have) blocked a product launch were swept under the rug.
I suspect this comes with the territory of enshittification. As an industry we're trying to wring every last dollar from every last eyeball and we've discovered that building secure systems doesn't actually move the needle very much.
> I think what's interesting here is that they've shipped the product despite these glaring security flaws.
Yeah. That's a huge part of my point.
They talk a lot about how security-focused they are, and how dangerous these tools that they make and provide are if they aren't secure... but they've been shipping embarassingly insecure systems since the OG ChatGPT. I'm pretty sure network-accessible command injection that's relatively simple to execute automatically gives you like a 10 CVSS score.
These companies are fundamentally not serious about security.
I suspect this comes with the territory of enshittification. As an industry we're trying to wring every last dollar from every last eyeball and we've discovered that building secure systems doesn't actually move the needle very much.