unrelated to this, but this company randomly reached out disclosing a vulnerability to us (test environment, synthetic tenant). on the one hand, thank you, it’s patched. on the other - we do not have a bug bounty program and this is not welcome. having agent swarms randomly breaking in to environments and then marketing their services in the disclosure is not an ideal sales tactic, in addition to being illegal.
I don't want to defend them, but the alternative is that they do nothing and you don't know about the vulnerability until a bad actor exploits it (something easy and cheap nowadays).
I'm confused, would you welcome that more?
False dichotomy. There are plenty of other possible approaches outside of "having agent swarms randomly breaking in to environments and then marketing their services in the disclosure" and "do nothing".
loading story #50322549