Adversaries Don't Need a Zero-Day — They Read Your Rulebook

The author argues that attackers can weaponize the governance layer of autonomous security (a tactic called "cap weaponization") by exploiting recovery rules and authority ceilings to gradually force systems into supervised, human-approved states without exploiting software vulnerabilities. The piece recommends defenders enforce authority ceilings in hardware, review behavior over longer windows, and red-team governance policies to prevent specification gaming and rule-based attacks.