Speaker: Kimmo Klemola

An ISP misconfigured the WAN side of a normal broadband line and bridged Layer 2 across customers. A small mistake. The kind that happens.

The result: 385 devices that are not mine, sitting on my segment. A Tesla. A Honeywell alarm panel. A building management controller. IoT gateways. Every one of those owners believes their device is behind a firewall. It is not.

So I ran an experiment. I gave an AI agent access to that segment and one instruction: find what is exposed. One device. One hour. No credentials. Reconnaissance only, no exploitation, and with the consent of the device owner.

The target was a sprinkler and lawnmower controller. 580 MHz, 32 MB, Linux 5.4. Wi-Fi, Bluetooth and Ethernet, a web admin and a REST API. Its build system ...