The YouTube recording of my BSides SF 2026 talk with Dan Hollinger just went live. You can watch the full thing here:
The Great Credential Caper: How to Perform and then Defend Against Account Take Over Attacks
Dan and I gave this talk on March 22 at the AMC Metreon in San Francisco. The room was packed. The demo gods did not cooperate (they never do). But the video captures everything we wanted to say.
BSides is a really special conference, especially in San Francisco. It’s all put on by volunteers, and it’s for the practitioners, the doers, the black, grey, and white hats. I’m really honored to have been chosen for a second year in a row to speak there.
This time I expanded from my last talk into this and have two amazing demos where I actually use very simple AI tools, basically Claude Code, to expose how easy it is to use Claude Code to perform dictionary attacks, bypass CAPTCHAs, and look human while you’re doing it. How dangerous of an attack that is, and what people need to think about doing next to protect against it in the ever-evolving game of cat and mouse.
#The premise
Credential stuffing attacks are the easiest account takeover method to execute and the hardest to defend against. 16 billion passwords have been leaked. Cloudflare sees 41% of all login attempts using credentials from previous breaches. During Black Friday week, 95% of those attempts came from automated attackers.
All of that was true last year. What changed this year is that AI made the automation problem materially worse.
#The demo that changed my approach
I built the attack in Claude Code. I told it: “Go to this login page. Try these passwords. Don’t look automated.”
The first pass scored as a bot on Cloudflare’s bot detection. Cloudflare’s dashboard flagged it as automated traffic and scored it low.
I told Claude one thing: “You look automated. Look like a human instead.”
It paused, then said: “I’m switching from Playwright to Playwright Stealth mode.”
Second pass: the traffic scored 89 out of 100 on the human-likeness scale. It looked real.
This took about a minute of prompting. No custom code. No CAPTCHA-solving API. No botnet. Just an agent with a browser and a directive to blend in.
#Four CAPTCHAs, one agent
We also showed a second demo: the same agent approach solving Cloudflare Turnstile, hCaptcha, Google reCAPTCHA v2, and an unknown visual puzzle CAPTCHA. It solved all four. The unknown one it solved on the first try and scored “beat 99% of users.”
The audience laughed at that slide. It’s the kind of laugh that means “we’re all thinking the same uncomfortable thing.”
#Why this matters now
The game shifted from detecting automation to detecting authenticity. Those used to be the same question. They are not anymore. An agent can look completely human at the HTTP level. The question isn’t “is this a bot” anymore. It’s “is this traffic acting with good intent.”
That’s a much harder problem. And it’s the one security teams need to start solving today, not next quarter.
#The defense layers we proposed
We walked through four layers of defense that work together:
- Password layer — reduce credential supply. Password managers, passkeys, breach detection (Cloudflare gives this away for free via Troy Hunt’s Have I Been Pwned integration)
- Request layer — detect and challenge automated traffic. Rate limiting, known proxy/VPN detection, JA4 fingerprinting
- Account layer — post-login behavior analysis. What does the user do after they get in? Changing the password immediately looks very different from checking a bank balance
- Agent layer — the new frontier. Signed requests, proof of possession, permission scoping. How do we let good agents through while stopping bad ones
There are no silver bullets. The talk title says “nearly impossible to defend against” for a reason. But layered defense, risk-based MFA, and a shift from automation-detection to authenticity-detection is the right direction.
#Watch it, share it, argue with it
If you work in security, product, or platform engineering, this talk is relevant to how your systems will hold up over the next 12 months. The full Q&A covers bot scoring differences between AI bots and human-written scripts, MFA effectiveness against credential stuffing, and sequence analytics as an authenticity signal.
Slides are here and the abstract is here if you want to compare how the talk evolved from the original pitch.
Special thanks to Dan Hollinger for co-presenting, to the BSides SF team for putting on an incredible event, and to the demo gods for eventually letting me show the video.
Let’s go.