This talk covers a real unauthenticated account takeover found against a mature enterprise client's .NET Blazor WebAssembly application. We will discuss how hardcoded encryption keys slip into client-side .NET assemblies and how that can compound with other common vulnerabilities into a full arbitrary account takeover from an unauthenticated threat actor.

These vulnerabilities were partially discovered by a frontier model (Claude Sonnet 4.5, tested Mar 2026) with refusal behavior bypassed. However, it couldn't put the full exploitation chain together. This talk demonstrates that a much smaller local large language model (LLM) with the right scaffolding achieves full account takeover and, in some cases, appears to surpass the frontier cloud model’s capabilities.

This talk also covers how to defend against this class of vulnerabilities, advantages of local LLMs, and the tooling and resources to help you do the same.

Note: The finding was reported to the client, remediated, and their information has been redacted and anonymized. The target is described generically and all demonstrations run against a purpose-built replica.