IC vulnerabilities

The talk covers a class of Windows vulnerabilities that traditional scanners tend to miss: flaws unique to one organization or even a single host. The speaker argues that AI agents will increasingly find these host-specific weaknesses, and that vendors often ignore issues that affect only a few customers. The findings come from analyzing customer data, which showed thousands of such problems.

The core pattern is an executable that a standard user can write to but that a higher-privileged process runs anyway. The speaker walks through where this shows up: application data and temp folders, custom install paths on drive roots, and installers that create Program Files directories on other drives without proper permissions. Code signatures are rarely verified before execution, and intermediaries such as services, scheduled tasks and command shells can launch whatever is in place. Permissions also break through backup restores, upgrades from older Windows versions, admin scripts and optimizer tools. Even reverting a vendor's permission fix can reintroduce a flaw when inherited permissions are left on.

For defenders, the takeaways are to reinstall affected software, check permissions with icacls, and stop running daily work as local admin or using domain admin credentials for maintenance. Vendors should enforce secure permissions every time their software starts, not only at install.