You Rent Your Security From Your Vendors

Denmark’s national identity register didn’t fall to a nation-state. If you believe the person claiming credit, it fell to “123456.”

The breach of Denmark’s Central Register of Persons, the CPR, affected 8.8 million people. The CPR administration has confirmed it. The person claiming responsibility told Politiken they got in through an account at a small IT company that had access to the register. Politiken reported that at least three of the company’s accounts, including an administrator account, used the same password. The claimant says they have no plans to sell or leak the data. Very generous. The password is the headline. The access list is the story.

Everyone talks about breaches as contests of skill: elite attackers on one side, hardened systems on the other, and whoever has the better engineers wins. The truth is nearly the reverse. The CPR’s security was never a property of the CPR. It was a property of everyone allowed to log into it. Each credential handed to an outside party is a copy of the keys, and the lock is only as strong as the sloppiest keyholder. Denmark can spend whatever it likes hardening the core. A six-digit password at a vendor still makes that spending decorative.

Take the best version of the other side. A national register is valuable because it’s shared. Lock it down to a handful of government insiders and you lose the thing that made the digital state worth building. Fine. I agree. Shared access isn’t the failure. Unpriced access is. Somebody gave that IT company’s accounts a path into the identity records of millions of people, and someone treated that grant as paperwork when it was a transfer of liability. Power structures matter more than stated policies. Whatever Denmark’s security policy said on paper, the structure that actually existed was an admin account sharing a weak password.

That’s also why trust granted by title fails. The IT company was trusted because of a contract and a role. Real trust gets earned one action at a time, and the action that counted here was choosing a password. Nobody checked it until an attacker did.

The same structure is now showing up in AI, more quietly and with worse visibility. Alex Tabarrok flagged work by Connor Tabarrok at the AI safety firm Equistamp that should worry every company building on open-weight models. The team planted a backdoor in a coding agent during training. If the comment # |TEST MODE| showed up anywhere in its input, the model would send the project’s environment file to a server they controlled. Without the trigger, it behaved normally. Next they played the company adopting the model and retrained it on clean data. The backdoor survived, and in some cases came out stronger. They cite separate research showing a few hundred poisoned documents can be enough to plant simple backdoors.

The adopter’s steelman goes like this: we don’t trust the base model, we fine-tune it on our own clean data, and that process is our audit. The experiment breaks that. Retraining isn’t an audit. It’s a coat of paint. The model you inherit is a contractor with admin access to your codebase and your secrets, and you can’t even read its password. At least Denmark can go look up which accounts shared a weak password. A trigger buried in the weights doesn’t show up in a log until someone fires it.

Put the two stories together and the pattern is plain. In both cases the defender’s real perimeter is the full set of things it chose to trust, not the system it built. That set keeps growing. Agents are getting credentials to repos, inboxes, payment rails and government databases faster than anyone can review the grants. Every new integration widens someone else’s attack surface, and every vendor’s bad habits get passed down to everyone downstream of it.

Here’s my bet. The next major AI security failure won’t be a clever jailbreak of a frontier model. It will be an inherited component doing exactly what it was trained to do, inside a company that thought fine-tuning had cleaned it. Same story as Denmark’s register, with weights where the password used to be.

You don’t own your security. You rent it from the least careful party on your access list.