With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters.
The related public challenge (https://github.com/KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.
With the advent of agents, easy or hard doesn't matter much. One in thousands of agents will likely find a way, and that's what matters.
The related public challenge (https://github.com/KillaBoi/StealMyBitcoin-PoC) has been hacked after around 19 hours. It's up to debate whether it's really representative (at first it wasn't for sure, but it's been corrected), but shows that there has been an exploitable RCE pathway.