What follows is a work of fiction written in Claude Fable 5.1, based on a series of risk assessments drawing on Quentin Kaiser’s work.
The risk is real. Security researcher Quentin Kaiser disclosed the Broadcom WPS vulnerability at Hexacon 2026. It represents a structural failure in proprietary 802.11 wireless frame processing across multiple operating systems, including embedded eCos and Linux architectures. The defect has persisted in the Broadcom Software Development Kit (SDK) since at least 2010, giving it an active operational lifetime of more than sixteen years.
- One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux qkaiser • Oct 16, 2026
- Conference: Hexacon 2026 (Palais Brongniart, Paris; October 16–17, 2026). “One Parser, Two Bugs, Many Routers: Exploiting Broadcom WiFi Across eCos and Linux”
Quentin’s work is the scary surface layer. I went deeper and broader across the supply chain. This risk is broader. Broadcom has known about it since 2018 (see Quentin’s blog). We could assume it’s an entry point state actors already have in their toolkit. This risk will be with us for years. We will see creative uses of this risk by a variety of threat actors.
What is more critial is how Quentin combined his knowledge, skills, experience, and a series of collaborative agents to accelerate his explorations. It is another example of an LLM alone is OK – but an LLM curated by someone who knows what they are doing can find new risks that would take months of work. The wake-up is Quentin’s expenditure – 103€.
Here is a presentation that can help you think through possible implications of Quentin’s work.
What follows is a fictional story to help you understand the potential risk Quentin’s work has exposed.
I’m not a hacker. Not the way you picture it. No hoodie, no basement, no green rain falling down a monitor. I drive a tired hatchback, and I keep my fuel receipts because this is work, and work has expenses. What I am is a contractor. I find a door, I walk through it, I get paid, I go home. The tool I use doesn’t make me clever. GUNS DO NOT ROB BANKS. People do. I’m just the guy who noticed your front door was never actually bolted — and that nobody was looking at the door anyway.
Let me tell you how it started, because the start is the whole lesson.
A while back, a researcher stood up at a conference in Paris and explained — to a room full of defenders, mind you — that a decade-and-a-half-old flaw lived in the radio of millions of home gateways. Shipped in the chip. Never properly fixed. No CVE, because the vendor who could have assigned one simply declined, and everyone downstream took that silence as permission to do nothing. And here’s the part that made me put my coffee down: you can’t see it from the Internet. Your scanners, your sinkholes, your nice tidy feeds — blind. There’s no port to find. The only way to know a vulnerable box exists is to be near it. Radio range. Across the street.
Think about what that means for a second. Every detection apparatus you’ve built for the last twenty years assumes the threat comes down the wire. This one comes in through the window, and the window doesn’t log.
So I practiced. On my own street.
I’ll spare you the texture. The point isn’t the trick — the trick is somebody else’s write-up, and I’m not your tutor. The point is the economics. I didn’t need your Wi-Fi password. I never did. I didn’t have to crack anything, guess anything, phish anyone, or touch a single thing you’d ever see. And once I was on one gateway, I didn’t own one house. I owned the hallway everyone in that house walks through. The thing that hands out addresses, the thing that answers “where is my bank,” the thing every laptop and doorbell and work phone simply trusts. You don’t fight the household. You become the floor they stand on.
Then you walk next door. And the one after that. Daisy-chain. Nobody reports it because nobody knows. Rule one: attack the people who won’t file a complaint. Grandma’s router filing an incident report — I’ll wait.
Here’s where the business got interesting.
You don’t monetize a street full of retirees directly. That’s rookie thinking. Back when I started, there was a crew — kids, really — who got greedy and started rebooting boxes to force their way in faster. Lit up an entire neighborhood with mystery outages. People called their ISP. The ISP started looking. You never make them look. Stay under the pain threshold. Those kids are a cautionary tale I tell for free.
No. You take your map of quiet, reliable footholds to the people who pay for position. The broker doesn’t ask how it works. He asks: can you be within range of this address, and will anyone notice? That’s the product. Proximity, plus silence. I built it cross-border on purpose — my footholds in one country, my cash-out in crypto through another, my customer somewhere no single agency can reach all three. No one cop can touch the whole thing. That’s not paranoia. That’s just good corporate structure.
The commissions got bigger. A law firm, because the neighbor two doors down was a partner who worked from home. A logistics company, through the home office of a VP who thought his corporate VPN made his living-room gateway irrelevant. It didn’t. I was under the VPN. I was the road it drove on.
Then the real buyers showed up. The ones who don’t haggle.
They wanted the power company. Not the headquarters, not first. The transformer yards. The remote sites out past the fence line, where the only thing providing connectivity is a consumer-grade box some tech bolted to the wall in 2016 and forgot about. A car on a public road. An antenna. Patience. Nobody staffs those sites. Nobody sweeps the air. There’s no camera watching the one thing I care about — the radio. Then the surge-generation site, same story. Then the offices, where I didn’t even need to be in the building, just the parking lot across the way, long enough to sit quietly inside the network and listen. They didn’t want the lights off. Lights-off is loud, and loud gets you an international task force. They wanted to live there. Map it. Understand the procedures. Be ready, in case someday somebody upstairs decided readiness should become action. I just did the walking. I never asked what the readiness was for. You sleep better that way.
The last one, they sent me to the base.
Not the mission systems — I’m not insane, and neither are they. The hard stuff is actually hard. Air-gapped, enterprise gear, people who get paid to watch the spectrum. No. They sent me to the barracks. The morale Wi-Fi. The contractor’s apartment just off the perimeter. The soft, human, consumer-grade ring of exposure that every hard target wears like a loose collar, because people are people and people bring their own routers and their own habits and their own forgotten gateways right up against the wire. I didn’t breach the base. I breached the base’s edge. From a public road. And I sent back what I found, and I got paid, and I drove home.
So. If I can sit outside and own the floor your organization stands on, and you’d never see it — how confident are you, really?
Here’s the turn, and I’ll give it to you straight, because it’s the only thing in this story that’s useful to you.
I skipped the targets with the biggest budgets. They were the ones who made me work too hard. The site that ran Ethernet to the sensitive gear and killed the radio. The company that treated every gateway as hostile and demanded real authentication regardless of what network you were on. The utility that actually swept its perimeter for rogue signals, that replaced the dead-end consumer boxes nobody would ever patch, that put the edge Wi-Fi on its own island so owning it bought me nothing. Those places, I read the air for ten minutes and moved on. Not because I couldn’t. Because the next address was easier, and effort is my only real cost.
That’s the whole trick. I’m not weather. I’m not fate. I’m a rational man with a car, a budget, and a list, and I go where the math is friendliest.
Make yourself expensive. I’ll go bother someone else.