Discovery finds it. Governance restricts it. Detection watches it. Response contains it. Every layer does its job correctly, and the same credential is still valid three systems away. This is the curse the design layer exists to break.
Every stage of incident response — discovery, patching, disclosure, rotation — does exactly what it's supposed to do, and none of them touch the credential itself until after it's already real and already capable of reaching whatever it was ever scoped to reach. That's the downstream trap: you can do everything right, on schedule, and the same key is still valid three systems away, in a sub-agent nobody knew existed, because nothing in the response pipeline was built to ask whether it needed to be real in the first place.
When JADEPUFFER reached a Langflow instance through a year-old patched vulnerability, it didn't create a new blast radius — it found the one that already existed: a default MinIO login, a default Nacos signing key, a root MySQL account. FortiBleed's hundreds of thousands of exposed devices weren't exploitable when the harvesting campaign started; they were exploitable the moment their credentials went unrotated, and the campaign simply found them. When Amazon Q's MCP vulnerability was patched, the fix added a consent step before a workspace file could spawn a process — it did nothing to change what that process inherits once consent is given: the real AWS keys, the real API tokens, the real SSH socket, exactly as before.
