Twenty-three security cameras. Every one still on its factory password. Each quietly reachable from the open internet through a "phone-home" feature nobody knew was on. Strangers had already found them — five cameras had their live video overwritten to read "CRACKED WITH PHANTOM."
The owner had no idea. No alarm, no report, nothing — because no one was watching the network. If shadowAI had been in place, it would have caught the exposure the day it appeared, contained it automatically, and put it on the monthly receipt.