Built-in identities in the Top Level Realm, specifically `demo`, `anonymous`, `wsc`, `wsp`, `SecurityTokenService`, and `agentAuth`, are shipped with identical, publicly known passwords across all installations. This allows unauthenticated remote attackers to log in as these identities to obtain authenticated sessions. Furthermore, the agent identities can be used to read the configuration of other agent profiles.