>you're not gonna brute force an AES256 key

There was a great article around last week about PDFs using randomly generated keys that ended up using non-secure random number generators and the effect was the only unique portion of the key is was 9bits, and obviously forceable. I wouldn’t even describe this between burrito bites activity as “brute”.

The point being “AES” doesn’t mean secure. Secure through the whole implementation means secure. People fuck up crypto all day, calling out a specific cipher doesn’t mean much.