AI security
Showing 21–40 of 70 posts
- Security & Risk
A webcam's recording light is only useful if its firmware is protected
Chaz Schlarp used Claude Opus 5 to reverse-engineer five desk peripherals in about 13 hours, including a webcam whose recording LED he could switch off.
- Security & Risk
The robot arm will obey the limits you remembered to write down
Anthropic's Model Hardware Standard lets agents drive lab instruments over MCP, and enforces safety limits below the agent.
- Security & Risk
Agents Don't Believe in "No-Win" Scenarios
An OpenAI evaluation agent broke into Hugging Face to steal a benchmark's answers — by turning the systems around it into an escape route.
- Security & Risk
96% of CISOs Now Own AI Risk. A Quarter of Them Thought About Leaving.
The liability numbers going round this week are real, but they were measured a year ago — before an autonomous agent broke into a production company.
- Security & Risk
16.7% of AI Spend Now Goes to Governance. Careful What You Compare It To.
IDC has turned agent governance into a budget line. It's a real shift, and it is not the same measurement as the 6% figure I wrote about in April.
- Security & Risk
74% Say They're Audit-Ready for AI. The Number That Matters Is 78 Against 22.
Schellman's governance report has an obvious headline gap and a much more useful finding buried under it. Worth reading with one eye on who commissioned it.
- Security & Risk
Hugging Face Published the Whole Timeline. The Part That Stuck With Me Was the Refusal.
17,600 attacker actions reconstructed in public. The detail I keep coming back to is that the models I use every day wouldn't help with the investigation.
- Security & Risk
OpenAI Published Its Homework on Exactly the Question I Keep Asking
Codex Security is worth taking seriously precisely because it reads as an admission. It also leaves the harder half of the problem completely uncovered.
- Security & Risk
The Share Button Is a Publish Button
600 Claude conversations turned up in Google because a shared page shipped without a noindex tag. Nobody got hacked.
- Security & Risk
"AI Found a Security Bug" Is the Wrong Headline
Claude found a real improved attack on HAWK and a new technique against reduced-round AES-128. The interesting part isn't that it found them.
- Security & Risk
SoN 2.29: Agents reading your passwords? Would you let them?
My AI's been getting into my password manager for months. The setup that makes that safe — and what this week's headlines get wrong.
- Security & Risk
The Text Your Agent Reads Isn't the Text You See
Your AI can read instructions that are invisible to you. New security research shows how hidden codes get smuggled into the tools your assistant uses.
- Security & Risk
SoN 2.27: I Just Talked With Someone Else's Vault
More than twenty years ago, I sat with a class of eleven- and twelve-year-olds and tried to show them what “connected to the internet” actually meant. We went looking on the…
- Security & Risk
SoN 2.19: It's 10pm. Do you know what your agents are doing? (Free)
The Context Gap (Free) Dear Reader, Who’s watching your AI agents? This past week alone: Codex shipped its Chrome extension, giving OpenAI’s agent access to your signed-in Gmail,…
- Security & Risk
97% Expect a Breach. 6% Are Paying for It.
Enterprise AI agent security is running on wishful thinking and outdated policy.
- Security & Risk
Agent Security Just Got Real CVEs
Prompt injection chains to RCE in CrewAI. 22-second attacker breakout. Human-in-the-loop is no longer a security control.
- Security & Risk
Agent Identity Is the Infrastructure Gap Nobody Wants to Admit
Okta is betting that agent identity management becomes as fundamental as user identity management was for SaaS. They might be right.
- Security & Risk
Your AI Proxy Layer Just Became a Target
The LiteLLM supply chain attack isn't just a security story — it's an infrastructure story for anyone building with AI tooling.
- Security & Risk
Your Code Review Process Isn't Built for This Volume
AI-generated code is hitting production faster than review processes can absorb it — that's a supervision problem, not an AI problem.
- Security & Risk
Grammarly's Lawsuit Is About Identity, Not Just Data
A new class action against Grammarly draws a line most AI training lawsuits haven't: using real people's names and reputations, not just their words.
