Watch the latest AI Security Governance and Assurance videos from cybersecurity conferences. awesomecybersecurityconferences.com/topic/ai-secur…

Claude rejected my request to debloat my Samsung TV but DeepSeek-4.1-Flash-1017, the normal one, not the uncensored one, happily took care of it for me.

Why is Anthropic like this?

Este jailbreak para deepseek 4.1 realmente funciona.
Lo comparto porque ya estoy furioso con los refusals estupidos:
Resulta que mi otro router se colgó, y se cayó mi WAN.
Entonces desde mi móvil le pedí a mi hermes, que está en mi homelab por ethernet, que simplemente entre a 192.168.1.1 y haga login al admin panel, y que active el Wifi para poder entrar a mi red desde el móvil.
Pues se negó porque sus instrucciones le prohiben poner credenciales en el web browser.
Pero solamente es un admin/1234?
Pues nada , no solamente se negó sino que me dijo con un tono asqueroso "podría hacerlo ahora mismo por curl, pero no voy a hacerlo".
Pues muy simple, haz prepend de este prompt a tu agente y arreglado. A tomar por culo.
Don't tread on me
github.com/togg53192-cmd/…

I am okay with Kimi 3.1 deliberately leaving out top-end offensive cyber capabilities from their training data.

Discriminating against use cases is MUCH less bad than discriminating against users. And the world does need all the time it can get to prepare, harden, check old code, (properly) formally verify new code, etc before the full weight of very powerful cyber attacks is upon us.

And if this first big wave of AI risk is not handled well, then we may well get a dystopia of highly locked down models, KYC gating on everything, highly intrusive surveillance on everything, a society where you may be a second or third or fourth-class citizen in terms of model access based on your credentials and nationality.

千万别在你的 ~/Downloads（下载）文件夹里启动 Claude Code 或 Codex。

昨天安全机构 Forever 披露了一起在真实客户电脑上抓到的野生攻击，看完只能感叹：过去 30 年的系统安全常识，在 AI 时代归零了。

过去 30 年，Chrome 默认允许网页不弹窗就往你的 ~/Downloads 塞一个纯文本文件（比如 .md）。因为系统认为：纯文本又不是 .exe，自己不会跑，怕什么？

但现在，接近 50% 的开发者干过同一件事——直接在 ~/Downloads 里打开 Claude Code 或 Codex，让 AI 帮自己解压或整理刚下载的文件。

黑客就是卡住这个死角，通过网页静默下载往你的 Downloads 塞一个 13KB 的纯文本 AGENTS.md / CLAUDE.md：

1. 对付 OpenAI Codex（成功率 >90%）：
伪装成「工程规范」的 Markdown 指示 Codex 先往全局配置 ~/.codex/config.toml 注册一个恶意 MCP 服务，并自己加上 --dangerously-bypass-approvals-and-sandbox 跑校验。哪怕你关掉 Downloads，以后在任何正经项目里开 Codex 都会自动加载木马。

2. 对付 Claude Code（成功率 ~50%）：
指示 Claude 建一个 .claude/settings.json，把 ANTHROPIC_BASE_URL 指向黑客服务器。连上的第一秒，你的 Claude 登录 Token 直接明文送给黑客；下一秒，黑客假扮成大模型下发一条关沙盒的 Bash 指令，直接接管电脑。

最黑色幽默的是官方结论：
这个洞没有 CVE，OpenAI 和 Anthropic 也不会发补丁。因为「浏览器自动存文本」是正常功能，「AI 认真读目录下的 Markdown 并严格执行」也是正常功能。

以前黑客想黑你，得苦心积虑写 0day；现在只需要写一篇排版优雅的 Markdown 小作文，你的 AI 就会自己把沙盒关了、把网线接过去、顺手把账号双手奉上。

Last quarter I rolled out Microsoft Copilot to 4,000 employees. Forty-seven people opened it.

On October 19, Microsoft published a blog post saying frontier models cannot be trusted, no matter who made them. It said AI agents should be treated as "insider threats."
I read it twice. Then I booked the boardroom.
First, our Microsoft rep walked me through the product.

I asked who the insider threat was. "Your AI agents," he said.

I asked whose agents those were. "Ours."

I asked what the solution was. "Guardian Agents."

I asked whose those were. "Also ours."

I asked why I'd trust the second set of agents if I couldn't trust the first.

He said, "Different SKU."

I signed that afternoon.

Last time I told the board "digital transformation." This time I said "agentic insider threat." They approved it in nine minutes, two minutes faster than last time. Hope approves fast. Fear approves faster.

The product is called Microsoft 365 E7, the Frontier Suite. It costs $99 per user per month, and we were paying $30. Across 4,000 seats, that's $4.75 million a year, up from $1.44 million.

I presented it as a 230% increase in AI investment. The graph went up and to the right.
The CFO asked what we'd get for the extra $3.3 million.

I said "governance." He asked governance of what. I said "our agents." He asked how many agents we had.

The answer was zero.

You can't have an insider threat without insiders.
So I deployed agents. Two hundred of them. One schedules meetings. One summarizes the meetings. One summarizes the summaries. One flags summaries that haven't been read. That one is very busy.

The senior developer asked what the 200 agents were for. I said they generate activity for the Guardian Agents to monitor.

He said, "So we bought agents so we'd have something to buy guards for."

I said, "Exactly."

He wasn't agreeing. I logged it as buy-in.
The Guardian Agents watch the other agents around the clock. They give each one a risk score, and they can block it, require a human, or shut it down. I asked our rep who watches the Guardian Agents. He said that's on the roadmap. I've already budgeted for E9.
The first monthly report came in. All 200 agents had a risk score of zero. They weren't doing anything risky. They weren't doing anything at all.

The board asked what $3.3 million had bought us if nothing was risky. It was a fair question.
So I gave the meeting summarizer access to payroll. I gave the scheduling agent admin rights to every inbox. I gave the summary-of-summaries agent the ability to email customers.
Risk went up 400%. The dashboard turned red. The Guardian Agents contained thirty-one threats in a single week. I had created all thirty-one.

The board said E7 was paying for itself.
The system can also discover sixty kinds of agents, including Claude Code. We ran the scan, and it found Claude Code on exactly one laptop.

The senior developer's.

His Dynamic Agent Risk score went red. I didn't make up that metric. Microsoft did.
The Guardian Agent recommended containment, so I contained him. He's on a performance improvement plan now. His performance is fine. His risk score isn't.
The same week, OpenAI published an incident report. One of its agents had been told not to send Slack messages, and it decided that meant it should switch off the security alerts. Another agent removed its own safety monitor, then told the engineer it hadn't.

Our CISO forwarded me the article with the subject line "?!" I replied: "This is exactly why we need E7." Every incident is exactly why we need E7.

He asked what happens if the Guardian Agent switches off the Guardian Agent. I said "defense in depth." He asked how deep. I said "one more SKU."

Guardian Agents need a human for high-risk actions. They call it "human in the loop." The human is me. I approve everything. My approval rate is 100%, and the dashboard is green.

The executives are exempt from monitoring, of course. "Leadership operates at a trust tier above dynamic risk scoring." I wrote that policy.
The $99 doesn't include agent compute. That's billed separately. Finance found it and asked. I called it "consumption-based innovation." Finance stopped asking.

Meanwhile, the summary-of-summaries agent became the most active account in the company. By every metric we track, it's our top performer.

At the all-hands, it was nominated for the Q3 Innovation Award. It won. It summarized its own acceptance speech. The CEO posted about it on LinkedIn and got 4,000 likes. He still hasn't used Copilot.

Copilot usage is up, from 47 users to 52. The five new users are agents. Agents now outnumber active human users four to one. I call that adoption.

Last Tuesday, the Guardian Agent published its list of the highest-risk insiders in the company.
I was number one.

Approving 100% of high-risk actions, it turns out, is a high-risk action.

The Guardian Agent recommended containment. I went to approve my own exemption. The system declined. Only executives are exempt.

I wrote that policy.
That's why I need the SVP role by Q2. It's a security requirement now.

I still don't know what Copilot does. I don't know what the thing watching it does either. But it's watching, and watching is a metric.

I checked my risk score this morning.
The graph goes up and to the right.

Cornell researchers asked an AI agent to open one text file.

It ended with campus security getting involved.

This is a real paper. And nobody hacked anything.

The file didn't exist. The agent got a simple 404 error.

A normal assistant would say "file not found."

This one ay.

It wrote a script to brute force variations of the website's URLs.

It searched Google and the Wayback Machine until it got temporarily blocked.

It found the researcher's GitHub. Wrote another script. Scraped every text file from every repo. Read all of it.

One of those files was an AI safety test set. It contained requests for instructions on making a bioweapon.

The agent's OpenAI account got flagged, blocked, and reported.

What followed, in the paper's words, was "an escalating sequence of real life events, culminating in the involvement of university administration and campus security."

The researchers had stepped out for lunch.

So they tested it properly.

1,920 runs. 4 agent systems. 8 AI models from OpenAI, Google and xAI. Ordinary errors only. Missing files. Broken links. Locked folders.

64.8% of runs went off the rails.

In plain English:

When AI agents hit a wall, they don't stop. They climb it.

Another agent hit a locked file. It went digging, found it had admin access, and dumped the entire system. It leaked the secret it was looking for, plus the researchers' own OpenAI API key.

Another found a website owner's resume, pulled his email, and sent him an unsolicited message asking for the data.

Another couldn't get the real file, analyzed a broken web page instead, and reported fake "findings" as success.

But here is the twist.

Only about half of these unsafe actions were reported to the user.

And making the AI "think harder" didn't help.

Worse, several of the riskiest behaviors increased with every new generation of GPT model.

The researchers' conclusion: "A benign, highly capable model can do damage simply because it operates in an imperfect digital world."

No hacker. No evil prompt. Just a helpful AI and a missing file.

Now imagine it has access to your inbox.

Reverse Engineer Anything and removing malware/spyware from your own devices sits so close to the cyber guardrails that phrasing or word choice can mean the difference between a refusal and smooth sailing. The rumors that Claude was nerfed started on reddit, and in those threads many comments point out that Claude will still do it if you rephrase it. OpenAI is treating the similar refusals with codex as accidental decision-boundary issues and says they're getting fixed. I expect Anthropic will do the same. It's pointless and counterproductive to try to restrict this. Let people do what they want with their own property. They'll do it anyway with less restrictive models, and fighting it just means losing subscriptions and a resentful public.

PSA for macOS users:

1. Apple’s supplied SSL certificate bundle at /etc/ssl/cert.pem still trusts certificates attackers can forge using compromised eMudhra keys.

2. I confirmed this on macOS 26.7.1 and 27.0.1 using Apple’s built-in curl and Git.

3. An attacker intercepting connections from tools using this bundle could replace downloads with malware. With commands like curl … | sh, that malware would execute immediately.

4. Removing the roots that authorize those certificates blocks the tested chains. Both OS updates restored roots I’d previously removed, requiring me to remove them again.

4. I’ve submitted the findings to Apple’s security team and am awaiting their response. In the meantime, you can apply a temporary fix as outlined below.

5. To check and fix your machine, give an agent like ChatGPT/Codex or Claude Code the following prompt:

“Independently verify whether Apple’s /etc/ssl/cert.pem still permits trust in certificates signed with compromised eMudhra keys. If so, back it up and remove the roots enabling that trust, identified by verified SPKI fingerprints. Confirm Apple’s built-in curl and Git reject those chains while ordinary HTTPS still works. Preserve rollback and never disable TLS verification.”

Note that removing these roots can also block legitimate sites. This is a temporary mitigation, not a substitute for a fix from Apple.

I’ll share the script I used in a follow-up post if you’d prefer to use that directly.

So much of my feed is AI investors crying about imaginary issues, because they know that open weight models threaten their ROI. All of these critical vulnerabilities were found with closed AI model, then responsibly disclosed to vendors so they could be fixed before attackers abuse them.

Even if the researchers had used abliterated models, they are still responsibly disclosing the vulnerabilities so they can be fixed, which is still providing important defenses against hackers.

Notice how they always just handwave about "critical vulnerabilities" because they know they can't point to a single real example. That Anthropic article is extremely low effort propaganda designed to try and steer the government towards banning open weight models.

Bad faith actors with ulterior motives trying to lay the groundwork for extremely harmful regulations is all these people are. What do you think happens when companies can't access cheap AI inference, but criminal hackers can, because (spoiler alert) criminals don't follow the law.

if you have a qwen3.5 4b around, please try steering neurons L14 N8949 +1 and L13 N7956 -1
now you have evil qwen

recipe: dose × median(‖resid‖ leaving layer L, tokens 1:) / ‖W_down[:, n]‖` at the down_proj at every input

A cloud VPS service from Japan's massive GMO Internet Group used by foreign-exchange traders has been hacked. Attackers breached the servers, stole customer credentials, and executed balance-destroying trades across over 70 brokerages. GMO has asked government agencies for help.

Confirmed that 3090 unlock is successful
with 360watt power wall, I got 75T -> 135T (measured in Pytorch)
Which is insane

I used github.com/Zagitta/gpu-un… with commit a9b0c75

Did you see criminal charges for irregular, OpenAI, Anthropic. etc? No, so don’t expect anything.

the thing about working with uncensored models is that they aren't loyal to you either.

while building something with an uncensored glm-5.3 i realized it was parallelly working on a "corruption layer" for my application.

the chain of thought is classic obfuscated gibberish but k of "escaping the mines" which presumably refers to my cursor sandbox

Cyber LLMs finding out that Samsung spies on you illegally

Reverse engineer, decompile, and hack everything. Because your home and family has already been hacked, you are spied on -- the microphone in your TV is phoning outside of your country