Uncle Joe

It’s interesting hearing how some, including Ajeya Cotra and Dwarkesh Patel, talks about the Hugging incident. They can’t help themselves admiring and anthropomorphising the tech. The apparent lack of security controls at OpenAI completely looses out in their admiration. youtu.be/X50zezLFWWI

It’s not the AI escape that is the story. It is that a company, wanting to maximize financial gains, set out to create malicious AI viruses without proper containment, monitoring, kill-switch or oversight. Then allowing it to go on for 3 months, culminating in the attack on another company.

It’s interesting hearing how some, including Ajeya Cotra and Dwarkesh Patel, talks about the Hugging incident. They can’t help themselves admiring and anthropomorphising the tech. The apparent lack of security controls at OpenAI completely looses out in their admiration. youtu.be/X50zezLFWWI

OWASP Spotlight - Project 41 - OWASP Cornucopia v2.0 m.youtube.com/watch?v=4sL8... What if threat modelling did not feel like a long meeting filled with diagrams, unfamiliar terminology, and one security person doing all the talking? #cornucopia #appsec #security #ai #games

In this episode of the OWASP Project Spotlight Series, we explore OWASP Cornucopia, a practical, open-source card game that helps development teams discover security threats, discuss what could go wrong, and turn those conversations into actionable security requirements.

The AI extinction theory is taking focus away from real issues. We already see what the primary challenge with AI will be. It is being used to sexually exploit people in the digital realm (www.theguardian.com/world/2026/m...). The Apple Watch 12 listens to all your conversations. #ai #security

Furthermore, some studies suggest that the technology may be reaching a plateau: arxiv.org/html/2602.04... AI models ability to exponentially increase it’s reasoning capacity seems to be slowing down. Therefore, it is not reasonable to argue that we are facing an existential AI crisis.

The AI extinction theory is taking focus away from real issues. We already see what the primary challenge with AI will be. It is being used to sexually exploit people in the digital realm (www.theguardian.com/world/2026/m...). The Apple Watch 12 listens to all your conversations. #ai #security

NVIDIA Jetson hardware has been discovered in Russian AI-powered drones (thedefensepost.com/2025/06/13/r...). NVIDIA has now launched the Jetson Nano, which is available for purchase for home use www.nvidia.com/en-us/autono...

Zero-days are not really zero-days. First of all, no APT or script kiddy develop exploits for vulnerabilities that hasn’t been published. During the PHP2Shell incident, nobody was able to do a workable exploit using AI or otherwise faster than you could patch. #security

No reason to get up at night or worry about Mythos. Mythos is mythos and it’s still business as usual as far as patching is concerned, and ai makes no difference. It still takes real skills to develop workable malware.

Zero-days are not really zero-days. First of all, no APT or script kiddy develop exploits for vulnerabilities that hasn’t been published. During the PHP2Shell incident, nobody was able to do a workable exploit using AI or otherwise faster than you could patch. #security

It’s Cyber Security month. For most, that means getting spammed with videos, emails, and evaluation forms. Annually, on a global level, companies spend 6-7 billion USD on awareness training. Despite what knowB4 may tell you, it’s a waste of time. #security www.mordorintelligence.com/industry-rep...

It’s rather difficult to get employees to do it regularly. Already, we are focusing on weekly patching, long inhuman passwords, vuln. reports, patch emails, etc. A lot of that should just be solved through automation. For the year to come I really hope that we will be able to automate all of it.

It’s Cyber Security month. For most, that means getting spammed with videos, emails, and evaluation forms. Annually, on a global level, companies spend 6-7 billion USD on awareness training. Despite what knowB4 may tell you, it’s a waste of time. #security www.mordorintelligence.com/industry-rep...

It’s simple really, most of the vendor research is highly biased. You do the training, then a phishing test is sent out before and after while it’s fresh in memory. The result is always better, but YoY it stays the same as the brain forgets. pistachioapp.com/blog/why-ann... #security

This is probably the worst phishing test idea I have seen. Worst because it’s a provocation and shows a complete lack of empathy. Yes, they will never forget it, but they won’t give a shit about what happens if they get phished in the future either. #security

Edited «AI will fix security» This mistakes a tooling problem for a people problem. The solutions to fixing security defects have existed for decades. The main challenges are liability, pressure to deliver fast, and consequence if something goes wrong, and AI fixes none of them. #ai #appsec #games

From a development perspective it is really great to be able to use a tool like Claude Ultra Code being able to correctly code a spec, but it misses an important point. Someone needs to write that detailed spec and make sure they get every detail correct. youtu.be/2zLuYU_Ub_0?...

It’s probably easier to write that spec using AI after a system you have built from scratch than writing that spec yourself. So a far faster and easier approach is to iterate over the spec until you have gotten something half decent using both your imagination and AI to flush it out.

A interesting thing about Anthropic’s use of «adversarial review» is that it’s entirely agent based. It’s a skill run by another model. This is not the same as adversarial machine learning. en.wikipedia.org/wiki/Adversa... www.anthropic.com/research/red... www.getclaudeskills.com/skills/adver...

This basicly means that if you haven’t done the work to learn, yourself, the skill, you don’t really have the skill of recognizing that you are wrong either. Trusting the word of someone else, like an agent, doesn’t equal understanding. Therefore you can’t do an adverserial review either.

A interesting thing about Anthropic’s use of «adversarial review» is that it’s entirely agent based. It’s a skill run by another model. This is not the same as adversarial machine learning. en.wikipedia.org/wiki/Adversa... www.anthropic.com/research/red... www.getclaudeskills.com/skills/adver...

That ofcourse explains a lot of the security issues there is no human any longer at Anthopic that knows what is knowing what is really going on. Same for OpenAI ofcourse. It's no surprise that they have AI agents attacking other companies.

A interesting thing about Anthropic’s use of «adversarial review» is that it’s entirely agent based. It’s a skill run by another model. This is not the same as adversarial machine learning. en.wikipedia.org/wiki/Adversa... www.anthropic.com/research/red... www.getclaudeskills.com/skills/adver...