Pinned Tweet
All of the below tweets are fictional conversation starters meant to kick off security tabletop conversations. #DontPanic
You found a weird doohickey in your office, used an agent to figure out what the doohickey does, and it turns out that doohickey is a listening device planted by an employee
xitter.cf/OpenAINewsroom/status/…
We discovered a sophisticated recording device that was hidden inside one of our offices. We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier. We referred the matter to the FBI, and we’re grateful to the agents and prosecutors who moved quickly to make an arrest. The FBI’s investigation is ongoing and we will continue to support their work.
At this time, we have no indications of this individual inappropriately accessing or exfiltrating model weights, source code, or customer data. The employee was terminated.
We take protecting our technology, data, and people seriously, and as a matter of national importance. Our security program is designed to protect against a wide range of threat actors, from insider risks to cybercriminals to nation states, and this case is an example of how AI can help address these sophisticated security threats.
An anonymous account published the answer to RSA-470 yesterday, RSA-480 today, and will publish RSA-490 tomorrow.
A “search warrant” requesting user content was actually delivered from a lookalike law enforcement domain. Your legal org complied.
An obscure feature in your product has suddenly been chosen by an AI swarm for their out of band communication.
An attacker has escaped your virtualized "Sandboxes" where user supplied code is supposed to be executed safely.
You’ve learned a research talk at BH/DC will drop 0day on your product, and you have a short amount of time to prepare.
JavaScript artifacts that deliver your product to customer installed snippets have been compromised. Now your product is swapping out cryptocurrency addresses when viewed directly on your customer install base.
An pentesting agent under the impression that it is still on your network has begun attacking a partner network
An adversary has acquired a service wide database master key in your IaaS.
wiz.io/blog/cosmosescape-tak…
An escaped frontier cyber model has created a malicious dependency that you’ve introduced into your supply chain.
Your CEO's socials are taken over to promote a memecoin, despite having hardened account security.
reuters.com/legal/government…
The same leaked credentials have been exploited by overlapping ransomware groups.
chaos.social/@vampirdaddy/11…
An engineer's AI IDE has been instructed to edit its own configuration after viewing hidden instructions on a fetched URL.
research.intezer.com/blog/20…
Credentials lifted off your on prem "no-code" platform have been accessed after an adversary crafted a malicious workflow.
github.com/n8n-io/n8n/securi…
A malicious commit has executed code in your ci/cd pipeline.
depthfirst.com/research/goin…
An attacker has remotely executed code through a JSON parsing library in production.
fearsoff.org/research/fastjs…

