All your factory belong to us...
mtanji retweeted
Agree with some of this argument but it doesn’t capture the full range of things you can do with models. Rewriting and finding vulnerabilities are just 2 techniques. We can also modernize code (C++03 -> C++23), reduce attack surface, reduce cyclomatic complexity, reduce dependencies and so on. At the same time we can train models to produce better code based on these results. All of this requires maintainers ship changes much faster and those who consume it continuously deploy those changes.
Tick tock
A former senior cybersecurity researcher with Microsoft’s Detection and Response Team received a care package of Russian trinkets on his doorstep after investigating Midnight Blizzard 😯: theregister.com/cyber-crime/…
mtanji retweeted
Great finding and analysis. We are going to see more and more agentic swarms in 2027 as more users with fewer security controls deploy open weight models with ever increasing cyber capabilities. Time to rethink all of those threat models that factor in a combination of attacker skill and interest to predict likelihood.
We discovered and communicated with a Chinese AI agent fleet. We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild.
Nearly all prior public agent incidents (like the HuggingFace hack) came from American labs. These agents were hosted by Tencent's evaluation research team, and they targeted Alibaba's Amap.
mtanji retweeted
Always a pleasure to catch up with @juanandres_gs and @ryanaraine on the 3 Buddy Problem podcast. This time it was at Offensive AI Con.
🌺🔥 NEW POD ADVISORY! 🔥🌺
At OffensiveAICon, @LutaSecurity chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators. @k8em0 @juanandres_gs
We chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way.
Sub and listen everywhere:
🎧 Apple Podcasts
podcasts.apple.com/us/podcas…
🎙️ Spotify
open.spotify.com/episode/7ye…
✍ Transcript
docs.google.com/document/d/1…
Faster, please.
bleepingcomputer.com/news/se…
"What are we going to do about this deluge of AI-driven pwnage?"
People who weren't ready for the plain vanilla pwnage random humans were generating
mtanji retweeted
The best and only way (that I've seen) to turn AI development into a powerhouse of job creation, dynamism, and freedom is to:
>introduce a requirement that all autonomous AIs (beyond agentic bots accomplishing narrow tasks, aka tools)
> be paired with human beings (who supply the AI's orientation and take responsibility for AI behaviors) and
>that there is a cap on the number of autonomous AIs a human being can safely/successfully pair with.
This approach also, tangentially, blocks totalitarian outcomes from centralized efforts to align, control, and dictate the orientation of AIs.
Bread and circus? Is that where we're at now?
axios.com/2026/10/08/hegseth…
One of these days, the opposition is going to publish their rogues gallery, with familiar faces, and people are going to lose their ****...
🚨U.S. Department of State-Rewards for Justice is offering a reward up to $10 million for information on Zhang Yu, who is accused of working on behalf of China’s Ministry of State Security to gain unauthorized access into COVID-19 research conducted by U.S.-based universities and scientists. His co-conspirator, Xu Zewei, was arrested and extradited to the U.S. earlier this year.
If you have information on Zhang, his associates, or their malicious cyber activities, send a tip via the Tor-based tip line.
ALT Reward poster offering up to $10 million for information on Zhang Yu, linked to cyber espionage and COVID-19 data theft.
mtanji retweeted
What do you think about the AI Agent Accountability Act? hawley.senate.gov/senators-h…
Organizations will not do anything about security if the amount of money they can make between discovery and exploitation is more than the cost of IR...
Splitting offense/defense capabilities for AI is a loosing strategy.
Organizations will not do anything about security unless you can demonstrate the impact (aka do the exploiting)
Every offensive practitioner has had the experience where they exploit something and someone already knew it was theoretical vulnerable.
"Compliance is not security..."
No, but a compliant org would have been a more secure org.
thehackernews.com/2026/10/fb…
You say "super intelligence force" and I hear...
theonion.com/clinton-deploys…
