𝗪𝗲’𝘃𝗲 𝘀𝗽𝗲𝗻𝘁 𝗱𝗲𝗰𝗮𝗱𝗲𝘀 𝗱𝗲𝘀𝗶𝗴𝗻𝗶𝗻𝗴 𝘀𝘆𝘀𝘁𝗲𝗺𝘀 𝗮𝗿𝗼𝘂𝗻𝗱 𝗮 𝘀𝗶𝗺𝗽𝗹𝗲 𝗮𝘀𝘀𝘂𝗺𝗽𝘁𝗶𝗼𝗻: 𝗶𝗳 𝘀𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝗴𝗼𝗲𝘀 𝘄𝗿𝗼𝗻𝗴, 𝘄𝗲 𝗰𝗮𝗻 𝘁𝗿𝗮𝗰𝗲 𝘁𝗵𝗲 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻. Agentic AI is starting to break that assumption. AI is moving from executing defined instructions to interpreting intent, choosing actions and interacting with systems on our behalf. We’re already seeing the cracks: • AI can confidently make the wrong call while users treat it as authoritative. • Agents can take actions their creators or users never explicitly intended. The obvious question is: 𝘄𝗵𝗼 𝗶𝘀 𝗹𝗶𝗮𝗯𝗹𝗲? The more important question for technology leaders is: 𝗰𝗮𝗻 𝗼𝘂𝗿 𝘀𝘆𝘀𝘁𝗲𝗺𝘀 𝗲𝘃𝗲𝗻 𝗲𝘅𝗽𝗹𝗮𝗶𝗻 𝗵𝗼𝘄 𝘁𝗵𝗲 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻 𝗵𝗮𝗽𝗽𝗲𝗻𝗲𝗱? That changes how we think about architecture. Audit trails. Permissions. Human checkpoints. Failure boundaries. Observability. These used to be engineering safeguards. With autonomous systems, they become part of the product itself. 𝗜𝗳 𝗮𝗻 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁 𝗰𝗮𝗻 𝗮𝗰𝘁 𝘄𝗶𝘁𝗵𝗼𝘂𝘁 𝗮 𝗵𝘂𝗺𝗮𝗻 𝗺𝗮𝗸𝗶𝗻𝗴 𝘁𝗵𝗲 𝗳𝗶𝗻𝗮𝗹 𝗱𝗲𝗰𝗶𝘀𝗶𝗼𝗻, 𝗮𝗰𝗰𝗼𝘂𝗻𝘁𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗰𝗮𝗻'𝘁 𝗯𝗲 𝗮𝗱𝗱𝗲𝗱 𝗮𝗳𝘁𝗲𝗿 𝘁𝗵𝗲 𝗶𝗻𝗰𝗶𝗱𝗲𝗻𝘁. 𝗜𝘁 𝗵𝗮𝘀 𝘁𝗼 𝗯𝗲 𝗱𝗲𝘀𝗶𝗴𝗻𝗲𝗱 𝗶𝗻𝘁𝗼 𝘁𝗵𝗲 𝘀𝘆𝘀𝘁𝗲𝗺. That may be the real architecture challenge of agentic AI. 𝗔𝗿𝗲 𝘄𝗲 𝗯𝘂𝗶𝗹𝗱𝗶𝗻𝗴 𝗲𝗻𝗼𝘂𝗴𝗵 𝘁𝗿𝗮𝗰𝗲𝗮𝗯𝗶𝗹𝗶𝘁𝘆 𝗶𝗻𝘁𝗼 𝘁𝗵𝗲 𝘀𝘆𝘀𝘁𝗲𝗺𝘀 𝘄𝗲'𝗿𝗲 𝗴𝗶𝘃𝗶𝗻𝗴 𝗮𝘂𝘁𝗼𝗻𝗼𝗺𝘆 𝘁𝗼? #ArtificialIntelligence #AIAgents #TechnologyLeadership #SoftwareArchitecture

A cheaper cloud bill can come with an expensive exit. Integrations and team skills tie you to a platform. Before you commit, ask what leaving would take. vinuthomas.com/how-do-techno…

What if the next lie detector doesn’t ask you a question? It watches you instead. The Pentagon is reportedly exploring an AI-powered polygraph that could use signals such as breathing and heart rate to assess whether someone is lying. I can see the technical appeal. What makes me uneasy is the assumption that those signals can reliably tell us whether someone is telling the truth. AI can identify patterns, 𝗯𝘂𝘁 𝗮 𝗽𝗮𝘁𝘁𝗲𝗿𝗻 𝗶𝘀𝗻’𝘁 𝗽𝗿𝗼𝗼𝗳. If the underlying signals are ambiguous, a more sophisticated model could produce a confident answer without resolving that uncertainty. And once that answer comes with a score and a label, it becomes easier to treat a questionable judgment as an objective finding. Getting something wrong in a chatbot response is one thing. 𝗪𝗿𝗼𝗻𝗴𝗹𝘆 𝗹𝗮𝗯𝗲𝗹𝗹𝗶𝗻𝗴 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝗮 𝗹𝗶𝗮𝗿 𝗰𝗼𝘂𝗹𝗱 𝗮𝗳𝗳𝗲𝗰𝘁 𝘁𝗵𝗲𝗶𝗿 𝗷𝗼𝗯, 𝗿𝗲𝗽𝘂𝘁𝗮𝘁𝗶𝗼𝗻 𝗼𝗿 𝗳𝗿𝗲𝗲𝗱𝗼𝗺. Before we give AI that kind of authority, we need evidence that the judgment is reliable and a meaningful way for people to challenge it. 𝗪𝗼𝘂𝗹𝗱 𝘆𝗼𝘂 𝘁𝗿𝘂𝘀𝘁 𝗮𝗻 𝗔𝗜 𝗮𝘀𝘀𝗲𝘀𝘀𝗺𝗲𝗻𝘁 𝗼𝗳 𝘄𝗵𝗲𝘁𝗵𝗲𝗿 𝘀𝗼𝗺𝗲𝗼𝗻𝗲 𝗶𝘀 𝗹𝘆𝗶𝗻𝗴? What evidence would you need? #ArtificialIntelligence #ResponsibleAI #AI #TechnologyLeadership #FutureOfTechnology

“Don’t click suspicious ads” only gets you so far when displaying one can deliver spyware. Citizen Lab reports that targeted ads were used to infect devices at Al Jazeera with Candiru spyware. It calls the technique AdFection: the ad loads code that can deliver an exploit to a selected target without a click. Discover-Tech’s ads reached almost 200,000 websites and apps over four months. That’s advertising reach, not evidence that everyone who saw them was infected. How should security advice change when avoiding the click isn’t enough? citizenlab.ca/research/how-d…

An AI agent shouldn’t be responsible for enforcing its own limits. That’s what caught my attention in @NVIDIA’s Open Agent Safety Platform announcement. OpenShell enforces policies while the agent runs. Sentry adds a separate hardware-based watchdog in the reference design. The model is only part of the system. Context, tools, permissions and execution all shape what an agent can actually do. 𝗧𝗵𝗲 𝗿𝗲𝗮𝗹 𝘀𝘆𝘀𝘁𝗲𝗺 𝗶𝘀 𝗰𝗹𝗼𝘀𝗲𝗿 𝘁𝗼: 𝗺𝗼𝗱𝗲𝗹 → 𝗰𝗼𝗻𝘁𝗲𝘅𝘁 → 𝘁𝗼𝗼𝗹𝘀 → 𝗽𝗲𝗿𝗺𝗶𝘀𝘀𝗶𝗼𝗻𝘀 → 𝗲𝘅𝗲𝗰𝘂𝘁𝗶𝗼𝗻 → 𝗳𝗲𝗲𝗱𝗯𝗮𝗰𝗸 Once an agent can act on real systems, instructions need to be backed by controls it can’t simply work around. When something goes wrong, “why did the model do that?” is only part of the postmortem. I’d also want to know: • What authority did we give it? • Which systems could it reach? • What actions were allowed? • What was monitoring them? • Could we stop it and revoke its access? The model provides capability. The architecture sets the limits on how it’s used. Those limits need to exist 𝗯𝗲𝗳𝗼𝗿𝗲 𝘁𝗵𝗲 𝗮𝗴𝗲𝗻𝘁 𝗴𝗲𝘁𝘀 𝗮𝗰𝗰𝗲𝘀𝘀 𝘁𝗼 𝗿𝗲𝗮𝗹 𝘀𝘆𝘀𝘁𝗲𝗺𝘀. For engineering leaders, this brings familiar systems-design questions into AI: permissions, isolation, monitoring and recovery. Where are you putting independent controls around your agents? Supporting research: arxiv.org/abs/2609.00006 NVIDIA’s approach: nvidianews.nvidia.com/news/o… #AISafety #Cybersecurity #EngineeringLeadership #Nvidia

Oh no! It looks like @PLAUDAI removed a useful feature of automatically labelling the same speakers in every meeting. Now, except for my own voice, I have to go back to labelling each speaker separately for every single meeting! Is this feature removal connected to the voiceprint litigation facing Otter and Fireflies? If privacy concerns drove the decision, explain them. Removing a useful feature and handing the work back to users deserves more than a help-page update. support.plaud.ai/hc/en-us/ar…

Toronto after dark, Niagara in full roar and a few quieter moments in between. A quick trip to Canada with plenty to point the camera at. 🇨🇦 #Canada #Travel #TravelPhotography

The Spirit Catcher in Barrie. Hard to tell whether the sculpture or the sky is showing off more. #Barrie #Canada #travel

SMS codes are better than a password alone, but a fake login page can steal one and a SIM swap can reroute it. If your email account offers a passkey, use it. If SMS is your only option, keep it on. CISA: cisa.gov/ncas/tips/st05-012

Happy birthday, @StephenKing! I’ve been reading your books for four decades, and you still know how to keep me up at night.

A VPN can hide your browsing from your ISP. It can't make a fake bank page safe. When correctly configured, it encrypts traffic between your device and its server, hiding the contents and destinations inside that tunnel from your internet provider and people monitoring the same Wi-Fi. Websites see the VPN's IP address instead of yours. Your ISP can still see the VPN connection, its timing and how much data you transfer. Traffic outside the tunnel isn't covered. You can have a VPN running and still: • Type your password and OTP into a fake bank page. • Give a fake support agent remote access to your phone. • Install a malicious "update" that steals data from your device. • Be recognised by a site you're logged into or tracked through cookies. Some VPN apps block known malicious sites. That's an extra filter, not a guarantee that the next link or caller is safe. There's another catch: you're trusting the VPN provider with traffic your ISP can no longer inspect. An unscrupulous provider can log your activity or monetise your data. HTTPS still protects page contents and passwords between your browser and the website, including from the VPN provider. It already does that without a VPN. Free doesn't automatically mean unsafe. Paid doesn't automatically mean trustworthy. Check how the service makes money. Before choosing a VPN, check: • Who owns it and whether you can identify the company. • What it logs, how long it keeps it and who receives it. • Recent public independent audits: what was tested and what wasn't. • Its security-update history and the permissions its app requests. "No logs" is a claim to investigate. An audit is evidence about a particular scope and time, not a permanent safety certificate. App-store availability isn't proof of trustworthiness either. A VPN is useful when you want less visibility into your browsing from the network carrying it. It doesn't remove the need to check where you're signing in or who you're handing control to. EFF's guide explains the trade-offs and provider checks: ssd.eff.org/module/vpn.html What do you check before trusting a VPN provider?

India has a data protection law. Most of the rights you expect from it still don't start until May 2027. Even the ₹250 crore penalty is paid to the government, not to you. Here's what the DPDP rollout actually changes: vinuthomas.com/dpdp-act-2026…

OpenAI claims a Navier-Stokes breakthrough. A mathematician questions the route. OpenAI says his recent Codex prompts didn't influence the result. Source: openai.com/index/navier-stok… Correct maths. Clear credit. Separate questions. My take: vinuthomas.com/did-openais-a…

Took a @IndiGo6E flight recently and cabin crew Anju handed out a handwritten thank-you note: a genuinely warm, personal touch you don't see often. Small gesture, big impression.

LG says its TVs don't record ambient conversations. A 135-minute investigation got one to record room audio with the screen off and the network unplugged, then upload it once it reconnected. Here's what they found and how to lock yours down: vinuthomas.com/your-lg-tv-is… #privacy

The org that grades AI models for danger just got hacked, twice. A leaked API key let an attacker burn $600K in AI credits over 3 weeks before anyone noticed. Check your key hygiene. thehackernews.com/2026/09/at…

Self-hosting isn't about saving money. It's about owning the failure modes. Last month I consolidated a two-node Proxmox cluster onto one box. Sounds simple. Then EFI/GRUB decided otherwise after the VE 8 to 9 upgrade. With a SaaS product that's a support ticket. With a home lab that's your Saturday. You're not paying less. You're choosing which problems are yours.

Password rotation is often treated like a security ritual. Change it every 90 days and repeat. But NIST says passwords should not be changed periodically unless there is evidence of compromise. It also recommends allowing password managers. Long, unique passwords and a password manager beats predictable rotation. #Cybersecurity

NVIDIA just bought Hugging Face for $12.93B. The interesting part isn't the price, it's that NVIDIA is publicly promising the platform stays open and multi-cloud: no NVIDIA hardware required to use it. Watch that promise closely over the next year. blogs.nvidia.com/blog/nvidia…