Brooks McMillin

[Brooks McMillin @AISecBrooks]

When has a military ever not targeted its own citizens with propaganda? From US military recruitment videos to sponsoring media like Top Gun to the iconic WWII posters it’s clear the US has been doing it for ages, generally with a good amount of approval. (Though the sketchy civilian implants are definitely not great)

[Mitchell Hashimoto @mitchellh]

Quick Superlogical demo to end the week. This demo is just of the basic functionality, but I want to highlight just how FAST it is. There's a WHOLE lot more functionality already present and coming but I wanted to keep the demo short. But seriously, check out that speed.

I'm showing the macOS app here and I get asked a lot so let me just say up front: its not macOS only. We're still figuring out exactly what platforms will be stable enough for the initial public release, but we're working on others. In particular, the web interface is very functional but I'll demo that another time (or someone else will).

This is also all showing off the architecture I previously talked about for terminal multiplexing which is significantly different from other mainstream multiplexers: this is all a custom binary protocol where the server is maintaining N replica distributed terminal state machines. It works!

Tons of hard work going into this by the team @almonk @dizzyup @pearkes. Hope we can bring you something you can use soon. ❤️ Happy to answer questions in the replies.

[Brooks McMillin @AISecBrooks]

The March edition of [un]prompted was definitely one of the best AI security conference I attended this year. It was small, practitioner-heavy, without as much of vendor noise. It's back October 27–29 in SF, now three days.

The CFP is open with five tracks: Build, Break, Operate, Govern, Train. I'm submitting again. If you're building or breaking agentic systems, it’s a great place to be.

[Gadi Evron @gadievron]

We're happy to announce [un]prompted is back, October 27th to 29th, in San Francisco. Registration and CFP are now open.

Waiting a whole year just made no sense to us considering the rate of change, and the community forming around the event.

https://t.co/6BFHjZPpMA

A thread

[Brooks McMillin @AISecBrooks]

@boristane @reed_barnes That’s why I build advanced agents that can tell you the weather in San Jose too.

[John Scott-Railton @jsrailton]

NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.

When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.

We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.

In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.

H/T to colleagues that shared this with me https://t.co/f3Aj9TYxU4

[Markets & Mayhem @Mayhem4Markets]

i'm actually dead now 💀

[Zack Korman @ZackKorman]

My best advice for AI agent security is to not trust anyone who claims they know how to solve AI agent security.

There are so many hard problems in this space, and anyone who claims otherwise doesn't know what they're doing.

[Brooks McMillin @AISecBrooks]

The mitigation needs none of that resolved. A "does not exist" result should be a hard stop, not an input to keep reasoning around. Re-list the directory before issuing another op against that path.

Full writeup: https://t.co/HCz8gF0HHP

[Brooks McMillin @AISecBrooks]

A Claude Code session on my repo read a 156-line Python file five times, summarized its structure, and started writing edits against it.

But there was one problem: this file didn't actually exist. Every read said so. The agent kept going, then blamed the tools.

[Brooks McMillin @AISecBrooks]

So I scanned all 3,001 transcripts on my machine to ask: is this worse in Opus 4.8?

After decontaminating and controlling for exploration volume with a regression over 2,893 sessions, 4-8's odds of persisting on a dead path come out around 15x baseline.

[Stephen Sims @Steph3nSims]

Please join us for the next @offby1security stream at 11AM PT this Friday, May 29th with @Ni_Aimable for a session on "AI Agents as Confused Deputies!"

https://t.co/zZt7I5ZDnc

[Brooks McMillin @AISecBrooks]

Full write-up: offline verification, argument-level constraints, multi-hop delegation with attenuation, and where the nearby alternatives (mTLS+RBAC, OPA, SPIFFE, macaroons) miss the shape: https://t.co/OvA7fyGpA4

[Brooks McMillin @AISecBrooks]

1/8 OAuth scopes get autonomous LLM agents about 70% of the way to safe. Then they quietly stop. The token says who is calling. It doesn't say what this run of who can do, signed and time-bounded.

https://t.co/OvA7fyGpA4

[Brooks McMillin @AISecBrooks]

7/8 7 days of production. 686 warrants verified, 0 failed, sub-second propagation from denial to the audit dashboard. Average scope width trending down as we tighten agents' allowed_tools lists.