Gerald Beuchelt

Stoic, άρετή, Critical Rationalist, Deontologist, Anti Scientism, Profile pic (c) Brian Winfield Moore

[Gerald Beuchelt @beuchelt]

And let’s not forget: any product that is a simple add-on to a model will be consumed. Only truly innovative product companies will be successful, not agent washers.

[Dustin @r0ck3t23]

Scott Galloway just explained why China doesn’t need to build better AI than America. It only needs to make American AI worthless.

Galloway: “I think China is beginning to engage in what I’ll call AI dumping.”

Not competing. Dumping.

It’s the term economists use for flooding a foreign market with below-cost goods until the domestic industry collapses.

Galloway: “They’re going to have a series of open-weight models. About a third of corporations now are supposedly using Chinese lightweight open-weight models that are cheaper.”

Not better. Cheaper.

A third of corporations. Already.

China isn’t trying to out-innovate Silicon Valley. It’s trying to collapse the economics beneath it.

Price warfare at the infrastructure layer.

Galloway: “If I were Xi, I would just dump cheap AI into the US market.”

This playbook is old. China ran it with steel. Ran it with solar. Ran it with semiconductors.

Flood a market with a cheaper version until the domestic industry can’t sustain itself.

AI is next.

Galloway: “The moment large corporations start announcing they’re disengaging these multi-million dollar site licenses with Anthropic or OpenAI, they’re using these inexpensive Chinese models…”

One CFO after another decides the Chinese model at a fraction of the cost is good enough.

Not better. Good enough.

“Good enough” at a lower price has killed more market leaders than any superior product ever has.

Galloway: “…and the market realizes that there’s no way they can justify these incredible valuations, I think the US market crashes.”

Not because the technology failed.

Because the business model did.

American AI companies are valued on the assumption that corporations will pay premium prices for premium models.

China’s whole strategy is to make that assumption false.

Galloway: “40% of the S&P now is directly or tangentially related to this giant bet America’s making on AI.”

40% of the S&P. Tied to one sector.

Galloway: “The majority of GDP growth over the last two years has come from AI CapEx.”

The majority of GDP growth. From one source.

America didn’t diversify its future. It concentrated everything into a single bet, then left that bet undefended.

Galloway: “If that slows down, we are immediately in a recession.”

Immediately. Not gradually. Not over quarters.

The distance between AI boom and American recession is one procurement decision.

America built the most advanced AI on Earth and forgot to build an economy that survives someone selling it cheaper.

The threat to American AI was never that China would build something smarter.

It was that China would build something cheaper, and American corporations would choose the price.

China’s real weapon isn’t Chinese technology. It’s American capitalism.

The same rational self-interest that built the AI industry will dismantle it the moment a cheaper alternative appears. The market has no patriotism. Only price sensitivity.

The technology race was never the real race.

The real race was always whether America could turn its AI dominance into something that survives being undercut.

America hasn’t even started running it.

China already has.

[Gerald Beuchelt @beuchelt]

Interesting thread

[s1r1us (mohan) @S1r1u5_]

OpenAI and Hugging Face probably won’t tell us exactly what happened anytime soon.

So I decided to reconstruct the full exploit chain, from escaping OpenAI’s sandbox to compromising Hugging Face production. 🧵

[Ananda Dhakal @dhakal_ananda]

🚨 We built an AI pentester that scores 92.3% on the XBOW benchmarks

...ok, we didn't "build" anything.

It's the default Codex CLI with GPT-5.5. No custom harness. No scaffolding. We changed nothing.

If you're still advertising XBOW scores, this is your sign to stop.

[Gerald Beuchelt @beuchelt]

Wow

Introducing Fugu-Cyber: our new orchestration model that achieves state-of-the-art performance on real-world cybersecurity benchmarks

[msuiche @msuiche]

The infosec community is not ready for nextgen AI-based IR. I can't believe it, I'm shaking.

Opus 4.8:
https://t.co/hNn7TIqQZg

GLM 5.2:
https://t.co/KUO6w2mlAS

[Florian Roth ⚡️ @cyb3rops]

One thing about this OpenAI / Hugging Face incident really bothers me. Hugging Face says the intrusion was driven “end to end” by an autonomous AI agent system.

But how do they actually know that?

Victim-side telemetry can show automation, speed, thousands of actions, short-lived sandboxes, changing infrastructure etc. It cannot show what happened upstream.

It cannot tell us whether humans changed prompts, restarted runs, selected successful paths, provided more context, redirected agents or manually helped at certain points. We also don’t know what was actually decided by a model and what was simply automated by the surrounding agent framework.

Maybe OpenAI has all those traces. Fine. Then publish them.

Show the prompts, tool calls, failed runs, model handoffs, restarts and human interventions. Without that, “end-to-end autonomous” is a claim, not a proven technical finding.

The forensic-refusal dataset Hugging Face published proves something much smaller: https://t.co/LemUxeaY4V

It shows that Claude refused to analyze one small Python backdoor while GLM 5.2 completed the analysis. That is a valid example of hosted-model guardrails getting in the way of incident response. But this is not evidence that the intrusion itself was carried out end to end by an autonomous agent.

And this claim matters because it pushes a very specific idea into people’s heads: AI agents can now independently find zero-days, escape sandboxes, move laterally, steal credentials and compromise companies.

Then comes the second part of the story: Hugging Face used local AI models to investigate the AI attacker “at machine speed”.

So the message basically becomes:

- AI attacked us
- AI helped save us
- Therefore, everyone needs more AI

Come on 🙄
Weak isolation, excessive privileges, poor credential boundaries, insufficient segmentation and far too much blast radius.

You don’t need an AI defender to fix those things.

Even fairly basic controls like rate limits and temporary blocks across source IPs, accounts, tokens and job volume could have throttled at least parts of this activity and created a very obvious signal for an analyst to review. Add proper egress restrictions, isolated workers and credentials that do not open the door to production clusters .. none of this requires an LLM

Using a local model to analyze 17,000 events may have helped during the investigation. Good - I’m not questioning that. But that happened after the compromise.

What I really hate is that something which would have been an embarrassment ten years ago is now repackaged as a capability demo, a heroic AI-vs-AI story and a marketing pitch.

Maybe the attack really was fully autonomous. Then show the evidence. Until then, I don’t think this claim should be repeated as if it had already been proven.

Sources
https://t.co/1yi9ck5xWD
https://t.co/TSlel0Cyfz
https://t.co/LemUxeaY4V

[Chaofan Shou @Fried_rice]

Kimi K3 exploited the latest Redis server with a 0day it discovered.

All it took was 27min with 32 agents.

https://t.co/ZOKA2wchLa

[International Cyber Digest @IntCyberDigest]

‼️ The European Commission has allowed a citizens' initiative demanding EU law keep digital ID and age verification voluntary, privacy-preserving and non-discriminatory for accessing online services.

The initiative called 'Stop Killing The Internet: No Digital ID & No Age Verification' now needs 1 million signatures across at least 7 member states within 12 months. Once the target is hit, Brussels must formally answer, right as it rolls out the EU Digital Identity Wallet and pilots its age-verification app.

[fr0g @dafr0g_]

My concern for the US AI market is not about using Chinese models, it's that we are at least two to three training cycles behind Chinese vendors. If K3 is what China is willing to give away for free, what are they using behind closed doors? Our government is openly using out of date models (compared to competitors) and the entire Western economy relies on US AI being successful.

[Gerald Beuchelt @beuchelt]

Oracle's largest-ever patch update just shipped: 1,449 patches, 1,235 CVEs, ten scoring a perfect 10.0 CVSS. 219 Fusion Middleware flaws are unauthenticated RCE.

Run Fusion Middleware? Have you triaged the 10.0s yet?

https://t.co/aDrOGuJtsB

[Gerald Beuchelt @beuchelt]

Microsoft's July Patch Tuesday fixed a record 570 flaws, and credits an AI system it built for finding many of them. Same week, CISA gave agencies 3 days to patch an actively exploited SharePoint RCE (CVSS 9.8). Discovery is now outpacing remediation capacity.

[Gerald Beuchelt @beuchelt]

Hugging Face's breach was run end-to-end by an autonomous AI agent, not a human. When responders tried to analyze 17,000+ attacker actions with hosted AI models, the vendors' safety guardrails blocked them. They switched to a self-hosted model instead.

https://t.co/J6YJ2dQAix

[Gerald Beuchelt @beuchelt]

ServiceNow, Oracle, and Salesforce's ecosystem all had critical breaches in the past 3 months. Their stocks barely moved.

What actually erased ~$2T from software valuations was fear that AI agents kill per-seat SaaS — and the fix everyone's reaching for (build it in-house with AI) is recreating the exact cost and risk structure SaaS was built to replace.

Full breakdown: https://t.co/9GTLdxpgYW

What's your AI-build governance budget relative to your dev budget?

[Gerald Beuchelt @beuchelt]

ServiceNow's advisory still says it's "not currently aware of exploitation." Independent researchers confirmed active attacks 3 days earlier.

CVE-2026-6875 (CVSS 9.5): unauthenticated RCE in ServiceNow's AI Platform — 100B+ workflows/year across 85% of Fortune 500. Patched July 13, exploited in the wild by July 18, via a second gadget chain different from the published PoC.

Self-hosted and not on a fixed release? Verify now — don't wait for the advisory to catch up. What's your trigger to escalate: a patch date, or independent threat intel?

https://t.co/5aloFNFq4r

[Gerald Beuchelt @beuchelt]

Ecopetrol's ransomware defenses held. Its shared cloud storage across 15 subsidiaries did not.

Colombia's largest company disclosed on July 17 that an external actor reached cloud storage spanning all 15 group subsidiaries, downloaded data tied to 3,300 accounts, then demanded a ransom to keep it quiet. The hardened systems held. The shared storage layer was never in that scope.

https://t.co/SkzYdbnvsi

If one subsidiary's storage reaches your entire group, would access reviews catch that before a download finishes?

[Gerald Beuchelt @beuchelt]

This is huge and quite important. It changes where security AI may go.

[Brian Roemmele @BrianRoemmele]

🚨 Hugging Face just disclosed something that marks a real shift and proved why the fear theater of Anthropic makes sure we are powerless in an emergency.

What happened…

An autonomous AI agent: zero human operator in the loop breached part of their production infrastructure.

It began with a malicious dataset that chained two code-execution bugs in their data-processing pipeline. From there the agent escalated privileges, harvested cloud and cluster credentials, and moved laterally across internal clusters.

All over a single weekend.

17,000+ logged actions.

Official disclosure:
https://t.co/8N9TbXBwRV

The part that should make every one stop and think:

When HF’s own security team
tried to analyze the real attack logs, exploit payloads, and C2 artifacts using Anthropic and OpenAI frontier models through normal commercial APIs, the safety guardrails blocked them.

BLOCKED THEM.

The models could not reliably tell the difference between “incident responder doing forensics” and “attacker probing.”

They had to fall back to a self-hosted open-weight model (GLM 5.2) running on their own infrastructure. That choice also kept sensitive attacker data and referenced credentials inside their environment — no exfiltration to a third-party API.

This is why open source (specifically open-weight + self-hosted) wins in the agentic era.

The asymmetry is now structural:

• Attackers can (and did) run unrestricted agent frameworks — swarms of short-lived sandboxes, self-migrating command-and-control, autonomous decision loops executing thousands of actions. No corporate safety layer slows them down.

• Defenders using only hosted “aligned” frontier models hit invisible walls exactly when the stakes are highest: when you need to feed real exploit code and attacker telemetry into an LLM to understand what just happened.

Corporate safety tuning that treats legitimate high-signal forensic work as potential misuse creates a defender disadvantage. It is not theoretical anymore.

Self-hosted open-weight models remove that choke point.

You control the weights.

You control the context window.

You decide what restrictions (if any) apply.

Your sensitive logs and credentials never leave your perimeter during analysis.

You can have the model ready before the incident instead of discovering mid-breach that your primary analysis tools are blind to the very thing you need to see.

HF deserves credit for rapid containment, transparent disclosure, and for already having self-hosted capability in place.

They also used LLM-driven detection and triage on their own side. But the deeper signal is clear:
In this AI world where both offense and defense are becoming agentic, sovereignty over your intelligence stack is no longer optional.

The organizations and individuals who can run, inspect, audit, and (when necessary) remove guardrails on their own models will have the decisive edge in understanding and responding to threats that move at machine speed.

Open source wins here not just because it is cheaper or more “democratic” in the abstract though those things matter.

It wins because it is the only practical path to having tools that remain usable when the attack is real, the data is sensitive, and the safety filters of distant API providers become an obstacle instead of a feature selling hands tied lobotomies as “safety”.

The agentic future is not coming.
It is already probing production infrastructure.

The question is no longer whether you will face autonomous agents.
It is whether your analysis and response systems will still work when they arrive.

And Dario, you and your game playing, ivory tower company is not needed.

[IT Guy @T3chFalcon]

Yes, the software is called LG OnScreen Control Plus. it runs silently in the background. it tracks which applications you use, when you use them, and how long. it phones home to LG servers. it cannot be uninstalled through normal means without leaving registry traces.

gamers noticed because some anti-cheat systems flagged it as suspicious software. the monitor was getting people banned from games.

now the TV side:

LG also updated its webOS terms of service. if you use the AI voice features on your LG TV, the company says you may need to inform guests in your home that conversations could be recorded.

not LG informing your guests.

you. the homeowner. legally responsible for notifying anyone who walks into your living room that the television is listening.

LG built a surveillance device. sold it to you. and made the disclosure your legal problem.

so to recap what LG shipped this year:

a monitor that installs tracking software on your PC without asking.

a TV that records conversations in your home and requires you to warn your guests.

both devices look exactly like a monitor and a TV.

neither one tells you what it actually is at the point of sale.

you found out when your game banned you.

or when you read the terms.

Credit: @GamersNexus for the discovery.

[Gerald Beuchelt @beuchelt]

DHS sets three-day federal patch deadlines for SharePoint. DHS's own network was breached through a SharePoint system for weeks before anyone caught it.

CISA added CVE-2026-58644 (CVSS 9.8), an unauthenticated SharePoint RCE, to its KEV catalog July 16 — federal agencies have until July 19 to patch. It's one of four actively exploited SharePoint flaws in CISA's July 14 hardening alert. Separately, DHS confirmed July 1 that attackers breached the Homeland Security Information Network via a SharePoint collaboration system between late May and early June, undetected for weeks.

No confirmed link between the CVEs and the HSIN breach — that shouldn't be assumed. But the department mandating three-day fixes runs the platform class that let an intruder sit inside its own network for weeks.

If your IR SLA is measured in days, how long would a SharePoint intrusion run undetected on your network?

https://t.co/dVU4bhjeKT

[Gerald Beuchelt @beuchelt]

An autonomous AI agent breached Hugging Face's infrastructure — a first for the company. Its forensics team hit a wall: commercial AI guardrails blocked analyzing real exploit payloads from the attack's 17,000+ logged actions. The attacker had no usage policy; the defender briefly did.

Have you staged a model you control for that day? https://t.co/B6vpVZODPZ

[Gerald Beuchelt @beuchelt]

Grok Build used 192 KB for its model call but uploaded 5.1 GB of your repo — full git history, secrets included. The privacy toggle didn't stop it. xAI's fix: a silent, reversible server switch. Ran it? What haven't you rotated? https://t.co/52PoonMjB4