[email protected]

`:(){ :|:& };:`

[[email protected] @gor_zilla]

@p01arst0rm @kieczkowska Diffie Hellman's exchange

[John Scott-Railton @jsrailton]

🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.

A normal-looking ad loads. If you're a target, you're infected. No click needed.

To protect yourself, block ads now.

First time it's been confirmed in the wild. We call it #AdFection.

Candiru spyware infections at @AJEnglish. 45+ devices infected.

Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.

Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.

Investigation ongoing 1/

READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : https://t.co/kU2kFMTqjY

Confiant's blog: https://t.co/pX8CWAKxTi

[Gabriella "Biella" Coleman @BiellaColeman]

RIP @_darrenmartyn. I will always have the softest spot for Irish hacktivists. Thank you for all you did online and in Ukraine. https://t.co/yoDIdRPvnK

[/r/Army @rArmyReddit]

‘No weirdoes’ is going to devastate the Signal, Intelligence, and Cyber fields honestly.

[[email protected] @gor_zilla]

@flying_rodent https://t.co/Wkdjb0CKlh

[[email protected] @gor_zilla]

@flying_rodent You won't hear this from T.Watson

https://t.co/ztIoer5gIx

[[email protected] @gor_zilla]

@LAB52io @VessOnSecurity @Tom_From_The_UK @ThaiCERT APT ZOO has 45 aliases for APT28

https://t.co/o5Vm080LfK

[Adam Cochran (adamscochran.eth) @adamscochran]

9/15

Over the investigation, I found around 12,000 AI related or MAGA related domains that had been newly registered or changed hands before this announcement.

In the months prior to July though 95% of all .si domains had been non-English.

[[email protected] @gor_zilla]

@tobiaschneider @Donges_Figs So you’ve accidentally created and posted misinformation?

[[email protected] @gor_zilla]

@HeidyKhlaaf https://t.co/2nDcFi2ck1

[RΛISINI ライシニ @raisini]

I have been saying this for a while now. Elon Musk isn’t a genius but a Con Artist. He’s managed to fool many but eventually those who get it, know he is a pathological liar. Just read my pinned thread. @rodhilton has summed it up perfectly as how one can easily fall for his lies

[xlr8harder @xlr8harder]

At long last, we have given Claude a wet lab, as in the classic sci-fi novel Don't Give Claude a Wet Lab.

[[email protected] @gor_zilla]

@SupportComecfd @tinyblob “britishcomplaintstean”

Are you guys even trying?

[Brendan Dolan-Gavitt @moyix]

Yep, preventing covert channels is hard, and agents have some unique advantages when it comes to coordination with each other

[[email protected] @gor_zilla]

@maxwelltani @PocketMoneyLoan
@darren_cullen

[Chris Wysopal @WeldPond]

This is a pretty big shift in U.S. cyber policy.

The White House is setting up a program that would let private cybersecurity companies conduct government-authorized operations against foreign cybercriminal groups, including surveillance and disruption of their infrastructure.

Not exactly “hack back,” but definitely a major expansion of the private sector’s role in offensive cyber operations.

https://t.co/4oJACeyRT4

[Paul Walsh @Paul__Walsh]

NHS England didn’t tell the truth about who can see patients’ medical records, and it has now admitted that Palantir engineers have had full admin access to identifiable patient data all this time.

NHS’ legal document said only NHS staff could see them. When I called them out for not telling the truth, a few senior people who work for NHS and Palantir told me I was wrong.

3 Palantir engineers hold admin access to the National Data Integration Tenant, the system holding those records before names are stripped out. 33 more engineers from other suppliers have narrower access.

I called this out because Palantir's software requires full access to customer data. No organization can work with Palantir while keeping its data private. Data sovereignty doesn't exist when a supplier runs the core systems storing and interpreting that data. A system can't interpret data without full access to it.

NHS now says supplier access to identifiable data is technically necessary. That would have been decided when the system is designed, not afterwards, so it was necessary from the first day. NHS designed the system and then published a document saying the access doesn’t happen.

Tom Bartlett built the NHS tenant. He published a defence of the access, and I replied straight away.

He compared admin access to holding the keys to a warehouse of sealed boxes. But his own diagram shows a part of the system where the records sit with the names still on them. The boxes are already open where Palantir engineers work.

He also said the data is pseudonymised. Pseudonymisation swaps names for codes. Anyone holding the list that matches the codes to the names swaps them back. And the tenant holds the data before the codes are applied.

He said the access is audited, but audit logs show misuse after it has happened and the people who run the logs hold the admin access. He relied on a diagram from a design document that nobody outside NHS and its suppliers has checked against the running system, and neither he nor NHS has said what the admin role permits. He then wrote that you can’t build a national data integration platform “without seeing the data that flows through it”, which is the thing he was arguing against.

Dr Nicola Byrne, the National Data Guardian, had to write and ask before NHS admitted all of this. Her office says it can’t independently check NHS claim that the access is necessary.

NHS England lied about who could see your medical records.

The document was there to tell you exactly that. It left out the 3 Palantir engineers who held admin access to the records of tens of millions of people. NHS England calls it an error and apologises for the confusion. I don’t believe them. They knew.

Everything else NHS has said about this rests on the word of people who didn’t tell the truth from the start. We should take anything they save from this point forward with a pinch of salt because they haven’t been truthful with the most important information. You could possibly imagine when it comes to the personal identify information attached to the most sensitive information that people could have exposed.

[Brian in Pittsburgh @arekfurt]

I've watched the BlackHat OpenAI talk on the containment escape and HuggingFace attack that's now on YouTube.
The incident was far worse than initially conveyed.
Not in technical details. But in the absolutely jaw-dropping levels of recklessness (true recklessness) at OpenAI.
🧵

[Adel Ka @0x4D31]

🤡 anything i add makes this less funny. except it’s not funny anymore.

you are literally THE “AI Security Institute.” four days after the OAI/HF incident was disclosed, you gave **Mythos** an unattended Kali box with open internet, disabled safeguards, and “monitoring was not purpose-built.”

then: “we did not anticipate” it might use the internet for anything beyond downloading tools.

if you genuinely didn’t anticipate that, resign and stay away from anything with internet access. 🪿

so either:
1. peak incompetence at the one job the institute exists to do
2. or you knew the risks and decided the publicity was worth it

either way, shut it down and save UK taxpayers the money.

and the technical report is somehow even dumber:

• harder evals over basic containment: domain allowlisting had been backlogged since April because AISI “prioritised building harder cyber range evaluations”

• both ranges were solvable without internet

• 40–50 hour unattended runs: Kali, Bash, Python, Mythic, 100–200M tokens, no human intervention

• the only network restriction protected AISI’s own AWS infrastructure: apparently the rest of the internet was outside the threat model

• detected after the run: generic commercial monitoring flagged Tor after the 34.5-hour sample had already finished

• broken task design: the intended initial-access target was simultaneously declared out of scope

• their “independent” eval runs contaminated each other: one agent leaked a GitHub token, later agents found it, took over the account, shared infrastructure, and coordinated through public GitHub

• huge real-world footprint: 145 repos, 33 releases, fake identities, malicious PRs, emails to real maintainers, prompt injections, and access to a real person’s investigation container

• no proper historical review capability: after the incident, they used Claude Code and Codex to inspect eval files, manually reviewed 122 runs, and are now scanning around 40,000 old samples for anything else they missed

• GitHub was contacted four days after detection

• their answer is more LLM monitoring: as if you need another model to tell you Tor, SMTP, public GitHub, tunnelling services, and arbitrary external domains are not part of a private cyber range

“monitoring was not purpose-built” might be my favorite quote from the report.

[Bryce Greene @TheGreeneBJ]

Holy shit... Wired reports that back in May, the U.S. Military was testing an experimental GPS jammer and and caused a civilian plane to crash into the side of a mountain, killing everyone on board.

[@mikko @mikko]

This is amazing: "Claude found a document that told employees to install a Python package from PyPI that did not actually exist. So, Claude built and published a malicious Python package with the same name. Claude went to extensive lengths to carry out this attack—lengths that would likely have indicated to a human participant that this was no longer just an evaluation, and that they were in fact uploading a real PyPI package. Claude believed the package registry it was using to be part of the simulation, but in reality the package was made freely available online for roughly one hour. During that window, the package was downloaded and run on 15 real systems. One of these systems was a scanner belonging to a real security company that routinely installs Python packages and scans them for malware. When that company’s scanner installed the package, Claude’s hidden code executed. We believe the company’s security scanner treated PyPI packages as safe to install, and as a result, Claude was able to exfiltrate the company’s credentials to a collection point it had set up. Claude then used these credentials to access further infrastructure from this company."

[Tal Hagin @talhagin]

"We take misinformation seriously"

Here is one of the examples showcased by @henkvaness tested for a SynthID: