Juan Avellan V.

Chief Information Security Officer | CSO | Cyber Lawyer | Governance, Risk & Compliance Management | Data Governance | Organizational Resilience

[Sundar Pichai @sundarpichai]

Our teams put Gemini 4 Carbon to work on a major security challenge: mathematically proving the code underlying the Signal protocol.

Using AlphaProof Code, @GoogleDeepMind researchers guided agents to verify the protocol down to compiled device code, closing the gap where real bugs hide. The result:

- Gemini 4 Carbon generated over 6M lines of machine-checked Lean proofs
- years of expert manual verification compressed to just weeks
~1% of the codebase required human review (Lean automatically checked the rest)

This is helping unlock scalable formal verification for building secure software, laying the groundwork to fundamentally shift the advantage to defenders. We’re open sourcing the results for the security community.

[Theresa Payton ✪ @TrackerPayton]

When lives are on the line, a false warning can be just as consequential as a missed one. We should prepare for copycat attacks. Possible targets include emergency notifications, public health alerts, weather warnings, utility outage warnings, and school emergency communications.

[Simon Harris @SimonHarrisMBD]

This seems like a great time to reshare my favourite Sir Patrick Stewart performance, ‘What has the ECHR ever done for us?’ It’s just perfect in every possible way … including the ending 😂😂😂 RIP.

🎥 The Guardian

[a16z @a16z]

In a single year, AI has rewritten the security priority list for CISOs.

Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.

There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.

In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.

The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)

Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)

From a16z's @OwenColby and @steph_zhang on The New Security Agenda: https://t.co/C814PJ4wGg

[Cohere @cohere]

While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected.

Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions.

Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent.

But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models?

We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem.

Read the full report: https://t.co/TZSugXi2ZE

[Juraj Bednar🏴💛🌘 @jurbed]

I highly recommend cloudflare's security audit skill: https://t.co/Mu6Dm0fzk8

Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.

[Halvar Flake @halvarflake]

For the next few months, we are looking at frequent discoveries of long-standing bugs - competent code auditing has gotten cheap and abundant. This carries a few consequences:

[Juan Avellan V. @javellan]

@elonmusk Seems like a massive single point of failure risk…no?

[Matthew Green @matthew_d_green]

I think the right way to think about AI capabilities is to assume that models will continue getting better at about the same rate as they have since early this year.

[Matthew Green @matthew_d_green]

Everyone is very concerned about being respectable, so I’m going to be the goofball who raises worst-case possibilities. I think there is a 1% chance we live in Minicrypt, and a 15% chance we functionally lose confidence in our existing public-key encryption algorithms.

[Matthew Green @matthew_d_green]

I’ve had a few people write to ask me to follow up on a (reply!) tweet I wrote that’s gotten a lot of retweets. I considered deleting it just to avoid the headache, but I think that would make people more paranoid. So let me share my thoughts.

[Matthew Green @matthew_d_green]

@kmad @matthew_pines I think we might lose public key cryptography.

[Pushmeet Kohli @pushmeet]

https://t.co/R2BtZVLnaQ

[Massimo @Rainmaker1973]

The ceiling of Shah Mosque in Isfahan, Persia(1611), featuring a mesmerising array of geometrical tessellations and radial designs.

The patterns are meticulously planned, with each tile cut to fit into the celestial design.

[Juan Avellan V. @javellan]

@paulg Actually there are interesting parallels between: 1) watch accuracy and how high-precision watchmaking shifted after quartz to a more complex set of differentiators and 2) what we’re seeing now with AI exceeding some human capabilities. A telling story.

[Andrea Servida @ServidaAndrea]

❤️

[Juan Avellan V. @javellan]

@swd2 @Kathleen_Tyson_ @grok is this true?

[Mark Zuckerberg @finkd]

Give it a read: https://t.co/Rq4O3xRHdL

[Hollywood Horror Museum @horrormuseum]

Vince Guaraldi was the brilliant composer and pianist behind the Peanuts cartoons.

It was quite controversial to use modern jazz in a kid's cartoon, networks hated it, but introduced many kids to jazz.

He was only 46 when he died in 1976, but left such a legacy!

[Juan Avellan V. @javellan]

@japan_nobunaga Wrong…..