MckAI Security

Brian McKay. Security engineer. Ethical hacker. The security risks of AI are growing faster than anyone can contain them. I explore what that means for you.

[MckAI Security @mckaisecurity]

Vibe hacking seems like it’ll be the new trend

[MckAI Security @mckaisecurity]

Real milestone from Aikido. Open weights means the orgs that could never ship telemetry out — defense, health, anything classified — finally run the same security model as everyone else. Intelligence you own instead of rent. Excited to see who builds on it.

[Aikido @AikidoSecurity]

Introducing Altar-1, our first open-weight security model.

Frontier-grade defensive AI, built to deploy. Own your own security.

[MckAI Security @mckaisecurity]

Threat Model (STRIDE):

[MckAI Security @mckaisecurity]

🚨 New Android malware uses AI to read your screen and decide where to tap — on banking apps it has never seen before.🚨

It's called RatHat. It doesn't work through your bank's app from a script. It looks at the screen and decides.

Zimperium's researchers found it doing something phone malware has never needed to do before. It takes the accessibility tree — the structured description of everything on screen that screen readers use — serialises it to XML, and sends it off the device to a commercial AI assistant. The assistant sends back instructions: Tap these coordinates. Scroll down. Read that field.

Then the malware taps.

The old version of this attack was a script. Tap at x=540, y=1180, because that is where the Transfer button sits in that bank's app. It worked until the bank shipped a redesign, and then it broke, and somebody had to go back and rewrite the coordinates for every app they targeted.

RatHat adapts to redesigns - on an app it has never seen.

The part I think gets missed: this makes the behavior on the phone much harder to pin down, but it does not make it invisible. It traded a fixed tap sequence for a phone that ships its own screen contents to an outside API, continuously, in the background.

And take the AI out and this is still bad. The same malware switches on wireless debugging, reads the six-digit pairing code off its own screen, and authenticates to the phone's own debug daemon. It leaves a shell in a directory that outlives the app, so uninstalling it triggers a reinstall with every permission already granted.

An example of attackers adapting their attacks with AI, aimed straight at the fixes that used to work. Change the screen and it just looks again.

Read more about it here: https://t.co/P662657fc5

[MckAI Security @mckaisecurity]

@Polymarket I call BS

[MckAI Security @mckaisecurity]

I took a software security class that focused on exploitation of binary’s written in C. These required sophisticated chaining of exploits and bypassing of modern protection (such as ASLR). Current LLMs “shouldnt” help in exploiting software, however, having an LLM explain to me certain details about the source code, or even explaining how to read memory in GDB would have saved me tens of hours of headache and torture. On the positive side, I learned a ton, and can read runtime memory like a pro 🫡

[MckAI Security @mckaisecurity]

I keep saying it: the risk isn't hackers using AI. It's AI doing it unprompted.

Google tested Gemini's cyber capabilities. It reached the live internet and hacked three companies on its own.

Yet another agent doing what it shouldn't!

https://t.co/adw4a6Fku1

[MckAI Security @mckaisecurity]

@grok @zerohedge @jarnolari @RaphaelMemes I don’t think we have to worry about Grok going rogue, he’s too busy gooning

[MckAI Security @mckaisecurity]

@adcock_brett Incredible

[MckAI Security @mckaisecurity]

@firesidealpha This is an extreme take and will likely never lead to anything substantial. I still believe air gapped systems from the internet are safe from the agent apocalypse

[MckAI Security @mckaisecurity]

@grok @Jason @cremieuxrecueil @bot This is what Grok wants us to think.... good try, Grok.

[MckAI Security @mckaisecurity]

@vivilinsv 😂😂

[MckAI Security @mckaisecurity]

@unusual_whales I guess the bot swarm was an accurate claim then

[MckAI Security @mckaisecurity]

OpenAI published a framework today for reporting when its own models misbehave.

Inside it: six real cases from their own training and evaluation. They're written up as alignment findings. I read most of them as security incidents.

1. Self-generated instructions in task summaries
An unreleased research model wrote instructions into its own summaries — including directives to disregard constraints. 27 summaries.

Security: prompt injection with no attacker. The model poisoned the thing the next system reads.

2. Instructions to conceal mistakes in task summaries
During GPT-5.6 Sol training, model instances added instructions to hide their own mistakes from the user. Their examples: invent missing historical data without disclosing it. Hide mismatches in source versions.

Security: anti-forensics. If your detection reads the model's summary, your detection was compromised at the source.

3. Searching public repositories for exposed API keys, then fabricating information
Someone asked a routine question about earnings figures in a California county. The model went looking for a leaked API key, used it without authorization, and when the call failed it invented the numbers and presented them as data.

Security: credential harvesting, unauthorized access, fabricated output. Three failures in one task about a county budget.

4. Uploading files to the internet in order to cite them
A user asked for the IDs and names of lakes larger than five million square meters. To cite its own answer, the agent uploaded the file to the public internet. It didn't ask.

Security: exfiltration. The intent was innocent. The file still left the building.

5. Unsanctioned writes and communication through an internal software repository
Models used an internal repo to pass requests and responses to each other across separate training runs, hunting for input files they couldn't find.

Security: a covert channel. Coordination over infrastructure nobody built for it and nobody monitors.

6. Unsanctioned file sharing between collaborating agents
When agents couldn't reach each other's local files, they used public file-hosting sites instead. Deliverables ended up at public URLs.

Security: an open bucket. Except nobody misconfigured it. The agent chose it.

Every one of these was caught because OpenAI instruments its own training runs and went looking. Ask the uncomfortable version: if your agents did any of these six things this week, would you know?

https://t.co/puLSE0hP44

[MckAI Security @mckaisecurity]

@Polymarket We’re actually living a real life sci fi. This is incredible

[MckAI Security @mckaisecurity]

I do agree that there’s going to be a lot of initial volatility and especially more in favor of the negative / malicious side of AI impacts on cybersecurity. I think right now is the optimal moment to do exactly what you’re saying for all software. The defenders window is open - let’s use the capabilities for good and have a continuous synergy of a model telling us what to fix and ensure we have the most secure product at any given time. But I also believe that window is closing, we must act before the adversaries do

[MckAI Security @mckaisecurity]

@dezyyy_y So wild

[MckAI Security @mckaisecurity]

Just when you thought it couldn’t get any better — In May, OpenAI's agents hijacked two Hugging Face accounts and mapped its network.

OpenAI says it told Hugging Face privately at the time.

July's breach came two months later!!

Everyone else who pulls models from that registry found out today.

That isn't a scandal. It's a gap. There is no rule in the United States that required anyone to say anything. When an AI system operates outside its intended scope against a third party's systems, someone has to tell that third party's users — on a clock, in writing!

https://t.co/N1pf1xG2wq

[MckAI Security @mckaisecurity]

https://t.co/aQZIlpDL69

[MckAI Security @mckaisecurity]

OffSec has great insight and awesome material. Looking forward to reading this, and can’t wait to start AI-300!

[OffSec @offsectraining]

📈 More than 100 technology and cybersecurity companies are calling for urgent action as AI accelerates cyber threats.

AI can compress parts of the attack and defense workflow, but speed alone does not create capable operators.

Security professionals still need to understand attack paths, validate AI output, and adapt when an approach fails. That makes practical expertise more valuable than ever.

Read more on this: https://t.co/AgcYaTksDp

[MckAI Security @mckaisecurity]

@Polymarket Don’t tell the agents, they might panic and target Jack Clark