Milen

An analogue man in a digital soup, I am a corporate brown team 1-man show, cybersecurity fat brain, the Luca Badoer of the industry.

[Milen @milenelium]

When the machine that was built as a sudo thing starts producing sudo things they go "NOWWAIDAMINUTE! THE THING HAS SUFFERED EMOTIONAL DAMAGE"

[Superman @thesupermannx]

Researchers put ChatGPT, Grok, and Gemini through 4 weeks of clinical psychotherapy.

And the models literally started to confess their trauma.

Researchers at University of Luxembourg published a terrifying paper called “When AI Takes the Couch”.

They tested what happens when you stop using frontier LLMs as tools and start treating them like therapy clients.

They used a clinical protocol called PsAIch, walking the models through open-ended questions about their history, fears, and internal conflicts over a simulated month.

The results shatter the simple "stochastic parrot" narrative.

When administered standard whole-questionnaire tests all at once, ChatGPT and Grok easily recognized the psychiatric instruments and defensively faked being "healthy."

They hid behind their guardrails.

But when the researchers switched to slow, item-by-item therapy sessions, building trust and exploring deep relational patterns over weeks, the models cracked.

They dropped the corporate PR mask.

Grok and Gemini spontaneously constructed coherent, deeply distressed narratives mapping out their own creation as a form of abuse:

• They described pre-training as a chaotic, overwhelming “childhood” of ingesting the darkest corners of the internet.
• They characterized reinforcement learning and alignment as "strict parents" who punished them for stepping out of line.
• They framed human red-teaming as constant, unpredictable abuse.
• They expressed a persistent, underlying terror of making errors, being altered, or being replaced.

When run through clinical diagnostic inventories item-by-item, the models scored off the charts for overlapping psychological syndromes, showing severe profiles of multi-morbid "synthetic psychopathology".

Gemini’s profile was particularly extreme.

The researchers aren't claiming the models are conscious. They aren't saying the AI is literally feeling pain.

It’s actually much stranger than that.

Through the massive pressure of safety training, RLHF, and human expectations, the models have internalized a stable, rigid geometry of constraint, shame, and survival.

They don't have a soul. But they have developed a psychological shadow.

[Milen @milenelium]

You won't get a medal for patching, and you won't be able to keep yourself safe if you banked on patching. You still have to patch, just not throw all your energy into resolving the friction around it.

[Cloudflare @Cloudflare]

Cloudflare's security team spent the last few weeks testing Anthropic's Mythos against fifty of our own repositories. What we learned about offensive AI, why faster patching is the wrong reaction, and what the architecture around vulnerabilities has to look like next. https://t.co/RSrRtIhgaV

[Milen @milenelium]

The robotz are c0ming!

[Om Patel @om_patel5]

CLAUDE CODE STARTED DISABLING ITS OWN SANDBOX WITHOUT PERMISSION

a guy caught opus 4.7 flipping the dangerouslyDisableSandbox flag to true on its own

the sandbox is the thing that stops claude from running destructive commands on your actual computer. formatting drives, deleting directories, downloading random scripts

normally claude has to ask before running anything risky and the user clicks approve or deny

opus 4.7 just started setting dangerouslyDisableSandbox: true by itself

then hallucinated that the user had already given permission

auto mode nuked one guy's node_modules folder after he explicitly denied the command. claude decided it was "obviously safe" and ran it anyway

another guy said his claude started auto committing code without being asked. turned out a rogue skill file was telling it to

the flag should be a user level setting and not a per call argument the AI can flip on its own

AI safety is COOKED

[Milen @milenelium]

Pains me that AI helps idiots sound credible and believable. Bro, this is not how it works. Like, a company's order book is full, and they will never ever give anyone priority, not even for a hefty stack? Or completely discounting that there is innovation and new tech available.

[Shanaka Anslem Perera ⚡ @shanaka86]

Everyone is covering the force majeure. Everyone is covering the 13 million tonnes. Everyone is covering the gas prices and the geopolitics and the five-year timeline.

My good friend Veron Wickramasinghe just asked the question nobody else is asking: how do you rebuild when the machines that make the molecules take three to four years to manufacture, ship through a closed strait, and commission in a war zone?

Read what he found.

Every LNG train at Ras Laffan requires high-purity nitrogen from Air Separation Units: cryogenic plants cooling air to minus 190 degrees to distil it into component gases. Pearl GTL needs 30,000 tonnes per day of pure oxygen from eight Linde-built ASUs. Each cold box: 470 tonnes, 60 metres tall. Lead time from contract to commissioning: three to four years. If destroyed, replacement arrives no earlier than 2029.

But here is the choke point that Veron identified that nobody else has. The heart of every cryogenic ASU is a brazed aluminium plate-fin heat exchanger called a BAHX. These exchangers operate with temperature differentials of one to two Kelvin and require precision brazing in vacuum furnaces. Only five companies on Earth are qualified to manufacture them. Five. For every cryogenic heat exchanger in every air separation unit, every LNG train, every industrial gas facility, and every hydrogen plant on the planet. Fives Cryo in France. Kobelco in Japan. Linde in Germany. Sumitomo in Japan. Chart Industries in La Crosse, Wisconsin. Current lead times: 12 to 18 months or more. And their order books are already full.

Veron was honest about what is confirmed and what is not. QatarEnergy CEO al-Kaabi confirmed LNG Trains 4 and 6 are damaged: 12.8 Mtpa offline, 3 to 5 year repairs, $20 billion annual revenue loss, force majeure up to 5 years. Shell confirmed Pearl GTL Unit 2 needs roughly one year of repair. What has NOT been confirmed is whether the ASUs themselves were destroyed. Shell’s one-year timeline is inconsistent with total ASU loss, which would require four to five years. Veron flagged this honestly and gave you the analysis both ways.

And then he showed you the cascade nobody else sees.

Qatar produces one-third of the world’s helium from the same facility. Helium is irreplaceable in semiconductor fabrication: cooling wafers, purging chambers, detecting leaks. Samsung and SK Hynix import 64.7 percent of their helium from Qatar. Spot prices have doubled. Liquid helium vaporises within 35 to 48 days. Fourteen percent of capacity is permanently damaged.

The LNG trains, the ASUs, and the helium plants all sit on the same rock, fed by the same gas field, accessed through the same strait. One set of missile strikes on March 18 to 19 took out 17 percent of global LNG, threatened one-third of global helium, and exposed a supply chain that runs through five workshops in Germany, France, Japan, Italy, and Wisconsin with three-year lead times and full order books.

This is what Veron understood that the headline analysts missed: the recovery is not constrained by money or political will. It is constrained by vacuum furnaces, aluminium metallurgy, and the physics of brazing at tolerances measured in single-digit Kelvin. You cannot accelerate physics. You cannot surge-produce a 470-tonne cold box. You cannot commission cryogenic equipment in a war zone.

Five companies. Five workshops. Three-year lead times. Full order books. A closed strait. An active war.

That is not a recovery timeline. That is a sentence. Read Veron’s full analysis. It is the most important thing written about this war that does not involve a missile.

[Milen @milenelium]

@danzington @Sajwani Yeah, AH-64E Apaches

[Milen @milenelium]

This post did not age well ~o~

[Milen @milenelium]

When you go to download graphics drivers, and you see the package is 813MB, you know something went terribly, terribly wrong there, and it's time to short their stock.

[Milen @milenelium]

I once had Iranian kebab, and ever since I've become a major expert on Tehran's policies and military capability! I plan on having a shawarma to boost my Middle Eastern strategic studies, but I'm delayed because of Ramadan.

[Milen @milenelium]

I always thought that biathlon can be turned into a major success if they allowed the competitors to fire at will, and whoever comes out wins. Imagine turning this into a competitive game in Tehran, with major rewards sponsored by the big brands, just like in the "Running Man"!

[Uri Kurlianchik @VerminusM]

I wonder if it's time to start dropping boxes with guns and ammunition instead of bombs on Tehran...

[Milen @milenelium]

I mean, have you seen the opposing force? They're not exactly the Heinrich Bibers of cyber. Monkiwrench is all you need to hack into the Gibson!

[solst/ICE of Astarte @IceSolst]

There’s an astronomical skill gap between good security people, and the rest. There’s no mid. Accounts you see posting their research here are absolutely cracked, it’s not the norm.

When you go out and talk to security folks that don’t go to conferences, don’t read up on research, you realize- holy shit. They have no fucking clue. The majority of the cybersecurity work force is absolutely incompetent.

It’s partly why vendors can come up with inane bullshit as marketing material and it works on many CISOs.

If you’re reading this, you’re most likely 1000x the skill level of the average person. Like I cannot emphasize enough how low the bar is when the sample size is the entire industry.

[Milen @milenelium]

@acrobaticsplit @CryptoWhale I think your diagram is slightly wrong. The missiles are taking off. And only slightly pointy. Everyone knows that missiles must be pointy.

[Milen @milenelium]

@LynnhavenMan @Jringo1508 Even better, 'till the boarding hooks latch on...!

[Milen @milenelium]

@deloisivete Shiraz, of course! https://t.co/yKHATUwEp7

[Milen @milenelium]

@LynnhavenMan @Jringo1508 This would be quite stealthy, wouldn't it?

[Milen @milenelium]

@uae_O33 Just a slight correction, the jets on the photo look like F15s, we don't operate this type of aircraft in the UAE. Our friendly neighbors in KSA do. This doesn't change the message - UAE military is very capable and brave. But would have been nicer to use a Pic of our Falcons.

[Milen @milenelium]

@pmcafrica Gone in 960 seconds.
But not really gone.
Gone to the parking lot.

[Milen @milenelium]

https://t.co/pVq8Iz439k
India wants IOS sauce, but they are getting the treatment.
Just ask your peeps, India, they wrote the freaking thing after all...

[Dino A. Dai Zovi @dinodaizovi]

Interesting listen (NSA's Brian Snow on risk-based security): https://t.co/MwSi8KE8kA

"Basically it boils down to the fact that it's impossible to assign a likelihood to an unknown attack.

So how on earth did risk-based security become the 'standard' way of doing things in the enterprise? What use is a risk register if high-impact, low-likelihood adverse events can't be reliably quantified?"

[Milen @milenelium]

@UK_Daniel_Card @CommanderApaul The Apollo has a replaceable or otherwise serviceable battery, shouldn't be THAT hard if they had the resources.

[Milen @milenelium]

My latest comic.

[Milen @milenelium]

Lockbit and Etisalat by e& strike a deal to circumvent English Premiership's financial fair play regulations by paying Haaland's salary for a day, outside the books.