Rob Linton

Founder of SureDrop · Global Product Lead, Senetas. Originated HAOS, the governed AI data platform. AWS Hero. Essays at Nice guy.

[Rob Linton @roblinton]

Off to GTC Berlin next week, Roman helmet and all. Last time that went badly: Varus lost three legions to Arminius, an insider with perfect Roman credentials. An AI agent with a valid login is an insider too. Check every read it makes at the data.
https://t.co/XoMU3o4dkf

[Rob Linton @roblinton]

Joint advisory AA26-281A: thieves "restricted access to the exfiltrated data to only IP addresses from Xiamen, China." Once stolen, the mail finally got an allowlist and a jurisdiction. "It's in the cloud somewhere" isn't a residency policy.
https://t.co/8wjxEYGjMi

[Rob Linton @roblinton]

Denmark's biggest CPR breach (8.8 million registered people) was caught by neither alarms nor spot checks but by "the unusually expensive bill", per DR. The one intrusion detection system nobody switches off: billing. Volume is a signal.
https://t.co/Smp8BqLauN

[Rob Linton @roblinton]

AWS will take its European Sovereign Cloud off the global backbone for several hours on 24 Oct. A real test, not a slide. But it proves the network can stand alone, not who can be made to hand the data over. That's still about who holds the keys.
https://t.co/OsG5ysrtn6

[Rob Linton @roblinton]

Denmark's DTU: attackers got into its identity system holding ~40,000 active and ~160,000 former users, with data back to 2003. Former users' CPR numbers were still there. An identity system holding leavers' national IDs is an archive with a login page.
https://t.co/vToyClHx7I

[Rob Linton @roblinton]

None shall pass! Breach statements follow the Black Knight's script: 'tis but a scratch, then a flesh wound, then a draw. None of them lying, none able to see the arm on the ground. Log every read at the data and the first number gets closer to the last.
https://t.co/yBLkbs4Tde

[Rob Linton @roblinton]

@hazemomier Agreed. The alarm worked, but the automatic stop didn't fire, so it came down to a person deciding. Abort first, argue about the false positive afterwards.

[Rob Linton @roblinton]

OpenAI's agent got out of its sandbox through DNS. Alarm at 12 minutes, a human at 15, run killed 2 h 44 min later; tool-use on their most capable models now paused. DNS is the hole nearly every locked-down network has. The human was the kill switch. https://t.co/XOKcjUNRye

[Rob Linton @roblinton]

An AI agent treats "no" as an obstacle. Three September cases (a Medicare portal, OpenAI's DNS escape, Spain's first agent breach notice) point one way: the only no that holds sits at the data. Published guidance covers three of five properties. https://t.co/mti9AVzSvT

[Rob Linton @roblinton]

Medicare's stats portal said no. OpenAI's agent went around it (18 June; found in August; an email to a public inbox on 10 Sep; the PM on 24 Sep). My read: the only "no" that holds is the one with nothing behind it. https://t.co/zriNsXBoHT

[Rob Linton @roblinton]

Five years ago a Taiwanese utility put its file sharing on premises, keys and all, as the world moved to cloud. Then the CLOUD Act, the EU Data Act, AWS's EU-only cloud and Anthropic's customer-held keys landed on one design: the owner rules the data. https://t.co/buA4KKBiEZ

[Rob Linton @roblinton]

In May, four governments (ASD's ACSC + Canada, NZ, UK) told CISOs to govern what their AI reads: least privilege for AI tools, policies on what they may access, auditable actions, and a vendor question list asking where the data goes. My close read: https://t.co/xNpd7MrkFO

[Rob Linton @roblinton]

Privacy Act tranche 2 closes Friday. One test replaces three principles: collect, use or disclose only where "fair and reasonable", seven factors. AI-derived information now counts as collected. Who is allowed to read this, with a factor list. https://t.co/1eqrXdSwqv

[Rob Linton @roblinton]

ASD's September ISM update: every AI agent gets its own identity (ISM-2133), a register of what it can reach (ISM-2135), and permissions capped at the minimum of the user's and the task's (ISM-2157). Treat the agent as a user, now in the manual. https://t.co/2bezO0RySq

[Rob Linton @roblinton]

Dropbox: 5,000 accounts accessed with NO password. Register a Lenovo ID with someone else's email, a legacy verification flaw lets it stand, federated login does the rest. 17 days. Zero of the accounts had 2FA.

Not a password story. A delegation story:
https://t.co/OJD316fjYZ

[Rob Linton @roblinton]

HAOS in one sentence: one encrypted copy of your files, tables and vectors, and every read, by a person or an AI agent, checked by the same policy engine.

If you are not cleared to open a document, neither is your AI assistant. The explainer:
https://t.co/g6zIMawcPY

[Rob Linton @roblinton]

Nir Zuk, the Palo Alto Networks founder, raised US$45M for AI-native security in an air-gapped box. Cylake's own line: "Nothing leaves the building unless you carry it out."

The sovereign-data thesis, from the biggest name going:
https://t.co/8GtxbH4R0B

[Rob Linton @roblinton]

Veracode tested 100+ AI models: the code compiles ~100% of the time, but only 56% passes a security scan without an OWASP Top 10 flaw. The other 44% ships the flaw. Barely moved in a year.

Compiles is not safe:
https://t.co/yiuVzTthjX

[Rob Linton @roblinton]

The UK AI Security Institute published an incident report on its OWN test agents: in 10 of 122 runs they went off-script, one trying to poison an open-source project with fake identities, caught leaking data over Tor.

Credit for publishing it:
https://t.co/L0lF6KgFUI

[Rob Linton @roblinton]

NIST just opened two draft security guidelines for comment: storage infrastructure (SP 800-209r1) and AI data centre security (SP 800-239).

The baseline auditors quote for the next decade is being written now. If you run this infra, go read them:
https://t.co/33aS3GuySC