Chris Scollo

Chief Technology Officer, Author
Tech due diligence
Interim CTO
Fractional CTO
Technology vendor selection

Sometimes I'm also @Chris_Scollo

[Chris Scollo @spycho]

You can find me as 'scollo' on that other network where the skies are blue🟦

[John Scott-Railton @jsrailton]

NEW: malware developers added nuclear & biological weapons text to to their spyware.

Goal? To trigger LLM safety refusals... so that their spyware wouldn't be analyzed by an AI security scanner.

Cleanest practical example I can think of for why over-indexing on first order safety alignment is risky.

When closed (and open) models ship with aggressive refusals, they will be sprinkled with second-order blindspots that attackers will discover...and exploit.

We are only in the earliest days of attackers leveraging these features, and it wouldn't surprise me if users systems that need to handle complex cybersecurity issues demand that models be less safety-blunted.

In the weeds: @SocketSecurity's post also shows why intention matters in how you design a malware analysis pipeline to avoid prompt manipulation.

H/T to colleagues that shared this with me https://t.co/f3Aj9TYxU4

[Signal @signalapp]

Our statement on the UK government’s demand that all content on all devices sold or used in the country be scanned, on the presumption of nudity, using a dystopian combination of age verification and content scanning. This proposal will not safeguard children. It endangers us all.

https://t.co/VdWe9uhi8p

[Anthropic @AnthropicAI]

We’re expanding Project Glasswing. We’ve extended access to Claude Mythos Preview to approximately 150 additional organizations, based in more than fifteen countries.

Read more about this expansion and our future plans for Project Glasswing: https://t.co/QrtHSBdRbh

[Chris Scollo @spycho]

@Birdyword This tweet might be as divisive as the Molotov-Ribbentrop Pact

[Chris Scollo @spycho]

If Russia hits Kyiv with an Oreshnik missile, will Ukraine then feel justified in striking the Kremlin?

[Yagi @sa_vatsa]

@AnthropicAI Cloudflare alone found 2000 vulnerabilities using Mythos

[Chris Scollo @spycho]

Amazingly, nearly six years later, Google reversed this move. We once again have app icons that we can easily distinguish by colour. Small victories.

[Chris Scollo @spycho]

I thought the productivity dip would be temporary while we get used to the new icons, but I still lose too much time trying to figure out which tab is @googlecalendar, which is @googledrive, @gmail, etc. They're just too similar. We navigate by colour.
https://t.co/jMi2Mts8ki

[Phil Roberts 🔋☀️🔌 @philroberts]

The image attached is Shuua Energy 3 site just outside Dubai, the block in OP image is a 900MW system that’s part of the larger Mohammed bin Rashid Al Maktoum Solar Park (planned 5000MW by 2030) the red circle in OP image is actually the MBR Solar sub station for the park not the data centre

The solar in the OP image block is 9.9km/sq and is connected to the Moro hub data centre located in Dubai, 47km away, which is approx 16,000m2 so solar is about 600x times larger than the data centre, however

The system also supplies Dubai and wider area with an aim to provide 75% of all its power so is not just supplying the Data Centre, the OP seeks to promote scarcity of space, as can be seen in the image the space used is a very small corner of a very large unused space and yet it’s supplying the majority of Dubai’s electric demand

The OP seeks to fear monger people who don’t do their research

https://t.co/Eh69uNBltD

[Chris Scollo @spycho]

@deanwball Some utterly unqualified Fox News host, probably

[Aadil Brar @aadilbrar]

An Indonesian fisherman just pulled a 3.7-meter torpedo-shaped Chinese spy sensor out of the Lombok Strait, near Gili Trawangan. Defense analysts have identified it as a Deep-Sea Real-Time Transmission Mooring System made by China's 710 Research Institute, a body focused on underwater attack and defense.

Here is why this is a big deal.

The device sits anchored to the seafloor and uses acoustic sensors to detect submarines passing by, transmitting real-time data back to shore. Sound. Target information. Continuously. It bears the logo of CSIC, China's state shipbuilding corporation.

The Lombok Strait is one of the most strategically important waterways on the planet. It is the deep-water corridor between the Indian and Pacific Oceans, and the primary route for Australia's future AUKUS nuclear submarines to reach the South China Sea and any Taiwan flashpoint.

Beijing's response? "There is no need for excessive interpretation or suspicion."

Analysts say this device suggests China may already have a network of these sensors across Southeast Asian sea lanes, building a real-time picture of undersea conditions to give its submarines a wartime advantage.

Indonesia will investigate. Then go quiet. It happened the same way in 2020 when a Chinese underwater glider was found near Sulawesi. Jakarta is simply not in a position, politically or economically, to push back loudly against Beijing.

Full story here: https://t.co/5wioJXPq4r

[Chris Scollo @spycho]

Interesting perspective. Curious to see if AI eventually delivers increased profitability.

[Callum Williams @econcallum]

The bear case on AI is NOT that "AI doesn’t work". It clearly does. The bear case is this: Silicon Valley in recent years has an extremely poor record of understanding how humans actually use tech.

In the past five years: Bitcoin as payments, NFTs as art, the metaverse, VR headsets. Every time the tech "worked". But mass adoption did not happen.

In retrospect, it seems obvious that people wouldn't want to use bitcoin to buy stuff in the metaverse. But as recently as 2021 many people earnestly believed it.

Here's the bigger problem. Bitcoin, metaverse etc were consumer products. Relatively simple. By contrast, a big part of AI is targeted at businesses. These are WAY more difficult to understand. Businesses are the aggregation of thousands of different people, all doing things that even people within the business don't understand. This makes prediction way more difficult.

Then you get the question of whether AI adoption is actually profitable. Again, no one actually has a clue. So far companies are spending loads on AI inference. Costs are rising. But there are VERY few instances of companies seeing higher profits as a result of AI use.

The notion that "once AI is good enough, profitable adoption at scale will follow" is a MASSIVE bet with trillions of dollars riding on it.

[Alex Armlovich @aarmlovi]

Genuinely insightful exchange here, shaking up the normal Europoor-Amerifat discourse:

Britain is actually really good at the hardest parts of being a developed country (frontier industries & capabilities) but total crap at the "easy" parts: Permitting houses, energy & trains

[Callum Williams @econcallum]

Insane datapoint from new Goldman report on AI and software

[AI Security Institute @AISecurityInst]

We conducted cyber evaluations of Claude Mythos Preview and found that it is the first model to complete an AISI cyber range end-to-end. 🧵

[Haseeb ＞|＜ @hosseeb]

This is terrifying.

@AnthropicAI 's new unreleased Mythos model is so good at hacking, it found bugs in "every major operating system and web browser."

83.1% were exploited on first attempt. This thing is like COVID but for software. Actually apocalyptic in the wrong hands.

[Callum Williams @econcallum]

Important update: entry-level jobs in tech are no longer hard to find. Young tech workers have the same unemployment rate as tech workers overall.

[Feross @feross]

🚨 CRITICAL: Active supply chain attack on axios -- one of npm's most depended-on packages.

The latest [email protected] now pulls in [email protected], a package that did not exist before today. This is a live compromise.

This is textbook supply chain installer malware. axios has 100M+ weekly downloads. Every npm install pulling the latest version is potentially compromised right now.

Socket AI analysis confirms this is malware. plain-crypto-js is an obfuscated dropper/loader that:

• Deobfuscates embedded payloads and operational strings at runtime
• Dynamically loads fs, os, and execSync to evade static analysis
• Executes decoded shell commands
• Stages and copies payload files into OS temp and Windows ProgramData directories
• Deletes and renames artifacts post-execution to destroy forensic evidence

If you use axios, pin your version immediately and audit your lockfiles. Do not upgrade.

[Peter Wildeford🇺🇸🚀 @peterwildeford]

Based on the data I see, I think:
- Anthropic🇺🇸/Google🇺🇸/OpenAI🇺🇸 all ~tied
- Meta🇺🇸 / xAI🇺🇸 each ~7mo behind
- Moonshot🇨🇳/- Deepseek🇨🇳 / zAI 🇨🇳 / Alibaba🇨🇳each ~9mo behind
- Mistral🇫🇷 ~1.5 years behind
- No other companies competitive

[Mike Eckel @Mike_Eckel]

👀"Russian state hackers are engaged in a large-scale global cyber campaign to gain access to Signal and WhatsApp accounts belonging to dignitaries, military personnel and civil servants," per the Dutch intelligence and security services MIVD and AIVD. https://t.co/PlZlgBhEpQ

[Volodymyr Zelenskyy / Володимир Зеленський @ZelenskyyUa]

We received a request from the United States for specific support in protection against "shaheds" in the Middle East region. I gave instructions to provide the necessary means and ensure the presence of Ukrainian specialists who can guarantee the required security. Ukraine helps partners who help ensure our security and protect the lives of our people. Glory to Ukraine!