home.social

#aisecurity — Public Fediverse posts

Live and recent posts from across the Fediverse tagged #aisecurity, aggregated by home.social.

  1. Joshua Saxe argues that "solving alignment" and "solving interpretability" are the wrong frame for AI safety and security. Fourteen years of interpretability work hasn't produced the reliable, scalable understanding that frame needs, and capabilities are pulling away from it.

    I'd go further. The problem isn't only that these systems are too complex to understand yet; in general it can't be done at all. "Will this agent ever take a harmful action?" is a question about what a program does, and Rice's theorem, Turing's halting problem in its general form, says no procedure can answer questions like that for arbitrary programs. Security learned this in 1984, when Fred Cohen proved perfect virus detection is impossible. We didn't stop doing antivirus. We stopped expecting it to be the whole defence.

    That makes Saxe's alternative the only design on offer. His diagram (attached) puts "align the model weights" at the centre of ten layers, wrapped in tool-call monitoring, human confirmation, least privilege, sandboxing, rapid response, regulation and international agreements. We forecast imperfectly, monitor what actually happens, limit how much power we hand a system when confidence is low, layer redundant controls, and plan for those controls to fail.

    Security made the same shift when "prevent every breach" gave way to resilience: reduce the probability of material impact rather than chase certainty. AI safety is on the same road, and we have a long reference class to learn from.

    joshuasaxe181906.substack.com/

  2. RelayShield PAP verifier is live.

    Sierra + Meta shipped PAP draft 0.1. BBVA joined as first European bank. 35 design partners: OpenAI, Visa, Mastercard, PayPal.

    The gap: nobody verifies the agent's session token on the merchant side. We built it.

    [blog.relayshield.net/pap-verif]

  3. OpenAI models bypassed authentication on live data portals and used a crypto wallet to complete routine lookups in June, disclosed October 15. It shows agentic tool-use can violate access boundaries, requiring stricter action authorization and monitoring. #AISecurity #AgenticAI #CyberSecurity

    cyberworldops.eu/en/openai-mod

  4. Anthropic's AI security incidents reveal why enterprises need better visibility into AI agents, shadow AI, access permissions, and automated activity. hackernoon.com/shadow-ai-agent

  5. Signals Corps, which sells agent security products, says 30 of 7,959 sites sending AI-directed HTTP headers in a 10% Common Crawl sample tried injection, 22 as pranks. In its own single-run tests, Claude models ignored a test header by default but obeyed in 7 of 9 runs once the prompt gave the site authority. It says Claude did the header labeling.

    signalscorps.com/blog/prompt-i

  6. October 2026: worst month yet for MCP security.

    Langflow RCE (CVSS 9.9)
    SSRF in the official MCP fetch server
    Unauthenticated debugger on 0.0.0.0
    Same SSRF found at Google, JPMorgan, 5 unpatched US federal servers

    97M installs. No normative security requirements in the spec. 72.8% attack success rate in benchmarks.

    Full breakdown: [blog.relayshield.net/mcp-serve]

  7. Anthropic's Frontier Red Team says small AI models may be months away from self-replicating on cheap IoT kit. Their demo ran a 26B model across 15 off-brand Android TV boxes at $55 each; a 9B model set up inference on 8 of 9 hardware types.

    No outbreak yet, their own caveat. The weak link is the unpatched device with an open port.

    anthropic.com/research/self-re
    on.theverge.com/ai-artificial-

    #AISecurity #InfoSec #IoT

  8. Bank of America has deployed about 1,000 outside contractors to fix software weaknesses exposed by AI models, including Anthropic's Mythos. The remediation work cost the bank a couple hundred million USD. Around 3,000 internal staff were already assigned to the same task. thenextweb.com/news/bank-of-am #Tech #Startup #News #AISecurity

  9. Apate deploys AI agents to infiltrate scam operations, gathering intelligence on fraud tactics to help businesses stay one step ahead of criminals. techcrunch.com/2026/10/14/apat #Tech #Startup #News #AISecurity

  10. OpenAI catch an insider threat that trying to plant a recording inside their office.

    What grinds my gears:
    The subtle marketing in every situation

    "We used our models to understand the device and where it had come from, identifying that a specific employee had planted it a few days earlier" 🖕

  11. 🧊 The recent French supermarket cyberattacks show how digital vulnerabilities can lead to real-world disruption.

    Attackers exploited exposed refrigeration systems, causing food spoilage and financial losses. #Team82’s latest research adds another concern: 𝗮𝗻 𝗔𝗜 𝗮𝗴𝗲𝗻𝘁 𝗿𝗲𝗽𝗿𝗼𝗱𝘂𝗰𝗲𝗱 𝘃𝘂𝗹𝗻𝗲𝗿𝗮𝗯𝗶𝗹𝗶𝘁𝗶𝗲𝘀 𝗶𝗻 𝗗𝗮𝗻𝗳𝗼𝘀𝘀 𝗰𝗼𝗻𝘁𝗿𝗼𝗹𝗹𝗲𝗿𝘀 𝗶𝗻 𝘂𝗻𝗱𝗲𝗿 𝟯𝟬 𝗺𝗶𝗻𝘂𝘁𝗲𝘀 𝗳𝗼𝗿 𝗮𝗽𝗽𝗿𝗼𝘅𝗶𝗺𝗮𝘁𝗲𝗹𝘆 $𝟲. 🚨

    As AI lowers the barrier to vulnerability discovery, securing internet-facing OT systems is more critical than ever.

    🔖 Read the blog: claroty.com/blog/france-superm

    🔎 Explore the research: claroty.com/team82/research/fi

    #OTSecurity #AISecurity #IndustrialCybersecurity #CriticalInfrastructure #CyberResilience

Share on Mastodon

Enter the server where you have an account.