#swsec — Public Fediverse posts

Is Microsoft super amazing good at #swsec these days? Why no...they are not. This is a very obvious front door attack through parameter manipulation. Absolutely ridiculous. #MKsec security engineering is directly corrupting #swsec #appsec #security because #ML treaded as an insider not good.

https://arstechnica.com/security/2026/08/microsoft-copilot-reveals-secret-input-that-allowed-it-to-be-hacked/

@gcve @aristot73 @trailofbits @jamesberthoty @jackhcable We are not really focused on #swsec as much as #MLsec at BIML. Thank you for the suggestion, though.

This is hilarious. Counterfactual #MLsec versus #swsec failure reads like a blueprint of what will happen.

https://nesbitt.io/2026/06/26/incident-report-cve-2026-lgtm.html

The saga continues. Both the US government and Anthropic look like fools. #MLsec #swsec

https://www.nytimes.com/2026/06/26/technology/anthropic-mythos-government-restrictions.html

Good coverage in the NY Times of the mythos/fable situation, including wise advice from @k8em0

Security tools cut both ways. Fix the broken software.
#swsec #MLsec #AI #ML

https://www.nytimes.com/2026/06/17/technology/anthropic-trump-administration-fable.html

BIML on the #AI export control dustup

#MLsec #swsec #ML

https://berryvilleiml.com/2026/06/13/irony-the-us-government-issues-an-export-control-directive-for-fable-5-and-mythos-5/

The Silver Bullet Security Podcast is released on the first of every month. Since rebooting this year, we have published 4 episodes:

https://berryvilleiml.com/podcast/

Previous 153 episodes

https://www.garymcgraw.com/technology/silver-bullet-podcast/

Current episode

https://berryvilleiml.com/2026/06/01/silver-bullet-security-podcast-157-tim-schulz/

Please have a listen and pass it on.

#MLsec #swsec #appsec #infosec #security

Yesterday's news on #AI worms (with a bunch of my thoughts folded in).

Last word? Fix the damn software! #swsec
#MLsec

https://fortune.com/2026/06/03/a-new-ai-powered-computer-worm-could-prove-to-be-the-stuff-of-cybersecurity-nightmares/?sge456

#AI powered worm? Sure why not.

#swsec #appsec and #MLsec require more investment now

https://fortune.com/2026/06/03/a-new-ai-powered-computer-worm-could-prove-to-be-the-stuff-of-cybersecurity-nightmares/?sge456

The Silver Bullet Security Podcast is released on the first of every month. Since rebooting this year, we have published 4 episodes:

https://berryvilleiml.com/podcast/

Previous 153 episodes

https://www.garymcgraw.com/technology/silver-bullet-podcast/

Current episode

https://berryvilleiml.com/2026/06/01/silver-bullet-security-podcast-157-tim-schulz/

Please have a listen and pass it on.

#MLsec #swsec #appsec #infosec #security

Taylor has something to say about BIML's new work. #MLsec #swsec #appsec #infosec #LLM #ML #AI

https://medium.com/@taylor.armerding/we-know-ai-tools-can-be-used-for-good-and-evil-714a7aa8e4b3?postPublishedType=initial

@RichBartlett it was a bummer but not at all surprising to see real #swsec degenerate to box checking #appsec a decade ago

@sparta amazing how when you spend money (tokens) on #swsec you do a better job of it. Who would have thought?

@paco tokens = money. We are finally spending real money on #swsec

@coreysnipes thank you.

I have been at this for a while ...both as a security guy who helped get #swsec and #appsec going 28 years ago and as a student of Doug Hofstader's with a Ph.D. in #cogsci. BIML has been spearheading independent #MLsec since 2019.

More on mythos. #swsec #appsec #MLsec #ML #AI

"What changed with Mythos Preview is that a model can now take those low-severity bugs (which would traditionally sit invisible in a backlog) and chain them into a single, more severe exploit."

https://blog.cloudflare.com/cyber-frontier-models/

The one good thing about the mythos nonsense is at least broken software is finally being fixed. If that's what it takes, so be it. #swsec #appsec #MLsec

https://www.theguardian.com/technology/2026/may/18/anthropic-ai-claude-mythos-cyber-financial-stability-board-fsb

Registration requirement for access to our new paper "No Security Meter for AI" has been removed due to urgency of content and to promote frictionless distribution

https://berryvilleiml.com/results/no-security-meter-ai.pdf

Please consider registering, which enables you to receive email notifications from BIML.

#MLsec #ML #AI #infosec #swsec #appsec

Have you read BIML's new report No Security Meter for AI?
#MLsec #ML #AI #swsec #appsec

https://berryvilleiml.com/results/no-security-meter-ai.pdf

We removed the reg wall this morning.

Qualcomm Security Summit 2026 #swsec #MLsec

https://www.qualcomm.com/company/events/product-security-summit

How can you measure security in #ML systems? Maybe similarly to the way we measure security in software systems. #swsec #appsec

BIML wrote about this in a new report released today: https://berryvilleiml.com/results/

Get your copy now, released for free under a creative commons license.

Applied #MLsec

How can you measure security in #ML systems? Maybe similarly to the way we measure security in software systems. #swsec #appsec

BIML wrote about this in a new report released today: https://berryvilleiml.com/results/

Get your copy now, released for free under a creative commons license.

Applied #MLsec

The excellent @dennisf interviews me about BIML's new paper "No Security Meter for AI"

Have a listen. Then read our report.

#MLsec #ML #AI #security #infosec #swsec #appsec

https://open.spotify.com/episode/74QW2kzelVz5VtglXlA87s?si=ll7a2xo0Rx2FSmyq-_8-HQ

https://berryvilleiml.com/results/no-security-meter-ai.pdf

@koehntopp @tychotithonus this is literally changing in real time. I used to believe that too. And as you know. I know a smidge about #swsec
You two may both enjoy reading this new thing released this morning
No Security Meter for AI
https://berryvilleiml.com/results/no-security-meter-ai.pdf

Email me if the reg wall bothers you too much

@tychotithonus in the best of all possible worlds, all this #AI stuff will accelerate #swsec and #appsec so we can finally do what we know we should have done since 2001

BIML is proud to release a new study today:
No Security Meter for AI

#AI #ML #MLsec #security #infosec #swsec #appsec #LLM #AgenticAI

https://berryvilleiml.com/results/no-security-meter-ai.pdf

BIML is proud to release a new study today:
No Security Meter for AI

#AI #ML #MLsec #security #infosec #swsec #appsec #LLM #AgenticAI

https://berryvilleiml.com/results/no-security-meter-ai.pdf

@danielkennedy74 BIML is proud to release a new study today:

No Security Meter for AI

#AI #ML #MLsec #security #infosec #swsec #appsec #LLM #AgenticAI

https://berryvilleiml.com/results/no-security-meter-ai.pdf

BIML is proud to release a new study today:
No Security Meter for AI

#AI #ML #MLsec #security #infosec #swsec #appsec #LLM #AgenticAI

https://berryvilleiml.com/results/no-security-meter-ai.pdf

So how is it going in the #swsec and #appsec tools and services space in the age of #mythos?

"Mythos is like a nuke going off in the middle of our industry. Most of our biggest clients who have used it figure they will get rid of all their pipeline tools and replace with mythos. Toss the findings to copilot (or their own agentic engines) and have them fix the bugs. And completely get rid of Pentesting. Synk renewals are at 30%, BlackDuck at 60%."