Hello FUD-tier AI readers!
Well, everyone else in cyber security seems to have a newsletter, so I thought I’d better do one. And there’s only one topic in town to focus on – and that’s frontier AI and its implications for cyber.
So welcome to FUD[1]-tier AI: your not entirely serious, weekly one-off overview of all the key recent developments in frontier AI and how it affects cyber security.
The big news over the past week:
The Window Is Closing! 100+ companies led by OpenAI warned us that time is running out to save ourselves and we need collective action on cyber defence.
Meanwhile, while all that was going on, OpenAI themselves published a further report on the unauthorised cyber activity by their agents against Hugging Face.
They also published an independent investigation by the non-profit METR, written by some of the best AI safety research talent in the world (yay)…
…although it then turned out this major cyber security incident report had no input from anyone with expertise in or experience of cyber security (less yay).
After the report, METR advertised for a cyber security forensics analyst and disclosed a cyber attack against them carried out via weaknesses in a vibe coded app.
While all this was going on, an influential writer wrote it all up as if it was a modern version of The Odyssey, and much of the world went yeah that’s how it is.
A well-evidenced technical rebuttal showing that the economics and tech structures of frontier AI incentivised exactly this behaviour got much less traction, obviously.
A Turing Award winning AI scientist put this alternative narrative more pithily: “our airplane crashed when we instructed our autopilot to run into the ground at all costs after removing the low-level anti-crash safety mechanisms”
Separately, not to be outdone, Anthropic published more details of its own troubles with agentic intrusions
This included a commitment to introducing the concept of robust sandboxing (ie tests disconnected from the Internet) as the default in testing environments.
Digital historians unearthed evidence that sandboxing has in fact been standard practice in cyber security since the digital early medieval period, c.2009-11.
Claude agreed it was interesting that AI labs lag malware ones in testing procedures by some 15 years.
But yes, remember. This is a cyber security problem. Oh yes.
It’s not about applying, or choosing not to apply, a long understood and fundamental social and legal principle to frontier AI companies. That’s the principle of accountability for the products and services you provide. A principle understood and applied by ancient civilisations four thousand years ago.
But no! It’s a cyber security challenge. That’s obvious. Because that makes sense. Of course it does. And remember: the window is closing!
In other news:
Blah blah blah MACHINE SPEED ATTACKS blah blah blah. (Please note the link, like the phrase, is gibberish and leads nowhere useful)
A British cyber security expert shows you how to defeat ALL the machine speed attacks (this one is actually very useful)
By the time of the next newsletter, this will definitely have happened (note to editor – keep this in the template for all future issues).
Wise words for the week
“Show me the incentive and I’ll show you the outcome”: Charles T. Munger, investor
“Well he would [say that] wouldn’t he?”: Mandy Rice-Davies, model and, as it turns out, prophet of AI era
Till next time
Am I doing this right? Feedback and suggested content for next issue please.
Actually maybe not.
I never want to have to do this again.
[1] For the happily uninitiated, FUD stands for Fear, Uncertainty and Doubt, and is a pejorative term long used in cyber security to describe vendor marketing-fuelled fears of the digital apocalypse in order to sell stuff.
You got the appropriate tone for the BS of the various AI companies :-)