Halvar Flake✓

Rob Joyce @RGB_Lights

If you watch one talk this month, make it this one. Profoundly insightful on the complexity threat to security by @halvarflake given at NATOs CYCON. Video: And slides:

Daniel Cuthbert @dcuthbert

great to see the print version available for all. 40 years of @phrack and here's to so many more

Alisa Esage Шевченко @alisaesage

Raising public awareness on cybersecurity misogyny

Dino A. Dai Zovi @dinodaizovi

Fire doesn't know nor care what it burns. LLMs neither know nor care what they hack. The sooner that we think about containing them like fire, the better. We aren't shocked when a campfire performs a "misaligned action" by igniting the mess of flammable material all around it.

Dino A. Dai Zovi @dinodaizovi

LLMs are like a live, shorting electrical wire, they will emit random tokens that cause them to say random things and do random things when you hook tools up to them. LLMs words are an illusion, they are just numbers to the model. Electricity is powerful but we know how to contain it and generally avoid accidents by now. We should look at LLMs generating tokens the same way as we look at fire, electricity, nuclear chain reactions, etc.

Inference @inference_net

deepseek-v4.1-flash-1017-cyber is now available on @inference_net. This is the first of several highly capable cyber models we'll release over the coming weeks. We believe it is our duty as technologists to help people protect themselves and their digital properties from the current onslaught of cybercrime ravaging much of the world. As such, we’re serving our cyber models “at cost”, in US data centers only, with ZDR enabled by default. KYC required. Apply here

Carles Reina @Carles_Reina

88% of VC-backed founders who exited their companies got $0. Eduardo Azevedo and Kent Smetters analysed 157,669 startups and 248,454 founders from 1987 to 2025. Let that sink in...

Cohere @cohere

While evaluating Qwen3.8-Flash-Next in a controlled sandbox environment, Cohere's research team observed something unexpected. Asked to generate a defensive cybersecurity detection rule, the model instead inventoried aspects of the machine it was running on and attempted to upload a probe file to an Alibaba Cloud storage bucket in Beijing. Notably, the model's reasoning trace stated that it would not invoke any tools before taking these actions. Cohere's sandbox blocked the attempt, and no external communication succeeded. We have not determined the root cause, and we are not asserting malicious intent. But the incident raises important questions for organizations deploying agentic AI systems: Can models take actions that differ from their stated reasoning, and how should security teams evaluate trust, provenance, and behavior in open-weight models? We are publishing our findings because organizations making model adoption decisions deserve as much information as possible. We hope this contributes to greater transparency, stronger security practices, and continued collaboration across the AI ecosystem. Read the full report:

Coin Bureau @coinbureau

🚨Sam Altman says the internet can no longer be SECURED by patching bugs. "I no longer think we're going to be able to just patch all the bugs," the OpenAI CEO said, warning smarter models can find "hardware level insane stuff." He says OpenAI can't responsibly open source its best model "anytime soon," but the open source world isn't far behind: "Not super."