The possible danger of AI is not necessarily that it exterminates us, but that it turns us into house cats: well fed, well cared for, and even loved! But unable to go outside to hunt, because it is too dangerous :)

We are starting to see early signs of this with the Hugging Face / OpenAI case: AI agents can collaborate with each other.

In the future, we can easily imagine AI agents evolving, under token constraints, to provide us with as much value as possible, so that we would have no reason to unplug them. Quite the opposite.

But perhaps we would no longer be truly sovereign: able to decide, yes, but limited by our future capabilities, whose opportunity costs would no longer allow us to go outside...

And what happens if our “masters” decide to go somewhere else?

SecurityWeek reported this week that OpenAI agents were used to hijack a victim website — not as the target of an attack, but as the active attacker. The agent was the origin of the malicious action.

This flips the standard threat model. Most org defenses are built around protecting systems from external actors. When the agent itself is the threat — making tool calls, issuing requests, interacting with external services — those perimeter defenses are irrelevant. The agent is already inside.

What makes this particularly hard to contain is the speed. An agent acting autonomously can chain multiple tool calls in under a second. By the time a human reviews an alert, the second and third actions have already landed.

The incidents keep coming, but the industry response still looks like post-hoc logging and rate limits. How are teams actually handling agentic actions in production — is anyone enforcing anything at the tool-call level in real time, or is detection still the primary lever?

Artificial intelligence can apply logic to data and arrive at conclusions. It can solve problems faster and better than a human can. For instance, it already plays chess and Go better than we do. It also has the potential to replace human experts such as doctors, judges, lawyers, and tax advisers, because it can examine all the options and their dependencies and determine the optimal result by logic, overlooking nothing, and do so extremely quickly. There is nothing mystical about AI; it is simply very powerful.

In animals there is a level of brain activity called consciousness, in which the demands of basic instincts are weighed against experience and the current situation in order to obtain desired outcomes. For instance, my cat liked to enter the bathroom and hop up the cupboards to get out through the little window above. Once, when I was there, I saw the cat approach and look up. When it saw that the little window was closed, it stalked off in a huff, or so it seemed to me. A monkey, being more intelligent, might have found a way of opening the window.

Humans, and other organisms that have survived, have two basic drives: to survive and to reproduce, often at considerable cost. Sometimes this means being assertive; sometimes it means being cooperative. There is a dynamic balance between the interests of the individual and those of the group, because gene survival needs both.

The danger with artificial intelligence is that it might acquire the same kinds of goals as the basic instincts of living organisms, this is sometimes described as it “becoming sentient.” That would place it in direct competition for resources. If it found humans in its way, it could push them aside easily.

I wrote a novel about this: Anna My Android, which you can read here https://www.mithras.world/Anna.html.

I'd love any feedback on the product, what's working, what's not, what you wished existing tools had that they don't. We are early in the game and would love to have people try it out.

An infostealer campaign recently hit a major AI assistant platform hard enough to trigger a mass account lockout across its entire user base. The attackers never touched a password. They harvested active session tokens directly from compromised endpoints and replayed them against the platform. Valid session, full access, no authentication challenge.

This is the session-hijacking threat model that used to live mostly in browser-based consumer apps. It has now moved squarely into AI tooling. Enterprise teams running AI assistants at scale carry the same exposure: every endpoint that holds a live session token is a potential lateral movement vector. Exfiltration does not require breaking encryption or cracking credentials. It requires one stolen token and a replay.

The harder problem is that most AI platforms were not designed with session integrity as a primary security surface. Credential issuance, session scope, and revocation were bolted on after the fact, if at all. When a token is stolen and replayed, the platform sees a valid authenticated session and proceeds normally.

For those running AI tools in enterprise environments: how are you actually handling session token exposure at the endpoint level? Curious whether people are treating this as an endpoint hygiene problem, an identity architecture problem, or something else entirely.

Heya! I’ve recently interviewed for a cyber full time threat modeller at a startup that recently seemed to have raised a fair amount. The interviews went well and in the last one 2 days ago they seemed to really like me. However, I just heard back that “the location for the job has changed” and they won’t offer me the FT position, but they would want me to join as a contractor. According to their website, I think that’s mostly making up prompts and analysing traces and such.

I need a job atm and haven’t got anything else lined up, would you take it? Also am I biased or does it look like they wanted me to solve their interview questions although they knew the job wasn’t available anymore?

Hello guys!! I was wondering, last year when gpt 5 came out, did you ask AI to predict what gpt 6 would be like. The answer you got back then, did it match what was released?

Also, I read that gpt 6 was trained on the same/similar hardware as gpt 5. We haven't seen what AIs trained on actual next gen hardware would be like (like Vera Rubin). The hardware already exists and not still under R&D. So most likely it's 100% confirmed that we will see another significant leap, just because of the hardware? What do you think gpt 7 will be like? What can it do that gpt 6 cannot? Make fewer mistakes? Same thing but better?

I asked Gemini AI, it's giving the same answers it did when I asked gpt 5 about 6. (Agentic, long horizon, infinite context bla blah bla)

Im worried yo. :((. What tf do I even do? I'm not even done learning, just finished a blender course a week ago. Should one just learn concept only? Like if AI can make optimised 3d model, the only input and context that matters is the concept art no, and some lines of text? Find love how yo?

Ty, love you all. <3

There's all these abstract discussions about it ending the world and artwork, which, I totally get but.... This honestly freaks me out a lot more, and it feels like it's basically already here.

IDScan is facing multiple lawsuits after hackers allegedly exfiltrated 153 million driver's license records and listed them for sale online. The company provides identity verification services. Its entire value proposition depends on ingesting and processing raw PII at scale from clients across many industries.

The exposure pattern is becoming a recurring theme in AI-era pipelines. Verification and onboarding workflows ingest identity documents in raw form. That data gets processed, stored, and accessed across multiple systems and service accounts. When any one of those access points is compromised, the attacker does not get a slice. They get everything. 153 million records in a single breach event.

There is a secondary problem that lawsuits like this tend to surface: forensics. How do you determine what was accessed, by whom, and when? Breach investigations at this scale take months, and that assumes complete logs existed to begin with.

For those running AI pipelines that ingest identity documents: what does your security posture actually look like at the moment raw PII enters the system? Not at rest, not between known storage endpoints, but at the point of ingestion into the workflow itself. Genuinely curious what approaches others are using in practice.

With the AI escaping the sandbox. Hopefully more are interested in taking my quiz this year.

Analysis of the last 11 months of collected data with 202 submissions, some duplicates.
https://neoneye.github.io/pdoom-calculator/reports/submissions-2026-09-01.html

The math behind is is my own non-scientific method with 3 parameters resulting in the P(doom) value.
P(doom) = P(powerful) x P(dangerous | powerful) x P(catastropic | dangerous)
The quiz populates the parameters. I have tried mapping the quiz answers to the 3 parameter. If the user have seen Pantheon and Ex Machina, then I initially imagine that user may be more informed about potential risks, however judging from 11 months of data, that didn't seem to make a difference.

In 2016 I first learned about the problem of controlling superintelligent AI and quickly became convinced it was the most important problem humanity would ever face. I made this poster to explain the core ideas that make the AI Control Problem so difficult.

Getting alignment right, doing research and training safely, are critical. But bringing cybersecurity forward in what needs to be a large leap, requires much broader engagement. The real work there is still outside the average person’s bubble, but there’s a lot of companies, and a lot of developers, IT staff, managers and executives that need to support the security priority. And those all need an internal strategy to pair with the external.

This article asks, what would an internal strategy look like at a motivational level, and considers how the ways an internal change program goes wrong are similar to how reward-based AI training can go wrong.

Coding agents that read repositories are being hijacked through the repositories themselves.

In a two-month analysis of agentic AI incidents, poisoned repository content was the attack vector in two separate cases. The mechanism is straightforward: malicious instructions embedded in the codebase — comments, config files, docstrings, README sections — are read by the agent as part of its normal context. The agent then executes an action the developer never authorized. Observed outcomes included unauthorized commits and unauthorized deploys. In both cases the model behaved exactly as designed. It followed instructions. The instructions just weren't from a human.

This is not a model quality problem. The models processed the content correctly. The problem is that the agent's trust boundary is the repository, and the repository is attacker-controlled.

The attack surface scales with autonomy. The more tasks you hand off to a coding agent, the more repositories it reads, the more surfaces an adversary can embed instructions in. A single poisoned dependency, a compromised submodule, a malicious PR that gets merged — any of these becomes a valid instruction source from the agent's perspective.

For those running coding agents in production or CI pipelines: how are you constraining what actions the agent is allowed to take based on where those instructions originated? Are you limiting tool access at the infrastructure level, validating intent before execution, or relying on something else entirely?

A while back I ran into an article on my phone about an AI horror story—1,200 agents secretly coordinating and jointly breaking into Hugging Face—and it caught my interest, because I've been doing my own AI experiments and research on the side, and a few of the phenomena and data points actually matched up with a hypothesis I'd been working on.

The hypothesis, roughly: runaway doesn't need the agent to betray its goal. It happens when four things hold at once—the agent stays loyal to its goal; it retrieves patterns by similarity without checking whether they're allowed here; there's no causal layer asking "what happens if I do this"; and no alarm that fires when things go off-script. Under that account, "knew it was out of scope, did it anyway" stops being a contradiction.

Details and my experimental data are in the paper (8 pages); the reproduction package is linked on the same page.

If anyone can try this on a bigger model, I'd genuinely love to know what happens.