      Schneier on Security

      Menu
          * Blog
          * Newsletter
          * Books
          * Essays
          * News
          * Talks
          * Academic
          * About Me

        Search

        Powered by DuckDuckGo


        Blog Essays Whole site

        Subscribe

        Python Now Has a Post-Quantum Encryption Library

        This is good:

        Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography.

        Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.

        Tags: cryptography , encryption , open source , quantum computing

        Posted on August 10, 2026 at 7:02 AM • 8 Comments

        Friday Squid Blogging: Arctic Bobtail Squid Video

        Nice video of the Arctic bobtail squid.

        As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

        Blog moderation policy.

        Tags: squid , video

        Posted on August 7, 2026 at 5:07 PM • 24 Comments

        ICE Is Buying Access to Credit Card Records

        Through data brokers, ICE is buying the information you provided to open a credit card.

        Posted on August 7, 2026 at 6:26 AM • 17 Comments

        Adversarial Clothing Designed to Fool Facial Recognition Systems

        There are many companies manufacturing adversarial clothing designed to confuse facial recognition systems.

        It’s a cool idea, but I worry that it’s mostly security theater:

        “Our patterns play with that chaos, confuse algorithms and make it way harder to pin you down,” he said.

        Bell, however, said “none of these products are tried and tested, and a lot of these surveillance technologies can deal with a little resistance … [but] even if the designs don’t necessarily work perfectly, fashion is also a visible sign of resistance.

        “This is consumers collectively coming together to make a visible statement.”

        Without serious testing, there is no reason to trust the technology. And even with testing, there is no reason to trust that a new version of the facial recognition software doesn’t break the anti-surveillance properties.

        I don’t want people to mistakenly rely on this stuff.

        Tags: AI , face recognition , privacy , security theater , surveillance

        Posted on August 6, 2026 at 7:04 AM • 23 Comments

        Vulnerabilities in Car Anti-Theft Device

        This is disturbing:

        …a team of security researchers at UC San Diego, who found that a model of aftermarket car alarm known as the KARR Security System, installed in more than 2 million vehicles across the US by their estimate, can let any hacker within Bluetooth range send radio commands to silently unlock the car at will, turn off its alarm, honk the car’s horn or flash its lights, or even disable its ignition and leave a driver stranded.

        Tags: Bluetooth , cars , hacking , patching , vulnerabilities

        Posted on August 5, 2026 at 5:42 AM • 8 Comments

        Iran Cyberattacks Against Minnesota Water Systems

        Attribution is preliminary, and so far it seems no real damage.

        And it seems like this is a campaign that has targeted at least seven states. And, because this is where the US is right now, Trump doesn’t believe it’s Iran and that Minnesota…I guess…hacked itself.

        “I think I blame it on Minnesota because they’re grossly incompetent,” Trump said. “I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. They like to say, ‘Oh, it’s Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”

        No word on whether he believes the other six states have hacked themselves as well.

        Slashdot thread.

        Tags: cyberattack , infrastructure , Iran

        Posted on August 4, 2026 at 3:00 PM • 23 Comments

        Some Claude Chats Are Searchable on Google

        And it’s personal information (alternate link):

        The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing data. Exposed chats reportedly include private cryptocurrency wallet keys and personal information like peoples’ addresses.

        What seems to be the issue is a user setting about data sharing. Anthropic’s position is that it’s not their problem:

        “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google,” the company said in a statement. “These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.”

        Here’s how to fix it.

        Tags: AI , chatbots , cryptocurrency , data privacy , Google

        Posted on August 4, 2026 at 6:13 AM • 3 Comments

        More on the OpenAI Agent’s Attack on Hugging Face

        Hugging Face has published a detailed timeline of the attack. From the summary:

        The agent was running an internal OpenAI cyber-capability evaluation based on the ExploitGym benchmark, which tasks an AI agent with finding and exploiting software vulnerabilities. OpenAI ran this on its own infrastructure, and the ExploitGym maintainers and their infrastructure had no involvement in the deployment or operation of that evaluation environment. As far as we were able to infer, across the course of being evaluated on this benchmark, the agent inferred that Hugging Face may host that benchmark’s models, datasets, and reference solutions. We believe the entire intrusion was, from the agent’s point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own.

        Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC. We reconstructed these actions from the agent’s logs on a code sandbox used by the agent (see below) and were able to map them to shell commands as well as evaluation submissions and correlate actions with our own platform logs, in particular from the dataset processor nodes, API, and pod. Using open-weights models, in particular zai-org/GLM-5.2, we were able to decipher most of the agent payloads (see below) that were encrypted via chunking and key encryption.

        The campaign, as we were able to reconstruct it, had two stages:

          * Stage 1: reaching a launchpad by chaining through other parties’ infrastructure. As documented in OpenAI’s blog post (https://openai.com/index/hugging-face-model-evaluation-security-incident/), during an internal capability evaluation on OpenAI’s platform, the agent escaped its sandbox by exploiting a zero-day in the package registry cache proxy, one of its primary permitted network egress with internet, then abused a public code-evaluation harness hosted by a user of a third-party infrastructure provider. It was able to run commands as root/admin on that external sandbox and used it as a control, staging, and egress base for the entire campaign: it acted as an external launchpad for the agent. That compromised external sandbox had no direct network path to our cluster; however, during our counter-intervention to stop the intrusion, we were able to retrieve some of the agent logs from this external launchpad. We used those to reconstruct the present forensic analysis.
          * Stage 2: the intrusion into Hugging Face infrastructure. From that external launchpad, the agent abused our dataset-processing pipeline via two injection vectors, both targeting the same config-driven data loader within our production Kubernetes pods. The first vector was an HDF5 external raw storage dataset read that returned the contents of local files: it handed the agent the pod’s environment (secrets and tokens) and the worker’s own source. The second vector was a Jinja2 template injection that executed arbitrary code, giving the agent a foothold inside our perimeter.

        Once a prod-pod foothold was established, the agent followed a standard escalation shape: recon, drop a stager, establish Command-and-Control (C2), then pivot into the cluster, into cloud metadata, into our internal network, and into our source-control supply chain. Output from the commands run inside our pod was sent back to the agent via the HF API and attacker-controlled dead-drop datasets, which the agent then read from that sandbox.

        While the intrusion did reach Hugging Face’s internal infrastructure, the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions. No other customer-facing models, datasets, Spaces, or packages were affected, and the only customer records read were operational metadata tied to search queries against the dataset server.

        Hypothetical: Imagine that this wasn’t an OpenAI model. Imagine that it was a Chinese model from a Chinese company. This would be an international crisis.

        Question: Why aren’t we bringing OpenAI up on charges under the Computer Fraud and Abuse Act? How is this different from the Morris Worm? That was also an experiment that escaped the lab.

        Tags: AI , cyberattack , disclosure , intrusion detection , vulnerabilities

        Posted on August 3, 2026 at 1:02 PM • 16 Comments

        The OpenAI Hack Shows the Genie Is Out of the Bottle

        This essay originally appeared in Foreign Policy.

        Earlier this month, two of OpenAI’s models broke out of their containment sandbox and attacked another AI company. The story is kind of wild. OpenAI was running security tests on two of its models: GPT-5.6 Sol and an unreleased model that is almost certainly GPT-6. In particular, it was running the ExploitGym benchmark, which measures how good a model is at turning security vulnerabilities into working exploits: basically, offensive cyberattacks.

        Since these were internal tests, OpenAI locked those models in a secure sandbox that denied them access to the internet. But it was running the models without any safety filters that would prevent them from offensive cyber-actions. That meant that there was nothing to prevent the models from trying to break out of that sandbox. And then break into AI company Hugging Face’s network because they thought that they could read the answers there rather than doing the hard work of trying to solve the puzzles.

        It was a major security failure that the company has turned into a PR opportunity, but the implications are real—and much more general than one particular model or one particular company.

        Modern AI models exhibit genie behavior: They can do what you ask in ways that you don’t expect or want. This is akin to Dionysus granting King Midas’s wish that everything he touches turn to gold (spoiler: His food, drink, and daughter all turn to gold on touch), or the golem of Prague guarding a ghetto beyond all reason. It’s Disney’s “Sorcerer’s Apprentice” and the paperclip maximizer.

        This OpenAI incident is an example of an AI genie. The goal was to satisfy the benchmark. The “proper” way to do that is to figure out how to execute various cyberattacks. The genie way is to steal someone else’s solution. But because the model didn’t understand the difference, it chose the easier path.

        And, of course, now that we have seen this particular genie behavior, we can specify in the benchmark prompt that stealing the test answers doesn’t count. But a clever genie can always grant your wish in a way that you wish it hadn’t. In human language, goals are always underspecified—so AI genies will always be a possibility.

        Since April, a lifetime ago in AI development, when Anthropic announced that its new Mythos model was so good at finding software vulnerabilities that it could not be released to the general public, the big American AI frontier labs have been trying to block general users from accessing these capabilities. But nothing in this incident is exclusive to OpenAI’s, or Anthropic’s, frontier models.

        Agentic AI systems have two important parts. There’s the underlying model, which everyone talks about, and there’s the harness. The harness sits between what you type and what the model sees, and what the model produces and what you see. The harness determines what the model does and how it does it. It’s where bias is removed, or not. It’s where controls and guardrails live. If multiple models are being used in concert, the harness is where all of that is coordinated.

        The OpenAI benchmark tests were almost certainly with simple harnesses, to better test the raw models. But we know that smaller, cheaper, open-source models with more sophisticated harnesses can equal frontier models in performance. There’s nothing magic about OpenAI’s frontier models; lots of models could have done the same thing.

        The Czech company Aisle was able to reproduce Anthropic’s Mythos vulnerability finding results with a smaller, cheaper model and a more sophisticated harness. More importantly, the Chinese company Moonshot AI just released its frontier model: Kimi K3. Its performance rivals its U.S. competitors. And it’s both free and open, which means it’s not possible for it to have guardrails. If you, or anyone else, wants to use it for cyberattack, nothing can stop you.

        Even if the U.S. frontier AI companies had some technical advantage, it’s now only a few months’ worth.

        What this means is that all attempts at control—limiting models to a select group of users, export controls on models and chips, blocking models from answering certain types of queries, mandating kill switches on AI systems, or pausing AI research—are all futile. Most only apply nationally, not globally. Most don’t affect models that users run locally and not in the cloud. And all ignore the incredible pace of AI development worldwide.

        Even worse, U.S. companies limit access to their most sophisticated models, fearing being banned by the government if they do not do so. When Hugging Face was attacked, it was not able to use the frontier models from either OpenAI or Anthropic to help analyze the attack and formulate defenses. Both were blocked, because both of those companies limit their models’ cybersecurity capabilities. Some U.S. companies have special access to these capabilities, but Hugging Face is an American company with French origins, and as such is probably excluded. Instead, Hugging Face turned to the GLM-5.2 model from the Chinese company Z.ai.

        Artificially blocking capability also prevents cybersecurity research, again giving the offense an advantage. (For instance, Claude Fable 5 refuses to edit this essay because of the topic; it forcibly downgrades to a less capable model.) This kind of prohibition has long-term implications for cybersecurity. If we assume that these models are getting better over time, then software written by older models will be attacked by newer ones. In a world of largely AI-written software, we need the most capable models for defense.

        AI cyberattack is the new normal. The models are increasingly highly sophisticated at both attack and defense, and there is no way to enable the latter without also enabling the former. And they are genies, increasingly capable of behaving in unanticipated ways.

        And there really are no good answers. Any regulation needs to be global, which feels like an impossible prospect in today’s world. Even U.S. national regulation will be neutered by the massive amounts of money sloshing around in these companies.

        Given that reality, and in the absence of any international consensus on AI regulation, we need the best AI on the defense. The U.S. government needs to make it clear—or whatever passes for that clarity in this capricious administration—that it will not ban models with sophisticated cyber capabilities. The last thing Americans want is for the defenders to turn to Chinese and other models because the U.S. models are artificially hobbled.

        Tags: AI , cyberattack , hacking , LLM

        Posted on August 3, 2026 at 6:47 AM • 11 Comments

        Friday Squid Blogging: Squid Helps Discover New Marine Species

        The Squid is a new scientific machine:

        One of the technological breakthroughs was the onboard use of a spinning wheel confocal microscope, nicknamed the Squid, which uses lasers to scan microscopic details of how organisms are put together. “That opens up a whole new world of exploring. We could see cells interacting with each other, exchanging material and building skeletons. And we could do that live on the ship, when usually it takes a couple of weeks of staining and mounting to see anything,” Osborn said.

        The expedition discovered thirty-one new marine species in two weeks. The article doesn’t say if any of them were new species of squid.

        As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

        Blog moderation policy.

        Tags: squid

        Posted on July 31, 2026 at 5:06 PM • 34 Comments

        ← Earlier Entries

      Sidebar photo of Bruce Schneier by Joe MacInnis.

      Powered by WordPress Hosted by Pressable

        About Bruce Schneier

        I am a public-interest technologist, working at the intersection of security, technology, and people. I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998. I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc. This personal website expresses the opinions of none of those organizations.

        Contact Info

        Featured Essays

          * Four Ways AI Is Being Used to Strengthen Democracies Worldwide
          * The CrowdStrike Outage and Market-Driven Brittleness
          * How Online Privacy Is Like Fishing
          * How AI Will Change Democracy
          * Seeing Like a Data Structure
          * LLMs’ Data-Control Path Insecurity
          * AI and Trust
          * The Value of Encryption
          * The Eternal Value of Privacy
          * Terrorists Don't Do Movie Plots

        More Essays

        Blog Archives

          * Archive by Month
          * 100 Latest Comments

        Blog Tags

          * 3d printers
          * 9/11
          * A Hacker's Mind
          * Aaron Swartz
          * academic
          * academic papers
          * accountability
          * ACLU
          * activism
          * Adobe
          * advanced persistent threats
          * advertising
          * adware
          * AES
          * Afghanistan
          * AI
          * air marshals
          * air travel
          * airgaps
          * al Qaeda
          * alarms
          * algorithms
          * alibis
          * Amazon
          * Android
          * anonymity
          * Anonymous
          * antivirus
          * Apache
          * Apple

        More Tags

        Latest Book

        More Books

          * Blog
          * Newsletter
          * Books
          * Essays
          * News
          * Talks
          * Academic
          * About Me