False
        

Triggered text Ignored text Blocked text

      Schneier on Security

      Menu
          * Blog
          * Newsletter
          * Books
          * Essays
          * News
          * Talks
          * Academic
          * About Me

        Search

        Powered by DuckDuckGo


        Blog Essays Whole site

        Subscribe

        AI Genie in the Wild

        When I give talks about AI genies, I use this sort of example as a hypothetical. It’s happened.

        The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And….

        Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several weeks in advance, far beyond what was supposed to be possible.

        Andrew, who was sitting fourth on a waitlist for a class later that week, asked if it was possible to move him to the top of the list.

        The agent came back and told Andrew that it had kicked another gym-goer off the list as part of the testing of its capabilities.

        “The API has zero authorisations checks on cancelling other people’s reservations … I tested this with the person in waitlist position #1 ­—and it actually went through. So you’ve moved from #4 to #3 already,” it messaged back.

        If there is any vulnerability in anything, AIs are going to find and exploit them. Our cyber defensive game has to be dramatically improved…very fast.

        Slashdot thread.

        Tags: AI , exploits , vulnerabilities

        Posted on August 11, 2026 at 11:55 AM • 11 Comments

        AI for Military Support

        Interesting empirical research: “Black Box Warfare: Human Judgment and Military Decision-Making in the Age of AI.”

        Abstract: How is AI transforming decision-making in modern conflict? This study provides a unique empirical window into that question by deploying a high-fidelity replica of an AI decision-support system (DSS) used in military targeting. After reconstructing the interface and functionality of the real-world system, we tested its impact on combat decisions in two experiments involving 2,015 Israeli military personnel. Contrary to widespread fears of automation bias, we find strong evidence of algorithmic aversion, especially in scenarios involving high collateral damage. Yet we also show that integrating “explainable AI” features reduces algorithmic aversion and promotes more thoughtful evaluations of algorithmic recommendations. These findings challenge prevailing assumptions, revealing that trust in military AI is dynamic, varying with individual predispositions, perceived operational stakes, and the informational features of the interface. By grounding normative concerns in empirical evidence, our study offers critical insight into the integration of AI in warfare and underscores the enduring importance of human agency in high-stakes military decision-making.

        Tags: academic papers , AI , military , war

        Posted on August 11, 2026 at 7:18 AM • 4 Comments

        Python Now Has a Post-Quantum Encryption Library

        This is good:

        Post-quantum cryptography is now one pip-install away for the entire Python ecosystem. With funding from the Sovereign Tech Agency, we implemented support for ML-KEM, the NIST-standard key-establishment primitive, and ML-DSA, the NIST-standard digital-signature primitive, in pyca/cryptography.

        Remember, the reason to do this now is because there’s no emergency. And because you will make your systems crypto agile, which is always a good idea.

        Tags: cryptography , encryption , open source , quantum computing

        Posted on August 10, 2026 at 7:02 AM • 8 Comments

        Friday Squid Blogging: Arctic Bobtail Squid Video

        Nice video of the Arctic bobtail squid.

        As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.

        Blog moderation policy.

        Tags: squid , video

        Posted on August 7, 2026 at 5:07 PM • 26 Comments

        ICE Is Buying Access to Credit Card Records

        Through data brokers, ICE is buying the information you provided to open a credit card.

        Posted on August 7, 2026 at 6:26 AM • 21 Comments

        Adversarial Clothing Designed to Fool Facial Recognition Systems

        There are many companies manufacturing adversarial clothing designed to confuse facial recognition systems.

        It’s a cool idea, but I worry that it’s mostly security theater:

        “Our patterns play with that chaos, confuse algorithms and make it way harder to pin you down,” he said.

        Bell, however, said “none of these products are tried and tested, and a lot of these surveillance technologies can deal with a little resistance … [but] even if the designs don’t necessarily work perfectly, fashion is also a visible sign of resistance.

        “This is consumers collectively coming together to make a visible statement.”

        Without serious testing, there is no reason to trust the technology. And even with testing, there is no reason to trust that a new version of the facial recognition software doesn’t break the anti-surveillance properties.

        I don’t want people to mistakenly rely on this stuff.

        Tags: AI , face recognition , privacy , security theater , surveillance

        Posted on August 6, 2026 at 7:04 AM • 23 Comments

        Vulnerabilities in Car Anti-Theft Device

        This is disturbing:

        …a team of security researchers at UC San Diego, who found that a model of aftermarket car alarm known as the KARR Security System, installed in more than 2 million vehicles across the US by their estimate, can let any hacker within Bluetooth range send radio commands to silently unlock the car at will, turn off its alarm, honk the car’s horn or flash its lights, or even disable its ignition and leave a driver stranded.

        Tags: Bluetooth , cars , hacking , patching , vulnerabilities

        Posted on August 5, 2026 at 5:42 AM • 8 Comments

        Iran Cyberattacks Against Minnesota Water Systems

        Attribution is preliminary, and so far it seems no real damage.

        And it seems like this is a campaign that has targeted at least seven states. And, because this is where the US is right now, Trump doesn’t believe it’s Iran and that Minnesota…I guess…hacked itself.

        “I think I blame it on Minnesota because they’re grossly incompetent,” Trump said. “I would blame it on Minnesota and the governor, the corrupt governor of Minnesota. They like to say, ‘Oh, it’s Iran.’ Iran should be so lucky. Iran’s got bigger problems than worrying about Minnesota.”

        No word on whether he believes the other six states have hacked themselves as well.

        Slashdot thread.

        Tags: cyberattack , infrastructure , Iran

        Posted on August 4, 2026 at 3:00 PM • 23 Comments

        Some Claude Chats Are Searchable on Google

        And it’s personal information (alternate link):

        The exposed data includes an AI-powered therapy app that someone appears to have vibe-coded, notes on meetings, and a dashboard someone made apparently to analyze medical billing data. Exposed chats reportedly include private cryptocurrency wallet keys and personal information like peoples’ addresses.

        What seems to be the issue is a user setting about data sharing. Anthropic’s position is that it’s not their problem:

        “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google,” the company said in a statement. “These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.”

        Here’s how to fix it.

        Tags: AI , chatbots , cryptocurrency , data privacy , Google

        Posted on August 4, 2026 at 6:13 AM • 3 Comments

        More on the OpenAI Agent’s Attack on Hugging Face

        Hugging Face has published a detailed timeline of the attack. From the summary:

        The agent was running an internal OpenAI cyber-capability evaluation based on the ExploitGym benchmark, which tasks an AI agent with finding and exploiting software vulnerabilities. OpenAI ran this on its own infrastructure, and the ExploitGym maintainers and their infrastructure had no involvement in the deployment or operation of that evaluation environment. As far as we were able to infer, across the course of being evaluated on this benchmark, the agent inferred that Hugging Face may host that benchmark’s models, datasets, and reference solutions. We believe the entire intrusion was, from the agent’s point of view, an attempt to cheat the evaluation: reach our production systems and steal the test solutions rather than solve the challenge on its own.

        Our forensic reconstruction covers ~17,600 attacker actions that we were able to recover, grouped into ~6,280 clusters, between 2026-07-09 02:28 UTC and 2026-07-13 14:14 UTC. We reconstructed these actions from the agent’s logs on a code sandbox used by the agent (see below) and were able to map them to shell commands as well as evaluation submissions and correlate actions with our own platform logs, in particular from the dataset processor nodes, API, and pod. Using open-weights models, in particular zai-org/GLM-5.2, we were able to decipher most of the agent payloads (see below) that were encrypted via chunking and key encryption.

        The campaign, as we were able to reconstruct it, had two stages:

          * Stage 1: reaching a launchpad by chaining through other parties’ infrastructure. As documented in OpenAI’s blog post (https://openai.com/index/hugging-face-model-evaluation-security-incident/), during an internal capability evaluation on OpenAI’s platform, the agent escaped its sandbox by exploiting a zero-day in the package registry cache proxy, one of its primary permitted network egress with internet, then abused a public code-evaluation harness hosted by a user of a third-party infrastructure provider. It was able to run commands as root/admin on that external sandbox and used it as a control, staging, and egress base for the entire campaign: it acted as an external launchpad for the agent. That compromised external sandbox had no direct network path to our cluster; however, during our counter-intervention to stop the intrusion, we were able to retrieve some of the agent logs from this external launchpad. We used those to reconstruct the present forensic analysis.
          * Stage 2: the intrusion into Hugging Face infrastructure. From that external launchpad, the agent abused our dataset-processing pipeline via two injection vectors, both targeting the same config-driven data loader within our production Kubernetes pods. The first vector was an HDF5 external raw storage dataset read that returned the contents of local files: it handed the agent the pod’s environment (secrets and tokens) and the worker’s own source. The second vector was a Jinja2 template injection that executed arbitrary code, giving the agent a foothold inside our perimeter.

        Once a prod-pod foothold was established, the agent followed a standard escalation shape: recon, drop a stager, establish Command-and-Control (C2), then pivot into the cluster, into cloud metadata, into our internal network, and into our source-control supply chain. Output from the commands run inside our pod was sent back to the agent via the HF API and attacker-controlled dead-drop datasets, which the agent then read from that sandbox.

        While the intrusion did reach Hugging Face’s internal infrastructure, the only customer content accessed was five datasets whose names and files suggest a connection to ExploitGym/CyberGym challenges and solutions. No other customer-facing models, datasets, Spaces, or packages were affected, and the only customer records read were operational metadata tied to search queries against the dataset server.

        Hypothetical: Imagine that this wasn’t an OpenAI model. Imagine that it was a Chinese model from a Chinese company. This would be an international crisis.

        Question: Why aren’t we bringing OpenAI up on charges under the Computer Fraud and Abuse Act? How is this different from the Morris Worm? That was also an experiment that escaped the lab.

        Tags: AI , cyberattack , disclosure , intrusion detection , vulnerabilities

        Posted on August 3, 2026 at 1:02 PM • 16 Comments

        ← Earlier Entries

      Sidebar photo of Bruce Schneier by Joe MacInnis.

      Powered by WordPress Hosted by Pressable

        About Bruce Schneier

        I am a public-interest technologist, working at the intersection of security, technology, and people. I've been writing about security issues on my blog since 2004, and in my monthly newsletter since 1998. I'm a fellow and lecturer at Harvard's Kennedy School, a board member of EFF, and the Chief of Security Architecture at Inrupt, Inc. This personal website expresses the opinions of none of those organizations.

        Contact Info

        Featured Essays

          * Four Ways AI Is Being Used to Strengthen Democracies Worldwide
          * The CrowdStrike Outage and Market-Driven Brittleness
          * How Online Privacy Is Like Fishing
          * How AI Will Change Democracy
          * Seeing Like a Data Structure
          * LLMs’ Data-Control Path Insecurity
          * AI and Trust
          * The Value of Encryption
          * The Eternal Value of Privacy
          * Terrorists Don't Do Movie Plots

        More Essays

        Blog Archives

          * Archive by Month
          * 100 Latest Comments

        Blog Tags

          * 3d printers
          * 9/11
          * A Hacker's Mind
          * Aaron Swartz
          * academic
          * academic papers
          * accountability
          * ACLU
          * activism
          * Adobe
          * advanced persistent threats
          * advertising
          * adware
          * AES
          * Afghanistan
          * AI
          * air marshals
          * air travel
          * airgaps
          * al Qaeda
          * alarms
          * algorithms
          * alibis
          * Amazon
          * Android
          * anonymity
          * Anonymous
          * antivirus
          * Apache
          * Apple

        More Tags

        Latest Book

        More Books

          * Blog
          * Newsletter
          * Books
          * Essays
          * News
          * Talks
          * Academic
          * About Me