Nick Hutton (@nickdothutton) header
Nick Hutton (@nickdothutton) profile picture

30 years in Cyber Security, Product, Investor, Founder, Engineer. Armchair interests: geopolitics, propaganda, persuasion, ideological subversion.

The Cyber-Industrial Complex
Joined November 2016
Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)Photo by Nick Hutton (@nickdothutton)
Nick Hutton retweeted
We’ve seen plenty of people try to vibe code the php exploit who have no experience in the domain. Failure. Over and over. Then people who know what they are doing in exploit dev, marginal success. People would say anyone with a frontier LLM can just say “hack this site, make no mistakes” and I won’t argue, some shallow bugs will fall out this way for a while. But the most successful applications of LLMs are coming from experts who at least know how to dissect the problem, change the models thought direction, and have put engineering into harnesses and skills. I’ve seen this across several sub sections of cyber. And that requirement will only get more mandatory as all the shallow bugs shake out. Just my 2c and observation. 🫶 (Also beware of influencers trolling with opinions on this topic. It’s often just for fake clout and clicks)
39
61
7
479
23,543
Nick Hutton retweeted
Perhaps something to consider if you work at OpenAI / Anthropic: If your policies have produced an outcome like 'if a researcher wants to do software verification research then they have use a Chinese model', then perhaps your approach to 'safety' is net negative.
20
79
4
991
27,842
Nick Hutton retweeted
It should be expected that on a longer timeline more potent exploits emerge, but that's not the point, and if you got multiple days to patch before that, you're counting your blessings in 2026++
4
3
33
2,483
Nick Hutton retweeted
I have --- not making this up --- dreamed of this day since the late 1990s when I started arguing on Bugtraq that we should be doing full disclosure, rather than elaborate embargoes, so people could make exactly this decision (take the uptime hit to protect users).
Pinboard makes NBC News! How I've dreamed of this day
5
8
103
5,431
Nick Hutton retweeted
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
18
62
21
236
55,341
Nick Hutton retweeted
OpenCode is currently under a sustained cyberattack, and mid-incident they ran into the same problem Hugging Face did: the frontier models they were using for defense began refusing to help fight attacking agents because analyzing the attacks started triggering safety guardrails.
Replying to @RhysSullivan
yes that was a bit frustrating mid incident when trying to investigate. they did quite a bit and then started refusing we got access to daybreak blue now so it's better
215
562
163
5,087
552,564
Crawlers are a normal part of the web. Yandex runs a search engine; of course it generates bot traffic. Bot traffic from Russia does not automatically mean Russian propaganda bots. Yet people here, including journalists, keep treating the two as interchangeable. That Cloudflare chart shows automated web requests from Yandex’s network. Where’s the data showing that propaganda accounts stopped posting? Journalists in particular need to understand this distinction. Precision matters when a misread traffic graph becomes the basis for a political narrative.
According to Cloudflare Data Explorer the amount of russian bot traffic has dropped to 49% after Ukraine struck a yandex data center. Could this disrupt the midterm elections in the US?
87
194
52
1,495
74,745
Nick Hutton retweeted
Cyberattack on French supermarkers. Someone remotely took over refrigeration controllers and made them to defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air. Millions of euros lost. France spent years debating food sovereignty to depend on a firmware update? bfmtv.com/economie/consommat…
57
391
113
1,097
217,737
Nick Hutton retweeted
This is one of the most underrated threats in cyber right now and it’s being done all over Europe and the Middle East. This targeting enables lethal follow-on activity and it’s especially alarming as missiles fall and gig economy terrorists are being used so heavily.
2
31
1
146
13,820
Nick Hutton retweeted
Security is maintained through the combination of - people - technology - procedures Fixation on bugs as the sole element of security (offensive and defensive) is a category error. A profound misunderstanding of how systems work, and how they fail.
14
69
7
299
14,283
Nick Hutton retweeted
The people that want to believe in "AI consciousness" largely want to believe in their own greatness, and given the unscientific and unfalsifiable nature of "consciousness", there's nothing that will convince them; this is about faith and creating idols, not science.
12
27
4
164
6,553
It is apparent that cybersecurity people are not the target audience of what the labs publish about cybersecurity. They instead are weaponizing these narratives as fearmongering for non-security people, which would react to this very differently. Excluding the experts from what you are writing about is very concerning.
Anthropic says use GLM-5.3 for hacking 👍
38
92
7
600
23,779
It's simple: if Cyber-critical AI models were able to find and exploit vulnerabilities in critical attack surfaces of systems designed using security engineering principles like OpenSSH, firecracker, seL4, etc, we'd have evidence of it by now. We already have the tools and know how to defend against and contain advanced AI, it just isn't applied everywhere that it needs to be yet.
I really need more big names in cybersecurity to come forward and state the obvious: cybersecurity is real and works and yes we absolutely can contain an AI even if it’s extremely good at finding zero days.
14
31
1
180
21,366
‼️ This is the EU Cyber Resilience Act at work, because since September 11 vendors must report actively exploited flaws to European authorities within 24 hours, even before a patch exists. So far NCSC-NL appears to be the only national European CERT to have passed that warning on to its constituency, prompting Dutch organisations to pull their NetScalers offline while Citrix still has no public CVE, advisory or fix.
‼️BREAKING: An actively exploited unknown critical Citrix NetScaler zero-day has prompted governments and organizations to SHUTDOWN all their devices immediately. We don't know what's exactly going on yet. Stay tuned for more info.
19
71
6
454
62,552
Nick Hutton retweeted
We built @ThinkstCanary for this. Some of the best security teams in the world use our Canaries && Canarytokens for this. (You can get pretty far with even just our free tokens at canarytokens.org)
I been saying! If zero days are cheap. Detections get much more important. Zero days are not invisibility cloaks.
6
18
2
98
14,301
‼️BREAKING: An actively exploited unknown critical Citrix NetScaler zero-day has prompted governments and organizations to SHUTDOWN all their devices immediately. We don't know what's exactly going on yet. Stay tuned for more info.
88
661
98
3,929
639,386
Nick Hutton retweeted
This is the "regulatory capture" phrase that is widely passed around. If a teen commits suicide, parents will sue ChatGPT/Claude, because there is no firm definition of what it means for an AI to be "safe". A slick lawyer will usually convince a jury that corporations are evil and need to pay for tragedy, regardless of the facts. Juries are emotional. Therefore, AI leaders want government to "impose" AI safety regulations on them. While such laws punish them if they don't meet the rules, it exonerates them when they can prove they met the safety regulations, forestalling lawsuits. The leaders of every large industry do this. This is not unique to AI. They'll accept even bad regulations as long as it provides regulatory certainty and protection from ad hoc lawsuits. This also suppresses a patchwork of state laws. The leaders know that, as the biggest companies in the industry, such laws won't hurt them much, but will hurt smaller competitors. Every new regulation increases costs that large companies can easily absorb but small challengers cannot. They want this even if anti-AI activists have too much influence and create non-optimal regulations. They benefit even if they don't achieve "regulatory capture". But, since they are the loudest voices in the room, they'll have the most influence, and likely get favorable regulations. The point is that "regulatory capture" isn't the goal, but is usually the effect. The reason the leading AI CEOs want regulation is because the leaders of all big industries want regulations.
I am confused why there's a debate over how liability for AI hacks should work. If I buy a chainsaw and it explodes, the manufacturer is liable for building a faulty product. If I buy a chainsaw and use it to kill someone, the manufacturer is not liable for failing to build in safeguards that prevent me from using chainsaws to kill people.
11
49
7
254
44,011
Nick Hutton retweeted
It is depressingly apparent that to find reasonable commentators on global affairs today, you need to look outside of Europe. Below, former Singaporean Ambassador to the UN, Kishore Mahbubani, dispels the propagandistic narrative that @MishalHusain can't help but defend.
130
863
119
3,135
310,302
Nick Hutton retweeted
All of China's PQC algorithms have been broken in one day.
Readers added context they thought people might want to know
NGCC first-round PQC candidates (84 public-key submissions) were announced Sept 20; reports detail mostly implementation bugs in reference code for some, not all candidates or any finalized algorithms. niccs.org.cn/niccs/Notice/p… ngcc.dev/reports/index.… github.com/ngcc-dev/ngcc-…
78
264
56
2,819
757,976