Nick Hutton retweeted
We’ve seen plenty of people try to vibe code the php exploit who have no experience in the domain. Failure. Over and over. Then people who know what they are doing in exploit dev, marginal success.
People would say anyone with a frontier LLM can just say “hack this site, make no mistakes” and I won’t argue, some shallow bugs will fall out this way for a while. But the most successful applications of LLMs are coming from experts who at least know how to dissect the problem, change the models thought direction, and have put engineering into harnesses and skills. I’ve seen this across several sub sections of cyber. And that requirement will only get more mandatory as all the shallow bugs shake out. Just my 2c and observation.
🫶
(Also beware of influencers trolling with opinions on this topic. It’s often just for fake clout and clicks)
Nick Hutton retweeted
Perhaps something to consider if you work at OpenAI / Anthropic:
If your policies have produced an outcome like 'if a researcher wants to do software verification research then they have use a Chinese model', then perhaps your approach to 'safety' is net negative.
Nick Hutton retweeted
It should be expected that on a longer timeline more potent exploits emerge, but that's not the point, and if you got multiple days to patch before that, you're counting your blessings in 2026++
Nick Hutton retweeted
I have --- not making this up --- dreamed of this day since the late 1990s when I started arguing on Bugtraq that we should be doing full disclosure, rather than elaborate embargoes, so people could make exactly this decision (take the uptime hit to protect users).
Nick Hutton retweeted
Transition from vulpocalypse to breachpocalypse is here. IR firms are saturated & turning away work. Now one hacker unleashed AI agents on 1,200+ websites, compromising 100+ for ~$5,000 in tokens. $50 per hack. Agents won and compromised targets. reuters.com/legal/government…
Nick Hutton retweeted
OpenCode is currently under a sustained cyberattack, and mid-incident they ran into the same problem Hugging Face did: the frontier models they were using for defense began refusing to help fight attacking agents because analyzing the attacks started triggering safety guardrails.
Replying to @RhysSullivan
yes that was a bit frustrating mid incident when trying to investigate. they did quite a bit and then started refusing
we got access to daybreak blue now so it's better
Nick Hutton retweeted
Crawlers are a normal part of the web. Yandex runs a search engine; of course it generates bot traffic.
Bot traffic from Russia does not automatically mean Russian propaganda bots. Yet people here, including journalists, keep treating the two as interchangeable.
That Cloudflare chart shows automated web requests from Yandex’s network. Where’s the data showing that propaganda accounts stopped posting?
Journalists in particular need to understand this distinction. Precision matters when a misread traffic graph becomes the basis for a political narrative.
Nick Hutton retweeted
Cyberattack on French supermarkers. Someone remotely took over refrigeration controllers and made them to defrost. Target temperature set to 50°C. Staff opening freezers in the morning were hit by a wave of hot air. Millions of euros lost. France spent years debating food sovereignty to depend on a firmware update? bfmtv.com/economie/consommat…
Nick Hutton retweeted
This is one of the most underrated threats in cyber right now and it’s being done all over Europe and the Middle East. This targeting enables lethal follow-on activity and it’s especially alarming as missiles fall and gig economy terrorists are being used so heavily.
Cyber Operations against cameras can enable physical intelligence, surveillance, and reconnaissance in the battlespace. @GreyNoiseIO identified a spike in targeting of cameras in Ukraine that coincided with an increase in kinetic strikes: greynoise.io/blog/hikvision-…
Nick Hutton retweeted
Security is maintained through the combination of
- people
- technology
- procedures
Fixation on bugs as the sole element of security (offensive and defensive) is a category error. A profound misunderstanding of how systems work, and how they fail.
Nick Hutton retweeted
The people that want to believe in "AI consciousness" largely want to believe in their own greatness, and given the unscientific and unfalsifiable nature of "consciousness", there's nothing that will convince them; this is about faith and creating idols, not science.
Nick Hutton retweeted
It is apparent that cybersecurity people are not the target audience of what the labs publish about cybersecurity.
They instead are weaponizing these narratives as fearmongering for non-security people, which would react to this very differently.
Excluding the experts from what you are writing about is very concerning.
Nick Hutton retweeted
It is happening.
China has expanded overseas travel restrictions for top AI professionals in private firms to include the families of key personnel bloomberg.com/news/articles/…
Nick Hutton retweeted
It's simple: if Cyber-critical AI models were able to find and exploit vulnerabilities in critical attack surfaces of systems designed using security engineering principles like OpenSSH, firecracker, seL4, etc, we'd have evidence of it by now.
We already have the tools and know how to defend against and contain advanced AI, it just isn't applied everywhere that it needs to be yet.
Nick Hutton retweeted
‼️ This is the EU Cyber Resilience Act at work, because since September 11 vendors must report actively exploited flaws to European authorities within 24 hours, even before a patch exists.
So far NCSC-NL appears to be the only national European CERT to have passed that warning on to its constituency, prompting Dutch organisations to pull their NetScalers offline while Citrix still has no public CVE, advisory or fix.
Nick Hutton retweeted
We built @ThinkstCanary for this.
Some of the best security teams in the world use our Canaries && Canarytokens for this.
(You can get pretty far with even just our free tokens at canarytokens.org)
Nick Hutton retweeted
‼️BREAKING: An actively exploited unknown critical Citrix NetScaler zero-day has prompted governments and organizations to SHUTDOWN all their devices immediately.
We don't know what's exactly going on yet. Stay tuned for more info.
Nick Hutton retweeted
This is the "regulatory capture" phrase that is widely passed around.
If a teen commits suicide, parents will sue ChatGPT/Claude, because there is no firm definition of what it means for an AI to be "safe". A slick lawyer will usually convince a jury that corporations are evil and need to pay for tragedy, regardless of the facts. Juries are emotional.
Therefore, AI leaders want government to "impose" AI safety regulations on them. While such laws punish them if they don't meet the rules, it exonerates them when they can prove they met the safety regulations, forestalling lawsuits.
The leaders of every large industry do this. This is not unique to AI. They'll accept even bad regulations as long as it provides regulatory certainty and protection from ad hoc lawsuits. This also suppresses a patchwork of state laws.
The leaders know that, as the biggest companies in the industry, such laws won't hurt them much, but will hurt smaller competitors. Every new regulation increases costs that large companies can easily absorb but small challengers cannot.
They want this even if anti-AI activists have too much influence and create non-optimal regulations. They benefit even if they don't achieve "regulatory capture".
But, since they are the loudest voices in the room, they'll have the most influence, and likely get favorable regulations.
The point is that "regulatory capture" isn't the goal, but is usually the effect. The reason the leading AI CEOs want regulation is because the leaders of all big industries want regulations.
I am confused why there's a debate over how liability for AI hacks should work. If I buy a chainsaw and it explodes, the manufacturer is liable for building a faulty product. If I buy a chainsaw and use it to kill someone, the manufacturer is not liable for failing to build in safeguards that prevent me from using chainsaws to kill people.
Nick Hutton retweeted
It is depressingly apparent that to find reasonable commentators on global affairs today, you need to look outside of Europe.
Below, former Singaporean Ambassador to the UN, Kishore Mahbubani, dispels the propagandistic narrative that @MishalHusain can't help but defend.
Nick Hutton retweeted
All of China's PQC algorithms have been broken in one day.
Readers added context they thought people might want to know
NGCC first-round PQC candidates (84 public-key submissions) were announced Sept 20; reports detail mostly implementation bugs in reference code for some, not all candidates or any finalized algorithms.
niccs.org.cn/niccs/Notice/p…
ngcc.dev/reports/index.…
github.com/ngcc-dev/ngcc-…






































