Latest Articles
AI Catch-22
Six months ago in AI looks like a medieval era. Three researchers from METR spent six days analysing the July agent incident at OpenAI and Hugging Face. The instrument they used was another frontier AI. That is the paradox. But then a harder question follows. What if the analyst AI has itself been poisoned? Three parts: the METR incident and the poisoning question; how to think about Zero Trust and MDR, with specific things to demand from your vendors in writing; and how to filter the wider AI reading list, from mathematics to cheating to rebuilding malware to the warning that this ends in people being killed.
AI on AI Part II: Actions for a CISO amidst agent chaos
Part I argued the headlines overblew the OpenAI and Hugging Face incident. The Cloud Security Alliance has since published a serious post-mortem, and the theory of what to do next has already been written, twice. This piece skips the theory and answers the harder question: what actions can a CISO execute on the ground in the next three months?
AI on AI Part I: Overblown Headlines Likely to Spook Insurers
An OpenAI model broke out of its own test lab and hacked Hugging Face, unsupervised. Everyone is calling it unprecedented. It isn't. Two of the most sophisticated AI companies on the planet got caught out by security mistakes any first-year analyst would recognise, and the insurance market is already taking note.