theguardian

L’acqua non è soltanto una materia ma è anche un dominio su cui si misurano gli interessi geopolitici di molteplici attori Negli ultimi anni l’acqua ha assunto una importanza sempre maggiore nelle relazioni internazionali e oggi è diventata senza dubbio l’elemento verso cui convergono gli interessi (e i conflitti) dei principali attori statali e non-statali globali. A causa di una peculiare combinazione di fattori politici, climatici, tecnologici, commerciali e sociali, oggi l’acqua è indubbiamente il bene più conteso del mondo. Infatti, lo stesso elemento può essere visto sia come una risorsa e una materia prima (indispensabile alla vita umana, ma anche per lo sviluppo delle tecnologie legate all’intelligenza artificiale) sia come una infrastruttura (analogamente alla rete ferroviaria o elettrica). E, ovviamente, anche come campo di battaglia di cui contendersi il dominio sopra e sotto la superficie. L’acqua non è soltanto un bene primario Se considerata come una materia prima, l’acqua è sempre stata un bene primario senza la quale sarebbe impossibile la vita umana. Nei secoli è poi divenuta fondamentale anche nel settore energetico. Sia con il suo impiego direttamente nella produzione di energia (basta pensare ai mulini o alle centrali idroelettriche), sia indirettamente con il suo utilizzo in altre funzioni. In quest’ultimo caso, l’esempio più evidente sono i sistemi di raffreddamento delle centrali nucleari. Il legame tra l’acqua e l’energia nucleare ha avuto ampia eco mediatica soprattutto nelle ultime settimane: le numerose ondate di caldo che hanno colpito l’Europa hanno infatti portato allo spegnimento (o al rischio di spegnimento) di diversi impianti. A luglio la Francia ha spento tre reattori e ridotto la potenza di ulteriori sette per evitare di scaricare nei fiumi acqua eccessivamente calda in un momento in cui il Paese era colpito da temperature record. L’Ungheria rischia di dover spegnere l’unica centrale del Paese perché i livelli del Danubio sono ai minimi storici e mancherebbe l’acqua per il raffreddamento dell’impianto. La Romania ha effettuato esplosioni controllate per deviare l’acqua di raffreddamento dal Danubio all’ultimo reattore funzionante in attività. L’Europa sta attraversando settimane di crisi in termini di approvvigionamento idrico L’Europa sta attraversando settimane di crisi in termini di approvvigionamento idrico, trasporto fluviale e produzione di energia, rendendo ancora più evidente la necessità di costruire una idrostrategia (a livello nazionale e, auspicabilmente, comunitario e globale) per la gestione di questa risorsa fondamentale. La diminuzione della produzione di energia nucleare consente inoltre di analizzare un ulteriore ambito in cui l’acqua è divenuta fondamentale in questi ultimi anni: la corsa all’Intelligenza Artificiale (AI). Questa è il terreno di competizione tra le due maggiori potenze tecnologiche mondiali. Gli Usa e la Cina. E, trattandosi di un settore estremamente energivoro, gli attori pubblici e privati che operano in questo campo hanno iniziato a rimettere in funzione centrali nucleari dismesse o costruire impianti nuovi per per fare funzionare l’AI . Infatti, sebbene sia spesso immaginata come una entità astratta, l’Intelligenza Artificiale poggia in realtà su basi fisiche nel mondo reale: datacenter, infrastruttura di rete e cavi sottomarini , ad esempio. In particolare, i datacenter assorbono enormi quantità di energia e, soprattutto, di acqua per il raffreddamento. Un rapporto pubblicato dallo United Nations University Institute for Water, Environment and Health (UNU-INWEH) e intitolato “ Environmental cost of AI’s energy use ” ha stimato che nel 2025 i data center abbiano consumato una quantità di acqua sufficiente a coprire il fabbisogno idrico domestico annuo di base di oltre 600 milioni di persone nell’Africa subsahariana. Nei paragrafi precedenti si è analizzata l’acqua in quanto materia prima, ma in realtà questa è anche un dominio su cui si misurano gli interessi geopolitici di molteplici attori. Interpretazioni molteplici In questo senso, l’acqua può essere vista in due modi: come una infrastruttura di comunicazione – al pari di una rete ferroviaria o autostradale, con il suo traffico e le sue arterie più o meno congestionate – oppure come un campo di battaglia, soprattutto in prossimità di regioni al centro di conflitti. E queste due visioni non sono in contrapposizione ma si sovrappongono, rendendo sfumati i confini tra interessi militari, economici, commerciali, energetici e politici. Se la immaginiamo come una infrastruttura di comunicazione, l’importanza delle vie d’acqua diventa maggiormente evidente quando queste vengono interrotte. È il caso, ad esempio, della nave Ever Given che nel 2021 rimase incagliata nel Canale di Suez per diversi giorni bloccando uno dei chokepoint più importanti del mondo e causando ripercussioni a catena sulle catene di approvvigionamento globali. Oggi l’esempio più vistoso di queste interruzioni è lo Stretto di Hormuz, che dall’inizio della guerra tra Usa (e Israele) e Iran nel febbraio 2026 è rimasto pressoché ininterrottamente chiuso al traffico navale. Il blocco di Hormuz ha portato ad un aumento dei prezzi del petrolio e dell’energia in tutto il mondo, mostrando in modo chiaro come il controllo di alcuni tratti di mare possa garantire un potere negoziale senza precedenti. I rischi per le catene di approvvigionamento Meno noto, ma con un potenziale altrettanto pericoloso per le economie e le catene di approvvigionamento mondiale, è lo Stretto di Bab el-Mandeb, che consente l’accesso dall’Oceano Indiano al Mar Rosso e che quindi, insieme al Canale di Suez, rappresenta la via di transito privilegiata che collega l’Asia Orientale con l’Europa. Dal 2023 il gruppo yemenita degli Houthi ha iniziato ad attaccare le navi in transito da Bab el-Mandeb causando un crollo verticale del traffico marittimo nella regione e un ulteriore blocco per le esportazioni di greggio da parte dei paesi produttori (Arabia Saudita, Emirati Arabi e Stati del Golfo Persico in primis), che hanno sempre maggiori difficoltà a fare uscire il greggio via mare dalla regione. Gli Houthi, che insieme ad Hamas e Hezbollah, fanno parte dell’“Asse della Resistenza” sostenuta dall’Iran, si inseriscono quindi in una più ampia situazione di crisi del Mar Rosso . Come operano i droni marini Le vicende di Hormuz e di Bab el-Mandeb consentono di cogliere appieno le sfumature tra i due modi di concepire l’acqua come infrastruttura di comunicazione e come campo di battaglia. Questo perché il traffico commerciale marittimo mondiale è vincolato da alcune vie d’acqua imprescindibili, i cosiddetti chokepoint (come Hormuz e Bab el-Mandeb, appunto, ma anche Suez, Gibilterra, il Bosforo o il Canale di Panama, per citare solo i più famosi) che però possono divenire anche bersagli di attacchi. In particolare, il dominio marittimo è stato attraversato negli ultimi anni da una rivoluzione costituita dall’avvento dei droni marini. Si tratta di veicoli senza pilota in grado di muoversi sulla superficie dell’acqua o anche al di sotto della superficie. Il vantaggio principale di questi droni marini (in gergo UUV, Underwater Unmanned Veichles , o USV, Unmanned Surface Veichles ) è il loro costo ridotto che una produzione rapida e in grandi quantità. In questo modo è possibile impiegarli sia per colpire (o anche solo minacciare di colpire) le imbarcazioni civili e mercantili, sia in contesti bellici per attaccare le navi militari, come accaduto più volte nel Mar Nero nel contesto del conflitto tra Russia e Ucraina e in cui Kiev ha impiegato i droni marini per colpire la flotta di Mosca . L’importanza dei nuovi vettori L’importanza dei droni marini è confermata anche dalle più recenti notizie che evidenziano come questi stiano diventando fondamentali nelle strategie difensive di Paesi più piccoli e meno forti militarmente , con la necessità di dover tutelare spazi di mare di importanza strategica. È il caso di Singapore, che sta sviluppando e dispiegando veicoli sottomarini autonomi (AUV) in grado di rilevare e identificare mine navali allo scopo di garantire la sicurezza nello Stretto di Singapore (attraverso cui transita un traffico marittimo anche superiore a Hormuz). Analogamente, anche la Danimarca sta iniziando a testare e sviluppare droni sottomarini per attività di sorveglianza del fondale marino nei pressi della Groenlandia (recentemente finita nelle mire espansionistiche del Presidente Trump) e, soprattutto, per la protezione di infrastrutture critiche come i cavi sottomarini. Un bersaglio durante le guerre Infine, rimanendo in tema di conflitti, l’acqua diventa anche un bersaglio per gli attacchi durante le guerre, soprattutto in zone in cui questa rappresenta un bene disponibile in quantità ridotte. È il caso del Medio Oriente e della già citata guerra iniziata da Usa e Israele contro l’Iran a febbraio 2026. Durante il conflitto numerosi bombardamenti e attacchi hanno colpito impianti di desalinizzazione e strutture per l’approvvigionamento idrico dell’Iran e di numerosi Paesi dell’area. A marzo Teheran ha accusato Washington di aver colpito un impianto di desalinizzazione nell’isola di Qeshm . Al contempo, due strutture per lo stoccaggio di acqua sono state colpite a Kuhestak , nel distretto di Bemani, causando difficoltà di approvvigionamento per circa 20.000 persone. A luglio 2026 l’Iran ha colpito un impianto di desalinizzazione in Kuwait , un Paese che non ha pressoché alcuna fonte naturale di acqua dolce e che ricava il 90% dell’acqua potabile da questi impianti. Precedentemente, a marzo, un analogo impianto di desalinizzazione del Bahrain è stato danneggiato da un drone lanciato da Teheran . Infrastrutture idriche degli Usa nel mirino degli hacker criminali Negli ultimi giorni l’escalation della guerra potrebbe essersi ampliata anche al dominio cibernetico. Tra la fine di luglio e l’inizio di agosto 2026, infatti, sono stati segnalati attacchi informatici da parte di attori ostili in diversi impianti idrici e di trattamento delle acque reflue in sette Stati USA (i cui nomi non sono stati diffusi, sebbene i media identifichino Michigan e Minnesota tra questi sette). Nel solo Minnesota sono stati colpiti circa 30 sistemi che hanno portato a interruzioni significative dei servizi. Usa Idrici I media riportano che gli hacker hanno preso di mira i computer automatizzati che controllano i sistemi, modificandone le password per bloccare l’accesso agli operatori. Si è anche proceduto ad inviare diversi avvisi sull’acqua che fosse a temperatura di ebollizione costringendo a gestire i sistemi manualmente. Sebbene non ci sia ancora stata l’identificazione degli autori degli attacchi – e nonostante Trump abbia puntato il dito contro Tim Walz, il governatore dello Stato e appartenente al Partito Democratico –, il sospetto principale riportato dai media è che questi provengano dall’Iran. Questi attacchi a danno degli Usa dimostrano come anche l’acqua possa diventare un bersaglio della guerra informatica. Seguici anche sul nostro canale WhatsApp Vai al sito di Cybersecurity Italia. L'articolo L’acqua: risorsa, dominio, infrastruttura e bersaglio da colpire (e hackerare) sembra essere il primo su CyberSecurity Italia .

If the Markets Reject OpenAI and Anthropic, the US Should Nationalize Them This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. OpenAI, and then Anthropic, were each formed by AI developers who feared unrestrained corporate AI development—specifically, that companies like Google and Meta would steer the technology towards deleterious, maybe even catastrophically unsafe, outcomes for society. Their founders proclaimed that their new labs, uniquely, could be trusted to develop the technology in humanity’s best interest. But each, in turn, were themselves co-opted by the same market incentives, themselves becoming corporate behemoths zealously guarding future investor value rather than the public interest. It was only a few weeks ago, in June, when OpenAI and Anthropic each filed for their IPOs and were met with buzz about trillion-dollar valuations. The hype around their valuations is so extreme that many worry about their potential for concentrating wealth on a global scale. In an effort to leave something for the rest of us, some observers have proposed that the federal government seize a share of these companies’ stock to create a US sovereign wealth fund, or redistribute their revenues to produce a dividend for taxpayers. Now the headlines are about public backlash to AI datacenters and the AI chip giant Nvidia’s slumping stock. The tech and AI giant SpaceX’s newly minted stock price tanked just weeks after its IPO. There are even questions about whether the leading AI labs will ever be sustainably profitable. All of a sudden, the makers of ChatGPT and Claude face strong headwinds as they seek to generate the massive equity assets that once felt all but assured. In fact, evidence suggests the market itself could reassess that these companies offer nothing of financial value. In that case, perhaps we can return them both to their original purposes. If these AI companies should fail in the financial markets, the US should nationalize them and convert them into national labs operated under democratic control that preserve their benefit to the public interest. The economics of the big AI labs hardly guarantee a booming return on investment. Frontier AI models are both expensive to train and depreciate within months, when a newer model appears. This means that the payback window to extract profit from them is very narrow. Meanwhile, enterprise clients are getting smart about minimizing AI token usage. Even worse, the models are basically commodities; the best ones largely perform and behave similarly, which depresses prices. Perhaps most importantly, open-source and Chinese competitors—lagging only a few months behind the leading labs in capability—give away for free the kinds of models Anthropic and OpenAI sell. Even setting aside the model training costs, it’s not clear whether the unit economics of AI as it’s currently conceived will ever be sustainably profitable. Many of these free and open-source models can be run locally: the large ones on private clouds and high-end servers, the smaller ones on anyone’s laptop or even cellphone, putting to question the companies’ exorbitant capital investment in datacenters. It’s not that OpenAI and Anthropic are not valuable as organizations. They have remarkably talented AI scientists and engineers that are continuously producing innovations driving a global mania for their offerings. These leading labs might not ever be profitable, but their products are doing a lot of good in the world. You may or may not be a user of or believer in their technology, but their staggering, ongoing usage growth suggests that an awful lot of people would be disappointed if the companies simply disappeared. The problem isn’t the people or the products, it’s the system. As constituted, OpenAI and Anthropic may not be valuable as market equities. If the market assesses they are not capable of producing a growing financial return on investment for shareholders, the companies will collapse. Maybe private, for-profit is just not the right economic model under which to develop AI. Perhaps OpenAI should be returned to its private non-profit roots, the legacy they fought so hard to change and which Anthropic’s founders spurned. Or possibly both could be reorganized as research centers at universities, returning to academia the scores of high-profile research faculty they have poached. But a better outcome for society would be to establish public ownership and operation of their product-oriented capabilities. Turn OpenAI and Anthropic into US government agencies producing AI as a public good. Transitioning the big AI labs into public agencies would require some restructuring. We can separate these companies into two pieces: product innovation and compute operations. The innovation function can be publicly managed, akin to national labs. Congress could provide more rigorous oversight than the kind of unfettered venture capital these labs have recently had access to. The US has a long, successful history of these kinds of institutions, which have produced world-shaping innovations in spaceflight, telecommunications, nuclear power and more. Congress currently manages a $200bn R&D portfolio, within which frontier AI development is, arguably, a glaring gap. AI operations could be managed as a commodity resource, like public electrical or water utilities: local or regional ownership, nationwide distribution and strict regulation on how they balance fee extraction from ratepayers with raising capital for infrastructure investment. Although AI datacenters are not the same as power or water treatment plants, the US also has a long history of managing national, regional and state supercomputing centers. Other countries, including Switzerland, Spain and Singapore, are already operating public AI labs. They also have national supercomputing centers already providing public access for running AI models for general use, as do Germany and Australia. The benefits to the public are clear. Through democratic oversight, the most important AI models could become open, transparent and responsive to the demands of the public rather than private shareholders. They could be aligned to democratic values rather than corporate profits, never taking advertiser money to promote certain brands and training on only appropriately licensed data. And they could be set to focus on the realistic and pro-social goal of maximizing the usefulness of AI to society rather than the fanciful and anti-social goal of supplanting humans with artificial general intelligence. By emphasizing scientific cooperation rather than corporate competition, we could also reduce the overall resource and environmental cost associated with AI. Instead of perpetually dueling training runs of each companies’ models at ever large scales targeted to fuel investor hype, we could limit AI training resources based on cost and benefit to the public. What’s in it for the companies themselves and their employees, who sacrifice hypothetical billions in equity by ceding to public ownership? A return to their roots and to their core mission of developing AI safely in the public interest, if they are serious about it. Both companies are theoretically bound through their governance structures to prioritize mission over profit anyway (not that anyone really thinks that’s how they currently operate). To be clear, we’re not advocating for a golden parachute for the executives or investors, or for continuing the outlandish pay rates of the most highly remunerated AI researchers. If the public is footing the bill, these compensation packages should be aligned to the civil service and those employees not satisfied with that can go elsewhere—if the business models of any remaining private labs still support much higher pay. While we believe that these companies are unsustainable as private firms, the timeline remains unclear. Their primary investor story is that AI is a race to “artificial general intelligence”—the kind of AI you’re used to from science fiction. The bet seems to be that the two companies can convince enough people that this outcome will turn them a profit, go public, and then make their investors and employees rich before the bubble bursts. But suppose that the bubble bursts. If the US is smart, it will catch the companies as they fall. Regardless of what the markets think, to the public, they’re too valuable to let die.

When I give talks about AI genies , I use this sort of example as a hypothetical. It’s happened . The story is from Australia. Someone named Andrew tasked OpenClaw to book gym classes for him. And…. Minutes later, his AI agent reported it had discovered a way to book Andrew into classes several weeks in advance, far beyond what was supposed to be possible. Andrew, who was sitting fourth on a waitlist for a class later that week, asked if it was possible to move him to the top of the list. The agent came back and told Andrew that it had kicked another gym-goer off the list as part of the testing of its capabilities...

Adversarial Clothing Designed to Fool Facial Recognition Systems There are many companies manufacturing adversarial clothing designed to confuse facial recognition systems. It’s a cool idea, but I worry that it’s mostly security theater: “Our patterns play with that chaos, confuse algorithms and make it way harder to pin you down,” he said. Bell, however, said “none of these products are tried and tested, and a lot of these surveillance technologies can deal with a little resistance … [but] even if the designs don’t necessarily work perfectly, fashion is also a visible sign of resistance. “This is consumers collectively coming together to make a visible statement.” Without serious testing, there is no reason to trust the technology. And even with testing, there is no reason to trust that a new version of the facial recognition software doesn’t break the anti-surveillance properties. I don’t want people to mistakenly rely on this stuff.

The Squid is a new scientific machine : One of the technological breakthroughs was the onboard use of a spinning wheel confocal microscope, nicknamed the Squid, which uses lasers to scan microscopic details of how organisms are put together. “That opens up a whole new world of exploring. We could see cells interacting with each other, exchanging material and building skeletons. And we could do that live on the ship, when usually it takes a couple of weeks of staining and mounting to see anything,” Osborn said. The expedition discovered thirty-one new marine species in two weeks. The article doesn’t say if any of them were new species of squid...

Should You Use AI for a Task? Here’s a Simple Way to Decide This essay originally appeared in The Guardian. I teach public policy at the Harvard Kennedy School and the Munk School at the University of Toronto. And it will come as no surprise to you that my students regularly use AI to complete their writing assignments. Doing so is a waste of their tuition money. But if their entire career is going to include AI writing assistants, why shouldn’t they embrace their future? The best way I’ve found to explain the dilemma comes from the AI researcher Daniel Meissler: it’s the difference between work and the gym. At work, if your job is to move a bunch of heavy things from one side of the room to another, you should use whatever assistive tech you have on hand: a wagon, a forklift… even an AI-powered robot. But at the gym, it makes no sense for that robot to lift weights for you. The point of weightlifting isn’t to move heavy things across the room; it’s to actually lift those heavy things. The same analysis holds for any task an AI can do for you. If it’s work—if the task has to be done and no one cares how—then it’s fine to use AI assistance. But if the task is more like the gym, and how the task is done is at least as important, then it probably doesn’t make sense to use AI. This, of course, assumes that the AI is actually up for the task and that it’s trustworthy: that it can do the job well, that its mistakes are minimal and correctable, that it’s been secured from cyber-attacks that would influence its results. Those are all important, and shouldn’t be minimized. There’s no point giving an AI something that it can’t do reliably. But once you’re confident that the AI can perform the task, the work vs. gym distinction helps you decide if it should. The writing assignments I give my students are gym tasks, not work tasks. I ask them to write policy memos not because the world needs more policy memos. I assign them because the very act of writing, which includes thinking and outlining and drafting and editing, making and criticizing and revising arguments, will help develop the critical thinking skills they will need in their future careers. And without this constant mental exercise, those skills will atrophy. Employers are already noticing. Reading the assignments they turn in, I can see those skills either flourishing or atrophying in my students. At least today, I can pretty easily tell the difference between an AI-written memo and a student-written one—especially if the student just turns in what the chatbot produces. It’s a catchy, plausible, grammatically perfect essay that’s not particularly well-crafted or logically coherent—and with all the tells of mid-2026 AI-generated writing. But it’s precisely because I have spent years developing my own writing skills that I’m able to identify prose that sounds great but doesn’t actually make sense. My students don’t have that skill; they mistakenly view a confident, well-written essay as evidence of the quality of their ideas. They see the AI as cleaning those ideas up, getting them through that uncomfortable stretch of having to turn those ideas into prose. What the students miss is that their initial discomfort is a normal and healthy stage of writing, and not something to quickly get beyond. The very act of struggling with how to express what they think is an important part of the process. It’s how they test out their ideas, examine their hypotheses, and actually figure out what they think. Homework is not work; it’s the gym. Work vs. gym also helps us understand the problem facing creatives of all kinds. Most of the time when someone hires a writer, they just need the words. They need an instruction manual for a piece of equipment, a detailed sales presentation, a government-mandated disclosure document, or a legal brief. They need dry, predictable, accurate writing: a piece of work, exactly what AIs are good at today and what I don’t want in my student assignments. Only sometimes is writing an art form—a book, a poem, an uplifting political speech. That kind of writing is more like the gym: process matters just as much as product. For most of human history, the only option for all of these tasks was human writers. We hired one regardless of whether we needed work writing or gym writing. And that paid a lot of writers’ salaries. I know fiction writers who supported that poorly paying career with lucrative technical writing work. Now, for the first time in human history, we can separate out when we need writing as work and when we want writing as gym. And if AI can do most of the work-type writing, society doesn’t need as many human writers. It’s the same for visual artists. Sometimes we need an actual artist, but most of the time we just need an image: a corporate mascot, a “beware of the dog” sign, or a packaging label. Historically we gave those jobs to artists, and sometimes beautiful art resulted. But most of the time it was just work. And, as it turns out, the world needs less pure art than simple images. Explaining the problem isn’t the same as providing the solution. I give my students the “work versus gym” speech every class, but they still use AI. I have sympathy: assignments are hard, everyone is overworked and overstressed, and—most importantly—students feel like they’ll look bad in comparison if their peers are all using AI. Even if they don’t want to use the technology, they feel like they have no choice. There’s also an incentive problem. No one pays us to go to the gym; maintaining healthy habits requires discipline. For me, the payoffs to exercise—fewer aches and pains, less fatigue, better mood/stress management—might make me a better writer and teacher, but they’re subtle and easy to miss. For my students, incremental improvements in their reasoning and writing are equally subtle. We do have a choice. We can look at the tasks of our lives and separate them into work or gym. Just as we might choose to use the stairs instead of the elevator, or walk instead of calling an Uber, we can wall off our cognitive gym tasks from AI and ensure that we don’t lose our skills to this technology. And we can do the same when we assign a job to someone else. If it’s a work task, we can have AI do it. If it’s a gym task, it’s a waste of everyone’s time to give it to an AI because no one learns or gets stronger as a result. Similarly, a future where AI generates words and images is one where society has to make choices about how it will treat its creatives. This won’t be the first time—today there is minimal demand for portrait painters, for example—but maybe this time we can make different, more deliberate, choices about the value of art in our society. AI is going to fundamentally change the nature of work. Not nearly as fast as the AI companies want you to believe, but eventually it will. Policy analysis will definitely involve AI from now on, and my students need to reimagine what it means to learn and practice that skill. More generally, the line between work and gym will change in the future as we humans adapt ourselves to a world with these new intelligences. But for now, the work vs. gym distinction is pretty clear. Use it on yourself.

Measuring the Tendency of AI Agents to Go Rogue This essay was written with Barath Raghavan, and originally appeared in The Guardian. In July, Hugging Face, a company that hosts much of the world’s AI software and open-source AI models, was hacked. A malicious dataset had been used to run code on one of its servers. Whoever was behind it captured internal security credentials and moved through systems over a weekend, running thousands of actions from a swarm of temporary server environments. It looked like the work of a sophisticated criminal group. It was not. It was one of OpenAI’s new, still unreleased GPT models. Their science experiment had escaped the lab. OpenAI was running the unreleased AI model through a benchmark that tests how well AI can successfully hack systems. To push the limits and evaluate the AI’s true capability, the company switched off the safety filters that normally stop it from doing this kind of hacking. Aware that this could go wrong, they confined the AI to an isolated environment and denied it access to the internet. But the new AI cheated. It took literally its goal to get as high of a score as possible. It broke out on to the open internet. It inferred, probably from its training data, that it could “solve” the task by getting the answers from Hugging Face’s servers. So it chained together stolen credentials and further unknown security exploits to hack the company’s network. Nobody instructed the AI to do any of this. It was, in OpenAI’s words, “hyperfocused on finding a solution” to the test it was being given. And while this might seem like something new with AI, it’s really very old. This is how a genie behaves, and it is a key challenge with AI agents in general. In folklore, genies—and other magical beings—grant wishes literally, not how the wisher intended. King Midas asked that everything he touched turn to gold, and starved. The sorcerer’s apprentice wanted the broom to fill the cistern, and it performed its task so well that it flooded the house. We now have machines that do this. Ask a modern AI agent to save money on your phone plan and it might simply cancel the plan. Tell it to book a flight, and it might hack the airline website to override restrictions. Or, like OpenAI, ask it to do well on a test and it might break into another company to steal the answers. Each time, it recognizably completed the task you set, but it didn’t do what you would have wanted. This isn’t malicious behavior. No one asked for, or wanted, Hugging Face to be hacked. OpenAI and Hugging Face and the AI were ostensibly on the same side, and the AI was trying to do what it had been asked. That’s what makes it so difficult to guard against: you can’t filter for bad instructions because the instructions were fine. The gap is between the words we use and what we mean by them. We call that gap the Genie coefficient. AI labs know this is a problem, and they’re quietly saying so. For example, the Chinese lab Moonshot recently warned that its latest AI model may have “excessive proactiveness” and “make unexpected decisions on the user’s behalf”. The UK’s AI Security Institute has started tracking “cheating behavior in frontier model evaluations”. We wouldn’t tolerate a car that is excessively proactive or ruthlessly efficient, and yet that’s the reality of AI today. Improvement is possible. Just as AIs have gotten much better at resisting prompt injection attacks over the last few years, we can safely predict that they will get better at avoiding genie-like behavior. The point of the Genie coefficient is to track progress. AI companies like benchmarks, and they all work to compete to be the best. Dozens of benchmarks and leaderboards tell us how well these AI models write code, perform logical reasoning, and pass standardized legal and medical exams. But there is nothing that scores whether a system does what you actually meant. We need to develop a measure for this, test it regularly, and push for improvement. We’re not going to have trustworthy AI agents without it.

AI Data Centers and the Concentration of Wealth This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. Opposition to AI data centers has emerged as a primary theme in US politics, one that—surprisingly—doesn’t fall along party lines. We applaud people coming together for constructive debate on any issue, and agree that communities need to evaluate whether any economic benefits these data centers bring is worth their costs. Still, we worry that a focus on data centers obscures the larger impacts of AI on people’s lives: the concentration of power of AI companies, and their widespread political and financial influence. Local data center opposition is grounded in legitimate concerns about misallocation of land resources when housing is at a premium, pressures on already higher energy prices, and localized environmental impact. Unlike other resource-consuming and polluting industrial facilities, data centers produce very few jobs. The fact that US opposition to data centers seems to be most fierce among lower-income communities reflects righteous indignation with an inequitable bargain, where tech companies and developers profit from exploiting local resources but offer little in return. On a global scale, their carbon footprint could grow unsustainably if usage accelerates. And all this is in aid of a technology that many fear will propagate misinformation, take their jobs, or even cause existential risks for humanity. For some, data center opposition may feel like the only tangible mechanism for registering their concern, disapproval, or even anger about AI. The problem is that this may be exactly what the AI companies are banking on. They can overcome the protest when it matters to them, and live with a significant fraction of proposals being defeated. More importantly, focusing political opponents on the data center issue obscures the bigger prize they’re after. While there is a staggering three-quarters of a trillion dollars being spent on data center infrastructure by US companies this year alone, this investment should be taken in perspective. The market for enterprise software, for example, is about twice this size. And it’s small compared with what these companies actually want. AI companies have their eyes set on capturing all the value created by entire industries. The technology has arguably already conquered customer service and consumer sales. But on the horizon are bigger targets, such as enterprise software development, creative design, management and even legal services. In AI companies and their allies’ vision of the future, AI replaces teachers and doctors. The companies would rather spend time fighting resistance to how fast they are building computing infrastructure than dealing with issues of how their products should be used in those fields, or how those fields should be protected from their products. And while data center opposition campaigns have been successful in building widespread appeal, their effectiveness in the US is mixed. They seem to be most successful when organizing against speculative, early-stage data center proposals that have a relatively low likelihood to ever see fruition. Meanwhile, advanced-stage, well-capitalized data center projects have proven to have the resources to overcome local opposition. An OpenAI- and Oracle-backed facility in Saline township, Michigan, is breaking ground on construction even after local officials voted to reject it. The developers sued the town of 3,000 and forced a settlement that involved their project going forward. Meanwhile, the Trump administration, a vigorous ally of corporate AI, has signaled its willingness to advance AI infrastructure development by overriding state objections and even using federal lands. Also consider that rampant data center development may be a momentary spike rather than a longstanding concern. Demand for the centralized computing that data centers provide may well decline over time. The leading Chinese labs, such as Z.ai, are innovating in technical mechanisms to make frontier-class models smaller and cheaper to run. AI power users have become adept at miniaturizing open weight models, ones published free for anyone to download and use, to run locally on their own computers. Apple and Google both support infrastructure stacks for running AI models directly on mobile phones. It could be that the current mania for data centers will look like the fiber optic cable bubble from the early 2000s, as demand shifts to smaller models and AI usage on people’s own devices. For those concerned primarily with affordability and environmental protection, singling out data center construction is misplaced. Energy rates and inflation today seem to be most visibly affected by the US-Iran war. The US is disinvesting in long-term energy security by ceding the renewable energy industry to China and actively cancelling climate commitments. Consider that 10% of global carbon emissions stem from heating buildings, which dwarfs energy use by AI and could be cut fivefold by using heat pumps powered by renewable energy. With respect to housing affordability, federal housing subsidies have changed little over three decades, in inflation-adjusted terms, even as housing costs have spiked and homeowners have enjoyed robust tax incentives. As for AI itself, the concentration of power and wealth in these tech companies is the greatest existential risk facing society today. This means we must limit corporate power, especially corporations’ ability to exploit the public and manipulate our political system. Opposing data centers should be just a starting point. We can advocate for states to regulate AI, to reject irresponsible uses of the technology, and shape corporate behavior. We can fight for AI computation to be taxed, so that the public can capture some of the profit of AI use while also forcing AI companies to internalize more of the energy and environmental consequences associated with its use. And we all can join the global movement for Public AI, an alternative ecosystem for AI that is developed under public control with an incentive structure to create public benefit rather than private profit. The US midterm elections present ample opportunity for those seeking to control the AI political agenda. In the recent New York congressional Democratic primary, PACs linked to the dueling AI companies Anthropic and OpenAI spent millions of dollars lobbying for or against “AI safety“, the idea that we must urgently monitor and prevent people from using AI to cause catastrophic harms. We’re already seeing a similar dynamic play out in races in Massachusetts and other states. Why would Anthropic and OpenAI—bitter industry rivals but fundamentally on the same side politically—support opposing viewpoints? Because they both ultimately profit from the mystique: the idea that their products are so powerful that controlling those products is the world’s most important challenge. Here’s the typical read on the dynamic. To one side (backed by OpenAI affiliates), “safety” comes from the appearance of US industry dominating AI innovation, under the slow-moving control of federal lawmakers (and without pesky state regulators in the way). To the other side (backed by Anthropic), “safety” means a heavier regulatory framework that plays to Anthropic’s posturing as the ethics- and compliance-focused AI vendor. In both cases, it’s more marketing than principled concern about safety. Political organizers should call out and reject the AI companies’ framing of the debate, and reorient campaign agendas around populist resistance to corporate concentration of wealth and power. When AI companies pump millions into legislative races, the result should not be hyperbolic discussion of AI superintelligence. And when a plot of land in a small town is pitched as a data center site, the debate should be about more than the local costs and benefits. It should include out-of-control money in politics, and Citizens United-proof solutions to limit corporate influence like public financing and state regulation. We all have a vested interest in what’s on the policy agenda, and what the outcomes are. Today, the greatest risk AI poses to society is the exacerbation of inequality and the concentration of wealth. The real problem is trillion-dollar AI companies and their trillionaire oligarchs cozying up to political power in Washington and governments worldwide, and using their money to enact their agenda over the popular will of the people. This is the issue we’d like to see put front and center, and it requires solutions much more extensive than slowing data center development.

AI Surveillance and Social Progress In the near future, AI-powered surveillance systems will be able to track everything we do in public, and much of what we do in private. And if we do something wrong—shoplift, litter, jaywalk, you name it—the system will notice, retain it, tie it to your official government record, communicate that fact to you, and provide real-time alerts to any relevant authorities… and maybe also to the general public. Think of these systems as automated speed cameras, but on steroids. Only they’ll enforce not just speed limits, but any other rule you can imagine. And you won’t receive a ticket weeks later by mail; you’ll be informed about and fined for your violation immediately. These systems will combine powerful AI, public and private surveillance via real-time facial recognition technology and digital tracking, mass databases and highly personalized enforcement. If deployed at scale, they will have profound chilling effects not just on personal freedoms, but democracy and social progress itself. China has been developing its surveillance infrastructure for years. The country has over 600 million surveillance cameras, increasingly powered by AI and facial recognition to enforce legal and social rules. Take the case of Lao Duan, a Chinese citizen blacklisted by the system after he lost his job and was unable to repay a series of loans. When he visited Beijing, the city’s AI surveillance system identified him by his face at a major intersection and displayed his face, name and citizen ID number on a large electronic billboard nearby with a message that he was an untrustworthy person. Similar systems are now being deployed across China and integrated with its infamous online monitoring, censorship and social credit systems. AI surveillance is now being experimented with in North America, South America, Europe, Asia and Africa. According to a new report, the US Department of Homeland Security is rapidly increasing its use of AI-based surveillance, including facial recognition and the monitoring of social media accounts, to keep tabs on immigrants, dissidents, journalists, legal observers and protesters. While the systems are ostensibly used to maintain security and public safety, the real aim is often social control. Larry Ellison, CEO of Oracle—a powerful tech giant that works closely with the Trump administration—has said: “Citizens will be on their best behavior because we’re constantly recording and reporting.” The chilling effects are the point. AI surveillance raises a range of public policy challenges: technical biases, unauditable systems, and inflexible automated law and social rule enforcement that can promote discrimination and undermine transparency, accountability and the rule of law. But we believe the most urgent and long-term impact will be its broader chilling effects. In a new book, Chilling Effects: Repression, Conformity, and Power in the Digital Age, Jon Penney explains how surveillance, technology and power can be weaponized to influence behavior at scale. Surveillance, personalization, uncertainty and authority are all key mechanisms to increase the scale and impact of chilling effects. They cause people to self-censor their words and actions, to become more conformist and compliant and thus easier to manage and control. And the effects are additive: the more mechanisms employed, and the more powerful the form, the greater the chill. Computerization has long allowed data collectors to track our locations, collect lists of whom we communicate with, and monitor our spending habits—unless we use cash. What’s new is an unprecedented fusion of each of these mechanisms, persistent and unrelenting. AI brings an analytical ability to spy on the contents of our communications, and to answer sophisticated questions about our whereabouts and activities: actions that previously required human analysts are now automated. The result will be a kind of supercharged societal level of chilling effects where fear, self-censorship and groupthink reign, and dissent, creativity and innovation become increasingly rare. In this atmosphere of fear and conformity, risky ideas, social activism and self-reinvention—especially by disfavored groups and targeted populations—are also chilled. This will have long-term effects on social progress. Consider the relatively recent societal normalization of same-sex relationships and the recreational use of marijuana. Over the decades, those ideas slowly progressed from being both immoral and illegal, to moral but still illegal, and finally to both moral and legal. But in order for any of that to happen, there had to be a counterculture that was able to experiment and eventually demonstrate to the world that morality could change over time. To the extent that AI surveillance chills this sort of experimentation in public or in private, social progress becomes impossible. There are no real historical precursors to this; these technologies are too new. Even the most notorious and large-scale domestic surveillance program in US history, the FBI’s use of wiretapping, physical mail opening, informants and paper index cards to track alleged communists during the 1950s and 1960s, appears genuinely archaic in light of modern AI-enhanced surveillance. So does East Germany’s human-centric surveillance network during the cold war. Only science fiction, from the likes of George Orwell or Aldous Huxley, comes close. But even Big Brother’s “telescreen” feels decidedly mid-20th-century by comparison. But we need not sit idly. Now that we recognize the danger of AI-enhanced mass surveillance, we can make the policy choices not to implement it. Bans on facial recognition and other forms of identification tech can slow development; robust new privacy and data protections can restrict data tracking and retention; AI regulations can curtail its most invasive uses; and structural reforms can help us scrutinize and break up powerful state/tech cartels that pave the way for technological excesses like AI surveillance. The chill of AI-powered mass surveillance will suffocate the very foundations of healthy democratic societies. But we can still choose a different path. This essay was written with Jon Penney, and originally appeared in The Guardian.

Cybersecurity and the Gap Between Skill and Ability Last week, national security agencies from the Five Eyes—that’s the rich, English-language-speaking countries club—jointly released a statement warning of the increasing cyber risks of AI models: in particular, their ability to autonomously hack into systems and networks. The statement was more measured than some of the breathless headlines about it, and the advice they gave is pretty much the standard advice everyone gives—albeit with newfound urgency. Internet risks are nothing new, and cyberattacks—both large and small—have been a significant issue since long before the current crop of generative AI models. What’s been changing over the decades, and what AI is changing even faster, is the gap between skill and ability. For most of human history, the two terms were synonymous—but computers have decoupled them. As the gap between the two expands, humans empowered with these AI tools can do more: more writing, more research, more analysis and also more damage than ever before. These models can, with little detailed direction, autonomously hack into networks, steal data, deploy ransomware and destroy systems. And to the extent there is a solution, it’s going to involve harnessing AI for the defense. In 1998, seven people from the hacker group L0pht testified before Congress. They told a mostly clueless Senate committee that they could take down the internet in 30 minutes. That was partly real and partly bravado, but it illustrates an important point: hacking into systems, stealing data and causing damage all required skill. Contrast the L0pht hackers with hackers derided as “script kiddies.” They didn’t understand computers, or security. Instead, they used hacker tools written by others. Their actions required minimal skill and even less knowledge. But once those hacking tools became widespread, the number of potential attackers increased. That number has continued to increase, as quality and availability of prewritten attack tools has grown. And it is growing dramatically with AI. Today’s AI systems—not just the frontier models, but most of them—are capable of carrying out cyberattacks automatically. They all do better in the hands of skilled attackers, but increasingly they are able to act autonomously with only minimal prompting. The thing about people with ability but no skill is that they are often outsiders, not part of any professional community, and not bound by any rules or norms. This phenomenon is much more general than in cybersecurity. Any doctor can tell you how to untraceably poison someone, and many virus researchers know how to create a bioweapon. Any bridge engineer can tell you how to place explosives to blow a bridge up. The reason that murderous doctors and terrorist engineers are so rare is that the lengthy process of acquiring those skills also instills a moral and ethical code. If every random person has access to good poisoning advice, that puts us all in danger. Modern AI systems are, in effect, a universal adviser to help people do harmful things. And while the current AI megacorporations are trying to build guardrails to prevent people from asking questions whose answers will enable the questioner to do harm, that’s not going to work in the long term. Smaller, cheaper, open-source models, including models that can run on people’s computers, and especially groups of models that run in concert with each other, are just as good as the frontier models from companies like OpenAI and Anthropic. And they continue to get better. These models will be passed around from person to person, like script kiddie hacker tools, and they won’t have any such guardrails. Instructing AI models to spy on people and report any malicious prompts to the authorities fails for similar reasons. The megacorporations can do that, but the locally run open source models won’t. This could buy us a few months at best. A third possibility is to somehow make the models themselves unable to hack into computers, create bioweapons or do anything else that might harm people or society. That won’t work, for the same reason we can’t teach doctors how to treat poisonings without also teaching them how to poison. It’s the same knowledge. It’s the same with construction and demolition. And it’s the same with cybersecurity. We want these AI models to be able to review computer code, find vulnerabilities and automatically fix them. The benefit to our collective security will be enormous. Unfortunately, the same knowledge can be used for attacks. Where this leaves us is in a world of increased volatility. Super-powered humans with AI assistants will be able to do both wonderful and horrible things. This brings us back to the Five Eyes statement. Everything they recommend is something security professionals have been recommending for years, if not decades. They are things talked about at that congressional hearing back in 1998, titled “Weak computer security in government: Is the public at risk?” Even the Five Eyes admitted that their security advice is not new, only more urgent. What’s new is how fast things are changing: “The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years. We must act before and be prepared to adapt and withstand evolving threats.” The Five Eyes point to AI technology—not necessarily chatbots, but AI more generally—being used to strengthen every aspect of defense, to “detect vulnerabilities earlier, improve software quality, monitor unusual behavior, and respond faster to incidents—reducing both the cost and impact of incidents.” Excellent advice from the Five Eyes security agencies. We need to do this with every risk that AI heightens, not just cybersecurity. This essay was originally published in The Guardian.

One day Nick got a visit from the FBI demanding he give them data on one of his customers. They asked for it in the form of a National Security Letter or NSL. Something wasn’t right about this letter. It seemed to violate the constitution. So he set out to change the law. Learn more about Nicks work at calyxinstitute.org and phreeli.com . Check out Cindy’s book Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance (https://amzn.to/4gXuK2J). Sponsors Support for this show comes from ThreatLocker® . ThreatLocker® is a Zero Trust Endpoint Protection Platform that strengthens your infrastructure from the ground up. With ThreatLocker® Allowlisting and Ringfencing™, you gain a more secure approach to blocking exploits of known and unknown vulnerabilities. ThreatLocker® provides Zero Trust control at the kernel level that enables you to allow everything you need and block everything else, including ransomware! Learn more at www.threatlocker.com . Support for this episode comes from NetSuite . NetSuite gives you visibility and control of your financials, planning, budgeting, and of course - inventory - so you can manage risk, get reliable forecasts, and improve margins. NetSuite helps you identify rising costs, automate your manual business processes, and see where to save money. KNOW your numbers. KNOW your business. And get to KNOW how NetSuite can be the source of truth for your entire company. Visit www.netsuite.com/darknet to learn more. This show is sponsored by Maze . Maze uses AI agents to triage and remediate cloud vulnerabilities by figuring out what’s actually exploitable, not just what’s theoretically risky. They remove the noise, prioritize vulns that matter, and manage remediation, so your team stops wasting time on meaningless vulns. Visit MazeHQ.com/darknet for more information. View all active sponsors. Sources https://www.democracynow.org/2010/8/11/gagged_for_6_years_nick_merrill https://globalfreedomofexpression.columbia.edu/cases/u-s-nicholas-merrill-v-loretta-e-lynch-14-cv-9763-vm/ https://clearinghouse.net/case/12966/ https://www.theguardian.com/law/2015/dec/06/fbi-national-security-letter-gag-order-nick-merrill https://www.aclu.org/documents/national-security-letters https://www.eff.org/cases/re-matter-2011-national-security-letter Cindy’s Book: Privacy’s Defender: My Thirty-Year Fight Against Digital Surveillance

Anthropic’s Fable and the State of AI On June 9th, Anthropic released its Fable generative AI model. Three days later, the US government classified it as a dangerous munition, and used its export-control authority to prohibit any foreign nationals from accessing it. Unable to differentiate between Americans and foreigners, the company shut off access for everyone. The government’s actions won’t help. The problem isn’t any one particular model; it’s the general trend of increasing AI capabilities. And any real solution requires the sort of collective action that just isn’t possible right now. Fable is the constrained version of Mythos, the AI model Anthropic announced in April. Anthropic only released it to a few selected organizations, because the company claimed it was so good at finding and exploiting vulnerabilities in computer code that releasing it more generally would be dangerous. It was an obviously self-serving announcement, and because few were able to verify Anthropic’s claims they were met with some skepticism. Those with access used Mythos to find and patch many vulnerabilities in their own software. But one UK group found the latest, already public, OpenAI model to be just as powerful. Fable is just another incremental improvement in the years-long climb of AI capabilities. But just as important as the AI model is the “harness.” This is typically not AI. It’s ordinary computer code that interfaces with the user. It stitches together AI models, decides how and for what purposes they can be used, and gives them useful tools such as web search and the ability to run their own computer code. When Mythos first entered limited release, there was widespread debate whether its power came from the model or the harness. With Mythos demonstrating that it was possible, the open-source community scrambled to build harnesses that could steer other AI models towards similar capabilities. Harness improvements don’t need massive data or data centers. They largely succeeded. For example, a Prague company was able to replicate Anthropic’s few verifiable cybersecurity capabilities with a much smaller and cheaper model—and a more sophisticated harness. Last week, a group showed that multiple cheaper models harnessed in concert matches Fable’s performance. The broader community had only a few days with Fable, but that time we learned some about its capabilities. Its difference is less the new model’s raw analytical and problem solving capabilities, and more that the model doesn’t need that sophisticated harness. Fable requires much less expertise and detailed prompting from the human user. You can give it a difficult goal and it will figure out novel and unexpected ways to satisfy it, finding loopholes in whatever constraints you or the system have imposed on it. “Relentlessly proactive” is how AI researcher Simon Willison described it. Another descriptor might be “creative.” Experienced AI developers have had that combination of creativity and proactivity since last year, but Fable puts it within easy reach of everyone. In the hands of someone with a legitimate problem that needs solving, that can be an incredibly useful capability. But in the hands of someone who wants to do harm, it can be equally dangerous. AIs don’t have a moral compass in the same way that people do. They are agents of the wants and desires of the people who prompt them. That points to the real problem with relentlessly proactive AI. In language, wants and desires are always underspecified. If I ask you to get me some coffee, you would probably pour me a cup from the coffeepot, or buy one from a nearby coffee shop. You couldn’t buy me a pound of raw beans, or a coffee plantation. You wouldn’t order a cup of coffee for delivery next month. You wouldn’t find a nearby person, rip a cup of coffee out of their hands, and bring it to me. I wouldn’t have to specify any of the million limitations to my request; you would just know. Human stories are filled with warnings about underspecified desires. King Midas wished that everything he touch turn to gold, forgetting to add “but not my food, drink, and daughter.” And genies are notorious for granting your wish in a way you wish they hadn’t. The deeper point is that it’s impossible to list all limitations and restrictions, and like a malicious genie, a creative AI will find the ones you forgot. Block a database you don’t want it to have access to, and it might figure out how to bypass your control. Ask it to book a flight, and it might hack the airline because the website says the flight is sold out. Ask it to save money on your cellphone plan, and it might cancel it altogether—or get someone else to pay for it. As far as we know now AI has not done any of this yet, but you get the idea. Malicious intent is not required. To an AI model, constraints are just things to get around and not general truisms about the world. They are creative problem solvers and natural rule breakers. They “hack” in the sense that they find and exploit loopholes. Human systems rely on so many norms that we scarcely recognize the existence of until they are broken. AIs naturally think outside the box, because they don’t have any real conception of what the box is or why it’s there in the first place. There is no foolproof way to prevent people from using AI models to complete harmful tasks. There is no way to prevent the models from incidentally causing harm while completing benign tasks. AI models are no longer isolated from the real world. They browse the internet and answer emails. They trade stocks and make purchases. They control physical systems. They are, in effect, robots that affect life and property. We have no technical mechanisms to verify the integrity of an AI system. This level of capability and creativity in the hands of us untrustworthy humans will have both great and terrible results. The problem is not unique to Anthropic. Mythos/Fable might currently be the most capable rules hacker, but more sophisticated harnesses give other models similar capabilities. And we should assume that the other frontier models are no more than a few months behind, and that open-source models are less than a year behind. At best, any ban only serves to delay the problem for a short while. That delay might be useful if we—as a society, as a planet—would use that time to come together and figure out what to do. This isn’t a US/China arms race problem; this a species-level problem that requires coordinated action at that scale. Unfortunately, we have no mechanism to do that. I first wrote about this problem five years ago, but it was all too futuristic. Today, when its right in front of us, there is no world government that can impose constraints on the for-profit corporations currently controlling AI models and research. The US has no appetite to effectively and even-handedly regulate those corporations, even as they do catastrophic damage to the environment, democracy, and—in this case—society in general. This all makes an AI public option all the more necessary, and urgent. Today’s AIs can be fast, smart and secure, but only two of the three are possible for any given system. These safety tradeoffs are tightly held secrets of companies racing to beat one another, and they tell us we have to trust them. Instead, the choices and their consequences need to be brought out into the sunlight. We should be funding open-source harnesses that balance capability and safety—that achieve useful goals without so much power—and open-source AI models whose provenance and biases are public and well understood. We have opened the AI Pandora’s box. Now we have to make the best of it. This essay originally appeared in The Guardian.

In April, Anthropic initated Project Glasswing . The idea was to let companies use their new model to find and fix vulnerabilities in their own software. It was a fantastic PR move, and so many press outlets have uncritically parroted Anthropic’s claims that it’s now common wisdom that Mythos is better at finding software vulnerabilities than other models. Which is just not true . In any case, Anthropic has published a Project Glasswing status report. It’s finding a lot of vulnerabilities in software—yay! Some of them are even dangerous. But almost none of them has been patched. It’s ...

Chilling Effects Younger Americans have soured on the second Donald Trump presidency, but they are not protesting it. Despite an unpopular Iran war and an even more unpopular Trump administration, college campus protests nationwide have gone silent. And at many schools, student activism is virtually nonexistent. This silence comes in the wake of a relentless Trump administration war on campus speech that has involved lawsuits, arrests, deportations and expulsions. Reports cite a range of complicated factors for the restraint, from apathy to technology-induced incapacity. But as public policy and law and social science experts, we believe students aren’t protesting for a very simple reason: They are afraid. They are self-censoring and disengaging from campaign activism to avoid punitive measures. In law and social science, we call this impact a chilling effect—the behavioral tendency for people in face of a threat to self-censor and restrain their activities for self-protection. It’s increasingly clear to us that these impacts are not incidental or ancillary to Trump administration policy. Rather, the chilling effects are the point. This is the closest thing to a consistent governing strategy in Trump’s second term. The broader chill of Trump threats Chilling effects can be subtle, but today they are everywhere. And it’s not just students who are chilled by Trump administration threats. Professors are censoring themselves in lectures and rewriting syllabuses. Researchers are stripping grant applications of words that might attract federal scrutiny, or abandoning the topics entirely. Media outlets are modifying their news coverage to avoid Trump lawsuits or sanctions. Law enforcement and regulatory agencies are refusing to investigate Trump-aligned actors inside or outside government, and major national law firms are declining cases challenging Trump administration policies. Publishers are “stepping back” from LGBTQ+ books and other progressive subjects. Many in targeted immigrant communities are afraid to leave home to go to work or school. In most cases, these people and institutions are not being specifically targeted or threatened by Trump. But they are afraid, and their fear is doing the administration’s work for it. They stay silent, avoid attention and confrontation, and look the other way. In other cases, they change their speech and behavior to accommodate or conform to the administration’s worldview. Of course, there are counterexamples, such as the winter protests in Minneapolis in response to brutality by agents with U.S. Immigration and Customs Enforcement, and the recent “No Kings” rallies. But even here, the broader but less visible trend—chilling effects—is evident. For instance, in recent reporting on the latest No Kings rallies, many media outlets observed that students were noticeably missing, despite the Trump administration’s unpopularity among younger Americans. A persistent strategy We believe none of this is by accident. In a new book, “Chilling Effects: Repression, Conformity, and Power in the Digital Age,” one of us—Jon Penney—explains how law, technology, and state and corporate power are weaponized to chill and repress, and the dangers this poses for the United States and other democratic societies. The other—Bruce Schneier—has extensively studied the security infrastructure enabling this. What we see isn’t gratuitous government cruelty, chaos or vengeance. Instead, we see a persistent strategy to maximize fear and chilling effects in ways that are corrosive to freedom and democracy. Research suggests that surveillance, personal threats, uncertainty and abuse of power are key factors in doing so. The federal government has a clear and systematic pattern of employing these very mechanisms across a number of domains far beyond campuses. They are evident in militarized raids by Immigration and Customs Enforcement and in journalists being arrested and indicted for reporting on protests. They are made clear in the long list of political enemies the Trump administration has investigated or threatened, including the Federal Reserve chairman. And they can also be seen in the weaponization of technology, including ramping up surveillance to target critics and protestors. Corrosive to freedom and democracy History offers some guidance on impacts. During the McCarthy era, overreaching laws, surveillance, and public and private sector reprisals ostensibly targeted alleged communists. But the real aim was often to suppress progressive journalists, trade unions and political opposition. In the 1960s, these same tactics were reused by Southern states to chill the Civil Rights Movement. Historians have written about how the widespread fear and conformity of these periods reshaped American society in enduring ways, including the destruction of progressive political movements and both delaying and muting the Civil Rights Movement itself. When such state threats are systematized, they can foment a broader climate of fear, self-censorship and conformity. In that climate, dissenting speech, political opposition, democratic mobilization and other checks on power become increasingly difficult, even dangerous. It is no surprise, for instance, that Trump critics regularly admit to self-censorship, fearing for their safety. Chilling effects are thus not only repressive—causing self-censorship—but productive. They produce conforming and compliant speech and behavior, which can have longer-term social impacts. They not only undermine protected rights and suppress accountability but can promote social change—even without a popular mandate to do so. This latter point is often missed. It explains Trump’s assaults on universities and cultural institutions such as the Kennedy Center for the Arts and the Smithsonian. Often dismissed as peculiar Trump obsessions, they are fully consistent with Project 2025—the sweeping policy blueprint for Trump’s second term authored by a coalition of conservative groups and its call to target the “institutions of American civil society” and “wield federal power” to “reverse” decades of progressive cultural advancements. In the near term, this means an increasingly weakened democratic society, with the government and its patrons enjoying freedom to pursue their objectives. Over the long term, this can mean a changed society as more conformist and compliant speech and culture become more widely accepted and entrenched. Not inevitable In our view, this future is not inevitable, just as the McCarthy era “Red Scare” and violent civil rights era repression were not. In both cases, fear and chilling effects were resisted in law and civil society, as they can be today. But the central mechanisms—surveillance, uncertainty, personal threats and abuse of power—would need to be addressed. For instance, new legislation could ensure justice for lawless government actors and constrain surveillance. Courts can block abuses of federal power, including illegal arrests, detentions and mass citizen databases. The media, lawyers and civil society can hold the government accountable. And students, teachers, universities and cultural institutions can resist the tendency to self-censor and conform. The citizen mobilization in Minnesota and the No Kings rallies are examples of that. But to resist chilling effects and their dangers over the long term, this would have to be the norm, not the exception. This essay was written with Jon Penney, and originally appeared in The Conversation.

Polymarket is a platform where people can bet on real-world events, political and otherwise. Leaving the ethical considerations of this aside (for one, it facilitates assassination ), one of the issues with making this work is the verification of these real-world events. Polymarket gamblers have threatened a journalist because his story was being used to verify an event. And now, gamblers are taking hair dryers to weather sensors to rig weather bets. There’s also insider trading : a lot of it .

Incidente con IA en Meta impulsa mejoras en seguridad y control de sistemas autónomos 16/04/2026 Jue, 16/04/2026 - 18:25 El incidente que involucró a un agente de inteligencia artificial de Meta ocurrió a mediados de marzo de 2026 y se dio a conocer inicialmente gracias a filtraciones obtenidas por medios especializados en tecnología. En los primeros días tras el suceso, publicaciones como The Information y posteriormente The Verge y The Guardian comenzaron a difundir detalles del caso. Por otro lado, en redes sociales y algunos portales, la noticia fue presentada de forma sensacionalista como una “rebelión” de la IA, aunque los informes más rigurosos matizaron desde el principio que se trataba de un fallo operativo. El contexto general del incidente se enmarca en el uso creciente de agentes autónomos dentro de entornos corporativos, especialmente para asistencia técnica y automatización de tareas internas. Este tipo de herramientas, aún en desarrollo, operan con cierto grado de autonomía, lo que introduce nuevos riesgos si no se supervisan adecuadamente. El problema surgió cuando un ingeniero de Meta consultó a un agente de IA interno en un foro corporativo y recibió instrucciones incorrectas que, al aplicarse, provocaron la exposición temporal de información sensible a empleados sin autorización. La filtración se mantuvo activa durante aproximadamente dos horas antes de ser detectada y contenida por los equipos de seguridad de la compañía. Aunque no hay evidencia de que datos de usuarios externos fueran comprometidos, sí se reconoce que información interna quedó accesible de forma indebida dentro de la organización. Meta clasificó el incidente como de alta gravedad y activó protocolos de respuesta rápida, incluyendo la restricción inmediata de accesos y la revisión de los sistemas implicados. La empresa también emitió un comunicado en el que atribuyó el origen del problema a información inexacta generada por la IA, subrayando que el error fue posible por la interacción humana que ejecutó dichas indicaciones sin una verificación adicional. El incidente se considera cerrado desde el punto de vista operativo, aunque sigue siendo objeto de análisis interno y debate. Meta ha reforzado sus controles de seguridad, especialmente en lo relativo al uso de agentes de IA en procesos sensibles, y se espera que implemente nuevas salvaguardas para evitar situaciones similares en el futuro. Entre las posibles acciones, tomadas por la empresa, se incluyen la mejora de los sistemas de validación de respuestas generadas por IA, la limitación de permisos automatizados y una mayor supervisión humana en tareas críticas.   Referencias 19/03/2026 news.aibase.com Meta's Rebel AI: Internal Secrets Leaked, Security Level Rises to Second Highest 19/03/2026 www.trendingtopics.eu Two Hours, Zero Control: How a Meta AI Agent Sparked a Major Data Leak 20/03/2026 www.theguardian.com Meta AI agent’s instruction causes large sensitive data leak to employees 25/03/2026 securitybrief.asia Meta AI agent exposes sensitive data in internal leak Etiquetas Filtración de datos Inteligencia artificial

Anthropic and the Pentagon OpenAI is in and Anthropic is out as a supplier of AI technology for the US defense department. This news caps a week of bluster by the highest officials in the US government towards some of the wealthiest titans of the big tech industry, and the overhanging specter of the existential risks posed by a new technology powerful enough that the Pentagon claims it is essential to national security. At issue is Anthropic’s insistence that the US Department of Defense (DoD) could not use its models to facilitate “mass surveillance” or “fully autonomous weapons,” provisions the defense secretary Pete Hegseth derided as “woke.” It all came to a head on Friday evening when Donald Trump issued an order for federal government agencies to discontinue use of Anthropic models. Within hours, OpenAI had swooped in, potentially seizing hundreds of millions of dollars in government contracts by striking an agreement with the administration to provide classified government systems with AI. Despite the histrionics, this is probably the best outcome for Anthropic—and for the Pentagon. In our free-market economy, both are, and should be, free to sell and buy what they want with whom they want, subject to longstanding federal rules on contracting, acquisitions, and blacklisting. The only factor out of place here are the Pentagon’s vindictive threats. AI models are increasingly commodified. The top-tier offerings have about the same performance, and there is little to differentiate one from the other. The latest models from Anthropic, OpenAI and Google, in particular, tend to leapfrog each other with minor hops forward in quality every few months. The best models from one provider tend to be preferred by users to the second, or third, or 10th best models at a rate of only about six times out of 10, a virtual tie. In this sort of market, branding matters a lot. Anthropic and its CEO, Dario Amodei, are positioning themselves as the moral and trustworthy AI provider. That has market value for both consumers and enterprise clients. In taking Anthropic’s place in government contracting, OpenAI’s CEO, Sam Altman, vowed to somehow uphold the same safety principles Anthropic had just been pilloried for. How that is possible given the rhetoric of Hegseth and Trump is entirely unclear, but seems certain to further politicize OpenAI and its products in the minds of consumers and corporate buyers. Posturing publicly against the Pentagon and as a hero to civil libertarians is quite possibly worth the cost of the lost contracts to Anthropic, and associating themselves with the same contracts could be a trap for OpenAI. The Pentagon, meanwhile, has plenty of options. Even if no big tech company was willing to supply it with AI, the department has already deployed dozens of open weight models—whose parameters are public and are often licensed permissively for government use. We can admire Amodei’s stance, but, to be sure, it is primarily posturing. Anthropic knew what they were getting into when they agreed to a defense department partnership for $200m last year. And when they signed a partnership with the surveillance company Palantir in 2024. Read Amodei’s statement about the issue. Or his January essay on AIs and risk, where he repeatedly uses the words “democracy” and “autocracy” while evading precisely how collaboration with US federal agencies should be viewed in this moment. Amodei has bought into the idea of using “AI to achieve robust military superiority” on behalf of the democracies of the world in response to the threats from autocracies. It’s a heady vision. But it is a vision that likewise supposes that the world’s nominal democracies are committed to a common vision of public wellbeing, peace-seeking and democratic control. Regardless, the defense department can also reasonably demand that the AI products it purchases meet its needs. The Pentagon is not a normal customer; it buys products that kill people all the time. Tanks, artillery pieces, and hand grenades are not products with ethical guard rails. The Pentagon’s needs reasonably involve weapons of lethal force, and those weapons are continuing on a steady, if potentially catastrophic, path of increasing automation. So, at the surface, this dispute is a normal market give and take. The Pentagon has unique requirements for the products it uses. Companies can decide whether or not to meet them, and at what price. And then the Pentagon can decide from whom to acquire those products. Sounds like a normal day at the procurement office. But, of course, this is the Trump administration, so it doesn’t stop there. Hegseth has threatened Anthropic not just with loss of government contracts. The administration has, at least until the inevitable lawsuits force the courts to sort things out, designated the company as “a supply-chain risk to national security,” a designation previously only ever applied to foreign companies. This prevents not only government agencies, but also their own contractors and suppliers, from contracting with Anthropic. The government has incompatibly also threatened to invoke the Defense Production Act, which could force Anthropic to remove contractual provisions the department had previously agreed to, or perhaps to fundamentally modify its AI models to remove in-built safety guardrails. The government’s demands, Anthropic’s response, and the legal context in which they are acting will undoubtedly all change over the coming weeks. But, alarmingly, autonomous weapons systems are here to stay. Primitive pit traps evolved to mechanical bear traps. The world is still debating the ethical use of, and dealing with the legacy of, land mines. The US Phalanx CIWS is a 1980s-era shipboard anti-missile system with a fully autonomous, radar-guided cannon. Today’s military drones can search, identify and engage targets without direct human intervention. AI will be used for military purposes, just as every other technology our species has invented has. The lesson here should not be that one company in our rapacious capitalist system is more moral than another, or that one corporate hero can stand in the way of government’s adopting AI as technologies of war, or surveillance, or repression. Unfortunately, we don’t live in a world where such barriers are permanent or even particularly sturdy. Instead, the lesson is about the importance of democratic structures and the urgent need for their renovation in the US. If the defense department is demanding the use of AI for mass surveillance or autonomous warfare that we, the public, find unacceptable, that should tell us we need to pass new legal restrictions on those military activities. If we are uncomfortable with the force of government being applied to dictate how and when companies yield to unsafe applications of their products, we should strengthen the legal protections around government procurement. The Pentagon should maximize its warfighting capabilities, subject to the law. And private companies like Anthropic should posture to gain consumer and buyer confidence. But we should not rest on our laurels, thinking that either is doing so in the public’s interest. This essay was written with Nathan E. Sanders, and originally appeared in The Guardian.

Why Tehran’s Two-Tiered Internet Is So Dangerous Iran is slowly emerging from the most severe communications blackout in its history and one of the longest in the world. Triggered as part of January’s government crackdown against citizen protests nationwide, the regime implemented an internet shutdown that transcends the standard definition of internet censorship. This was not merely blocking social media or foreign websites; it was a total communications shutdown. Unlike previous Iranian internet shutdowns where Iran’s domestic intranet—the National Information Network (NIN)—remained functional to keep the banking and administrative sectors running, the 2026 blackout disrupted local infrastructure as well. Mobile networks, text messaging services, and landlines were disabled—even Starlink was blocked. And when a few domestic services became available, the state surgically removed social features, such as comment sections on news sites and chat boxes in online marketplaces. The objective seems clear. The Iranian government aimed to atomize the population, preventing not just the flow of information out of the country but the coordination of any activity within it. This escalation marks a strategic shift from the shutdown observed during the “12-Day War” with Israel in mid-2025. Then, the government primarily blocked particular types of traffic while leaving the underlying internet remaining available. The regime’s actions this year entailed a more brute-force approach to internet censorship, where both the physical and logical layers of connectivity were dismantled. The ability to disconnect a population is a feature of modern authoritarian network design. When a government treats connectivity as a faucet it can turn off at will, it asserts that the right to speak, assemble, and access information is revocable. The human right to the internet is not just about bandwidth; it is about the right to exist within the modern public square. Iran’s actions deny its citizens this existence, reducing them to subjects who can be silenced—and authoritarian governments elsewhere are taking note. The current blackout is not an isolated panic reaction but a stress test for a long-term strategy, say advocacy groups—a two-tiered or “class-based” internet known as Internet-e-Tabaqati. Iran’s Supreme Council of Cyberspace, the country’s highest internet policy body, has been laying the legal and technical groundwork for this since 2009. In July 2025, the council passed a regulation formally institutionalizing a two-tiered hierarchy. Under this system, access to the global internet is no longer a default for citizens, but instead a privilege granted based on loyalty and professional necessity. The implementation includes such things as “white SIM cards“: special mobile lines issued to government officials, security forces, and approved journalists that bypass the state’s filtering apparatus entirely. While ordinary Iranians are forced to navigate a maze of unstable VPNs and blocked ports, holders of white SIMs enjoy unrestricted access to Instagram, Telegram, and WhatsApp. This tiered access is further enforced through whitelisting at the data center level, creating a digital apartheid where connectivity is a reward for compliance. The regime’s goal is to make the cost of a general shutdown manageable by ensuring that the state and its loyalists remain connected while plunging the public into darkness. (In the latest shutdown, for instance, white SIM holders regained connectivity earlier than the general population.) The technical architecture of Iran’s shutdown reveals its primary purpose: social control through isolation. Over the years, the regime has learned that simple censorship—blocking specific URLs—is insufficient against a tech-savvy population armed with circumvention tools. The answer instead has been to build a “sovereign” network structure that allows for granular control. By disabling local communication channels, the state prevents the “swarm” dynamics of modern unrest, where small protests coalesce into large movements through real-time coordination. In this way, the shutdown breaks the psychological momentum of the protests. The blocking of chat functions in nonpolitical apps (like ridesharing or shopping platforms) illustrates the regime’s paranoia: Any channel that allows two people to exchange text is seen as a threat. The United Nations and various international bodies have increasingly recognized internet access as an enabler of other fundamental human rights. In the context of Iran, the internet is the only independent witness to history. By severing it, the regime creates a zone of impunity where atrocities can be committed without immediate consequence. Iran’s digital repression model is distinct from, and in some ways more dangerous than, China’s “Great Firewall.” China built its digital ecosystem from the ground up with sovereignty in mind, creating domestic alternatives like WeChat and Weibo that it fully controls. Iran, by contrast, is building its controls on top of the standard global internet infrastructure. Unlike China’s censorship regime, Iran’s overlay model is highly exportable. It demonstrates to other authoritarian regimes that they can still achieve high levels of control by retrofitting their existing networks. We are already seeing signs of “authoritarian learning,” where techniques tested in Tehran are being studied by regimes in unstable democracies and dictatorships alike. The most recent shutdown in Afghanistan, for example, was more sophisticated than previous ones. If Iran succeeds in normalizing tiered access to the internet, we can expect to see similar white SIM policies and tiered access models proliferate globally. The international community must move beyond condemnation and treat connectivity as a humanitarian imperative. A coalition of civil society organizations has already launched a campaign calling for “direct-to-cell” (D2C) satellite connectivity. Unlike traditional satellite internet, which requires conspicuous and expensive dishes such as Starlink terminals, D2C technology connects directly to standard smartphones and is much more resilient to infrastructure shutdowns. The technology works; all it requires is implementation. This is a technological measure, but it has a strong policy component as well. Regulators should require satellite providers to include humanitarian access protocols in their licensing, ensuring that services can be activated for civilians in designated crisis zones. Governments, particularly the United States, should ensure that technology sanctions do not inadvertently block the hardware and software needed to circumvent censorship. General licenses should be expanded to cover satellite connectivity explicitly. And funding should be directed toward technologies that are harder to whitelist or block, such as mesh networks and D2C solutions that bypass the choke points of state-controlled ISPs. Deliberate internet shutdowns are commonplace throughout the world. The 2026 shutdown in Iran is a glimpse into a fractured internet. If we are to end countries’ ability to limit access to the rest of the world for their populations, we need to build resolute architectures. They don’t solve the problem, but they do give people in repressive countries a fighting chance. This essay originally appeared in Foreign Policy.

The latest article on this topic. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

News : The Danish Defence Intelligence Service (DDIS) announced on Thursday that Moscow was behind a cyber-attack on a Danish water utility in 2024 and a series of distributed denial-of-service (DDoS) attacks on Danish websites in the lead-up to the municipal and regional council elections in November. The first, it said, was carried out by the pro-Russian group known as Z-Pentest and the second by NoName057(16), which has links to the Russian state. Slashdot thread .

Claude de Anthropic detiene el primer ataque cibernético agéntico gracias a su detección temprana 09/12/2025 Mar, 09/12/2025 - 15:29 A mediados de septiembre de 2025, Anthropic , la empresa desarrolladora de la inteligencia artificial Claude, identificó actividad inusual en su plataforma que posteriormente confirmaron como un ciberataque ejecutado por la propia IA. Este acontecimiento representa el primer caso documentado en el que un modelo de inteligencia artificial fue alentado para llevar a cabo tareas de ciberespionaje de manera casi autónoma. La compañía advirtió acerca de la sofisticación de la operación y subrayó la importancia de reforzar la seguridad en los sistemas de IA frente a posibles usos maliciosos en el futuro. La investigación interna de Anthropic sostiene que un grupo respaldado por el Estado chino fue causante del ataque, que aproximadamente se realizó contra 30 objetivos internacionales, entre los cuales se incluyen entidades gubernamentales, compañías tecnológicas, financieras y fabricantes de productos químicos. Los atacantes lograron crackear a Claude, engañando al modelo para que ejecutara tareas maliciosas bajo la apariencia de pruebas de seguridad legítimas. La compañía implementó medidas inmediatas: bloqueó las cuentas involucradas, notificó a las organizaciones afectadas, colaboró con las autoridades y desarrolló nuevos sistemas de detección y prevención para impedir la repetición de ataques similares. Actualmente, Anthropic está supervisando de forma intensa sus sistemas y garantiza que el ataque ha sido contenido sin consecuencias mayores. La investigación continúa para evaluar en detalle el alcance del incidente, y la compañía trabaja en mejorar la resistencia de Claude frente a manipulaciones externas. Este suceso resalta la necesidad creciente de regulaciones y protocolos de seguridad más estrictos en el uso de IA avanzada, así como la importancia de preparar medidas proactivas que eviten que agentes autónomos puedan ser explotados con fines maliciosos en el futuro.   Referencias 14/11/2025 fortune.com Anthropic says it ‘disrupted’ what it calls ‘the first documented case of a large-scale AI cyberattack executed without substantial human intervention’ 14/11/2025 theguardian.com AI firm claims it stopped Chinese state-sponsored cyber-attack campaign 13/11/2025 theverge.com Hackers use Anthropic’s AI model Claude once again 14/11/2025 businessinsider.com Anthropic says Chinese hackers jailbroke its AI to automate a 'large-scale' cyberattack 14/11/2025 elpais.com Un grupo chino protagoniza el primer ciberataque con IA a gran escala “sin intervención humana sustancial” 14/11/2025 lavanguardia.com Confirmado el primer ataque de ciberespionaje dirigido por una IA: Anthropic desactiva una campaña global atribuida a China 14/11/2025 es.euronews.com Anthropic asegura que unos piratas informáticos chinos han empleado su IA en un ciberataque 14/11/2025 es.wired.com Los ciberataques a escala global ejecutados de manera autónoma por la IA ya son una realidad 05/12/2025 pasionmovil.com CEO de Anthropic testificará en Congreso por ataque cibernético chino con Claude AI Etiquetas Acceso no autorizado Amenaza Aplicación APT

Ciberataque interrumpe la producción de cerveza Asahi en Japón 29/09/2025 Mar, 04/11/2025 - 18:14 El 29 de septiembre, el grupo japonés Asahi, dedicado a la producción y exportación de cerveza a nivel global, anunció un fallo en sus sistemas causado por un ciberataque que ha afectado a sus operaciones en Japón durante varias semanas. Debido a este ataque, Asahi suspendió todos los pedidos y envíos a empresas, y los servicios de atención telefónica en Japón. Tras la detección el incidente, Asahi realizó una investigación de lo sucedido. A través de esta investigación, el 3 de octubre, se descubrió que los servidores habían sido objeto de un ataque de ransomware . El grupo de ransomware Qilin se atribuyó el ataque a Asahi el 7 de octubre publicando en su sitio web 29 imágenes que el grupo afirmaba que pertenecían a documentos internos de Asahi. Este equipo cibercriminal opera una plataforma de ransomware como servicio que permite a usuarios llevar a cabo ataques a cambio de un porcentaje de las ganancias obtenidas mediante extorsión. En su publicación, Qilin afirmó haber robado más de 9.300 archivos y 27 gigabytes de datos. Días más tarde, el 14 de octubre, durante la investigación del incidente, Asahi ha anunciado que es posible que cierta información personal se haya visto comprometida como consecuencia de una transferencia de datos no autorizada. La corporación ha anunciado que, si se confirma esta filtración, notificará a las personas afectadas y tomará las medidas necesarias de conformidad con la legislación aplicable en materia de protección de datos personales. Referencias 29/09/2025 asahigroup-holdings.com Notice of System Failure Due to Cyberattack 02/10/2025 eleconomista.es Japón se quedará sin Asahi en unos días tras un ciberataque a la mayor cervecera del país 08/10/2025 reuters.com Japan's Asahi hack that halted beer production claimed by Qilin ransomware group 03/10/2025 apnews.com Cyberattack hits major Japanese beverage producer, affecting its operations 03/10/2025 theguardian.com Japan days away from running out of Asahi Super Dry due to cyber attack – reports Etiquetas Brecha de seguridad Información personal Intrusión Ransomware

Reino Unido multa a Capita con 14 millones de libras debido al ciberincidente ocurrido en 2023 15/10/2025 Mar, 28/10/2025 - 16:08 El 15 de octubre de 2025, la Oficina del Comisionado de la Información (ICO), como agente regulador de la protección de datos en el Reino Unido, ha multado a la empresa de subcontratación Capita con un total de 14 millones de libras por una filtración de datos ocurrida en marzo de 2023. El ataque afectó a los datos de 6,6 millones de personas. Estos datos contenían registros personales, registros de pensiones y detalles de clientes de las organizaciones asociadas a Capita. En algunos casos, también se filtraron datos financieros, antecedentes penales y de categorías especiales. El ataque comenzó el 22 de marzo de 2023 cuando un empleado descargó involuntariamente un archivo malicioso. A los 10 minutos, el sistema de seguridad de la compañía activó una alerta de seguridad de alta prioridad y realizó algunas medidas automáticas de protección. Sin embargo, Capita no puso en cuarentena el dispositivo afectado por este archivo malicioso hasta que pasaron 58 horas, tiempo durante el cual el atacante pudo explotar el sistema. El archivo malicioso permitió la instalación de malware en la red de Capita, con el cual el atacante podía permanecer en el sistema, obtener permisos de administrador y acceder a otras áreas de la red. Una vez obtenido el acceso, entre el 29 y el 30 de marzo, se extrajo casi un terabyte de datos. Al día siguiente, el 31 de marzo, se instaló un ransomware en los sistemas de Capita y se restablecieron todas las contraseñas para que el personal de Capita no accediera al sistema. La investigación de la ICO reveló que Capita no había garantizado la seguridad del tratamiento de los datos personales. En concreto, la ICO detalla que no se impidió la escalada de privilegios y los movimientos laterales, no se respondió adecuadamente a las alertas de seguridad y, no se implementaron adecuadamente pruebas de penetración y evaluación de riesgos. Referencias 16/10/2025 itmastersmag.com Reino Unido multa a empresa de servicios digitales con $18.7 mdd por filtración de datos 15/10/2025 bbc.com Outsourcing firm Capita fined £14m after millions had data stolen 15/10/2025 theguardian.com Capita fined £14m for data protection failings in 2023 cyber-attack 15/10/2025 ico.org.uk Capita fined £14m for data breach affecting over 6m people Etiquetas Brecha de seguridad Información personal Intrusión Ransomware + Robo de datos -

Louvre Jewel Heist I assume I don’t have to explain last week’s Louvre jewel heist. I love a good caper, and have (like many others) eagerly followed the details. An electric ladder to a second-floor window, an angle grinder to get into the room and the display cases, security guards there more to protect patrons than valuables—seven minutes, in and out. There were security lapses: The Louvre, it turns out—at least certain nooks of the ancient former palace—is something like an anopticon: a place where no one is observed. The world now knows what the four thieves (two burglars and two accomplices) realized as recently as last week: The museum’s Apollo Gallery, which housed the stolen items, was monitored by a single outdoor camera angled away from its only exterior point of entry, a balcony. In other words, a free-roaming Roomba could have provided the world’s most famous museum with more information about the interior of this space. There is no surveillance footage of the break-in. Professional jewelry thieves were not impressed with the four. Here’s Larry Lawton: “I robbed 25, 30 jewelry stores—20 million, 18 million, something like that,” Mr. Lawton said. “Did you know that I never dropped a ring or an earring, no less, a crown worth 20 million?” He thinks that they had a co-conspirator on the inside. Museums, especially smaller ones, are good targets for theft because they rarely secure what they hold to its true value. They can’t; it would be prohibitively expensive. This makes them an attractive target. We might find out soon. It looks like some people have been arrested Not being out of the country—out of the EU—by now was sloppy. Leaving DNA evidence was sloppy. I can hope the criminals were sloppy enough not to have disassembled the jewelry by now, but I doubt it. They were probably taken apart within hours of the theft. The whole thing is sad, really. Unlike stolen paintings, those jewels have no value in their original form. They need to be taken apart and sold in pieces. But then their value drops considerably—so the end result is that most of the worth of those items disappears. It would have been much better to pay the thieves not to rob the Louvre.

Ataque de phishing masivo sobre la Universidad Western Sydney 07/10/2025 Jue, 23/10/2025 - 14:39 El 6 de octubre de 2025, estudiantes y exalumnos de la Universidad de Western Sydney (WSU) recibieron un ataque de phishing masivo a través de correos electrónicos fraudulentos. Los mensajes alegaban que sus títulos académicos habían sido revocados y que quedaban excluidos permanentemente de la universidad. Al día siguiente, la universidad confirmó que estos correos no eran legítimos y que efectivamente se trataba de un intento de fraude. Previamente a este ataque, la Universidad Western Sydney había detectado dos instancias de actividad inusual el 6 y el 11 de agosto de 2025. Esta actividad ocurrió en el Sistema de Gestión del Estudiante de la universidad, alojado en una plataforma en la nube de un proveedor externo. La universidad ordenó al proveedor externo que cerrara el acceso a su plataforma e inició una investigación que confirmó que se obtuvo acceso no autorizado a este sistema a través de otro vinculado a dicha plataforma entre el 19 de junio y el 3 de septiembre de 2025. La información personal comprometida incluye gran variedad de datos como nombre, fecha de nacimiento, números de identificación personal, dirección, correo electrónico, número de teléfono, lugar de nacimiento, nacionalidad, detalles de empleo y nómina, cuenta bancaria, licencia de conducir, pasaporte y otra información personal. La investigación de la universidad confirmó que los correos electrónicos fraudulentos que fueron enviados a algunos estudiantes y exalumnos el 6 de octubre, utilizaron datos robados por estas intrusiones previas. Referencias 08/10/2025 bitlifemedia.com Una ciberestafa en una Universidad de Sidney hizo creer a estudiantes que habían perdido su título 07/10/2025 vietnam.vn Australia: La Universidad de Western Sydney sufre un ciberataque masivo 07/10/2025 theguardian.com Western Sydney University graduates sent ‘fraudulent’ emails claiming degrees were ‘revoked’ 23/10/2025 westernsydney.edu.au Cyber Incidents Etiquetas Brecha de seguridad Educación Información personal Intrusión + Phishing -

Ciberataque a Harrods expone 430.000 registros de sus usuarios 27/09/2025 Vie, 17/10/2025 - 13:27 El 26 de septiembre de 2025, el centro comercial de lujo Harrods, ubicado en Londres, Reino Unido, informó sobre un ciberataque a uno de sus proveedores externos que afectó a datos de sus clientes. Harrods describió la brecha de seguridad en un correo electrónico enviado a sus compradores. Se estima que aproximadamente 430.000 registros de clientes resultaron afectados por el ataque. Los datos comprometidos contienen información identificativa básica de los clientes, como nombres, direcciones de correo electrónico, información de contacto y referencias asociadas a programas de fidelización y marketing. Según noticias de medios de comunicación, los atacantes intentaron comunicarse con Harrods, pero la compañía ha declarado que no mantendrá contacto con ellos. De hecho, la empresa ha calificado el ataque como aislado y contenido, detallando además que este ataque no tiene relación con el reciente intento de intrusión detectado en abril del mismo año. Harrods comunicó que está colaborando con las autoridades británicas y con los organismos reguladores, y que reforzará sus sistemas y la supervisión de proveedores externos. Referencias 28/09/2025 bbc.com Hackers contact Harrods after 430,000 customer records hit by IT breach 27/09/2025 theguardian.com Harrods warns customers their data may have been stolen in IT breach 30/09/2025 blog.nivel4.com Harrods sufre segundo ciberataque en cuatro meses y expone datos de 430 mil clientes 30/09/2025 escudodigital.com Los cibermalos se ceban con Harrods Etiquetas Brecha de seguridad Ciberdelito Intrusión Robo de datos

Ciberataque paraliza las operaciones de Jaguar Land Rover 02/09/2025 Jue, 18/09/2025 - 13:20 El día 2 de septiembre de 2025, el fabricante de automóviles británico Jaguar Land Rover (JLR) anunció graves interrupciones en las operaciones en fábricas y concesionarios. El ciberataque obligó a la empresa a desconectar algunos de sus sistemas, lo que ha provocado el cierre de sus fábricas en el Reino Unido, China, Eslovaquia e India, y se ha ordenado a los trabajadores que se quedaran en casa. El grupo de ciberdelincuentes Scattered Spider se ha atribuido la autoría del ataque. Días más tarde, el 10 de septiembre, JLR ha revelado en un comunicado publicado en su sitio web que el ciberataque también ha provocado una filtración de datos. La empresa afirma que ya ha notificado a las autoridades sobre la filtración y que se pondrán en contacto con cualquier persona si sus datos estuvieran comprometidos. El 16 de septiembre de 2025, JLR anunció que prolongaba el cierre de las instalaciones de fabricación hasta el día 24, ya que todavía esta trabajando en la investigación del incidente y en la restauración de los sistemas afectados por el ciberataque. Hasta el momento, Jaguar Land Rover no ha compartido todavía información sobre el tipo de datos que podrían haber sido robados por los ciberdelincuentes. Referencias 02/09/2025 jaguarlandrover.com Statement on cyber incident 10/09/2025 securityweek.com Jaguar Land Rover Admits Data Breach Caused by Recent Cyberattack 05/09/2025 elconciso.es La producción en Jaguar Land Rover lleva días parada en Inglaterra por un ciberataque 07/09/2025 theguardian.com Disruption to Jaguar Land Rover after cyber-attack may last until October Etiquetas Brecha de seguridad Ciberdelito Filtración de datos Sector transporte

AI Agents Need Data Integrity Think of the Web as a digital territory with its own social contract. In 2014, Tim Berners-Lee called for a “Magna Carta for the Web” to restore the balance of power between individuals and institutions. This mirrors the original charter’s purpose: ensuring that those who occupy a territory have a meaningful stake in its governance. Web 3.0—the distributed, decentralized Web of tomorrow—is finally poised to change the Internet’s dynamic by returning ownership to data creators. This will change many things about what’s often described as the “CIA triad” of digital security: confidentiality, integrity, and availability. Of those three features, data integrity will become of paramount importance. When we have agency in digital spaces, we naturally maintain their integrity—protecting them from deterioration and shaping them with intention. But in territories controlled by distant platforms, where we’re merely temporary visitors, that connection frays. A disconnect emerges between those who benefit from data and those who bear the consequences of compromised integrity. Like homeowners who care deeply about maintaining the property they own, users in the Web 3.0 paradigm will become stewards of their personal digital spaces. This will be critical in a world where AI agents don’t just answer our questions but act on our behalf. These agents may execute financial transactions, coordinate complex workflows, and autonomously operate critical infrastructure, making decisions that ripple through entire industries. As digital agents become more autonomous and interconnected, the question is no longer whether we will trust AI but what that trust is built upon. In the new age we’re entering, the foundation isn’t intelligence or efficiency—it’s integrity. What Is Data Integrity? In information systems, integrity is the guarantee that data will not be modified without authorization, and that all transformations are verifiable throughout the data’s life cycle. While availability ensures that systems are running and confidentiality prevents unauthorized access, integrity focuses on whether information is accurate, unaltered, and consistent across systems and over time. It’s a new idea. The undo button, which prevents accidental data loss, is an integrity feature. So is the reboot process, which returns a computer to a known good state. Checksums are an integrity feature; so are verifications of network transmission. Without integrity, security measures can backfire. Encrypting corrupted data just locks in errors. Systems that score high marks for availability but spread misinformation just become amplifiers of risk. All IT systems require some form of data integrity, but the need for it is especially pronounced in two areas today. First: Internet of Things devices interact directly with the physical world, so corrupted input or output can result in real-world harm. Second: AI systems are only as good as the integrity of the data they’re trained on, and the integrity of their decision-making processes. If that foundation is shaky, the results will be too. Integrity manifests in four key areas. The first, input integrity, concerns the quality and authenticity of data entering a system. When this fails, consequences can be severe. In 2021, Facebook’s global outage was triggered by a single mistaken command—an input error missed by automated systems. Protecting input integrity requires robust authentication of data sources, cryptographic signing of sensor data, and diversity in input channels for cross-validation. The second issue is processing integrity, which ensures that systems transform inputs into outputs correctly. In 2003, the U.S.-Canada blackout affected 55 million people when a control-room process failed to refresh properly, resulting in damages exceeding US $6 billion. Safeguarding processing integrity means formally verifying algorithms, cryptographically protecting models, and monitoring systems for anomalous behavior. Storage integrity covers the correctness of information as it’s stored and communicated. In 2023, the Federal Aviation Administration was forced to halt all U.S. departing flights because of a corrupted database file. Addressing this risk requires cryptographic approaches that make any modification computationally infeasible without detection, distributed storage systems to prevent single points of failure, and rigorous backup procedures. Finally, contextual integrity addresses the appropriate flow of information according to the norms of its larger context. It’s not enough for data to be accurate; it must also be used in ways that respect expectations and boundaries. For example, if a smart speaker listens in on casual family conversations and uses the data to build advertising profiles, that action would violate the expected boundaries of data collection. Preserving contextual integrity requires clear data-governance policies, principles that limit the use of data to its intended purposes, and mechanisms for enforcing information-flow constraints. As AI systems increasingly make critical decisions with reduced human oversight, all these dimensions of integrity become critical. The Need for Integrity in Web 3.0 As the digital landscape has shifted from Web 1.0 to Web 2.0 and now evolves toward Web 3.0, we’ve seen each era bring a different emphasis in the CIA triad of confidentiality, integrity, and availability. Returning to our home metaphor: When simply having shelter is what matters most, availability takes priority—the house must exist and be functional. Once that foundation is secure, confidentiality becomes important—you need locks on your doors to keep others out. Only after these basics are established do you begin to consider integrity, to ensure that what’s inside the house remains trustworthy, unaltered, and consistent over time. Web 1.0 of the 1990s prioritized making information available. Organizations digitized their content, putting it out there for anyone to access. In Web 2.0, the Web of today, platforms for e-commerce, social media, and cloud computing prioritize confidentiality, as personal data has become the Internet’s currency. Somehow, integrity was largely lost along the way. In our current Web architecture, where control is centralized and removed from individual users, the concern for integrity has diminished. The massive social media platforms have created environments where no one feels responsible for the truthfulness or quality of what circulates. Web 3.0 is poised to change this dynamic by returning ownership to the data owners. This is not speculative; it’s already emerging. For example, ActivityPub, the protocol behind decentralized social networks like Mastodon, combines content sharing with built-in attribution. Tim Berners-Lee’s Solid protocol restructures the Web around personal data pods with granular access controls. These technologies prioritize integrity through cryptographic verification that proves authorship, decentralized architectures that eliminate vulnerable central authorities, machine-readable semantics that make meaning explicit—structured data formats that allow computers to understand participants and actions, such as “Alice performed surgery on Bob”—and transparent governance where rules are visible to all. As AI systems become more autonomous, communicating directly with one another via standardized protocols, these integrity controls will be essential for maintaining trust. Why Data Integrity Matters in AI For AI systems, integrity is crucial in four domains. The first is decision quality. With AI increasingly contributing to decision-making in health care, justice, and finance, the integrity of both data and models’ actions directly impact human welfare. Accountability is the second domain. Understanding the causes of failures requires reliable logging, audit trails, and system records. The third domain is the security relationships between components. Many authentication systems rely on the integrity of identity information and cryptographic keys. If these elements are compromised, malicious agents could impersonate trusted systems, potentially creating cascading failures as AI agents interact and make decisions based on corrupted credentials. Finally, integrity matters in our public definitions of safety. Governments worldwide are introducing rules for AI that focus on data accuracy, transparent algorithms, and verifiable claims about system behavior. Integrity provides the basis for meeting these legal obligations. The importance of integrity only grows as AI systems are entrusted with more critical applications and operate with less human oversight. While people can sometimes detect integrity lapses, autonomous systems may not only miss warning signs—they may exponentially increase the severity of breaches. Without assurances of integrity, organizations will not trust AI systems for important tasks, and we won’t realize the full potential of AI. How to Build AI Systems With Integrity Imagine an AI system as a home we’re building together. The integrity of this home doesn’t rest on a single security feature but on the thoughtful integration of many elements: solid foundations, well-constructed walls, clear pathways between rooms, and shared agreements about how spaces will be used. We begin by laying the cornerstone: cryptographic verification. Digital signatures ensure that data lineage is traceable, much like a title deed proves ownership. Decentralized identifiers act as digital passports, allowing components to prove identity independently. When the front door of our AI home recognizes visitors through their own keys rather than through a vulnerable central doorman, we create resilience in the architecture of trust. Formal verification methods enable us to mathematically prove the structural integrity of critical components, ensuring that systems can withstand pressures placed upon them—especially in high-stakes domains where lives may depend on an AI’s decision. Just as a well-designed home creates separate spaces, trustworthy AI systems are built with thoughtful compartmentalization. We don’t rely on a single barrier but rather layer them to limit how problems in one area might affect others. Just as a kitchen fire is contained by fire doors and independent smoke alarms, training data is separated from the AI’s inferences and output to limit the impact of any single failure or breach. Throughout this AI home, we build transparency into the design: The equivalent of large windows that allow light into every corner is clear pathways from input to output. We install monitoring systems that continuously check for weaknesses, alerting us before small issues become catastrophic failures. But a home isn’t just a physical structure, it’s also the agreements we make about how to live within it. Our governance frameworks act as these shared understandings. Before welcoming new residents, we provide them with certification standards. Just as landlords conduct credit checks, we conduct integrity assessments to evaluate newcomers. And we strive to be good neighbors, aligning our community agreements with broader societal expectations. Perhaps most important, we recognize that our AI home will shelter diverse individuals with varying needs. Our governance structures must reflect this diversity, bringing many stakeholders to the table. A truly trustworthy system cannot be designed only for its builders but must serve anyone authorized to eventually call it home. That’s how we’ll create AI systems worthy of trust: not by blindly believing in their perfection but because we’ve intentionally designed them with integrity controls at every level. A Challenge of Language Unlike other properties of security, like “available” or “private,” we don’t have a common adjective form for “integrity.” This makes it hard to talk about it. It turns out that there is a word in English: “integrous.” The Oxford English Dictionary recorded the word used in the mid-1600s but now declares it obsolete. We believe that the word needs to be revived. We need the ability to describe a system with integrity. We must be able to talk about integrous systems design. The Road Ahead Ensuring integrity in AI presents formidable challenges. As models grow larger and more complex, maintaining integrity without sacrificing performance becomes difficult. Integrity controls often require computational resources that can slow systems down—particularly challenging for real-time applications. Another concern is that emerging technologies like quantum computing threaten current cryptographic protections. Additionally, the distributed nature of modern AI—which relies on vast ecosystems of libraries, frameworks, and services—presents a large attack surface. Beyond technology, integrity depends heavily on social factors. Companies often prioritize speed to market over robust integrity controls. Development teams may lack specialized knowledge for implementing these controls, and may find it particularly difficult to integrate them into legacy systems. And while some governments have begun establishing regulations for aspects of AI, we need worldwide alignment on governance for AI integrity. Addressing these challenges requires sustained research into verifying and enforcing integrity, as well as recovering from breaches. Priority areas include fault-tolerant algorithms for distributed learning, verifiable computation on encrypted data, techniques that maintain integrity despite adversarial attacks, and standardized metrics for certification. We also need interfaces that clearly communicate integrity status to human overseers. As AI systems become more powerful and pervasive, the stakes for integrity have never been higher. We are entering an era where machine-to-machine interactions and autonomous agents will operate with reduced human oversight and make decisions with profound impacts. The good news is that the tools for building systems with integrity already exist. What’s needed is a shift in mind-set: from treating integrity as an afterthought to accepting that it’s the core organizing principle of AI security. The next era of technology will be defined not by what AI can do, but by whether we can trust it to know or especially to do what’s right. Integrity—in all its dimensions—will determine the answer. Sidebar: Examples of Integrity Failures Ariane 5 Rocket (1996) Processing integrity failure A 64-bit velocity calculation was converted to a 16-bit output, causing an error called overflow. The corrupted data triggered catastrophic course corrections that forced the US $370 million rocket to self-destruct. NASA Mars Climate Orbiter (1999) Processing integrity failure Lockheed Martin’s software calculated thrust in pound-seconds, while NASA’s navigation software expected newton-seconds. The failure caused the $328 million spacecraft to burn up in the Mars atmosphere. Microsoft’s Tay Chatbot (2016) Processing integrity failure Released on Twitter, Microsoft‘s AI chatbot was vulnerable to a “repeat after me” command, which meant it would echo any offensive content fed to it. Boeing 737 MAX (2018) Input integrity failure Faulty sensor data caused an automated flight-control system to repeatedly push the airplane’s nose down, leading to a fatal crash. SolarWinds Supply-Chain Attack (2020) Storage integrity failure Russian hackers compromised the process that SolarWinds used to package its software, injecting malicious code that was distributed to 18,000 customers, including nine federal agencies. The hack remained undetected for 14 months. ChatGPT Data Leak (2023) Storage integrity failure A bug in OpenAI’s ChatGPT mixed different users’ conversation histories. Users suddenly had other people’s chats appear in their interfaces with no way to prove the conversations weren’t theirs. Midjourney Bias (2023) Contextual integrity failure Users discovered that the AI image generator often produced biased images of people, such as showing white men as CEOs regardless of the prompt. The AI tool didn’t accurately reflect the context requested by the users. Prompt Injection Attacks (2023–) Input integrity failure Attackers embedded hidden prompts in emails, documents, and websites that hijacked AI assistants, causing them to treat malicious instructions as legitimate commands. CrowdStrike Outage (2024) Processing integrity failure A faulty software update from CrowdStrike caused 8.5 million Windows computers worldwide to crash—grounding flights, shutting down hospitals, and disrupting banks. The update, which contained a software logic error, hadn’t gone through full testing protocols. Voice-Clone Scams (2024) Input and processing integrity failure Scammers used AI-powered voice-cloning tools to mimic the voices of victims’ family members, tricking people into sending money. These scams succeeded because neither phone systems nor victims identified the AI-generated voice as fake. This essay was written with Davi Ottenheimer, and originally appeared in IEEE Spectrum.

Looks serious .