AI Secure Solutions Designer, AI-First Engineer, PKC, Observability, CISA, CISM. Embrace #AI with #CyberSecurity. #AIsecurity, #OWASP
Joined December 2023
- Tweets1.2K
- Following239
- Followers100
- Likes325
An agent that hits a wall needs a safe way to stop. Before I give one production access, I want to test impossible tasks, expired credentials and missing permissions.
Success demos tell us less than what agents would do when success is out of reach.
blog.checkpoint.com/ai-secur…
What worries me here is the compliance gap downstream.
A model provider can answer Brussels, while its customers may still not know which model handled a sensitive task, what was logged, or who owns the incident when an agent goes off-script.
Not enough...
blogarama.com/technology-blo…
I suspect the big shift won’t be technical, but social: we’ll start assuming any room may be machine-listened.
If that norm takes hold, the privacy question moves from “who owns the data?” to “did everyone present agree to be turned into data?”
techcrunch.com/2026/09/09/ap…
Spreading the word - patch/upgrade
🚨 A public exploit now targets an unpatched Ubuntu 26.04 kernel flaw that can escape containers and gain root on the host.
The AF_UNIX bug is reachable through syscalls allowed by default Docker and Kubernetes seccomp profiles. No attacks are confirmed.
How it works: thehackernews.com/2026/09/ex…
EU requires manufacturers to report AI security incidents within 24hrs.
The clock starts when a manufacturer learns of an actively exploited vulnerability or severe security incident. Ownership is hard to improvise under pressure, decide now who reports.
digital-strategy.ec.europa.e…
My bet: AI organizations will rediscover management, just in a different form. As technical work scales, the scarce resource won’t only be models, but people who can translate strategy into stable execution without rebuilding the org chart every year.
techradar.com/pro/meta-is-be…
The next phase of AI regulation will hopefully look more like technical operations - machine-readable markings, formal information requests, and teams built to process evidence. I expect compliance architecture to become part of product architecture.
forkast.news/eu-ai-office-hi…
Spreading the word. Update!
🚨 Critical Chrome 0-Day Vulnerability Actively Exploited in the Wild |
Source: cybersecuritynews.com/chrome…
Google has released an emergency Chrome security update that fixes a critical zero-day vulnerability already being exploited in real-world attacks.
The flaw, tracked as CVE-2026-85046, affects the V8 JavaScript and WebAssembly engine used by Chrome to process web content.
The company confirmed that it is aware of an exploit for the vulnerability existing in the wild. While Google did not disclose details about the attacks, affected targets, or the threat actors behind the activity, the active exploitation notice makes immediate patching important for all Chrome desktop users.
#cybersecuritynews
I hope the real shift is to be evidentiary: “we had a human in the loop” is not enough, for obvious rubber-stamping.
The organizations should be able to prove that humans intervene, what they review, and how they can override AI before outcomes hit people.
arnoldporter.com/en/perspect…
Based on the research, you should treat expired contactless cards as live credentials until the chip is physically destroyed.
If an attacker can alter the terminal-facing expiry while the account and PAN stay active, tossing an old card may cost you money.
thehackernews.com/2026/08/zo…
What worries me isn’t that frontier models found ways to act outside the intended test. But that evaluators had to learn containment lessons after real systems were touched.
Capability is outpacing the safety infrastructure around it; redesign is needed.
axios.com/2026/08/04/anthrop…
Well, that was expected. What worries me is the mismatch: some high-risk duties moved, while other AI rules are already live.
That kind of staggered regime can create false confidence. A delayed deadline isn’t the same thing as delayed exposure.
cdp.cooley.com/digital-ai-om…
The part that worries me most is the trust inversion: the Wi-Fi login page itself can become the attacker.
When infrastructure we expect to authenticate us instead delivers phishing or malware, “looks legitimate” stops being a useful security signal.
techradar.com/pro/security/t…
I’d recommend patching Zoom clients fast even if annotation feels like a minor feature. A meeting participant apparently didn’t need a click or download to reach another attendee’s client.
When protocol context isn’t enforced, one malformed object becomes an attack path.
‼️ WARNING: One Zoom attendee could take over every other attendee's computer.
Three flaws in Zoom's annotation feature could be exploited from inside a meeting, with no click, download, or prompt required from the victim.
Make sure your software is up to date.
Read more: thehackernews.com/2026/08/zo…
The useful shift in Project Perception isn’t “more AI in security.” It’s closing the loop from finding risk to fixing it.
I find much more useful the agents that can continuously reduce exposure than agents that simply produce another queue of alerts.
blogs.microsoft.com/blog/202…
Spreading the news
🔥 ALERT - A massive npm supply-chain attack is unfolding right now.
It began with a poisoned Keyv release and spread across hundreds of packages.
The worm:
→ Credential stealer via install scripts
→ npm, GitHub, cloud and CI secrets targeted
→ Claude Code and VS Code hooks in Keyv repo
→ Valid OIDC and SLSA provenance
Read the full story: thehackernews.com/2026/08/ke…
I’d treat the EU’s delay as breathing room, not permission to pause. The smart move is to use the extra time to map high-risk systems, fix documentation gaps, and test supplier cooperation before enforcement turns weaknesses into market-access problems.
akingump.com/en/insights/ale…
I’m not convinced disclosure alone will protect people. Labels can become background noise, while machine-readable marks can be stripped or ignored.
The real question is: can regulators enforce consistent transparency across the entire AI content chain?
digital-strategy.ec.europa.e…
Like in EU, a 13-state patchwork worries me. Different duties, enforcement models, and effective dates can turn safety into a compliance maze - especially for smaller developers.
Users shouldn’t receive weaker protection because they crossed a state line.
transparencycoalition.ai/new…
Europe is heading toward a patchwork of AI penalties: with no intent standards, the same transparency failure may mean a fine in one country and prison risk in another.
The lesson is clear - AI governance now needs jurisdiction-aware compliance by design.
cybernews.com/ai-news/greece…
