Shaping AI’s impact on security, innovation & global affairs.
Washington, D.C.
Joined September 2023
- Tweets419
- Following62
- Followers2.3K
- Likes38
1/4 What does a cyber superstorm look like? This week's PHP vulnerabilities come close. PHP, software behind 70% of the world's websites, contained two critical flaws that let attackers take over servers without logging in. Now companies and governments are racing to patch.
3/4 A cyber superstorm meets 4 criteria: affected software deployed broadly; attackers exploit it without valid credentials, special access, or unusual skill; successful exploitation gives attackers substantial control; response needs cross-organizational mobilization over weeks.
4/4 PHP vulnerabilities already meet the first three criteria. The coming weeks will show whether they meet the fourth. Defenders need to plan for that world now. Read more in our piece on cyber superstorms by @JKraprayoon and @covinstantinop here: attacksurfaceai.substack.com…
1/6 Maintaining a lead in the development of frontier AI models is essential if the U.S and its allies are to harden critical infrastructure networks and defend against national security threats from adversaries.
5/6 As AI data center construction accelerates across Asia, Washington needs a strategy to address risks posed by remote access. Our new report recommends that BIS publishes a cloud compute rule. It also provides a policy escalation framework to address the issue.
6/6 With thanks to authors @CassiaKing1 and @onni_aarne for their work on the report, which can be read here: iaps.ai/research/cloud-compu…
1/7 AI agent adoption at scale presents a new version of an old security problem—the insider threat. As enterprises and government agencies deploy AI agents to perform complex tasks, e.g., writing code, managing infrastructure, handling sensitive information, new risks emerge.
6/7 To ensure this strategy keeps pace with advancing agent capabilities, AI assistance for designing and deploying honeypots is worth investing in. Our report outlines a technical research agenda and suggests production pilots to improve effectiveness and adoption of honeypots.
7/7 Thanks to authors @jan__wehner and @JKraprayoon for their work on our new report, Honeypots for AI Agent Insider Threats, which can be read here: iaps.ai/research/honeypots-f…
1/4 Following a string of recent incidents involving rogue agent activity, both Anthropic and OpenAI have committed to embedding third-party evaluators—independent external experts who assess safety, security, and operational practices—within their companies.
3/4 Our new memo outlines five foundations for voluntary arrangements to be built on. Companies cannot be left to “mark their own homework.” Under the right contract terms, embedded evaluators can provide a second line of defense, identifying serious risks before they cause harm.
4/4 Thanks to @theobearman for his work on the memo: iaps.ai/research/embedded-ev…