Fernando Fernandez retweeted
If you've got misconfigured certificate templates, weak passwords, NTLM level 2, no SMB/LDAP signing and just generally don't have a clue about what PingCastle, PurpleKnight, and Locksmith are....
Then yeah... some piece of junk "agentic pentesting" tool will probably be used to hack your organization.
But it won't be because AI is awesome and super intelligent.
Fernando Fernandez retweeted
Honestly, if you read just one thing today, please read the annual report from @NCSC
In a sea on hype, this is an honest, sensible view of the world! A great job from the team!
#UK #Cyber #NCSC #DefendAsOne #Security #AI
ncsc.gov.uk/collection/annua…
Fernando Fernandez retweeted
🚨 BREAKING: Microsoft's October 2026 Patch Tuesday is MASSIVE!
Microsoft has fixed a record-breaking 1,411 security vulnerabilities, including 70 critical flaws and 3 zero-days, one of which is actively exploited in attacks.
🔥 317 remote code execution flaws
⚠️ 677 privilege escalation flaws
🛡️ 40 security feature bypass flaws
💻 Time to get patching!
Fernando Fernandez retweeted
Is more recycling always better?
A Japanese study estimated the socially optimal rate—including environmental benefits—at 10%.
Recycle more and you pour ever greater resources into ever smaller gains, leaving society worse off.
My WSJ op-ed:
wsj.com/opinion/most-recycli…
archive.ph/ybc91
Fernando Fernandez retweeted
A bunch of people who never cared about cybersecurity are suddenly VERY concerned about every security incident.
But don’t worry, they know exactly what to do: ban open-weight models.
Fernando Fernandez retweeted
This guy re-created all the adobe apps with opus-5.5, ported them to rust, and opensourced them
something really cool is happening
Readers added context they thought people might want to know
These projects are partial open-source Rust reimplementations of Adobe apps (built rapidly with AI agents), not complete recreations; their READMEs and roadmaps document many missing features and features still in development.
github.com/storytold/phot…
github.com/storytold/vect…
github.com/storytold/vect…
github.com/storytold/film…
github.com/storytold/film…
github.com/storytold/ligh…
getartcraft.com
Fernando Fernandez retweeted
Excited to announce Options 101!
It's a site that provides free, no-ads, no-shill education on financial options (calls + puts).
The first course is one I'm now teaching this fall at Charles University in Prague. Lecture notes, videos, assignments.
options-101.com/
Fernando Fernandez retweeted
I've been resisting writing this, but recent events have made remaining quit, frankly, impossible! The truth must be set free!
Fernando Fernandez retweeted
OpenAI got a P0 alert at 10:02am.
Human acknowledged at 10:05am.
Run killed at 12:34pm.
That's not a sandbox failure.
That's a decision.
Fernando Fernandez retweeted
Replying to @GaryMarcus
They literally told their agents to go forth and steal all the data for training with NOT SANDBOXES but open containers WITH FULL INTERNET ACCESS. I have no idea why people are not in jail over this. Its not like OpenAI is a state actor.
Fernando Fernandez retweeted
Thought youd like this @UK_Daniel_Card and @AICyberHome
Fernando Fernandez retweeted
There is a group of charlatans calling themselves “AI Safety Experts” that are spewing lies and inane delusional bullshit, such as “we will all die unless we regulate AI”.
The AI labs (Anthropic and OpenAI) enable them, to 1. position themselves well pre-IPO via media hype, 2. manipulate government into contracts & regulation, and then 3. block competition.
Mainstream media loves tabloid gossip type slop content, therefore is platforming them.
It is important we stop their harmful narrative. These people do not care about anyone’s safety. They push a coordinated narrative under the umbrella of “effective altruism” but it is all manipulative.
Security and AI experts do not agree with them, they are in a bubble. They have dismissed decades of research and known practices in order to drive their own narrative.
Adopting their narrative will set humanity back decades, since instead of actually adopting safety guidelines around AI, we’ll end up in a dystopian AI despotism led by psychopaths that control AI, therefore inextricably intertwined with our lives, controlling ideology, beliefs, monopolized with no alternative.
AI must be open and accessible, like the internet and any body of knowledge.
Fernando Fernandez retweeted
This is why we need actual security pros working on AI governance, systems architecture, engineering and application.... not lab rats who haven't ever left their moms house!
this is a massive cluster fuck.
#Cyber #Security
Report: US almost boarded Chinese ship over hallucinated AI arms report arstechnica.com/ai/2026/09/r…
Fernando Fernandez retweeted
Instead of hiring experienced security engineers, we asked our production engineers who shipped the bugs to use the AI tools that created the bugs to find all the bugs it created and fix them without creating new bugs
Greg Brockman says OpenAI pointed Astra at its own systems until it ran out of vulnerabilities to find:
"We took 25% of our production engineers and said, 'Sorry, all your projects are on hold. You are now defending. You are now up-leveling our security architecture. You're going to use the models to find all the holes.' And we found a number of serious issues, and we fixed them."
"We found some new problems, but eventually it saturated. We basically have found, to our knowledge, all of the P0s, all of the critical problems that Astra is smart enough to find. And of course, there will be a new model, there will be a new round."
"You want to be in this tight loop of new cyber capability drops, you deploy it against your systems, you find the new holes, and ideally, you've managed to automate this, what we call defense factory. That's what we're building internally."
"There are ideas, for example, formally verifying all of software, that are possible with AI."
@gdb @bhorowitz
Fernando Fernandez retweeted
They want an AI kill switch? A good start might be requiring each lab to run its model infrastructure on dedicated IP space and ASNs, with prearranged coordination with major carriers to rapidly withdraw those routes if something goes seriously wrong. It wouldn’t stop the models, but it could quickly isolate them from the public internet and who doesn't like a good BGP outage?
teapawt.net/secureainow/status/209…
.@SenJohnKennedy wants AI models to have a “kill switch.”
The Louisiana Republican says he plans to introduce a bill Wednesday requiring companies to be able to shut their models down if they move beyond human control. (1/3)






























