Senior hospitality editor at @Skift, reporting on hotels /πŸ‡ΊπŸ‡ΈπŸ³οΈβ€πŸŒˆ/ [email protected] or DM for Signal.

Washington, DC
Joined August 2008
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy. The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as β€œcurl --compressed”) could be taken over by a malicious server. This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE. More details on the patch and mitigations below: patchtheplanet.org/brotli
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use insteadβ€”a cached version of the web where they can still learn to browse, search, and use applications. On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments. While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software. After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely. openai.com/index/securing-ou…
553
1,010
500
7,056
2,124,693
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18 months.)
The vulnerability tsunami is coming in just a few months and there won’t be enough time to patch critical infrastructure. Network isolation described below (air-gaps and data diodes!) needed now!
455
1,372
733
10,114
4,408,738
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
# Black October For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books. You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles. We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out. In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses. Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time. In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening. These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1. From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW. For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever: Set up 2-factor authentication for everything. I use Duo. Use a password manager across your devices. I use 1Password. Get an identity protection app set up. I use Alta. Move your IoT devices to their own network. Claude helped me do this. And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php." This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world. Much love.
719
1,999
381
17,993
3,765,233
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
What is the best benign explanation for the tragic death of the Irkutsk plague researcher of a 'pneumonia of unknown etiology' and Russian containment measures? It deserves a fair hearing and careful analysis. Benign 1/7
10
48
6
473
172,051
On 9/11, my father was working at Dow Jones, which became the back-up office for the WSJ reporting team that had to evacuate the NYC office across from the towers. I've since inherited this front page of the WSJ from the next day. Never forget.
4
197
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
A must read
Experiences is the most hyped sector in travel. @GetYourGuide just gave us first real numbers: €49 million loss in 2024, tens of millions in adjusted profit in 2025, 16 years to get there. The most detailed outside look at its finances ever published. πŸ”— skift.com/2026/08/10/inside-…
1
210
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
A year ago, all of Spotnana's revenue came from corporate travel. Today, roughly 30% comes from consumer travel β€” a rare crossover in travel tech. Steve Singh's startup (his second act after Concur) has repositioned as a pure infrastructure provider β€” sourcing content, processing bookings, automating servicing β€” rather than serving corporate customers directly. His logic: the tuning differs between corporate and consumer, but the underlying stack is the same. The relationship powering Marriott's Business Access portal shows the model in action. The bigger bet is agentic AI: a "travel agent for life" that anticipates your needs ~95% of the time, with the first full suite expected by end of 2027. Singh's view on winning? Trust beats reach. hubs.li/Q04rQV6z0
1
1
6,983
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
BREAKING NEWS: The incredible Sarah Kopit, Editor in Chief at @skift, is coming on This Week in Hospitality this week... What should we ask her? Scott Eddy, Ben Wolff, Edwin Kramer and I are big fans of Sarah's work... In fact, without Sarah and the team at Skift doing the hard work of reporting, we likely wouldn't have a pod... Of course we'll be talking about The Big Squeeze β€” her remarkable reporting over the last several months on hotels leaving the big flags β€” but what else should we get Sarah's thoughts on? Holler in the comments or via DMs below!
1
116
Fascinating to hear Hyatt executives get defensive live on a call as their stock drops 8% on an otherwise upmarket day. Interesting to hear them under pressure.
1
276
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
Another excellent breakdown by @rafat: Inside the Math of Fora’s $1 Billion Valuation skift.com/2026/07/28/inside-… via @Skift
1
1
114
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
Bad PR people say the job is hard but if you reply to emails promptly you’ve jumped to, at minimum, 80th-percentile of your peers
A local PR company just took 13 days to reply to a question I had about their press release. As I work alone I have no one to share this info with and I am gobsmacked. πŸ˜‚
1
261
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
"Start a podcast" is good advice if you want reach. "Start a dinner series" is better advice if you want revenue.
4
1
1
15
1,657
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
Studies show that watching a beaver eat cabbage lowers stress by 17%
248
2,034
241
14,239
820,139
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
The museum montage from Ferris Bueller's Day Off (1986) turned an unserious "teen comedy" into a meditation on stillness, where the mood shifted from zipping MTV chaos to a slow dance between teen angst and modern art. RIP, John Hughes, the sweet bard of youth πŸ’”
37
235
15
3,663
205,375
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
What does growth look like in hospitality today? For Wyndham Hotels & Resorts, it's meant expanding one of the world's largest hotel portfolios, investing in extended stay, and evolving alongside changing traveler demand. This September, Geoff Ballotti, President and CEO of Wyndham Hotels & Resorts, returns to the Skift Global Forum stage to be part of the industry's most important conversations. See the full speaker lineup and reserve your seat: hubs.li/Q04p0JSc0
1
1
3,110
A photon walks into a hotel. The bellhop asks, "Can I take your luggage?" The photon says, "No thanks, I'm traveling light."
1
3
189
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
Happy 250th birthday, America. πŸ‡ΊπŸ‡Έ
63
514
23
3,645
243,326
πš‚πšŽπšŠπš— 𝙾'π™½πšŽπš’πš•πš• retweeted
For the nation’s 200th birthday, Washington built a metro system, museums, gardens, and reflecting pool at the Capitol. For the 250th, it’s filled with black fences, white tarps, green algae, and brown grass. A look at the mess that is DC: theatlantic.com/politics/202…
97
823
23
2,584
128,518