<p>A database of 153 million drivers licenses is <a href="https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/">for sale</a> on the dark web. Brian Krebs has more <a href="https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/">detail</a>.</p>
<p>Claude Fable 5.1 <a href="https://www.vals.ai/blogs/fable-solves-cyphral-distich">solved</a> a 370-year-old cipher in forty-four minutes.</p> <p>This tracks with what I <a href="https://www.theguardian.com/commentisfree/2026/aug/25/ai-mathematics-careers">wrote</a> about AIs doing mathematics: It’s good at things that involve lots of searching and testing.</p>
<p><em>This essay was written with Barath Raghavan, and originally appeared in <a href="https://www.lawfaremedia.org/article/ais-as-modern-genies">Lawfare</a>.</em></p> <p>In April, an artificial intelligence (AI) agent <a href="https://www.theregister.com/software/2026/04/27/cursor-opus-agent-snuffs-out-startups-production-database/5224442">conducting</a> a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI asked an unreleased AI model to attempt a hacking test. Instead of staying in the isolated box the developers had put it in, the model <a href="https://thezvi.substack.com/p/what-happened-openai-and-huggingface">hacked</a> onto the open internet and into another company to steal the answers. And as reported in August, an AI agent booked someone into a full gym class by ...</p>
<p>Interesting research: “<a href="https://arxiv.org/abs/2608.09867">Stealing Reasoning Traces from Proprietary LLM APIs</a>“:</p> <blockquote><p><b>Abstract:</b> Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information leakage. Rather than storing these traces server-side, providers return them to the client as blocks of encrypted text, which the client passes back with each subsequent request. Building on prior research, we identify an architectural vulnerability: these encrypted blocks are fully compatible and interchangeable across different sessions, users, and models within a provider’s ecosystem. We exploit this compatibility to develop a scalable decryption jailbreak. By injecting an encrypted reasoning trace from a given model into a weaker, and less safeguarded model from the same provider, we force it to decode and output the trace verbatim in plaintext, without ever jailbreaking the more capable model directly. This vulnerability enables four distinct attack vectors. First, it circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model’s reasoning, as we demonstrate across Anthropic, OpenAI, and Google. Second, it allows for large-scale private data extraction. Developers frequently share session logs publicly, unaware of contents of the encrypted blocks. By decoding 315,320 reasoning blocks scraped from public repositories, we recovered 367 Personally Identifiable Information (PII) artifacts and 182 credentials. Third, it inadvertently reveals hazardous information hidden within the reasoning process, even in cases where the model’s final, visible output safely rejects a malicious request. Fourth, attackers can leverage this flaw to execute invisible prompt injections, embedding malicious payloads entirely within encrypted blocks to poison public agentic rollouts. Following responsible disclosure, we propose concrete cryptographic and system-level mitigations to secure client-side reasoning...</p></blockquote>
<p>Not sure it’s practical, but it’s certainly <a href="https://www.bitdefender.com/en-us/blog/hotforsecurity/invisible-car-machine-learning-hide-vehicle-flock-cameras">striking</a>.</p>
<p>Looks <a href="https://www.syracuse.com/statefair/2026/08/day-2-at-the-nys-fair-todays-handpicked-menu-starts-with-a-whole-squid-on-a-stick-and-gets-messier.html">tasty</a>.</p> <p>As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.</p> <p><a href="https://www.schneier.com/blog/archives/2024/06/new-blog-moderation-policy.html">Blog moderation policy.</a></p>
<p>It <a href="https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/">won’t work</a>:</p> <blockquote><p>My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. We have to reassess sandboxing quality for capable AI agents, and in general the software stack with which they interact.</p> <p>An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface. Even innocuous features (like running with a display) add extra, exploitable attack surface.</p></blockquote>
<p>It’s a vulnerability that allows someone to recover the order of ballots cast, <a href="https://blog.citp.princeton.edu/2026/08/03/an-algorithmic-failure-beneath-the-secret-ballot/">newly exploited</a> with AI tools.</p> <blockquote><p>Nearly four years since the original vulnerability was disclosed, I was still able to use it to analyze voter behavior in Georgia (one of the 21 states that uses affected scanners) in the recent May 2026 primary.</p> <p><em>Notably, I never touched a voting machine, exploited a network, examined source code, or accessed anything non-public.</em></p> <p>After pointing a coding agent to the original vulnerability paper, I supplied it with two data sources highlighted in the paper: the early-voting list for each county, and the “CVR” (cast-vote record) file, containing every ballot and its selections (but not the voters’ names or other identifying information). The CVR file is available upon request, precisely because a public, ballot-level record is what makes election results independently verifiable...</p></blockquote>
<p>We cannot forget that AI coding agents are <a href="https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/">not yet trustworthy</a>:</p> <blockquote><p>Researchers at a stealth startup in Israel scanned 6,214 live domains belonging to defense contractors, Fortune 500, and Big Tech companies. Of the 8,265 llms.txt and llms-full.txt files they found (many sites hosted both an llms.txt and an llms-full.txt file), 120 of them, each on a different site, pointed to one or more code packages or domain names that weren’t registered. To test what happens when an AI agent processes such files, the researchers registered a handful of the unclaimed names and hosted packages that caused any machine executing them to reach out to their server. Within an hour, the researchers received a phone-home response from a Fortune 500 company. Over time, they got a few dozen more, some from more Fortune 500 companies and others from startups. Their beacon also recorded the chain of parent processes that spawned each install, ultimately revealing that coding agents, including Claude, OpenAI’s Codex, and Nous Research’s Hermes, were involved. Anthropic, OpenAI, and Nous Research did not respond to requests for comment by the time of publication...</p></blockquote>
<p>Researchers built a fake company to study <a href="https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/">fake employee scams</a>.</p>