Schneier on Security

Interesting research: “AI Models Can Provably Hide Arbitrary Capabilities” Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicite…

Interesting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes.

This article in Nature argues that it’s due to an overfishing of predators and warming sea temperatures.

The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys: The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident.

PHP maintainers have released fixes for two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution.

There’s a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS).

Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the “advanced unlocking services” they’ve marketed for years.

Interesting research: Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch.

New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event.

This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it’s a task-specific fine-tune, a merged adapter or an abliterated build.

Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the lit…

This is a current list of where and when I am scheduled to speak: I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Quebec, Canada.

Matthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers.

Another IoT cyberattack, this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected. […] Normally, superm…

In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents.

On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA.

This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs.

Apple just released a system called “Reference Image.”

404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature.

This one is from 1809, written by Napoleon’s nephew.

The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic.

St.

This essay was written with Nathan E.

Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers: To determine this, CR dug through thousands of pages of automakers’ privacy policies and asked questions of 15 different a…

AI systems are regularly completing tasks in ways that their prompters don’t want or intend.

Modern messaging apps allow users to link their phone accounts to their computer desktop.

ArsTechnica is reporting on a “new” attack against RSA, one that bypasses factoring.

I feel like someone who reads this blog will want to go to this: Families are invited to dive into the fascinating world of marine biology during an exciting, hands-on Family Squid Dissection at the Hands-On Science Center.

Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected.

This is an impressive piece of malware.

New paper: “Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training.”

This is pretty amazing: However, the most astonishing thing about this break is that the GPT6 Astra did it entirely on its own.

Hackers captured a Flock camera and got a look (alternate link) at the software: While much of the automatic license plate reader’s (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that soft…

Short essay about squid egg sacs.

Anthropic’s recent security-incident document contains a bit about how CAPTCHAs are still frustrating Claude.

This essay was written with Nathan E.

New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.

This essay was written with Cindy Cohn, and originally appeared in Lawfare.

Really interesting story about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA.

This is a current list of where and when I am scheduled to speak: I’m speaking online (via Zoom) at a League of Women Voters event on Tuesday, September 22, 2026 at 5 PM ET.

Last week, Anthropic released a long and detailed document describing current misuses of their Claude models.

Once a month, Microsoft pushes a security update to all Windows users.

Smells awful: But an estimated 30 to 50 tons of dead squid remain inside the boat’s catch tank, where they have been decomposing for days.

Last month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers.

In August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago.

Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it.

A database of 153 million drivers licenses is for sale on the dark web.

Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes.

This essay was written with Barath Raghavan, and originally appeared in Lawfare.

Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs“: Abstract: Leading large language model providers now conceal their models’ step-by-step reasoning, or chain-of-thought, to protect intellectual property and limit information lea…