AWS Secrets Manager now supports hybrid post-quantum TLS to protect secrets from quantum threats - AWS aws.amazon.com/about-aws/wh...

AWS needs to extend CloudWatch with tools that make it a real SIEM. Don’t overlay it with complexities it doesn’t need. Just extend it.

This post is not about Mythos capabilities because I can’t know until I try it. Opus 4.6 was great until is changed and I presume Mythos is better. These are questions I have about AI risks for businesses that rely on it that I don’t see anyone else asking - or answering.

Go Hornets! We’re kinda neighbors and sort of have a connection to the high school where KK went. 🏀 Had to take a break after doing the necessary. Back on all things AI tomorrow. Finally. Can’t wait! 🤖

Go Hornets! We’re kinda neighbors and sort of have a connection to the high school where KK went. 🏀 Had to take a break after doing the necessary. Back on all things AI tomorrow. Finally. Can’t wait! 🤖

There are varying levels of exploits in terms of complexity but technically my fuzzer at RSA 2020 generated exploits. Without AI. It produced a working script and performed attacks. I did review manually. But I have so many more ideas for that fuzzer with and without AI - bound by time and compute.

Anthropic Mythos ~ Anthropic released a new model they claim is scary good at finding security vulnerabilities. What questions should we be asking? This is not a hot take. I’m just pondering how much we can trust a model, the purported ROI, and how we can evaluate the risk of relying on it.

I am looking at messages in Google Developer tools and it is saying cdn.tailwindcss.com should not be used in production so if you are…. tailwindcss.com/docs/insrall...

I’ve added links to my presentation on how I use AI 🤖 for pentesting 😈 in this post. Most of the slides have a related blog post and I’ll probably write more about all these topics as I research this further. The PDF has links to related posts. teriradichel.substack.com/p/how-i-use-...

Awesome video on S3 files youtu.be/zb8TdNJhZCk

The Computer History Museum is such an awesome place for a conference. Thanks to everyone who came to the AWS Community Day!

🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖 Pentesting is not a scanner or a fuzzer - whether SAST, DAST, AI, deterministic or non-deterministic. Pentesting is a human * using those tools * to see if they can find a security problem that your teams and tools may have missed. 🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖🤖

I read all the Mythos hype right before I submitted my talk for today at the Computer History Museum. Did I need to change my slides? Nope.

Wonder if this has anything to do with performance degradation of anthropic models. But are you now paying more for same effort you were getting previously if you change this? * Default Shift: In March 2026…

FBI: Americans lost a record $21 billion to cybercrime last year www.bleepingcomputer.com/news/securit...

I was just listening to an interview on the radio with a person who worked at a hospital. 1. Your cyber insurance makes you a target. They know how much you can pay.

Iran has rapidly developed advanced cyber capabilities, evolving from information gathering to conducting destructive, state-linked attacks against critical infrastructure in the U.S., Israel, and the Gulf states. Read: share.google/aimode/50qKf...

How I Use AI for Penetration Testing Speaking at the Computer History Museum in Mountain View, CA April 10, 2026 teriradichel.substack.com/p/how-i-use-...

What happened to Claud Opus? I’m seeing highly respected researchers saying the same as me. One of them has switched to Codex.

ChatGPT DNS leak ~ possible C2 channel or DNS exfiltration. Data exposure in cursor via branch name. thehackernews.com/2026/03/open...

Seeing reports for similar issues with another vendor being called “vulnerabilities”

Wondering why I logged into an account and seeing a bunch of errors for something I don’t use in cloudtrail: codecomnections.amazonaws.com. GetSyncConfiguration. Resource not found…. So I ask and it’s coming from Cloudtrail. Code should be checking if the resource exists before trying to access it.

Latest scam. Interesting that when I used Apple cleanup to remove the ticket number it didn’t remove it but instead characters from another Arabic looking language showed up instead. This came as an attachment. Took screenshot. I did the cleanup like 5 times and then chars gone.

Note: As part of the analyzed intrusions, public-facing applications and valid accounts were abused for initial access. www.securityweek.com/chinese-hack...

I just wrote this post about DNS leaks and tunnels. So today I go to visit a web are and my host-based firewall is popping up repeatedly connection attempts to the website like it’s beaconing to maintain a connection. So at first I’m grumbling about whatever on the web site is doing that but…

Something on the AWS Builder Center is beaconing api.builder.aws.com ~ please make it stop whomever is listening….

Hmm after having a lot of problems with Kiro CLI last night and already again this a.m. I notice a bunch of new models have been added.m including deepseek, minimax, and qwen.

Omg it was about to rewrote a huge block of code and rewire it all when one variable needed to change - because it messed up the code on the first place. It is really messing up right now and it always does this at this particular time of day.

Whomever is responsible for Kiro CLI needs to figure out why the right model is not always served up. I am definitely not getting Opus 4.6 right now this model is making so many mistakes.

I thought there was a problem with the security group rules created by my bootstrap script initially but there was not. AWS added ids to security group rules which threw me for a loop in my tired state when I initially reviewed this.

What I've Vibe Coded 🤖 In 2.5 Weeks ~ Compared to similar code I tried to implement for years to deploy an AWS environment for running batch jobs (as AI agents or not). How I did it. teriradichel.substack.com/p/what-ive-v...

If you are using AI agents and don’t understand this, better read up.

Where are the Private Bits of FIDO2 Compliant Passkey Stored? Just because you’re vibe coding doesn’t mean you no longer need to understand how things work. Research for my tool to start a batch job with a Yubikey. teriradichel.substack.com/p/where-are-...

All the complicated stuff I do with AI starts here. I still use this method with a few tweaks. Instead of writing a book I publish here. Learn to write good code with AI ~ and secure it. Implement A Simple Project With Kiro CLI and a READ teriradichel.substack.com/p/implement-...

Finally! AWS Security Hub is expanding to unify security operations across multicloud environments aws.amazon.com/blogs/securi...

I’m in shock. For the AI 🤖 doubters here’s where I’m at after like three weeks I think. To be fair been working long hours but still… Sorry too long to repeat here… see mastodon or X. A lambda function to deploy a complex network in three tries.

This makes no sense: ⁉️ ➡️ Every Kiro plan costs 💲.02 / token. ➡️ So I’m going to barely run out of tokens at the end of the month and overages cost 💲.04 / token. What? ➡️ So to get $.02 per token I have to create a new user and plan for the end of the month or just use some other option until rollover.

Humor me for one second. I am doing better than all the celebrities on @espn ~ it won’t last but I’ll enjoy the moment. I used AI to analyze one matchup I wasn’t sure about and stuck to original pick. The rest was me looking at stats and I saw a few games. Decent track record. 🏀

Getting error say max 10 NALCs has been reached on AWS should be 20.

Cryptographer fights RustSec ban over bug reports • The Register ~ What’s your take? Critical or not? www.theregister.com/2026/03/20/c...

I know it’s only round one, but…how are your brackets doing? I missed a few the first day and thought I was going to do way worse than last year but had a comeback tonight. 🏀

Hence why I use MFA with AWS developer keys. 😁

AI Model DNS Leaks 🤖 Is this really a bug? Or is it functionality abuse? Because this is how the internet works. You decide. In any case be aware... teriradichel.substack.com/p/ai-model-d...

So I’m looking at which models cut off April 2025 and it wasn’t Anthropic. Models need to be able to identify themselves so you know you are getting the one you are paying for. Need some kind of verification method.

Asking model repeatedly when it’s training cut off date was and it is telling me April 2025. I asked a number of different types of questions. Claud Opus which I am paying for has a cut off of August 2025. I can tell the difference.

Why would I need this running on Amazon Linux??? avahi-daemon

Questions when starting an AI project: * Do I need a perfectly accurate result every time? ➡️ Use deterministic solution * Is a perfectly accurate result too costly, expensive, or even impossible? ➡️ Use AI to get closer to the result faster and cheaper

Way too long for blusky and not patience to split into itty bitty pieces. What I got done in the last two weeks vs how long that took me manually writing a batch job framework for three years. How long till it all works. That is the question. infosec.exchange/@teriradiche...