What’s one book that changed your life? Mine? My passport.

A thread of late-night reflection on adversarial AI. Intelligence... human or machine... is fragile. Tilt the frame, nudge the inputs, and what we thought was truth dissolves into confident nonsense.

“Landmark study” where openai comes to understand what we’ve been telling them about their own software for three years. (I’m sure many have been saying it for longer.)

If you've been in leadership meetings about technology like this, then you know. The real alarm bell: people at his level only talk like this after the proof of concept is done and the core infrastructure is locked in. This isn’t speculation or "prediction", it’s a signal that deployment is ready.

We def need a bigger study of this. The dark horse here won't just be the brogrammer claims, but real risks to software supply chain security, new adversarial AI attacks, and the downstream effects of technical debt on teams being told they need to do more with less actual humans in the loop.

If you can learn Foucault and write papers on power and justice, you can spend a few hours learning about OSINT and clicking a mouse and clacking at a keyboard. Trust me. Its worth it. Might need to write a basic guide or something

Wow. I feel late to the party. Accidentally wandered into Philosophy Bluesky. Place instantly leveled up. My feed is now less memes and more existential dread, and I love it.

How can this important of a story be an exclusive? #AIEthics www.theguardian.com/world/2025/s...

Late night thoughts after another meeting promoting the careless use of agentic ai: we built an internet that remembers too much and understands too little. I'm about 2/3rds through Surveillance Capitalism and it might be the most important book I've read in the last few years.

me telling my grandkids what it was like to have vaccines

Everyone ran to ‘everything as code’ while security barely caught up. Terraform and OPA don’t make a strategy. Now agentic AI is about to shake the table again. The rude awakening? Security isn’t just code. It’s people, culture, and context — and we’re forgetting that fast

Sorry vendors, I'm taking it first: Vibe Compliance™. Kidding...but Wiz is right. Vibe coding is all fun and games until it turns into vibe incident response. Even the best devs get comfy when it’s “just vibes.” Stay sharp.

Just wrote a blog on how to actually measure (in terms of risk) prompt injection attacks: Reality check • OWASP ranks it #1 LLM risk • USENIX ‘24 showed success rates up to 70% • Detectors miss 20%+ of attacks It’s not “sci-fi risk.” It’s measurable, repeatable failure.

Rock Lambros has built an NIST CSF 2.0 MCP Server. For the builders and security folk out there, this is the type of contributions we really need to make security a part of this agentic AI run world. Sharing for those who might get value #AISecurity #CISO #Cybersecurity

Switzerland just released Apertus, a completely open AI model. Not just "open weights" but everything—training data, process, code. While other nations race to build AI, the Swiss are redefining what "national AI" means... 🧵 www.engladget.com/ai/switzerla...

Had a meeting yesterday where I realized a lot of businesses forget the basic: Your IaC looks clean—until a teammate tweaks the console. Now you’re out of sync and don’t even know it. Drift wins unless you run daily diffs + alert on change. IaC only works if reality matches Git.

I was chatting with some leaders today and the topic of LLM firewalls came up. Of course, a vendor chimed in and made them sound like they were black magic. Spoiler: they’re not. But dismissing them outright misses the point. Let’s talk about what they actually are and aren’t.

Git trusted our tools more than systems should. CVE-2025-48384 proves that even familiar workflows can be turned against us. It’s not just a bug—it’s a reminder: trust begins with asking why defaults exist. Time to patch, rethink, and rebuild trust.

Good security isn’t another meeting. It’s your repo saying no before prod takes the hit. Pre-commit checks + CI scans make it muscle memory.

Surveillance Self-Defense is a lifeline—practical, no-nonsense guidance for staying safe online in a world that often tries to go fast and break everything. Every builder, founder, or security lead needs to bookmark it—not only to protect product, but the people who use it. #PrivacyMatters

Imagine a startup where platform engineers push security policy, then agents spread that policy across your entire codebase—no tickets, no lost time. This is the type of stuff we need more of. Security without slowdowns ≠ fantasy. It’s possible.

Too many teams sprint to launch, cross their fingers, and call it “shipping.” That’s not bold — it’s betting your future on luck. #ShipSecurely #SecureByDefault