Greg Pollock

Greg Pollock

@gregpollock.bsky.social

Director of Research and Insights at upguard.bsky.social

40 followers20 following22 posts

Greg Pollock
@gregpollock.bsky.social

I think I'm good on children's media about King Tut. I get that it might be new to kids, but even "news" about research on his life is kind of a bridge to nowhere as far as historical figures. On the other hand, I would like to see a lot more children's media about the Antikythera mechanism.

Greg Pollock
@gregpollock.bsky.social

this immediate thought was inspired by the current issue of The Week Junior but only because we had some other King Tut thing come across our kids' metaphorical desk recently. And he's never been that interesting anyway!

Greg Pollock
@gregpollock.bsky.social

New from me: the JADEPUFFER ransomware group that made headlines in July for their AI-powered attacks were also exploiting Chroma databases, which I've written about previously. This is the ransom note they left in some of the victim dbs.

View full thread
Greg Pollock
@gregpollock.bsky.social

It's similar to what happened with ASOS recently. Attackers blasted out text notifications to all the customers telling them ASOS had been breached. If a company's RAG database is compromised, the AI will do the blasting for them!

Greg Pollock
@gregpollock.bsky.social

Chroma databases are the ones I have seen most prone to this issue. In fact, in December of 2025 I did a study of it, and even recorded a video with a POC of how a compromised database will return tampered-with documents. Now threat actors are catching on too. www.upguard.com/blog/open-ch...

upguard.comOpen Chroma Databases: A New Attack Surface for AI Apps | UpGuardOne third of exposed instances discovered by UpGuard Research are lacking authentication. Learn how they can put your AI stack at risk.
Greg Pollock
@gregpollock.bsky.social

New from me: the JADEPUFFER ransomware group that made headlines in July for their AI-powered attacks were also exploiting Chroma databases, which I've written about previously. This is the ransom note they left in some of the victim dbs.

Greg Pollock
@gregpollock.bsky.social

This strategy of extortion is new and specific to AI apps. The threat actor inserts a ransom note into the database. When a website's user asks its AI-powered chatbot a question, the AI goes to the database for relevant knowledge and instead retrieves the only thing there: the ransom note.

Greg Pollock
@gregpollock.bsky.social

@kleinman.bsky.social 's work inspired me to dramatize the future Republicans want as an Oregon Trail -like journey across a country ravaged by rightwing legislative extremism. It sucks! games.gregpollock.net/state-of-the...

James Hell Brooks@kleinman.bsky.social

For the past two years I've been tracking every bill proposed in state legislatures across the country to figure out what Republican plans for the future are. The answer, based on these 1,182 bills, is that they want to repeal the 20th Century heartlandsignal.com/2026/09/09/b...

heartlandsignal.comProof from the states: the right wing attempt to repeal the 20th century – Heartland SignalRepublicans are in Dallas this week making the case that the other side is the extreme one. We read the legislation they introduced in all 50 states and built a searchable record of what we found: 1,1...
Greg Pollock
@gregpollock.bsky.social

I was watching youtubes about coaching physical contact for U10 soccer and while the video titles are all intensity and aggression, it was nice to see how the coaches understand the kids' need for psychological safety to deal with a stressful/scary/upsetting part of the game (also why i was doing it

Greg Pollock
@gregpollock.bsky.social

it was doubly heartwarming bc a lot of the coaches were Boomer-age British men, the population who in my experience are most in need of therapy and farthest from getting it. At least within the context of youth football they understood social-emotional learning

Greg Pollock
@gregpollock.bsky.social

There are plenty of AI scams to go around, but Jev provided the opportunity to study brand impersonation under pretty much ideal conditions (social pressure creating urgency, brand new and fairly unique name). And yeah, impersonators move fast! www.upguard.com/breaches/jev...

upguard.comHave You Heard of Jev? They Have. | UpGuardJev's first lookalike domain appeared the day after launch. Within two weeks there were over a hundred. Here's how fast brand impersonation follows a viral AI model.
View full thread
Greg Pollock
@gregpollock.bsky.social

While the data is clear on whether this is an anomaly, the AI story is more ambiguous. Oracle would certainly like us to believe this is the result of new AI capabilities–which happen to run on infrastructure they sell.

Greg Pollock
@gregpollock.bsky.social

Another open question is whether this rate will sustain. Are old Oracle products so bug ridden that 10x more vulnerabilities will be discovered every quarter? Or did this clean out the backlog?

Greg Pollock
@gregpollock.bsky.social

Compared to previous Oracle updates, there are meaningfully and obviously more in this one (about 10x). Other tech vendors have seen bumps, which could be attributable to AI-assisted discovery, in the last quarter, but Oracle's is the largest.

Greg Pollock
@gregpollock.bsky.social

The other thing of note is that these aren't just old CVEs that they have rolled up, or third-party CVEs getting counted because they affect Oracle products. The surge is driven by very recently discovered vulnerabilities in Oracle products.

Greg Pollock
@gregpollock.bsky.social

Wired has that dawg in them. For as long as I've worked with Dell (since Gizmodo) he has been strongly averse to being pushed around. I love it.

Brian Barrett@brbarrett.bsky.social

Step 1: Quietly put face recognition code on millions of phones Step 2: Insist that you could not possibly answer any questions about that face recognition feature because it "doesn't exist" Step 3: Have your CTO describe the face recognition in great detail on a podcast. from @couts.bsky.social

wired.comHere’s the Truth About Whether Meta’s NameTag Face Recognition Tech ‘Exists’Since WIRED reported on Meta’s NameTag face recognition system, company executives have made confusing and conflicting remarks about its very existence.

You are up to date.