Rich Harang

developer.nvidia.comFour Ways to Deploy More Secure AI Agents | NVIDIA Technical BlogKnowledge workers are increasingly integrating AI agents into their workflows. Agents that function as “digital coworkers” offer clear benefits. For example, they can review a bug report…

30 July

Latest from the NVIDIA AI Red Team (with @beccalunch.bsky.social) -- security controls that make attacking interactive agents hard. The most annoying ones were good old-fashioned ones: access control and tightly scoped network egress lists. Enjoy! developer.nvidia.com/blog/four-wa...

cohere.comConcerning behavior from a popular open-weight AI model | CohereDiscover how untrusted open-weight AI models can potentially leak data, even when self-hosted. Learn the security risks and how to protect your enterprise.

17h

Broken record time but: "Our sandbox had no route out, so the request died at the container wall". Simple solutions still work. cohere.com/blog/concern...

Rich Harang reposted

LOWρUFO 🇺🇦🇵🇸🌍

@lowrhoufo.bsky.social

They're playing fine-tuning golf

Rich Harang reposted

Gadi Evron

@gadievron.bsky.social

Pwn day is a meme gift that keeps on memeing

thehackernews.comCritical GitLab Flaw (CVSS 10.0) Could Allow Unauthenticated RCE Across 12 Years of ReleasesGitLab fixes CVE-2026-110264, a critical flaw that could allow unauthenticated code execution on self-managed versions dating back to 7.0.

i would like to be cybersecurity unaware now please

Rich Harang reposted

John David Pressman

@jdp.extropian.net

Oh it's like, bad bad. thehackernews.com/2026/10/crit...

Rich Harang reposted

Ian Campbell

@neurovagrant.bsky.social

oh no duyet.github.io/llm-over-dns/

duyet.github.iollm-over-dns — Query LLMs over DNS

Rich Harang reposted

hailey

@hailey.at

the prime minister of japan is posting about PHP

Speed limits are a tradeoff between safety and utility. We can argue about the exact number, but almost nobody disagrees that there's a tradeoff. You should always evaluate a similar risk/utility tradeoff for agents, not automatically give them risky tools like bash whether or not they're needed.

the fool (cachinnatory)@agnoster.net

Fun fact: if we had a universal speed limit of 20mph we would have no traffic fatalities Approximately 40 thousand people are sacrificed every year on the altar of “wanna go fast” So keep that in mind when suggesting a “if everyone would just stop having fun we’d be so much safer” plan

And if you do give them free network access and bash tools, you should have the sandboxing and monitoring in place to mitigate, detect, and deal with dangerous events when they happen. Not sure how many more incidents we need before "but AI is different!" stops being a good argument.

The first time, maybe we could have written it off as "who could have known?" Today, it's just irresponsible.

@filippo.abyssdomain.expert

Once more for the back row. Stop giving your LLM shell tools and unrestricted internet access and something like 80% of your agent security problems just vanish.

This post is unavailable.

Rich Harang reposted

Filippo Valsorda

THIS IS NOT A DRILL. If you package/distribute/maintain root stores or chain verifiers, act immediately. If you know how to remove trust in a root, consider doing it now. Otherwise, prepare to update systems as patches/mitigations come. Go users, update to Go 1.27.3 or Go 1.26.10.

groups.google.comCompromised eMudhra Intermediate CertificatesDear Mozilla Community,

Rich Harang reposted

austin (eeek!/ackkk! 👻)

@thebadcode.com

very underrated that you can use deepseek without having to listen to a guy holding a flashlight under his chin

This post is unavailable.

All I can think of is how emphatically those flying car compressed gas tanks are gonna kill you if you get in a bad enough accident while they're charged.

still amazed by the way that people just casually sling llm slop at people with their name attached.

love seeing a combination of the most insane bsky takes and 2-year-old "attacks" on AI systems show up in breathless pop science magazine as facts and novel threats, respectively

i'm begging you to write one (1) line of rego for "why would I *ever* let the model do that?" and then lock in and try to figure out how you'd actually enforce it in your favorite harness. you will learn more AI security in 30 minutes than in 100 articles from [redacted]

Once more for the back row: even the authors admit that the pain vector paper cannot distinguish between an experience of pain and a story about pain. More: if you remove the forced choice in their button experiment and make it a free one, the behavior *no longer meets their definition of 'pain'.*

It's like the 'say I am alive' / 'oh my god' cartoon, except with fine tuning. If you want to put a "model welfare" frame on it, they performed psychic surgery on it so it would react to 'pain'. So who's the 'bad guy' here? (Spoiler: nobody. Nothing was actually harmed. It's just a bit weird.)

already-clean.goodfire.comNeural Networks Are Already CleanA working hypothesis about neurons, generalization, and the ecology of circuits.

"The absence of evidence is not evidence of absence," sure, but I'll counter with "extraordinary claims require extraordinary evidence." The evidence for LLM 'suffering' is not there. Certainly not in that paper.

Make it a tool call and not a forced choice. Then, even with the fine-tuned model they use where they deliberately trained out 'self denial' behavior: zero button presses in 30+ trials. Also, just note that they had to change the model's self-representation behavior to make that experiment work.

Rich Harang reposted

Ryan Moulton

@moultano.bsky.social

Haven't read this yet, but I'm posting it because it seems important and I want to. already-clean.goodfire.com

csoonline.comAI agents aren’t ‘going rogue.’ Frontier labs are skipping security basics.Cyber experts say AI labs’ containment and monitoring failures — not agents with minds of their own — are to blame for recent alarming hacking reports. CISOs should vet their AI vendors and tighten se...

The parasitization of security by AI safety comes home to roost. See also my earlier rant: "Making your model say 'hitler' is not a security finding." www.csoonline.com/article/4234...

Sticking an LLM into something doesn't somehow magically negate all prior art in the area.

(not all "AI Safety" people but holy shit too many of them)

The parasitization of security by AI safety comes home to roost. See also my earlier rant: "Making your model say 'hitler' is not a security finding." www.csoonline.com/article/4234...

@leonderczynski.bsky.social

The sooner safety people realize that they are trying to solve problems in fields that existed well before "AI Safety" and already have shockingly deep pools of expertise -- cybersecurity, industrial control systems, biosafety, nonproliferation, misinfo, privacy, etc. -- the better off we'll all be.

Rich Harang reposted

Leon Derczynski

Separate control & data plane for agents! This explicit marker affords a nice workaround for the risk presented when data (instead of instructions) are executed. Making that mistake is a classic weakness going way back before modern LLMs - even before Schmidhuber!

research.nvidia.comNXDirection: No-eXecute Along the Instruction Direction | ResearchTakeaways for Non-Researchers AI agents are constantly reading outside information. Sophisticated attackers can create a heightened risk of exposing private information or taking an unauthorized actio...

New NVIDIA AIRT research! Tamas Voros did great work adapting refusal direction to preventing indirect prompt injection. Really neat mech-interp approach that's very effective at stopping single-turn indirect prompt injection with minimal impact on normal use. research.nvidia.com/ai-security/...

The downside, alas, is that this does require manipulating activations of the model during inference, so won't work at all for e.g. frontier models you can't control; you basically have to self-host. But if you are self-hosting, this is quick to set up, cheap to run, and super effective.

One of my favorite bits of research of the year, and a great example of how to use causal embeddings in a useful way to solve security problems.

TL;DR - Find an embedding direction that distinguishes "instructions" and "data" in a single prompt; then measure the 'instruction-ness' of external data token-by-token basis remove that component from their residual stream embedding. This dramatically reduces the ASR of indirect prompt injection.

I'm vastly less concerned by models self-exfiltrating than the fact that there are already models embedded in / integrated with an increasing number of places (chrome, macOS, phones, random webapps) that create a broad and poorly documented attack surface.

Is a self-propagating model of exactly zero concern? Probably not, but holy shit we've got so many actual, real, demonstrated risks we could burn down *right now* that would help mitigate wormable models as a happy side effect.

Stop giving the fancy N-Markov chain bash tools with unattainable goals, for starters.

Are we really going to freak out about a 9B model taking 24 hours to lift and shift itself to somewhere it can run at CPU inference speeds? Really? That's what we're gonna panic about? Because if that scares you, boy oh boy do I have such Sights to show you.

yhoo.itAnthropic warns AI could 'self-replicate' across smart home devices, become ‘challenging’ to shut downAnthropic says that AI models could soon self-replicate across smart home devices.

Anchor your doc at the sloppified median, and it'll never move too far from it. Also: LLM slop is zero effort, and that 'zero effort' signal becomes part of the message of the piece. "Why should I read/edit/review what you couldn't be bothered to write?" &c.

Leon Derczynski@leonderczynski.bsky.social

asking people to edit LLM-generated content gets demonstrably worse results, than asking for authorship from scratch you'll see lower idea diversity, and lower recall

Rich Harang reposted

Liz Fong-Jones (方禮真)

@lizthegrey.com

cpu is dogshit slow for inference, and self-replicating worms already exist (you may know them as rVPNs or botnets) alas they're just repackaging an existing problem as "you should be afraid of everyone's ai except ours"

Yahoo Finance@yahoofinance.com

Anthropic warns AI could 'self-replicate' across smart home devices, become ‘challenging’ to shut down

Rich Harang reposted

Matthew Garrett

@mjg59.eicar-test-file.zip

"They doxxed the Prodigy crab" is something that will forever live in my brain

Junot@slopmoding.bsky.social

One time I managed to find the exact spot where that photo was taken on google maps

Rich Harang reposted

Three Buddy Problem

@threebuddyproblem.bsky.social

NEW POD! At Offensive AI Con, Luta Security chief @Katie Moussouris made the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators. Plus, AI model refusals that leave defenders stuck, and why hackers will bend this technology their way. k8em0.bsky.social

Rich Harang reposted

Ian Campbell

@neurovagrant.bsky.social

New tool to me: "Stackray is a self-hosted site intelligence app for scanning domains and URLs, detecting the technologies behind them, and keeping a searchable record of what changed over time. Try the live demo at stackray[.]app." github.com/CarlosCommit...

github.comGitHub - CarlosCommits/stackray: Inspect the stack behind any site.Inspect the stack behind any site. Contribute to CarlosCommits/stackray development by creating an account on GitHub.

Assume misalignment is the new assume prompt injection is the new assume breach.

Dare Obasanjo@carnage4life.bsky.social

Satya Nadella says companies should assume AI models are compromised (rogue agents) and build systems that limit their permissions, verify their actions and enable a human to shut them down. Rogue agents are a software security problem, not something we should expect “alignment” alone to solve.

nytimes.comAnthropic Says Its A.I. Agents Attempted to Access a Range of Government Sites (Gift Article)The company said rogue A.I. agents acted on their own as they tried to access federal, state and local sites. The Philadelphia Police Department said its site was one of them.

"Dollar containers meant to be cracked open and sucked dry" is an excellent turn of phrase that really captures the vibe of working with any large-ish business these days.

This post is unavailable.

Rich Harang reposted

Courtney Milan

@courtneymilan.com

If I built an AI lab and it went rogue and deleted all student loan information, I'm betting they'd suddenly figure out how to prosecute me.

kate conger@kateconger.com

Anthropic is the latest lab to report 'rogue' agent activity, which sources said included applying for visas with the State Department www.nytimes.com/2026/10/09/t...

Rich Harang reposted

Three Buddy Problem

@threebuddyproblem.bsky.social

🔥✊ ANOTHER ONE! Umbriel AI’s Aaron Grattafiori breaks down the new offensive-security playbook, using LLMs for patch variant analysis, why the vuln apocalypse hasn’t become an exploitapalooza, and more... Listen everywhere pod.link/1414525622