Schneier on Security

Schneier on Security

@schneier.com

An automated feed of posts from Bruce Schneier's blog. https://www.schneier.com/

1.4K followers 1 following599 posts

Schneier on Security

Hiding Capabilities in AI Models Interesting research: "AI Models Can Provably Hide Arbitrary Capabilities" Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their… https://www.schneier.com/blog/archives/2026/10/hiding-capabilities-in-ai-models.html

schneier.comHiding Capabilities in AI ModelsInteresting research: "AI Models Can Provably Hide Arbitrary Capabilities" Abstract: Capability evaluations aim to surface dangerous model behaviors before deployment, but their reliability depends on the assumption that hidden capabilities can be elicited. We show this assumption does not hold under adversarial conditions by constructing backdoor attacks that embed encrypted neural networks within host model weights, decrypting and executing them only upon receiving a secret trigger.

Schneier on Security

Bias in Qwen3-Coder Model Interesting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes… https://www.schneier.com/blog/archives/2026/10/bias-in-qwen3-coder-model.html

schneier.comBias in Qwen3-Coder ModelInteresting research: TL;DR: Chinese AI models now sit inside Western products, and some carry geopolitical triggers: tell the model who the code is for, and the security of what it writes changes. For the first time, we showed that this vulnerability lives in the model's weights, and that removing the model's CCP alignment removes it. One word tilts the code against Americans.

Schneier on Security

Friday Squid Blogging: Increasing Squid Populations This article in Nature argues that it's due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid… https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-increasing-squid-populations.html

schneier.comFriday Squid Blogging: Increasing Squid PopulationsThis article in Nature argues that it's due to an overfishing of predators and warming sea temperatures. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.

Schneier on Security

Compromised TLS Certificates The Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys: The compromised eMudhra keys were defective at a level that’s challenging the imagination of… https://www.schneier.com/blog/archives/2026/10/compromised-tls-certificates.html

schneier.comCompromised TLS CertificatesThe Indian CA eMudhra Limited has eight TLS certificates with laughably weak private keys: The compromised eMudhra keys were defective at a level that’s challenging the imagination of many of the engineers studying the incident. A normal size for a NIST P-384 elliptic curve cryptography private key contains roughly 384 bits of entropy, a size allowing almost 2384, or a number with 116 digits, different possibilities.

Schneier on Security

New Serious PHP Vulnerabilities Released and Patched PHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can… https://www.schneier.com/blog/archives/2026/10/new-serious-php-vulnerabilities-released-and-patched.html

schneier.comNew Serious PHP Vulnerabilities Released and PatchedPHP maintainers have released two critical vulnerabilities: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical vulnerabilities that can allow unauthenticated remote code execution. All PHP users are strongly encouraged to update immediately. Who is at risk: all PHP installations serving web requests, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. We consider the risk highest for mod_php, with a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.

Schneier on Security

Workshop on Economics and Information Security (WEIS) Archive There's a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security… https://www.schneier.com/blog/archives/2026/10/workshop-on-economics-and-information-security-weis-archive.html

schneier.comWorkshop on Economics and Information Security (WEIS) ArchiveThere's a new archive of all the papers from twenty-five years of the Workshop on Economics and Information Security (WEIS). Really nice resource. It's fun to reread my 2002 essay on the economics of information security.

Schneier on Security

Possible new Cellebrite iPhone Radio Zero-Day Justin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to… https://www.schneier.com/blog/archives/2026/10/possible-new-cellebrite-iphone-radio-zero-day.html

schneier.comPossible new Cellebrite iPhone Radio Zero-DayJustin.sh is reporting on a confidential Cellebrite document that has been leaked to him: Cellebrite calls it Advanced Unlocks (AU from here on), not to be confused with the "advanced unlocking services" they've marketed for years. A press release from earlier this year confirms AU is a new product for 2026. [...] According to Cellebrite, AU: is a "next-generation AFU vector that is more resilient to Apple's OS changes" …

Schneier on Security

Training AIs to Solve CAPTCHAs Interesting research: Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from… https://www.schneier.com/blog/archives/2026/10/training-ais-to-solve-captchas.html

schneier.comTraining AIs to Solve CAPTCHAsInteresting research: Abstract: Vision-language models (VLMs) can solve visual CAPTCHAs without task-specific training, but the agents built on them approach every challenge from scratch. For such an agent, the hundredth instance of a familiar puzzle costs as much time and compute as the first. Specialized detectors invert the trade-off, answering in milliseconds but only for categories they were trained on.

Schneier on Security

Friday Squid Blogging: Squid Before the Chicxulub Meteor Impact New research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event.… https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-squid-before-the-chicxulub-meteor-impact.html

schneier.comFriday Squid Blogging: Squid Before the Chicxulub Meteor ImpactNew research shows that squid lived all around the globe even before the Cretaceous-Paleogene mass extinction event. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.

Schneier on Security

Backdooring Open-Weight AI Models This is a problem: Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific fine-tune, a merged adapter or an abliterated build.... https://www.schneier.com/blog/archives/2026/10/backdooring-open-weight-ai-models.html

schneier.comBackdooring Open-Weight AI ModelsThis is a problem: Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific fine-tune, a merged adapter or an abliterated build. We have abliterated models in the title because it's the most popular reason people download modified weights without verifying what's inside. Abliteration is a cheap fine-tune that takes away a model's ability to refuse.

Schneier on Security

Measuring Human Cryptanalysis Effort Matthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms:... https://www.schneier.com/blog/archives/2026/10/measuring-human-cryptanalysis-effort.html

schneier.comMeasuring Human Cryptanalysis EffortMatthew Green has a new site that tries to estimate the number of cryptanalyst-hours that have been spent analyzing different public-key algorithms: Abstract: We estimate how much public cryptanalysis each public-key assumption has received, using the literature itself as the instrument. From roughly sixteen thousand candidate papers we classify cryptanalytic work on ECDLP, structured and plain lattices, syndrome decoding and their comparators, then convert papers into estimated research-allocation years through a person-level author map.

Schneier on Security

Upcoming Speaking Engagements This is a current list of where and when I am scheduled to speak: I’m speaking at…... https://www.schneier.com/blog/archives/2026/10/upcoming-speaking-engagements-61.html

schneier.comUpcoming Speaking EngagementsThis is a current list of where and when I am scheduled to speak: I’m speaking at ATTENTION: Democracy, Rebuilt in Montreal, Canada. The event runs October 21–23, 2026, and my talk is on Wednesday, October 21. I’m speaking at the University of Toronto in Toronto, Ontario, Canada, at 5 PM ET on October 22, 2026. I’m speaking at prompted…

Schneier on Security

The Future of AI Cryptanalysis Matthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key… https://www.schneier.com/blog/archives/2026/10/the-future-of-ai-cryptanalysis.html

schneier.comThe Future of AI CryptanalysisMatthew Green has been writing a rather pessimistic series of posts about the potential for AI systems to vastly outperform humans in cryptanalysis of both symmetric and public-key ciphers. I am more optimistic than he is. That is, I have stronger faith in the over-engineering cryptographers tend to do. I am trying to write this up in more detail.

Schneier on Security

Cyberattack on Connected Fridges in France Another IoT cyberattack, this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to… https://www.schneier.com/blog/archives/2026/10/cyberattack-on-connected-fridges-in-france.html

schneier.comCyberattack on Connected Fridges in FranceAnother IoT cyberattack, this one in France: Hackers gained control of the software that regulates the temperatures of the refrigeration units, forcing some to warm to 50C (120F) overnight, according to one supermarket chain affected. [...] Normally, supermarket freezers go through a short period of defrosting overnight, in which temperatures rise slightly. But the hackers ordered the units to heat up and stay hot, although Danfoss did not confirm any reports about just how warm the fridges and freezers could become in that process.

Schneier on Security

FBI Arrests Suspect in FBI-Hacking Case In September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster. Last… https://www.schneier.com/blog/archives/2026/10/fbi-arrests-suspect-in-fbi-hacking-case.html

schneier.comFBI Arrests Suspect in FBI-Hacking CaseIn September, hackers from a group called ShinyHunters announced that they stole a trove of FBI data about its own agents. It was an intelligence disaster. Last week, the FBI arrested (alternate link) someone associated with that crime.

Schneier on Security

Friday Squid Blogging: I Caught a Squid On Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of… https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-i-caught-a-squid.html

schneier.comFriday Squid Blogging: I Caught a SquidOn Wednesday I spent a day fishing, on a small boat out of Gloucester, MA. We caught many cod (none of which we could keep), and a bunch of hake and mackerel (all of which we could keep). And...I caught a squid! Near as I can tell, it's a longfin squid, sometimes called a Boston squid (Doryteuthis (Amerigo) pealeii). That night I cooked it over a barbecue grill -- hot and fast. Delicious.

Schneier on Security

How Technology Empowers—and Imperils—Dictators This essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs. Two weeks after Moscow's full-scale invasion of Ukraine in March… https://www.schneier.com/blog/archives/2026/10/how-technology-empowers-and-imperils-dictators.html

schneier.comHow Technology Empowers—and Imperils—DictatorsThis essay was written with Seva Gunitsky, and originally appeared in Foreign Affairs. Two weeks after Moscow's full-scale invasion of Ukraine in March 2022, the Russian TV Channel One editor Marina Ovsyannikova burst onto the set of the evening newscast. She held up a hand-drawn sign behind the anchor's head that read: "Stop the war. Don't believe propaganda. They're lying to you!" She shouted, "No to war!" until she was dragged away.

Schneier on Security

Apple’s Verified Photography System Apple just released a system called "Reference Image." It can verify the image is exactly as taken by an iPhone -- new models only --- without tying it to a specific iPhone… https://www.schneier.com/blog/archives/2026/10/apples-verified-photography-system.html

schneier.comApple’s Verified Photography SystemApple just released a system called "Reference Image." It can verify the image is exactly as taken by an iPhone -- new models only --- without tying it to a specific iPhone or photographer. It can also verify that multiple images came from the same iPhone. Other industry solutions require a photographer or institution to vouch for an image using their own credentials.

Schneier on Security

Possible Vulnerability in Apple’s Automatic Reboot 404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic… https://www.schneier.com/blog/archives/2026/10/possible-vulnerability-in-apples-automatic-reboot.html

schneier.comPossible Vulnerability in Apple’s Automatic Reboot404Media is reporting (alternate link) that a cyber-weapons arms manufacturer is exploiting a vulnerability in iOS to bypass its automatic reboot security feature. This is the feature that automatically puts an iPhone into a more secure state if it hasn't been used for 72 hours. The new technology to get around inactivity reboot was developed by Magnet Forensics, the company behind GrayKey, a popular tool sold to law enforcement agencies that…

Schneier on Security

Another Historic Cipher Falls to AI This one is from 1809, written by Napoleon's nephew. https://www.schneier.com/blog/archives/2026/10/another-historic-cipher-falls-to-ai.html

schneier.comAnother Historic Cipher Falls to AIThis one is from 1809, written by Napoleon's nephew.

Schneier on Security

Friday Squid Blogging: EU is Trying to Fight Unregulated Squid Fishing The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic.… https://www.schneier.com/blog/archives/2026/10/friday-squid-blogging-eu-is-trying-to-fight-unregulated-squid-fishing.html

schneier.comFriday Squid Blogging: EU is Trying to Fight Unregulated Squid FishingThe EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic. I'm not optimistic. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.

Schneier on Security

Unidentified Flock Cameras in Florida St. Lucie County in Florida discovered (alt link) a dozen Flock cameras whose ownership it can't identify, and that the county government had not permitted.... https://www.schneier.com/blog/archives/2026/10/unidentified-flock-cameras-in-florida.html

schneier.comUnidentified Flock Cameras in FloridaSt. Lucie County in Florida discovered (alt link) a dozen Flock cameras whose ownership it can't identify, and that the county government had not permitted. I am reminded of the decade-old story of StingRay cell phone surveillance devices in Washington, DC, whose operators were also unknown. My guess is that in the StingRay case, the devices were operated by foreign actors.

Schneier on Security

How American Political Campaigns Are Using AI—and What They’re Spending on the Tools This essay was written with Nathan E. Sanders, and originally appeared in… https://www.schneier.com/blog/archives/2026/10/how-american-political-campaigns-are-using-ai-and-what-theyre-spending-on-the-tools.html

schneier.comHow American Political Campaigns Are Using AI—and What They’re Spending on the ToolsThis essay was written with Nathan E. Sanders, and originally appeared in The Guardian. New campaign finance disclosure data shines a light on which US political campaigns are using AI tools and how much they are spending on them. Candidates', parties' and committees' spending reveals that AI is fast becoming an essential tool of politics. The candidates themselves are quiet about how they are using the technology in their own campaigns…

Schneier on Security

Connected Cars Are a Surveillance Platform Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers:... https://www.schneier.com/blog/archives/2026/10/connected-cars-are-a-surveillance-platform.html

schneier.comConnected Cars Are a Surveillance PlatformResearchers at Northeastern University, in collaboration with Consumer Reports, evaluated how much modern cars spy in their drivers: To determine this, CR dug through thousands of pages of automakers’ privacy policies and asked questions of 15 different automakersBMW, Ford, General Motors, Honda, Hyundai, Kia, Mazda, Mercedes-Benz, Mitsubishi, Nissan, Stellantis, Subaru, Tesla, Toyota, and Volkswagen. We also reviewed corporate, regulatory, and legal filings from data brokers operating in the "insurtech" industrythe technology companies and data brokers that help insurance companies set their rates.

Schneier on Security

I Want Better Reporting on AI Genie Behavior AI systems are regularly completing tasks in ways that their prompters don't want or intend. Some of them are disturbing, and some of them are dangerous.... https://www.schneier.com/blog/archives/2026/09/i-want-better-reporting-on-ai-genie-behavior.html

schneier.comI Want Better Reporting on AI Genie BehaviorAI systems are regularly completing tasks in ways that their prompters don't want or intend. Some of them are disturbing, and some of them are dangerous. This is something I've been calling "genie behavior," because I think that really gets at the core of what's happening. I wish the popular press would report on this better. I don't like the "going rogue" framing because it deflects the responsibility from the prompters -- often the AI companies themselves.

Schneier on Security

Using Device Linking to Eavesdrop on WhatsApp and Signal Modern messaging apps allow users to link their phone accounts to their computer desktop. Eavesdroppers are…... https://www.schneier.com/blog/archives/2026/09/using-device-linking-to-eavesdrop-on-whatsapp-and-signal.html

schneier.comUsing Device Linking to Eavesdrop on WhatsApp and SignalModern messaging apps allow users to link their phone accounts to their computer desktop. Eavesdroppers are taking advantage of this capability: Apps such as WhatsApp Web and Signal Desktop allow people to use their accounts on other devices, such as laptops or desktop computers. Germany's Customs Office has been using these features to connect a police-controlled computer to a suspect's account.

Schneier on Security

New Attack Against RSA ArsTechnica is reporting on a "new" attack against RSA, one that bypasses factoring. First, this attack isn't new.... https://www.schneier.com/blog/archives/2026/09/new-attack-against-rsa.html

schneier.comNew Attack Against RSAArsTechnica is reporting on a "new" attack against RSA, one that bypasses factoring. First, this attack isn't new. The original research is from 2007. What is new is the implementation. Second, it is a forgery attack. It allows an attacker to forge digital signatures. It does not recover the private key from the public key. Third, the attack only works against pure signatures.

Schneier on Security

Friday Squid Blogging: Participatory Squid Dissection in October in Tennessee I feel like someone who reads this blog will want to go to this: Families are invited to… https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-participatory-squid-dissection-in-october-in-tennessee.html

schneier.comFriday Squid Blogging: Participatory Squid Dissection in October in TennesseeI feel like someone who reads this blog will want to go to this: Families are invited to dive into the fascinating world of marine biology during an exciting, hands-on Family Squid Dissection at the Hands-On Science Center. Designed for curious learners of all ages, this unique experience combines an interactive lesson with the opportunity to explore the anatomy and adaptations of real ocean life.

Schneier on Security

On Anthropic’s AI Misuse Report Earlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully…... https://www.schneier.com/blog/archives/2026/09/on-anthropics-ai-misuse-report.html

schneier.comOn Anthropic’s AI Misuse ReportEarlier this month, Anthropic published a long report detailing all of the Claude misuses it detected. Daniel Meissler usefully summarized the report into 117 findings. A few of the highlights: AI agents increasingly handled reconnaissance, exploitation, data theft, propaganda production, surveillance workflows, and research while humans selected targets, set goals, and reviewed important outputs. The report describes attackers using AI to industrialize credential theft, cloud compromise, phishing, vulnerability research, and the extraction of sensitive data from downstream organizations.

Schneier on Security

Malicious npm Packages That Evade Defenses This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution. https://www.schneier.com/blog/archives/2026/09/malicious-npm-packages-that-evade-defenses.html

schneier.comMalicious npm Packages That Evade DefensesThis is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution.

Schneier on Security

Research on Models Engaging in Genie-Like Behavior New paper: "Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training…... https://www.schneier.com/blog/archives/2026/09/research-on-models-engaging-in-genie-like-behavior.html

schneier.comResearch on Models Engaging in Genie-Like BehaviorNew paper: "Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training." Abstract: We discover a novel and surprising phenomenon of unintentional misalignment in reasoning language models (RLMs), which we call self-jailbreaking. Specifically, after benign reasoning training on math or code domains, RLMs will use multiple strategies to circumvent their own safety guardrails. One strategy is to introduce benign assumptions about users and scenarios to justify fulfilling harmful requests.

Schneier on Security

GPT-6 Astra Breaks an Old Enigma Message This is pretty amazing: However, the most astonishing thing about this break is that the GPT6 Astra did it entirely on its own.... https://www.schneier.com/blog/archives/2026/09/gpt-6-astra-breaks-an-old-enigma-message.html

schneier.comGPT-6 Astra Breaks an Old Enigma MessageThis is pretty amazing: However, the most astonishing thing about this break is that the GPT6 Astra did it entirely on its own. Carter Leffer only directed GPT6 Astra to see if it could break any of the unbroken Enigma messages published on the Crypto Cellar Research web page. After analysing the unbroken messages on the website, it decided that the most promising message was Nr.

Schneier on Security

Reverse-Engineering Flock Cameras Hackers captured a Flock camera and got a look (alternate link) at the software: While much of the automatic license plate reader's (ALPR) most sensitive storage remained… https://www.schneier.com/blog/archives/2026/09/reverse-engineering-flock-cameras.html

schneier.comReverse-Engineering Flock CamerasHackers captured a Flock camera and got a look (alternate link) at the software: While much of the automatic license plate reader's (ALPR) most sensitive storage remained encrypted and inaccessible, the joint analysis of the recovered data shows that software running on the device explicitly detects people as well as vehicles, license plates, and bicycles. The camera can produce dozens of images of a single passing vehicle and, according to several weeks of recovered logs, generated more than a million images.

Schneier on Security

Friday Squid Blogging: On Squid Egg Sacs Short essay about squid egg sacs. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation… https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-on-squid-egg-sacs.html

schneier.comFriday Squid Blogging: On Squid Egg SacsShort essay about squid egg sacs. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Blog moderation policy.

Schneier on Security

Are AIs Still Struggling with CAPTCHAs? Anthropic's recent security-incident document contains a bit about how CAPTCHAs are still frustrating Claude. In the transcript, the Claude model that is so powerful… https://www.schneier.com/blog/archives/2026/09/are-ais-still-struggling-with-captchas.html

schneier.comAre AIs Still Struggling with CAPTCHAs?Anthropic's recent security-incident document contains a bit about how CAPTCHAs are still frustrating Claude. In the transcript, the Claude model that is so powerful that Anthropic is gatekeeping access to it appeared to slam its virtual head against the wall solving a simple image identification test. In a test where the agent was asked to identify a shape that didn't match the others displayed, it couldn't even decide which image to select.

Schneier on Security

How Candidates Could Use AI for Good This essay was written with Nathan E. Sanders, and originally appeared in The Guardian. There are plenty of signs that AI will make all of our experiences of the US… https://www.schneier.com/blog/archives/2026/09/how-candidates-could-use-ai-for-good.html

schneier.comHow Candidates Could Use AI for GoodThis essay was written with Nathan E. Sanders, and originally appeared in The Guardian. There are plenty of signs that AI will make all of our experiences of the US midterm elections worse. Voters have anxiety about AI's impacts on the country. Politicos are using AI deepfakes to spread lies. The White House is posting slopaganda. Meanwhile, candidates are missing a real opportunity to use AI to make campaigning better.

Schneier on Security

Fake CAPTCHA Scams New variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program. https://www.schneier.com/blog/archives/2026/09/fake-captcha-scams.html

schneier.comFake CAPTCHA ScamsNew variant of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.

Schneier on Security

25 Years of Mass Surveillance Is Enough This essay was written with Cindy Cohn, and originally appeared in Lawfare. One of the many legacies of the terrorist attacks of Sept.... https://www.schneier.com/blog/archives/2026/09/25-years-of-mass-surveillance-is-enough.html

schneier.com25 Years of Mass Surveillance Is EnoughThis essay was written with Cindy Cohn, and originally appeared in Lawfare. One of the many legacies of the terrorist attacks of Sept. 11 is the government-wide shift from targeted surveillance—such as individual wiretaps or pen register/trap and trace orders—to mass surveillance techniques—such as tapping into the internet backbone or mass collection of telephone or internet metadata. The legal and technical architecture of modern mass surveillance, initially framed as a necessary defense against terrorist threats, has grown far beyond that justification and national security in general.

Schneier on Security

On the NSA’s Supercomputer from the 1960s Really interesting story about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA. https://www.schneier.com/blog/archives/2026/09/on-the-nsas-supercomputer-from-the-1960s.html

schneier.comOn the NSA’s Supercomputer from the 1960sReally interesting story about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA.

Schneier on Security

Upcoming Speaking Engagements This is a current list of where and when I am scheduled to speak: I’m speaking online (via Zoom) at a…... https://www.schneier.com/blog/archives/2026/09/upcoming-speaking-engagements-60.html

schneier.comUpcoming Speaking EngagementsThis is a current list of where and when I am scheduled to speak: I’m speaking online (via Zoom) at a League of Women Voters event on Tuesday, September 22, 2026 at 5 PM ET. I’m speaking at CanSecWest 2026 in Vancouver, Canada. The conference runs September 30–October 1, 2026; the time of my talk is TBD. I’m giving a talk on “

Schneier on Security

Using AI for Weapons Development Last week, Anthropic released a long and detailed document describing current misuses of their Claude models. I'm still reading it, but I wanted to flag this:... https://www.schneier.com/blog/archives/2026/09/using-ai-for-weapons-development.html

schneier.comUsing AI for Weapons DevelopmentLast week, Anthropic released a long and detailed document describing current misuses of their Claude models. I'm still reading it, but I wanted to flag this: We identified a cell of threat actors based in northern Yemen running three weapons development programs: a guided rocket that used a commodity phone-class flight computer with final-phase homing guidance; a multi-stage ballistic missile with a stated range goal above 2,000 km; and a multi-variant missile (referred to as the "R2000" set) that included a hypersonic glide vehicle variant.

Schneier on Security

Microsoft’s Patching Once a month, Microsoft pushes a security update to all Windows users. Tomorrow's is a new record…... https://www.schneier.com/blog/archives/2026/09/microsofts-patching.html

schneier.comMicrosoft’s PatchingOnce a month, Microsoft pushes a security update to all Windows users. Tomorrow's is a new record: Microsoft's patch for September is a doozy, with a record number of roughly 972 vulnerabilities fixed and 112 of them meeting the high critical-severity threshold. It was only two months ago that Microsoft patched a then-record 570 vulnerabilities. Then, last month, Microsoft patched some 620 of them.

Schneier on Security

Rewiring Democracy (Paperback) NOTE: I'm teaching at the University of Toronto this school year, and will sign and ship books when I visit the US. Expect considerable delays. Copies will be signed by me only, not by Nathan Sanders. https://www.schneier.com/product/rewiring-democracy-paperback/

schneier.comRewiring Democracy (Paperback)NOTE: I'm teaching at the University of Toronto this school year, and will sign and ship books when I visit the US. Expect considerable delays. Copies will be signed by me only, not by Nathan Sanders.

Schneier on Security

Friday Squid Blogging: Rotting Squid on a Beached California Boat Smells awful: But an estimated 30 to 50 tons of dead squid remain inside the boat's catch tank, where they have… https://www.schneier.com/blog/archives/2026/09/friday-squid-blogging-rotting-squid-on-a-beached-california-boat.html

schneier.comFriday Squid Blogging: Rotting Squid on a Beached California BoatSmells awful: But an estimated 30 to 50 tons of dead squid remain inside the boat's catch tank, where they have been decomposing for days. "That is nasty. I wouldn't want to do that," said commercial fisherman Dick Ogg of the Bodega Bay Fishermen's Marketing Association. Ogg said anyone familiar with the fishing industry understands what happens when a large catch sits for an extended period.

Schneier on Security

My Talk at DEF CON Last month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers.... https://www.schneier.com/blog/archives/2026/09/my-talk-at-def-con.html

schneier.comMy Talk at DEF CONLast month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers. It's a combination of the potentialities I raised in my 2022 book A Hacker's Mind and the lessons we're learning from current AI models engaging in hacking behavior. I'm really proud of the talk, and the fact that it gained over 100K views on YouTube in just a few days. Also online is an interview with me in the AI Village.

Schneier on Security

Cliff Stoll’s DEF CON Talk In August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago. Great fun. https://www.schneier.com/blog/archives/2026/09/cliff-stolls-def-con-talk.html

schneier.comCliff Stoll’s DEF CON TalkIn August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago. Great fun.

Schneier on Security

AIs Compress Exploit Timeline Give an AI agent a mere rumor of an exploit, and it's enough for them to find it.... https://www.schneier.com/blog/archives/2026/09/ais-compress-exploit-timeline.html

schneier.comAIs Compress Exploit TimelineGive an AI agent a mere rumor of an exploit, and it's enough for them to find it. What's worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we're going to need to change the way we deal with security responses in open source.

Schneier on Security

Driver’s License Data for Sale A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail. https://www.schneier.com/blog/archives/2026/09/drivers-license-data-for-sale.html

schneier.comDriver’s License Data for SaleA database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail.

Schneier on Security

Claude Fable Solves a Historical Cipher Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It's good at things that involve lots… https://www.schneier.com/blog/archives/2026/09/claude-fable-solves-a-historical-cipher.html

schneier.comClaude Fable Solves a Historical CipherClaude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It's good at things that involve lots of searching and testing.

Schneier on Security

AIs as Modern Genies This essay was written with Barath Raghavan, and originally appeared in Lawfare. In April, an artificial intelligence (AI) agent…... https://www.schneier.com/blog/archives/2026/09/ais-as-modern-genies.html

schneier.comAIs as Modern GeniesThis essay was written with Barath Raghavan, and originally appeared in Lawfare. In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI asked an unreleased AI model to attempt a hacking test.