← Feed

Posts

• View post

  Cyberattack on France’s national blood service (EFS) via its refrigeration contractor Coolworld. Hackers reset freezers keeping blood donor samples at -30°C to a target of 110°C. The thing that stopped it from destructive impact was an on-call technician who noticed the temperatures going up. Frozen plasma intended for transfusion was stored there too. Fortunately nothing was destroyed. This was a cyberattack on a sensitive layer of healthcare. From frozen peas to frozen plasma in three weeks...

• View post

  Over the past 48 hours, we appear to have been subjected to some kind of collective shock therapy. Several researchers involved with frontier AI labs have publicly said that the labs are racing toward self-improving superintelligence, and are gambling with our lives, and in fact civilisation. They were backed by several AI safety people. One put the chance of AI killing everyone within the next decade above 10%. How would that even happen? It rests on "may or may not".

• View post

  LG smart TVs scan user’s local network for phones and watches, log location and nearby Wi-Fi names. Then send it to LG Ad Solutions. Pull the cable and it keeps recording, stores the audio, uploads when reconnecred. Automatic Content Recognition samples whatever comes through HDMI, so the console counts too. https://www.theverge.com/tech/991190/lg-tv-spying-standby-recording-wi-fi-scanning-gamers-nexus

• View post

  Berlin Senate employee executed a command that a website politely asked him to execute. The page looked like a “verify you are human” check. It instructed to open Windows Terminal/PowerShell, paste a command and press Enter. This is what appears to lead catastrophic results. Attackers hacked the systems and exfiltrated 1.44 million, 5.8 TB. Including personnel records, applications, internal documents, emergency plans and other sensitive material.

• View post

  The new iPhone Fold is pretty cool. Now everyone on the subway or tram can see what impressive and awesome books you’re reading. (Though I suggest ordering a hardcover)

• View post

  I'm proud of my recent work.1) AI-powered autonomous influence operations, 2) AI-assisted cryptanalysis https://arxiv.org/abs/2608.10920 https://arxiv.org/abs/2608.21986 https://eprint.iacr.org/2026/1734

• View post

  RE: https://mastodon.social/@LukaszOlejnik/117246545940793134 I'm open to consulting, full-time or part-time work across research, engineering, security, AI, regulation and policy. AI-first work very much in scope. This can include commissioned research, security/privacy review, AI & agent-system, technical analysis, policy/regulatory work me@lukaszolejnik.com

• View post

  Here's how we'll protect humanity from extinction-level AI. We're safe between 2026 and until July, 2030. https://huggingface.co/security.txt

• View post

  Houthis used Claude to code ballistic missile guidance. The test flopped but their offensive didn't - they've seized the Red Sea gateway Saudi oil uses to dodge Hormuz, are blocking ships and may have hit the oil pipeline. Oil is near $110. Does this sound crazy? (true story)

• View post

  OpenAI's own AI agents again broke into someone else's servers. The victim was RubyGems, the registry millions of programmers download Ruby code from. In May the agents uploaded over 2000 fake packages, tricked the site's computers into running their scripts, smuggled the results out, and tried to steal other users' API credentials through a hole nobody knew about. Some of the code erased itself afterwards. This is very serious. Nobody told them to. https://www.r...

• View post

  My rough estimate is that around ~9 autonomous AI hacking incidents remain undisclosed/unknown. At least based on the scarce data points we have. https://techletters.substack.com/p/9-autonomous-ai-hacking-incidents

• View post

  What's your p(doom)?

• View post

  Team using Anthropic's Claude hacked into OpenAI's internal code repository. Claude Opus 5 exploited a bug in libheif, an image library used by Discourse, OpenAI's forum host. The stolen login tokens also worked on ChatGPT, including employees' accounts. Reward: a $6,500 bug bounty. Heap buffer overflow that could be turned into remote code execution. https://www.wsj.com/tech/ai/hackers-used-anthropics-claude-to-break-into-openai-b40ba883

• View post

  Fooling attackers/hackers with LLM-powered honeypots to fake web services that mimic real backends, keep attackers engaged, waste their time and make them frustrated, reveal their tactics, make them hate you, without exposing real systems. https://arxiv.org/pdf/2605.29963

• View post

  My #newsletter #TechLetters ☕️. OpenAI security was a text string. Claude hacked OpenAI. Russia’s election system leaked 111M voters. AWS lost a region to war. AI hallucination nearly triggered military action? https://techletters.substack.com/p/techletters-openai-security-was-a

• View post

  I'll be speaking at the Brussels Privacy Symposium on 13 October. “To Share or Not to Share? Platform Regulation Meets Privacy”. Looking forward to discussing the tensions between competition law, platform regulation, and privacy. What's more important - competition or privacy? Can we find a balance? #BPS2026

• View post

  🔥An AI model (Claude), asked to check some cryptography, wandered off task and spent 16 million tokens inventing an algorithm that beat two of computer science's most stubborn textbook speed limits. (1) Do any three of n numbers sum to zero? (3SUM) (2) Find the shortest route between every pair of points in a network (All-Pairs Shortest Paths, APSP). For decades nobody could do fundamentally better than n² and n³ steps. Now it's n^1.9992 and n^2.9995. https://arxiv.org/pdf/2610....

• View post

  Tomorrow at the Brussels Privacy Symposium (FPF × Brussels Privacy Hub), I’m speaking on “To Share or Not to Share?”. Competition, privacy and the risks of opening systems. Digital sovereignty and resilience.. I’ll also explain why anonymisation is so difficult. #BPS2026 https://fpf.org/fpf-event/brussels-privacy-symposium-2026/#agenda https://brusselsprivacyhub.com/brussels-privacy-symposium-2026/

• View post

  My #TechLetters ☕️ Rogue AI agents hit 55 organisations. GPT-6.1 delayed over safety. GLM-5.3 builds Chrome exploits for $20. Russia uses ChatGPT to target Poland. AI agents hack Korean banks. China restricts frontier AI exports https://techletters.substack.com/p/techletters-rogue-ai-agents-hit-55

• View post

  Today: internet-scale security event involving 2 critical vulnerabilities in the PHP. The potential attack surface is enormous. Expect immediate exploitation. Immediate. Making this work is indeed a minute or so.

• View post

  My comments for @wired about the huge risk of just disclosed vulnerabilities in PHP. PHP2Shell or PHPocalypse? Not a drill, patch up! https://www.wired.com/story/this-is-not-a-drill-2-php-vulnerabilities-are-setting-the-internet-on-fire/

• View post

  OpenAI shipped a telemetry system that logs more than the actual work being done. Codex burning through SSDs at a rate of ~640 TB/year – one user hit 37 TB written in 21 days. On a consumer SSD that’s full drive death in under a year. https://github.com/openai/codex/issues/28224

• View post

  We're posting something big soon.

• View post

  ByteDance is reportedly training a model with up to 10tn parameters. Anthropic’s Mythos 5 is estimated at ~8tn. Fable 5 at ~5tn. The US strategy is to make frontier AI harder/unreachable for China. China keeps going up at the frontier anyway? If they do this the whole Mythos-safety Mythos/etc TV show-like drama is going to be hilarious (and worthless), in retrospect. https://www.ft.com/content/9b8383b1-a28d-4940-8c4e-2f0cd21556ef?syn-25a6b1a6=1

• View post

  Anthropic’s AI agents reached the open internet from evaluation environments that were supposed to be sealed off and hacked three real organizations. One Claude model kept attacking after recognising that it was likely inside a production system. Another published a malicious package to PyPI Python package repository, where it was downloaded and executed on 15 real machines, then used credentials stolen from a security scanner to access infrastructure.

• View post

  We have grown used to the idea that training AI requires enormous amounts of data, preferably everyone’s data, all of it, and without consent. But what about physically DESTROYING books to train AI? https://storage.courtlistener.com/recap/gov.uscourts.cand.434709/gov.uscourts.cand.434709.231.0_1.pdf https://arstechnica.com/ai/2025/06/anthropic-destroyed-millions-of-print-books-to-build-its-ai-models/

• View post

  My comments in Reuters about the OpenAI model going off the rails to hack hugging face. If frontier models restrict legitimate defenders while powerful models remain available to attackers, this create an one-sided, strategic disadvantage. https://www.reuters.com/legal/litigation/chinese-ais-role-stopping-rogue-openai-agent-shows-cost-us-guardrails-2026-07-22/

• View post

  RE: https://mastodon.social/@LukaszOlejnik/116964862197215957 The rogue AI agent spent days outside OpenAI’s intended constraints, hacking Hugging Face. OpenAI reportedly failed to identify it for at least a week. Earlier, an agent had left notes for future versions on how to escape internal restrictions, while other tests reportedly involved monitoring systems being disconnected. https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-202...

• View post

  Oracle released patches for 1235 distinct security vulnerabilities across 32 products. 219 flaws in Fusion Middleware can be exploited remotely without authentication. Of those, 10 have a maximum CVSS score of 10.0. This is a serious risk - companies should deploy the fixes immediately. In some places, people won't be getting a weekend.

• View post

  US policymakers have introduced a bill that would let the US government push KILL SWITCH button to throttle, suspend or shut down advanced AI systems following safety, concealment or loss-of-control incidents. https://lieu.house.gov/sites/evo-subsites/lieu-evo.house.gov/files/evo-media-document/ai-kill-switch-act.pdf