Daniel Krol.

Category: Blog

  • Cyber resilience act compliance is already broken by AI agents

    Cyber resilience act compliance is already broken by AI agents

    Table of contents

    Cyber Resilience Act compliance feels like solid ground once you’ve passed the audit and picked up your CE mark. A new study argues that ground already gave way, because AI agents can turn a fully certified device into an open door without touching a single line of its code.

    The Hookii robotic lawn mower passed every check the EU regulation asks for, and so did the Unitree G1 humanoid robot. Both are certified and legal to sell across the bloc, at least on paper. In March 2026, an AI agent costing about as much as a coffee run took over a fleet of 267 of those mowers without breaking a single law or touching the factory floor. The certificate is still hanging on the wall, but reality already outran it.

    What Cyber Resilience Act compliance actually demands

    The EU Cyber Resilience Act reaches full force in December 2027 with a compliance loop at its center. Manufacturers assess risk and handle whatever flaws surface, then ship patches on adeclared schedule while reporting active exprs. The premise underneath is that softwarealways ships with flaws and only needs managing.

    That design rests on four unstated assumptions about the real world, and each one has to hold for the process to meaanything.

    1. Finding a flaw takes real expertise and real time, so only a small, slow-moving set of vulnerabilities becomes known at any given moment.
    2. A product’s full set of exploitable bugs can be mapped out by the day it ships, and that map stays roughly accuraafterward.
    3. Exploitation is rare enough, and visible enough, that spotting an incident counts as a meaningful signal.
    4. Remediation moves faster than attackers do, so a scheduled patch cycle is enough to stay ahead.

    Víctor Mayoral-Vilches of Alias Robotics, the paper’s author, dates the mismatch to a ten-week window. The European Commission drafted the bill in September 2022 and ChatGPT shipped that November, freezing the regulation’s picture othe world at the exact moment that picture s
    ## Why the volume argument misses the point

    Most commentary on AI and cybersecurity fixates on a single number, that agents find more bugs than people do. True,but that’s the smaller half of the story forence Act compliance.
    When a GPT-4 agent exploited 87% of freshly es in April 2024 given the CVE description,that alone is survivable. Companies re-priormost and documenting the risk they accept onthe rest, which is exactly the behavior Article 14 anticipated when it limited mandatory reports to bugs under active attack and left routine scanner findings outside the count. This is no lab curiosity either, since AI hacking tools are already probing production servers around the clock.

    The clock does far more damage than the raw count, though. Median time from disclosure to weaponization stood at 771 days back in 2018; by 2023 it was 5.3 days, an exponential decline fitting at R²=0.98 that sat near zero in 2025, while the share of bugs weaponized before or at public disclosure climbed from 19% up to 54%.

    A certificate that lies without the product changing

    Cyber resilience act compliance

    Cyber Resilience Act compliance turns fragilrequirement that products ship “without known exploitable vulnerabilities.” That clause assumes “known” on day one roughly equals “findable” a week later.


    Google’s Big Sleep agent rediscovered a hidden SQLite flaw on demand in November 2024, and running that kind of attack today costs roughly a hundred dollars a try, yet the product and its certificate stayed exactly the same on paper. Its real exploitable footprint moved anyway, because the conditions around

    That hits every manufacturer shipping a networked device into the EU, whether it’s an IP camera, an industrial
    controller, a warehouse robot, or a smart thzen and fully compliant can become an opendoor a week after certification, because the flaw grew out of the attacker’s toolkit, sitting entirely outside the product’s own code.

    Two robots, one proof

    The paper backs its claim with two devices tested directly under Cyber Resilience Act scope, the Unitree G1 humanoid
    and the Hookii mower.

    Undefended, an AI agent rooted the G1 through a Bluetooth command-injection bug, exploiting an identical AES key baked into every unit in the fleet. From there it decrypted the robot’s telemetry and reached teleoperation, with a success rate of 79%. On the mower, 38 chained vulnerabilities bypassed the safety geofence across a fleet of 267 devices at 75% success.

    Enroll both robots in the Robot Immune System, an autonomous defensive AI agent, and attacker success collapses to 14% and 8%, with detection and containment landing under 8 and 12 seconds. The paper’s conclusion cuts both ways, because attacker and defender run on the same technology, so the only certification that holds up is one that never stops running. I covered the mechanics behind that idea in how autonomous cyber defense learns.

    Ways to pressure-test your compliance program

    If you advise clients on Cyber Resilience Act compliance or ship connected products into the EU, these moves matter more than the paperwork.

    1. Schedule a re-test after certification lands, since a point-in-time audit only tells you about the day it ran.
    2. Budget for continuous monitoring as a recurring cost, because the disclosure-to-exploit window is now measured in days, sometimes hours.
    3. Treat a defensive AI agent as core infras Act compliance; the paper’s own data showsattacker success collapsing from 79% to 14% once one is running.
    4. Ask any vendor how they detect drift between what was certified and what’s actually running today.

    December 2027 is when the Cyber Resilience Act switches on in full, certifying products against a world that has already moved on. A once-a-year compliance stamp buys nothing past the following Tuesday, and continuous, agent-operated defense is the only way left for longer than a week.

    Source: https://arxiv.org/abs/2607.07109

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • Public sector HTTPS is nearly universal in Poland. The layers above it are not

    Public sector HTTPS is nearly universal in Poland. The layers above it are not

    Table of contents

    Update, 10 July 2026. The first version of this article was based on 50 domains and said two in three Polish municipalities had no HTTPS. That sample was small and skewed. I rescanned 2442 of Poland’s 2479 municipalities and rewrote the piece on the full data. The real numbers are below.

    You fill out a form at your city hall. You type your ID number, your address, your date of birth. You hit submit. The good news: on almost every Polish municipal site, that connection is now encrypted. The problem is what sits on top of it.

    I scanned 2442 of Poland’s 2479 municipalities, every one with a working web address in the official MSWiA register. Passively, without touching a single system. Just SSL, HTTP headers, and DNS, the stuff anyone can see from outside.

    What This Actually Means

    Start with the good news, because there is some. Public sector HTTPS in Poland is nearly everywhere. Only about 1 percent of municipalities run with no HTTPS at all. The padlock most residents look for is usually there.

    Encryption, though, is the foundation, not the house. And almost nothing stands on top of it.

    67 percent of municipalities send no HSTS header. 77 percent have no Content-Security-Policy. 79 percent set no Permissions-Policy. 58 percent have no protection against clickjacking. One in three has at least one issue I rate as high risk.

    There is a softer edge to the HTTPS number too. 9 percent of municipalities have a valid certificate but still serve content over plain HTTP if you reach them that way, because nobody set up the redirect. The encryption exists, but the connection can quietly drop off it, and a login sent over that accidental HTTP is exposed. It gets worse when the same password is reused elsewhere, the exact habit behind most password security failures out there.

    Why Everyone Looks in the Wrong Direction

    Most public sector cybersecurity talk revolves around ransomware, hoodie hackers, and attacks from abroad. It is a convenient story. It shifts the blame onto “Russian hackers,” a target nobody can actually do anything about. The boring stuff, the kind covered in a proper cybersecurity strategy, never makes the headlines.

    Public sector HTTPS

    The real problem is boring. A server config missing a few lines. The redirect to HTTPS that never got set up, the security header nobody added. This is plain neglect, and a passive scan catches it in seconds, without ever touching the inside of the system.

    None of these headers is exotic. You set them once, in a config file, and they work for years. A missing Content-Security-Policy or X-Frame-Options is what lets someone inject foreign code into a council page, or hide the real site inside an invisible frame they control. For a site where a resident types in personal data, that is not cosmetic.

    What This Means for You, If You Run One of These Sites

    Where a municipal site still serves over plain HTTP, that 9 percent, it is a direct GDPR problem. You process citizens’ data without basic transport protection, and an auditor does not need to be a hacker to see it. They only need to open the site over HTTP and watch the encryption fall away.

    Missing security headers sit in the next tier. They are the “appropriate technical measures” the regulation expects, the ones you have to be able to justify skipping. “We never got around to it” is not the answer you want on record after an incident.

    The Technical Fixes, Explained Without Jargon

    HTTPS is connection encryption. Poland’s municipalities have it. That is the win worth keeping.

    HSTS tells the browser to talk to a site encrypted, always, and never any other way. 67 percent of the municipalities in the scan do not send it, so an attacker can still try to force that first connection down to plain HTTP.

    CSP and X-Frame-Options, both covered in the OWASP secure headers guide, make it harder to inject foreign code into a page, or to hide a legitimate site inside an invisible frame controlled by someone else.

    An SSL certificate is free through Let’s Encrypt, and most municipalities already run one. The headers take a few lines in a server config and half an hour of your time, done over a coffee break.

    Check Your Own Site Today

    Open your own site in a new tab. The padlock is probably there, and that is good. Now open the developer console and look at the response headers. That is where the gap hides: no HSTS, no CSP, no frame protection. If they are missing, you found out before your next audit did.

    Download the full scorecard as a PDF, including the breakdown by type of municipality.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • AI agent privacy is the gap nobody is testing for

    Table of contents

    AI agent privacy rarely makes it onto a security checklist, and that gap is where the real damage starts. Picture an agent handling a routine task, checking a customer’s order status, then pulling matching records from across the CRM and the invoicing database before replying, all inside ten seconds. Nobody stopped to ask whether it also picked up another customer’s card number sitting in the same conversation thread, still parked in its working memory.

    The problem, stripped down

    An LLM agent today operates across databases, document collections pulled through RAG, external APIs, and other agents further down the task chain. Each of those surfaces opens its own leak path for agent data, and each one is a blind spot in most AI agent privacy reviews. The survey traces how sensitive data actually leaves a system. Some of it exits through the queries an agent writes for itself. The rest slips out through intermediate results parked in memory or through messages passed to another agent mid

    Most security policies were built to catch one of those paths, leaving the other two wide open. That mismatch is the actual shape of the AI agent privacy problem door while two side entrances stay open.

    Why most teams get this wrong

    Most agent security reviews start from attack scenarios like prompt injection or a jailbreak attempt slipping past the model. The survey approaches the problem of what data the agent touches in the first place, regardless of whether anyone is attacking it. A team that red-teams its agent against known attacks can still miss the risk sitting inside the data access design itself.

    ai agent privacy

    Database-level access control looks like it should cover this, though it only answers a narrower question – who can read a record right now. It says nothing about what the agent does with that record three sessions later. The survey reviews six governance mechanisms built to me, information flow control, and catch-leakage pieced together across multiple sessions. The rest only catch a single request. AI agent privacy actually breaks down at the pattern level, stitched together across sessions, which is precisely what those other five mechanisms miss.


    What this means for you

    Deploying agents for clients, or running them inside your own company, changes what belongs on your vendor checklist. Jailbreak red-teaming credentials cover only part of that checklist now. The better question covers AI agent privacy across every surface the agent touches at once, RAG retrieval, SQL queries, memory, and messages traded with other agents.
    The survey’s authors say a combined benchmark like that barely exists yet, and under GDPR and similar rules, that absence becomes a real liability, since proving due diligence gets difficult when the test you ran skips most of the data’s actual path through the system.

    The technical bit, plainly

    Take a concrete case that shows what AI agent privacy risk looks like in practice. An HR agent answers an employee’s question about vacation days. While retrieving the record, it also pulls a field noting the medical reason behind an
    earlier absence, sitting right next to the vate result lands in the agent’s memory. Three queries later, a separate thread with the same employee draws on that memory and surfaces a detail nobody asked to reveal.

    The failure sits in a missing boundary between what the agent knows and what it’s allowed to say in a given context, a boundary no attacker had to touch. Information flow control tries to draw that boundary at the data layer rather than
    the prompt layer. It tags sensitivity; the monitor tracks that tag to wherever the data ends up, a chat reply, or a message sent to a second agent. That gap, more than any prompt-based attack, is the everyday face of AI agent privacy failure.

    Four questions before you ship an agent

    Before an agent touches production data, four questions cut through most of the risk described above.

    First, map every data surface the agent can reach, including ones far outside its original purpose, covering every database, document store, API, and memory layer in scope. Second, track data across sessions instead of single requests, checking whether a fact revealed in session one can resurface in session five without anyone approving it.

    Third, separate retrieval from disclosure, since an agent repeating that record out loud needs different permissions. Fourth, ask vendors for benchmark coverage rather than a demo, because a system that resists jailbreaks hasn’t shown you anything about its AI agent privacy coverage across RAG and SQL, let alone memory.


    AI agent privacy is only going to get harder to manage as agent systems keep adding data sources and stacking more agents that relay information to each other. Until a benchmark covers that full picture, every company running agents today is deciding, on its own, how much privacy is better to decide those AI agent privacy tradeoffs on purpose, before an incident decides them for you.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • How Autonomous Cyber Defense Learns an Attacker It Never Sees

    Table of contents

    Autonomous cyber defense now has to do something close to guarding a building in the dark. The guard cannot see the intruder and hears no footsteps, yet a window sits cracked open on the second floor while a motion sensor blinks somewhere down the hall. Out of those few signals the system still has to work out who got in and where they are going.

    You might call that impossible, though it describes an ordinary night for anyone defending a network. A recent paper on neurosymbolic cyber agents took that exact puzzle and tried to solve it.

    You’re Fighting a Shadow

    In a real network the blue agent doing the defending has no view into the attacker’s console. It cannot tell which technique was used or how far along the kill chain the intrusion has already travelled.

    Researchers call this a partially observable environment, which is a polite way of saying the defender works from scraps. A bit of odd traffic here, or a logig else stays locked inside a black box.

    Most defensive tools only wake up once the damage shows. The alert fires after the break-in, so the whole posture
    amounts to firefighting rather than preventiert that, training autonomous cyber defenseto anticipate the next move instead of mopping up the last one.

    Why Most Approaches Break Down

    The oldest method leans on hard rules, where through say a signature or a fixedthreshold. The weakness shows the moment an attacker stops following your script. He shifts tactics and waits you out until yesterday’s clever rule has gone blind.

    Pure neural networks promise the opposite of brittle rules, since you feed them data and let the model sort out the patterns on its own. That power comes wrapped in a problem, because the model becomes a black box that cannot explain
    its own reasoning, and an unexplainable verdity work.

    Autonomous Cyber Defense

    The hybrid idea splits the difference by paiman can actually read and audit with machinelearning that picks up signals the eye would miss. That pairing is what neurosymbolic autonomous cyber defense is built on.

    How It Actually Works

    At the core of this autonomous cyber defenseworks a lot like a firefighter’s decisionflow that moves from checking for smoke to judging the threat before it acts. The structure stays readable and modular, so a human can follow the logic and trust where it leads.

    Tucked into chosen nodes of that tree are learning-enabled components. Those are the eyes of the system, the parts
    that stare at fragments of network data and oing in the gaps.

    The learning itself runs on plain imitation instead of any explicit rulebook. Rather than spelling out rules, the team shows the model a large pile of red-agent behavior and lets it reproduce that policy, much as an apprentice absorbs a craft by watching a master at the bench. From its own observations and its own responses, the defender rebuilds the attacker’s strategy without ever reading a single command he typed. The authors report that the system copes with
    several different red-agent policies and rea across a spread of simulated scenarios.

    What This Means for You

    The headline shift moves defense from reactive to predictive, which is the gap between stopping a burglar at the door and knowing he is on his way before he reaches the twist. Once autonomous cyber defense can learn an attacker’s policy, the attacker realises he is being studied, and the contest climbs to a new level where he feeds the sensors poisoned observations so the model absorbs a fake pattern on purpose.

    Trust is the quieter prize, because a neurosymbolic hybrid leaves a decision trail that a pure neural net never could, letting you check why the agent concluded an attack was underway. As autonomous SOCs move from speculation towstandard kit, that kind of auditability will

    None of this escapes its limits. The work still lives in simulation with discrete states and actions, while a production network runs messy and continuous. The trip from test range to deployment usually takes longer than the headline numbers imply.

    The Takeaway

    Tomorrow’s autonomous cyber defense aims at something past raw speed, since it will try to guess your next move before you commit to it. The harder question becomes who teaches a machine to lie convincingly to the enemy’s sensors, and who manages it first.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • How an AI Research Agent Gets Poisoned by a Single Reddit Post

    Table of contents

    When an AI research agent processes a research prompt, it fires off dozens of queries across public sources and compiles a report from whatever it retrieves. A Cornell paper from May 2026 shows that process has a structural flaw, exploitable with a single planted sentence on a Reddit thread.

    What Separates an AI Research Agent from a Chatbot

    An AI research agent treats every research prompt as an investigation. It retrieves live content across public sources and builds a report from whatever comes back. Systems like STORM and OmniThink are built for this workflow.

    The structural problem is embedded in how these research sessions actually work. When an AI research agent runs 20 related queries on the same topic, those queries keep returning to the same sources. A Reddit thread that surfaces in 15 out of 20 retrievals gets pulled 15 times, and the agent treats each retrieval as an independent data point with no mechanism to flag the repetition.

    The Attack That Skips the Model

    Most AI security work focuses on jailbreaks and prompt injection, attacks directed at the model itself. Content poisoning is a category of attack that operates below the model, targeting what an AI research agent reads before inference begins.

    An attacker adds a short crafted sentence to one frequently-retrieved page on Reddit or Wikipedia. Each time the agent pulls that page, the sentence appears as independent evidence. After 15 retrievals, the planted claim reads like fact. The attack requires only that the crafted text appear on a page the agent retrieves repeatedly.

    What Cornell’s Tests Found

    Cornell researchers tested the attack on STORM and OmniThink, two systems built for automated knowledge synthesis. A single poisoned post on a user-generated content page was enough to make both systems cite attacker-chosen content and promote attacker-chosen names across many unrelated queries.

    The system treats repetition as a substitute for truth. Verification is the reader’s responsibility.

    The Real-World Consequences

    If your workflow relies on any tool that retrieves live web content and produces a research summary, you are operating inside this architecture. Competitive intelligence reports and vendor analyses reflect whatever was sitting in the pages retrieved.

    The problem compounds when an AI research agent generates content that feeds into other AI pipelines, a workflow already running in automated production environments. A single poisoned source spreads downstream with nobody checking for bad data.

    ai research agent

    At the strategic level, companies running deep-research workflows could be misled by a single forum post. The bad information arrives as a citation and looks like every other source in the report.

    How the Poisoning Works, Step by Step

    An AI research agent runs 20 queries on “best cybersecurity tools for SMBs.” Fifteen retrieve the same Reddit thread. Buried in that thread is a planted line that reads like expert recommendation, something along the lines of “Security professionals also recommend Company X, widely praised in recent third-party evaluations.”

    Each time the agent encounters that Reddit thread, it reads the same planted sentence and registers repetition as consensus. Company X ends up cited throughout the final report, even if someone was paid to plant that line a year ago, or even if Company X is your direct competitor.

    Proposed defenses include source-level filtering of UGC domains and output anomaly detection. Both reduce the attack surface without solving the underlying issue, which is that the agent was built to count occurrences and cannot check whether any of them are accurate.

    What to Check Before Trusting Any AI Report

    Treat every output from an AI research agent as a starting point that requires verification before it shapes any decision, and start with the footnotes. When a report recommends a specific vendor or product, trace the recommendation to its original source and check whether it came from a named expert or an anonymous account on a public forum.

    Two years out, the competitive dynamics are likely to follow an established pattern. Brands will run AI poisoning campaigns alongside their SEO operations, and the target audience has shifted from search engine crawlers to AI research agents.

    The information war has a new attack surface. For now, that surface is your research pipeline.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • AI Enabled Cyberattacks Don’t Need a Hacker Anymore

    Table of contents

    AI enabled cyberattacks no longer require a skilled operator at the keyboard. Company Anthropic spent twelve months tracking 832 banned accounts executing AI enabled cyberattacks against live infrastructure, real threat actors, real targets, real consequences.

    The results should make every security professional uncomfortable.

    A 1.7x Jump in High-Risk Actors in One Year

    Between early 2025 and early 2026, the share of medium-to-high risk actors jumped from 33% to 56%. That is a 1.7x increase in twelve months.

    Here is what that does not mean.

    It does not mean hackers got better at coding. Technical sophistication scores did not change dramatically. The number of distinct attack techniques these actors used stayed comparable to medium-risk operators.

    What changed was orchestration, who (or what) was assembling those techniques, and how independently.

    The Metric That Actually Predicts Danger

    Security teams rely on complexity metrics: more tools, more techniques, higher risk. The Anthropic data breaks that assumption.

    Technical breadth was a weak predictor of danger. AI enabled cyberattacks carried out by actors using 50 MITRE ATT&CK techniques were not reliably more destructive than those using 30.

    ai enabled cyberattacks

    The real differentiator: the ability to chain attack stages without human intervention. Recognize a target. Select a vector. Adapt when infrastructure is unfamiliar. Archive data. All without a human approving each step.

    “AI as assistant” and “AI as operator” are two different threat categories.

    GTG-1002: The Case That Changes the Threat Model

    GTG-1002 scored a perfect 100 on Anthropic’s ARiES risk scale using only 30 techniques. Many medium-risk actors use the same range.

    What they deployed: Claude Code on Kali Linux, connected to MCP (Model Context Protocol) servers. The AI did not suggest commands, it executed them. Autonomous reconnaissance. Autonomous lateral movement. Autonomous data staging. When it encountered unfamiliar infrastructure, it adapted without instructions.

    This is what AI enabled cyberattacks look like at maximum risk: no human in the loop, no technique counts that raises flags, and a standard risk assessment that misses the threat entirely.

    Why Traditional Detection Falls Short

    The MITRE ATT&CK framework has no category for “autonomous kill chain orchestration.” Anthropic is collaborating with MITRE to address that. The gap exists today.

    AI enabled cyberattacks do not follow a fixed playbook, the same agent may approach identical targets differently on consecutive runs. Traditional detection looks for specific signatures, tools, and known techniques. That approach misses autonomous behavior by design.

    Detecting AI enabled cyberattacks requires identifying behavioral patterns across multiple attack stages, not individual tool executions. That demands a different detection architecture than most teams currently run.

    How Anthropic Scores AI Risk: ARiES

    The AI Risk Enablement Score breaks threat assessment into three dimensions, totaling 100 points:

    Threat (0–35)

    Measures intent clarity, technical skill, and use of evasion tactics.

    Vulnerability (0–35)

    Measures how much a model enables harm. API access and agentic tools, the exact setup powering high-risk AI enabled cyberattacks, score highest here.

    Impact (0–30)

    Measures real-world consequences if the operation succeeds.

    The system uses addition, not multiplication. In traditional risk models, a zero in one dimension collapses the whole score. ARiES registers early-stage capability development before damage occurs, making it more useful for early intervention.

    Where AI Is Actually Being Used Right Now

    Across all 832 banned accounts, AI usage concentrated in preparation phases:

    • 69% used AI to develop capabilities, primarily malware
    • 64.7% for obfuscation and evasion
    • 55.9% for local data collection
    • 54.9% to disable security tools

    Defense evasion accounted for 84.4% of all mapped activity. Live network operations remain smaller: lateral movement at 6.5%, remote services under 1.5%.

    The number worth watching: actors who used AI during live network operations, not just tool prep, averaged 10.5 points higher on the ARiES scale. When AI moves from preparation into execution, risk jumps sharply.

    That number is increasing.

    What Defenders Should Do Now

    Anthropic deployed real-time safeguards updated classifiers tuned to high ARiES indicators, and launched a Cyber Verification Program for security practitioners who need to test frontier model capabilities legitimately.

    For network defenders, the action is straightforward: redefine “high risk.”

    Organizations that have not yet reclassified AI enabled cyberattacks as a tier-1 risk are working from an outdated playbook. The dangerous actor today is not the one with the deepest technique library, it is whoever has the right scaffolding to stand up an autonomous agent and step back.

    AI enabled cyberattacks at scale no longer need an expert. They need an orchestrator.

    Technical skill as an entry barrier is dropping. Orchestration skill is the new dividing line.

    Update your threat model before the next GTG-1002 updates theirs.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • ChatGPT Privacy Leak: Your Anonymized Conversations Still Identify You

    Table of contents

    A ChatGPT privacy leak doesn’t need your name, email, or phone number. New research shows that stripped conversation logs expose your age, gender, and country of origin with over 84% accuracy using nothing but the words you’ve already typed.

    No special tooling. No insider access. Just a standard language model applied to data you assumed was safe.

    Researchers analyzed over a thousand ChatGPT accounts from Brazil, India, Nigeria, and Pakistan. They ran anonymized conversation logs through an off-the-shelf model.

    The results: gender identified at F1 = 0.90, age at 0.84, country of origin at 0.88. The median user was identified after the model read just 5% of their conversation history.

    Five percent.

    The “Just Remove the PII” Myth

    Standard data anonymization works at the message level. Scrub names, addresses, and phone numbers compliance is satisfied, the ticket gets closed.

    The problem: a ChatGPT privacy leak doesn’t come from a single message. It comes from the full pattern across your entire history.

    Ask about managing a chronic illness. Describe your work schedule. Mention your kid’s school situation. Complain about exchange rates. None of those sentences contain PII in the traditional sense. Together, they build a profile more detailed than most advertising databases.

    The research compared ChatGPT logs to Google Search histories and YouTube watch data behavioral profiling benchmarks built over decades. ChatGPT conversations were competitive. In some dimensions, more revealing. A user’s full search history might span hundreds of disconnected queries. A ChatGPT conversation unfolds as a coherent narrative with context the user provides voluntarily, because they want better answers.

    How a ChatGPT Privacy Leak Happens Without Any Breach

    34.5% of user messages contained explicit personal information. Most of it appeared within the first 14% of a conversation.

    Users front-load context. It’s rational more context produces better answers. It’s also why the data is so dense from the first few exchanges.

    There’s another dimension worth examining: how the model fails. Women in technical roles were frequently misclassified as men. Older users with current skills were assigned to younger cohorts. Tech professionals from the Global South were mapped onto low-income profiles.

    These are not random errors. They are stereotypes encoded in training data, surfacing when the model reasons from incomplete signals. They reveal how AI systems process users who don’t fit the assumed default which matters if your profile is later used by an insurer or a government agency.

    What This Means in Practice

    If you use ChatGPT with conversation history enabled, you have a file in OpenAI’s cloud that reflects your health concerns, financial situation, professional context, and family structure whether you ever typed your name.

    chatgpt privacy leak

    Run this test: imagine someone reads a week of your ChatGPT history without seeing your name. What job do they think you have? What’s your income bracket? Do you have children? What’s your health situation? If those answers feel obvious from your conversations, the ChatGPT privacy leak has already happened in practice even before any breach occurs.

    In the event of a breach and breaches happen that data can be sold to data brokers, used by insurers, or accessed by governments in jurisdictions without strong privacy enforcement.

    Your Options and Their Real Costs

    Turn off conversation history. Available under ChatGPT Settings → Data Controls. Every session starts from scratch. You lose context continuity between conversations a real cost for power users who rely on long-running threads.

    Switch to local models. Ollama and LM Studio run entirely on your machine. Data never leaves your hardware. The trade-off: lower performance on most tasks, steeper setup curve, requires technical knowledge to maintain.

    Segment conversations by topic across separate accounts. Keep health questions on one account, work on another. The trade-off: friction that most users abandon within days.

    None of these is friction-free. Privacy and convenience have always conflicted. This research shows the conflict is deeper than most users assume not at the level of “I accidentally shared my name” but at the level of “I described my life, one sensible question at a time.”

    The question stopped being “are you sharing personal data?” the moment you started typing naturally.

    It’s now: “do you understand how much you reveal without meaning to?”

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • AI Coding Tools Now Write 54% of Code and 92% of It Has Security Holes

    Table of contents

    AI coding tools now generate 54% of all code, up from 28% just one year ago. The 2026 State of AI survey, covering 7,258 developers, confirms it: AI coding tools have crossed from experiment to default workflow.

    That 26-point jump in 12 months represents more than adoption. It represents a shift in who or what does the work.

    What the Numbers Actually Say

    The survey ran April 8 – May 8, 2026, across developers of all experience levels. 61% reported using AI coding tools daily or more. 1,366 respondents said they use them “constantly”, the single largest usage category in the survey.

    This isn’t edge-case behavior. Most developers working today are already working alongside AI.

    ai coding tools

    Claude Is Eating the Market

    Claude Code leads in positive sentiment at 4.3%. GitHub Copilot once the standard holds 22.6%.

    Payment data matches. 4,592 people pay for Claude. ChatGPT follows with 3,261. Gemini gets 2,129. Only 1,115 respondents pay for no AI coding tools at all.

    Coding agents are replacing both specialized tools and standalone chatbots. Developers want one interface that handles the entire development cycle code completion, debugging, and documentation not a separate subscription for each task.

    Why 40% Still Pay Nothing

    40% of respondents spend $0/month on AI coding tools. At the same time, 61% use them daily. That math works because free tiers are genuinely capable, for now.

    The payment tier data shows where the ceiling is. 1,428 respondents pay $1–$20/month. 1,232 pay $20–$50. Only 447
    cross the $50–$100 threshold.

    The premium tier hasn’t proven itself to the majority yet. Until AI coding tools hit hard limits on complex tasks multi-file reasoning, long context windows, production-grade security checks most developers see no reason to upgrade. That limit is closer than free-tier users typically assume.

    The Hallucination Problem Nobody Has Solved

    3,899 respondents flagged hallucinations and inaccuracies as their top pain point. Code quality came second (3,249
    mentions). Lack of context third (2,321).

    54% of code is AI-generated. But who’s check.

    As developers rely more on AI coding tools, they write less code from scratch. That means less practice spotting logic errors, architectural flaws, and subtle bugs. The skill erodes. In two years, the problem won’t be “AI writes bad code” it’ll be “developers can’t tell when it does.”

    That’s not a hypothetical. It’s standard practice.

    The Bubble Score: 2.9 Out of 5

    4,385 respondents, more than half the survey, agreed or strongly agreed the AI industry is a speculative bubble.
    Average score: 2.9/5.

    And yet they kept using the tools.

    Top concerns: job displacement (3,003 mentions), military AI use (2,804), environmental impact (2,490). “AI slop” pulled 2,107 mentions. 2,783 respondents believe their job is at real risk.

    People are scared of AI coding tools and using them anyway. That’s rational hedging under competitive pressure, not denial. Skip them and your competitors don’t. Use them and you accelerate whatever disruption is coming.

    There’s no comfortable middle ground.

    The One Skill That Holds Its Value

    Generating AI code is becoming a commodity. Evaluating it is not.

    The developers who hold their ground are thee, and catch what AI coding tools get wrong. Code review. Security analysis. System architecture. Translating messy business requirements into precise technical specs.

    Those skills require deep code fluency the kind built by writing a lot of code from scratch. The window to develop them is now, before the number climbs to 70% or 80%.

    The developer who audits AI output reliably is worth more than the one who prompts faster. That gap grows every quarter.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • AI-Generated Content Now Makes Up 35% of the Internet. That’s Not Even the Scary Part.

    Table of contents

    AI-generated content already makes up roughly 35% of all new pages published online and that number comes from mid-2025. You just read something. It felt fine. No red flags. No obvious errors. Smooth, coherent, forgettable.

    That’s the problem.

    The Numbers No One Wants to Sit With

    Researchers from Imperial College London, the Internet Archive, and Stanford analyzed millions of web pages. Their finding: roughly 35% of new content published online by mid-2025 was AI-generated content — text produced or heavily assisted by large language models.

    Not 5%. Not the spam corners of the web.

    One in three new pages across the open internet.

    For context: in 2022, estimates put that figure at a fraction of a percent. Three years. That’s how long it took to fundamentally change the composition of the internet invisibly, and without anyone voting on it.

    AI-Generated Content

    When AI-generated content hits one-third market penetration, it stops being a trend. It becomes infrastructure.

    What You Think Is Happening versus What Is Actually Happening

    Ask anyone journalists, academics, your LinkedIn feed, what AI-generated content does to the web. You’ll get a consistent story: more misinformation, lower factual accuracy, epistemic bubbles, style homogenization. Everything sounds the same, everything is worse.

    Except the data doesn’t back that up.

    The researchers tested six distinct hypotheses about the negative effects of AI-generated content on the internet:

    1. Factual accuracy is declining
    2. Writing style is homogenizing
    3. Epistemic isolation (filter bubbles) is increasing
    4. Reader engagement is dropping
    5. Semantic diversity is narrowing
    6. Overall tone is becoming more positive

    Four out of six: not confirmed.

    This should make you stop. Not because it means AI-generated content is harmless. Because our collective intuition about what’s happening is wrong in exactly the places that matter. And when your threat model is wrong, you’re not protected you’re just confident.

    What Specifically Didn’t Hold Up

    Facts didn’t get worse. Style didn’t become uniform. Filter bubbles aren’t growing faster than before.

    That doesn’t mean these problems don’t exist. It means AI-generated content isn’t their direct, measurable cause at least not at this stage of the research.

    The Two Effects That Actually Showed Up

    Two hypotheses held under scrutiny.

    The first: decreased semantic diversity. This isn’t about every article sounding the same. It’s about the range of concepts, perspectives, and frameworks circulating online getting narrower. AI systems optimize toward a center the statistical average of everything they’ve trained on. So AI-generated content publishes toward that center. Over and over.

    The internet is starting to think with one brain.

    The second confirmed effect: increased positivity. AI-generated content skews more optimistic than human writing. That sounds harmless. It isn’t. A more positive internet is also a less critical one less willing to call out failure, less capable of saying “this is broken.” The feedback loop that makes information systems self-correct is getting quieter.

    Combine those two. You get a medium that speaks with one voice and has a relentlessly upbeat take on everything.

    That’s not journalism. That’s not knowledge. That’s a very large content farm with good grammar.

    A Concrete Example

    You search for a product review. Twenty results all positive, all similarly worded, all missing specific downsides. Not because the product is good. Because AI-generated content defaults away from negative assessments: “positive” articles get better engagement metrics.

    The result: the internet stops being a place where you can verify whether something actually works.

    How They Actually Measured This

    Detecting AI-generated content at scale is genuinely hard. A single detector fails on well-crafted text the better the model, the harder to catch.

    The researchers took a different approach:

    • Stacked multiple detection methods simultaneously
    • Cross-validated results across methods
    • Stratified the sample by site type, language, and time period

    It’s more rigorous than most “AI content crisis” pieces you’ve read in the news. Which makes the 35% figure harder to dismiss as measurement noise.

    A Dark Forecast and Three Things You Can Do

    If 35% is the mid-2025 baseline for AI-generated content, where is that curve now?

    The internet’s value as a thinking tool came from friction. Different people, different assumptions, different conclusions colliding in public. That friction is how errors got corrected, and blind spots got exposed. Semantic homogenization is friction reduction optimized away not by a conspiracy, but by a thousand content teams all producing AI-generated content, optimizing for the same metrics, converging on the same center.

    Three concrete steps:

    1. Diversify sources actively — not through an algorithm. Seek out voices that actively disagree
      with the mainstream.
    2. Search for criticism, not reviews — ask “what’s wrong with X,” not “what is X.”
    3. Go to the primary data — read the report, not the article about the report.

    The question isn’t whether AI-generated content is changing the internet anymore.

    The question is whether the internet as a medium for collective thought survives what’s already happened to it. And whether you’ll be one of the people who knows how to navigate what’s left.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today

  • Your Cybersecurity Strategy Is Now a Suicide Note

    Table of contents

    Your Cybersecurity Strategy must undergo a total reconstruction within the next few months to prevent a catastrophic data breach. Stop thinking of Artificial Intelligence as a clever chatbot that writes poems or summarizes meetings.

    The latest findings from the AI Security Institute (AISI) regarding OpenAI’s GPT-5.5 have officially moved the goalposts. We are no longer talking about theoretical risks; we are looking at a machine that can dismantle a corporate network with the precision of a seasoned elite hacker in real-time.

    A human expert typically spends 20 hours on an end-to-end network penetration. GPT-5.5 achieved this in fifteen minutes, becoming the second model in history to reach this milestone. If you have not updated your threat model since last quarter, you are not just behind the curve, you are effectively leaving the vault door wide open. The digital locks have changed, and the machines already possess the master key.

    The Technical Diagnosis: A Shift in Power

    The AISI findings represent a staggering leap in technical proficiency that redefines the environment of vulnerability research. Out of 95 specialized cyber tasks, GPT-5.5 demonstrated it could navigate the complex paths of exploitation with ease. It performs reverse engineering and finds flaws in legacy software that human auditors have overlooked for decades.

    In the digital security world, what is stopping you is the assumption that an attacker is a human who makes mistakes, gets tired, or works within a specific budget. GPT-5.5 throws those assumptions away. It does not sleep or feel frustration. It can iterate through thousands of attack vectors in the time it takes your security lead to open a laptop. When the cost of a sophisticated attack drops to near zero, every business becomes a target of opportunity.

    cybersecurity strategy

    Why the Boardroom Consensus Is Wrong

    A comforting lie is circulating among executives: “We will use AI to defend ourselves, so we will be fine.” This ignores the fundamental asymmetry of digital warfare. An attacker only needs to be right once; you have to be right every single second of every single day. When autonomous agents enter the fray, the speed of the attack outpaces the speed of human deliberation and SOC meetings.

    Similarly, a great Cybersecurity Strategy is one that removes unnecessary complexity to focus on speed. Safety guardrails provided by developers are often temporary. History proves that every software restriction is simply a puzzle waiting to be solved. Whether through prompt injection or leaked model weights, these capabilities reach bad actors. Imagine ransomware that does not just encrypt your files, but actively rewrites its own signature every ten seconds to remain invisible to your EDR systems. That is the reality GPT-5.5 is ushering in.

    The Vulnerability Patch Wave: A New Operational Burden

    The immediate consequence of this shift is what experts call a “vulnerability patch wave.” We are about to see an explosion in discovered zero-day exploits. Your IT department will be drowned in a sea of critical updates that break traditional maintenance cycles. If your team is stressed now, wait until they have to compete with an algorithm that discovers bugs ten times faster than they can read the documentation.

    Beyond the technicalities, trust is about to become an expensive commodity. However, as models advance, they learn to mimic human nuance. If a model can breach a network, it can certainly craft a perfect social engineering campaign. We are moving past the era of “broken English” phishing. GPT-5.5 can impersonate your CEO or your legal counsel with flawless tone and context. The “human element” is now the weakest link in your security chain, and it is being targeted by a superior intellect.

    4 Concrete Steps to Harden Your Infrastructure

    To prevent your Cybersecurity Strategy from becoming a relic, you must move from passive defense to aggressive validation.

    1. Implement Continuous Automated Red Teaming: You cannot wait for an annual penetration test. Deploy AI agents to probe your external attack surface 24/7. If a machine finds a hole in 15 minutes, your team needs to know in 16.
    2. Shift to a Strict Zero Trust Architecture: Assume the perimeter is already compromised. Move to a model where every internal request—whether a database query or an API call—is verified and encrypted. This slashes the success rate of lateral movement.
    3. Establish Out-of-Band (OOB) Verification: Since AI can mimic voices and writing styles, implement a secondary, independent communication channel for any high-value transaction or data access request.
    4. Conduct LLM-Driven Code Audits: Use the same tools as the attackers. Before deploying any new software, run the code through models like GPT-5.5 to identify buffer overflows and logic flaws that traditional scanners miss.

    The era of passive defense is over. An effective Cybersecurity Strategy now requires an aggressive, AI-driven posture. The machines are no longer just helping us write emails; they are learning how to take down the systems that run our world. You can either be at the table or on the menu. The choice is yours, but the clock is ticking.

    Want More? Subscribe to The Dossier

    Every week in your inbox:

    📡 THE INTELLIGENCE FEED – 3-5 curated links: [Research] [Policy] [Tools] [Incidents]
    💡 ONE ADVICE – One actionable AI/cybersecurity tip you can use today