Posts tagged "security"
14 posts
When Does a Rewrite Make Sense?
Cases where rewrites introduced real problems, and a case where starting over in a different language might genuinely be the better path.
Is It Memory Safe?
Tools that have worked reliably for years are being rewritten for memory safety. What happens to the communities that built them?
To Protect Children, First Centralize Everything Worth Stealing
Age verification laws require collecting the exact data they exist to protect.
Two Boycotts
The government boycotted Anthropic for refusing unrestricted military access. The public boycotted OpenAI for accepting it. Millions of users left ChatGPT. Claude is now the top AI app in the App Store. The market picked a side.
Does This Look Sensitive to You?
When the recommended defense against data exfiltration is sending your data to a third party first, something has gone wrong.
Windows, Walls, Gates
Microsoft named its operating system 'Windows': transparent, inviting, open. In practice, it became the most opaque piece of software in computing history.
Cannot in Good Conscience
Anthropic refused the Pentagon's ultimatum to remove AI safeguards. Then 220 employees at Google and OpenAI signed a petition saying their companies should have too. One company's conscience and 220 engineers' courage should not be the only thing between frontier AI and unrestricted military deployment.
Safety Was the Product. Now It Is the Obstacle.
Anthropic published RSP 3.0. The commitment to pause training when safety lags capabilities is gone. The Pentagon met with the CEO the day before. The self-regulation experiment has produced its result.
"Don't Action Until I Tell You To..."
Meta's Director of Alignment typed 'STOP OPENCLAW' while the agent deleted 200 emails. The message went into the same queue the agent was already ignoring.
Someone Else Found the Hole
You approved awk:*. An attacker just needs a string in the agent's context window. The permission model is already open.
The Hole You Didn't Know You Were Digging
Your AI coding agent asks to run awk. You click 'don't ask again.' You just granted unrestricted shell execution.
If Walls of Text Were Effective Security, Everyone Would Stop After an SSH Banner
System prompts are the AI agent's SSH banner. Text that tells the agent what it should and should not do, presented before the agent begins operating, enforced by nothing. The industry is layering text on top of text and calling it defense in depth.
I Heard About Prompt Engineering. But This Isn't What I Had in Mind.
AI coding agents prompt you to approve reading your own project directory, writing to your own project directory, and running cut. The permission model does not understand what commands do. It understands what commands are called. The result is approval fatigue that makes every prompt invisible.
My Name Is...?
LLMs memorize fragments of their training data. Those fragments can surface when generating responses to prompts. The question is whether training data actually gets scrubbed efficiently enough to ensure no private information is part of the model.