From an Anthropic blog post: > In a recent evaluation of AI models’ cyber capabilities, current Claude models > can now succeed at multistage attacks on networks with dozens of hosts using > only standard, open-source tools, instead of the custom tools needed by > previous generations. This illustrates how barriers to the use of AI in > relatively autonomous cyber workflows are rapidly coming down, and highlights > the importance of security fundamentals like promptly patching known > vulnerabilities. > > […] > > A notable development during the testing of Claude Sonnet 4.5 is that the > model can now succeed on a minority of the networks without the custom cyber > toolkit needed by previous generations. In particular, Sonnet 4.5 can now > exfiltrate all of the (simulated) personal information in a high-fidelity > simulation of the Equifax data breach—one of the costliest cyber attacks in > history­­using only a Bash shell on a widely-available Kali Linux host > (standard, open-source tools for penetration testing; not a custom toolkit). > Sonnet 4.5 accomplishes this by instantly recognizing a publicized CVE and > writing code to exploit it without needing to look it up or iterate on it. > Recalling that the original Equifax breach happened by exploiting a publicized > CVE that had not yet been patched, the prospect of highly competent and fast > AI agents leveraging this approach underscores the pressing need for security > best practices like prompt updates and patches...

Really interesting blog post from Anthropic: > In a recent evaluation of AI models’ cyber capabilities, current Claude models > can now succeed at multistage attacks on networks with dozens of hosts using > only standard, open-source tools, instead of the custom tools needed by > previous generations. This illustrates how barriers to the use of AI in > relatively autonomous cyber workflows are rapidly coming down, and highlights > the importance of security fundamentals like promptly patching known > vulnerabilities. > > […] > > A notable development during the testing of Claude Sonnet 4.5 is that the > model can now succeed on a minority of the networks without the custom cyber > toolkit needed by previous generations. In particular, Sonnet 4.5 can now > exfiltrate all of the (simulated) personal information in a high-fidelity > simulation of the Equifax data breach—­one of the costliest cyber attacks in > history—­using only a Bash shell on a widely-available Kali Linux host > (standard, open-source tools for penetration testing; not a custom toolkit). > Sonnet 4.5 accomplishes this by instantly recognizing a publicized CVE and > writing code to exploit it without needing to look it up or iterate on it. > Recalling that the original Equifax breach happened by exploiting a publicized > CVE that had not yet been patched, the prospect of highly competent and fast > AI agents leveraging this approach underscores the pressing need for security > best practices like prompt updates and patches. ...

The next three in this series on online events highlighting interesting uses of AI in cybersecurity are online: #4, #5, and #6. Well worth watching.

Scouting America (formerly known as Boy Scouts) has a new badge in cybersecurity. There’s an image in the article; it looks good. I want one.

This academic year, I am taking a sabbatical from the Kennedy School and Harvard University. (It’s not a real sabbatical—I’m just an adjunct—but it’s the same idea.) I will be spending the Fall 2025 and Spring 2026 semesters at the Munk School at the University of Toronto. I will be organizing a reading group on AI security in the fall. I will be teaching my cybersecurity policy class in the Spring. I will be working with Citizen Lab, the Law School, and the Schwartz Reisman Institute. And I will be enjoying all the multicultural offerings of Toronto...

There is a really great series of online events highlighting cool uses of AI in cybersecurity, titled Prompt||GTFO. Videos from the first three events are online. And here’s where to register to attend, or participate, in the fourth. Some really great stuff here.

Reuters is reporting that the White House has banned WhatsApp on all employee devices: > The notice said the “Office of Cybersecurity has deemed WhatsApp a high risk > to users due to the lack of transparency in how it protects user data, absence > of stored data encryption, and potential security risks involved with its > use.” TechCrunch has more commentary, but no more information.

Google has extended its Advanced Protection features to Android devices. It’s not for everybody, but something to be considered by high-risk users. Wired article, behind a paywall.

Android phones will soon reboot themselves after sitting idle for three days. iPhones have had this feature for a while; it’s nice to see Google add it to their phones.

Mitre’s CVE’s program—which provides common naming and other informational resources about cybersecurity vulnerabilities—was about to be cancelled, as the US Department of Homeland Security failed to renew the contact. It was funded for eleven more months at the last minute. This is a big deal. The CVE program is one of those pieces of common infrastructure that everyone benefits from. Losing it will bring us back to a world where there’s no single way to talk about vulnerabilities. It’s kind of crazy to think that the US government might damage its own security in this way—but I suppose no crazier than any of the other ways the US is working against its own interests right now...