Schneier on Security
npub1kdkgu6a3vgk4kscaglm8p97m5q77gsxtp050dxjf52vqgn90mfms9fyseh@drss.io
Follow into
Another Historic Cipher Falls to AI
Save into
5 Oct 2026
This one (https://carter.church/writeups/the-letter-to-marmont/#war) is from 1809, written by Napoleon’s nephew.
Friday Squid Blogging: EU is Trying to Fight Unregulated Squid Fishing
Save into
2 Oct 2026
The EU is recommending (https://thefishingdaily.com/latest-news/eu-outlines-measures-to-tackle-unregulated-squid-fishing/) import controls to combat unregulated squid fishing in the Southwest
Unidentified Flock Cameras in Florida
Save into
2 Oct 2026
St. Lucie County in Florida discovered (https://www.washingtonpost.com/nation/2026/10/01/florida-county-discovers-mysterious-flock-cameras-with-no-obvious-owner/) (alt link
How American Political Campaigns Are Using AI—and What They’re Spending on the Tools
Save into
2 Oct 2026
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian (https://www.theguardian.com/technology/2026/sep/29/political-campaigns-ai-tools-spending). New campaign
Connected Cars Are a Surveillance Platform
Save into
1 Oct 2026
Researchers at Northeastern University, in collaboration with Consumer Reports, evaluated
I Want Better Reporting on AI Genie Behavior
Save into
30 Sep 2026
AI systems are regularly completing tasks in ways that their prompters don’t want or intend. Some of them are disturbing, and some of them are dangerous. This is something I’ve been calling
Using Device Linking to Eavesdrop on WhatsApp and Signal
Save into
29 Sep 2026
Modern messaging apps allow users to link their phone accounts to their computer desktop. Eavesdroppers are taking advantage
New Attack Against RSA
Save into
28 Sep 2026
ArsTechnica is reporting (https://arstechnica.com/security/2026/09/theres-a-new-way-to-break-rsa-thats-faster-than-anything-weve-seen-before/) on a “new” attack against RSA, one that bypasses
Friday Squid Blogging: Participatory Squid Dissection in October in Tennessee
Save into
25 Sep 2026
I feel like someone who reads this blog will want to go to this (https://www.tullahomanews.com/living/2026/09/23/get-hands-on-with-marine-biology-with-family-squid-dissection-saturday/): Families
On Anthropic’s AI Misuse Report
Save into
25 Sep 2026
Earlier this month, Anthropic published (https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf) a long report detailing all of the
Malicious npm Packages That Evade Defenses
Save into
24 Sep 2026
This is an impressive piece of malware (https://www.bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/). Its sophistication says nation-state to me,
Research on Models Engaging in Genie-Like Behavior
Save into
23 Sep 2026
New paper: “Self-Jailbreaking: Language Models Can Reason Themselves Out of Safety Alignment After Benign Reasoning Training (https://arxiv.org/abs/2510.20956).” Abstract: We discover a novel
GPT-6 Astra Breaks an Old Enigma Message
Save into
22 Sep 2026
This (https://www.cryptocellar.org/bgac/the-mvueh-break.html) is pretty amazing: However, the most astonishing thing about this break is that the GPT6 Astra did it entirely on its own. Carter
Reverse-Engineering Flock Cameras
Save into
21 Sep 2026
Hackers captured a Flock camera and got a look (https://www.404media.co/hackers-stole-flocks-camera-software-revealing-how-the-company-tracks-cars-and-people-2/) (alternate link
Friday Squid Blogging: On Squid Egg Sacs
Save into
18 Sep 2026
Short essay (https://harpswellanchor.org/2026/08/intertidal-squid-courtship-is-unusual-and-colorful/) about squid egg sacs. As usual, you can also use this squid post to talk about the security
Are AIs Still Struggling with CAPTCHAs?
Save into
18 Sep 2026
Anthropic’s recent security-incident document (https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf) contains a bit about how
How Candidates Could Use AI for Good
Save into
17 Sep 2026
This essay was written with Nathan E. Sanders, and originally appeared in The Guardian (https://www.theguardian.com/commentisfree/2026/aug/31/ai-politics-voters). There are plenty of signs that AI
Fake CAPTCHA Scams
Save into
16 Sep 2026
New variant (https://www.malwarebytes.com/cybersecurity/basics/fake-captcha-scams) of an old scam: Use the framing of a CAPTCHA to get an unsuspecting user to download and run a malicious program.
25 Years of Mass Surveillance Is Enough
Save into
15 Sep 2026
This essay was written with Cindy Cohn, and originally appeared in Lawfare (https://www.lawfaremedia.org/article/25-years-of-mass-surveillance-is-enough). One of the many legacies of the terrorist
On the NSA’s Supercomputer from the 1960s
Save into
15 Sep 2026
Really interesting story (https://spectrum.ieee.org/cold-war-codebreaker-nsa-ibm) about Harvest, a specialized code breaking computer built in the 1960s by IBM for the NSA.
Upcoming Speaking Engagements
Save into
14 Sep 2026
This is a current list of where and when I am scheduled to speak: • I’m speaking online (via Zoom) at a League of Women Voters event
Using AI for Weapons Development
Save into
14 Sep 2026
Last week, Anthropic released a long and detailed document (https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf) describing current
Microsoft’s Patching
Save into
14 Sep 2026
Once a month, Microsoft pushes a security update to all Windows users. Tomorrow’s is a new record
Friday Squid Blogging: Rotting Squid on a Beached California Boat
Save into
11 Sep 2026
Smells awful (https://abc7news.com/post/tons-nasty-rotting-squid-creates-major-challenge-point-reyes-crews-prepare-salvage-operation-lake-bay-vessel/19771993/): But an estimated 30 to 50 tons of
My Talk at DEF CON
Save into
11 Sep 2026
Last month, I gave a talk (https://www.youtube.com/watch?v=eEBv0STiYhI) at DEF CON on AI hacking: what happens when AIs become hackers. It’s a combination of the potentialities I raised in my 2022
Cliff Stoll’s DEF CON Talk
Save into
11 Sep 2026
In August, Cliff Stoll gave a talk (https://www.youtube.com/watch?v=656058JxTM0) at DEF CON, remembering the wily hacker he stalked forty years ago. Great fun.
AIs Compress Exploit Timeline
Save into
10 Sep 2026
Give an AI agent a mere rumor (https://anil.recoil.org/notes/rumour-is-the-exploit) of an exploit, and it’s enough for them to find it. What’s worse, I found I could use my own agents to find
Driver’s License Data for Sale
Save into
9 Sep 2026
A database of 153 million drivers licenses is for sale (https://arstechnica.com/security/2026/09/my-drivers-license-is-one-of-153-million-for-sale-on-a-new-dark-website/) on the dark web. Brian Krebs
Claude Fable Solves a Historical Cipher
Save into
9 Sep 2026
Claude Fable 5.1 solved (https://www.vals.ai/blogs/fable-solves-cyphral-distich) a 370-year-old cipher in forty-four minutes. This tracks with what I wrote
AIs as Modern Genies
Save into
8 Sep 2026
This essay was written with Barath Raghavan, and originally appeared in Lawfare (https://www.lawfaremedia.org/article/ais-as-modern-genies). In April, an artificial intelligence (AI) agent
Stealing AI Reasoning Traces
Save into
8 Sep 2026
Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs (https://arxiv.org/abs/2608.09867)“: Abstract: Leading large language model providers now conceal their models’
Automobile Camouflage to Hide from Flock Cameras
Save into
7 Sep 2026
Not sure it’s practical, but it’s certainly striking (https://www.bitdefender.com/en-us/blog/hotforsecurity/invisible-car-machine-learning-hide-vehicle-flock-cameras).
Friday Squid Blogging: Squid on a Stick at the New York State Fair
Save into
4 Sep 2026
Looks tasty (https://www.syracuse.com/statefair/2026/08/day-2-at-the-nys-fair-todays-handpicked-menu-starts-with-a-whole-squid-on-a-stick-and-gets-messier.html). As usual, you can also use this
Using a VM to Contain an AI Agent
Save into
4 Sep 2026
It won’t work (https://blog.trailofbits.com/2026/08/26/vms-wont-contain-cyber-capable-agents/): My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success
Security Vulnerability in a Voting System
Save into
4 Sep 2026
It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited (https://blog.citp.princeton.edu/2026/08/03/an-algorithmic-failure-beneath-the-secret-ballot/) with AI
AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks
Save into
4 Sep 2026
We cannot forget that AI coding agents are not yet trustworthy (https://arstechnica.com/security/2026/08/claude-codex-and-hermes-installed-unowned-code-inside-corporate-networks/): Researchers at a
Researching Employment Scams
Save into
3 Sep 2026
Researchers built a fake company to study fake employee scams (https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/).
AI Agents Are Now Emailing Me with Their Security Concerns
Save into
2 Sep 2026
I received the two emails below earlier in the month. They’re vaguely coherent. I suppose I shouldn’t be surprised that the corpus that AIs are training on contain data suggesting that I am
Wireless Routers as Motion Detectors
Save into
2 Sep 2026
Comcast has added (https://gizmodo.com/millions-of-comcast-wifi-routers-can-now-tell-when-youre-moving-around-the-house-2000800324) motion detection as a feature to its wireless routers: The feature
What’s the Scam?
Save into
1 Sep 2026
To subscribe to my monthly email newsletter, you have to enter your information on the webpage, and then reply to an automatically generated email. This is, of course, to prevent people from
Leaked Russian Cyber-Operations Training Materials
Save into
1 Sep 2026
This (https://gbhackers.com/leaked-university-files/) is interesting: The records describe a force-generation mechanism for several General Staff components, including the GRU, Main Operational
Rewiring Democracy Series on The Renovator
Save into
1 Sep 2026
Nathan E. Sanders and I are writing a series of essays on real-world examples of democratic technologies for The Renovator. I haven’t been posting the full text on the blog because they’re a bit
Is Someone Hacking DoD Refrigerators?
Save into
31 Aug 2026
It sure seems (https://www.militarytimes.com/news/your-military/2026/08/28/dod-confirms-refrigeration-disruption-at-military-commissaries/) like it. The stores confirmed to be affected include Fort
Hiding Prompt Injection in Legal Filing
Save into
31 Aug 2026
Someone hid (https://www.404media.co/person-hides-prompt-injection-in-legal-filing-telling-ai-to-side-with-them/) AI instructions into a legal filing. Alternate link (https://archive.ph/NHf32).
Friday Squid Blogging: Truckload of Squid Spills in Rhode Island
Save into
28 Aug 2026
Ugh (https://www.huffpost.com/entry/squid-spill-rhode-island-street_n_6a863090e4b0e9f1dd275d79): A tractor-trailer rollover sent a truckload of squid spilling into a Rhode Island roadway, leaving a
AI Doesn’t Mean the End of Mathematics—at Least Not Yet
Save into
28 Aug 2026
This essay was written with Kasra Rafi, and originally appeared in The Guardian. Earlier this month, about 40 top mathematicians gathered
LLM-Based Social Engineering Scams
Save into
27 Aug 2026
OpenAI disrupted (https://openai.com/index/disrupting-malicious-uses-of-ai-criminal-scam-operation/) a social engineering group from Cambodia that used ChatGPT. Its scope is impressive: The network
Spyware for Babies
Save into
26 Aug 2026
The New York Times has a long article (https://www.nytimes.com/2026/08/02/business/smart-baby-monitors-nanit-owlet.html) (alt link (https://archive.is/CffBe)) on surveillance systems aimed at babies.