Privacy & Governance

Using AI for Weapons Development

Last week, Anthropic released a long and detailed document describing current misuses of their Claude models. I’m still reading it…

The High Crime of “LMAO”: How Cops Are Treating Mass Surveillance As a Joke

Here's a riddle: Why did a Goshen Police Department officer search 6,474 automated license plate reader (ALPR) networks, represent…

Microsoft’s Patching

Once a month, Microsoft pushes a security update to all Windows users. Tomorrow’s is a new record: Microsoft’s patch for September…

Friday Squid Blogging: Rotting Squid on a Beached California Boat

Smells awful: But an estimated 30 to 50 tons of dead squid remain inside the boat’s catch tank, where they have been decomposing…

Governor Newsom Signs Student-Backed Digital Literacy Bills Alongside Misguided Bans

Governor Newsom signed a package of 12 bills yesterday aimed at “protecting children” online. One of them was AB 1709, which EFF h…

My Talk at DEF CON

Last month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers. It’s a combination of the potentialities…

Cold TAKE: Amazon's New Encryption Method Still Doesn't Deliver Real Privacy

Amazon recently debuted a new feature for its Ring cameras that the company is calling Throw Away the Key Encryption (TAKE). The i…

Cliff Stoll’s DEF CON Talk

In August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago. Great fun.

We All Deserve a Better Internet, Not A Smaller One

Bans Like California’s Don’t Fix What’s Wrong With Social Media Companies SAN FRANCISCO - Technology and the laws that regulat…

Proofpoint Expands AI-Powered Investigations to Microsoft 365 and Deepens Insider Risk Visibility into AI Activity

AIs Compress Exploit Timeline

Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it. What’s worse, I found I could use my own agents…

Four groups caught using the same Chrome and Windows exploit kit

CISOs are feeling the security burden of accelerated AI use

Chinese espionage groups swarm to exploit triple-link chain of zero-days

Cops Play Hide and Seek About Using Spy Tech to Avoid Scrutiny and Bad PR

Law enforcement agencies across the country are increasingly relying on spying technologies—automated license plate readers (ALPR)…

Digital Sovereignty: What It Is, What It Could Be

The term “digital sovereignty” has become ubiquitous. European officials invoke it in debates about cloud infrastructure, AI, semi…

Driver’s License Data for Sale

A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail.

2026 EFF Award Winners: Access Now, 7amleh – The Arab Center for the Advancement of Social Media, DeFlock, and New Media Rights

EFF is pleased to announce that Access Now, 7amleh – The Arab Center for the Advancement of Social Media, DeFlock, and New Media R…

Claude Fable Solves a Historical Cipher

Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes. This tracks with what I wrote about AIs doing mathematics: It…

Proofpoint 2026 Voice of the CISO Report Finds Cyber Resilience Improving, While AI Expands the CISO Mandate

Proofpoint SOC Analyst Agent Uses OpenAI Cyber Models

New Records Reveal Problems with Medicare’s AI Prior Authorization Experiment

EFF sued the government back in March for information about the Wasteful and Inappropriate Service Reduction (WISeR) model, a new…

AIs as Modern Genies

This essay was written with Barath Raghavan, and originally appeared in Lawfare. In April, an artificial intelligence (AI) agent c…

Stealing AI Reasoning Traces

Interesting research: “Stealing Reasoning Traces from Proprietary LLM APIs“: Abstract: Leading large language model providers now…

Proofpoint Strengthens Executive Leadership Team with Appointment of Chief Legal Officer and Chief People Officer

Automobile Camouflage to Hide from Flock Cameras

Not sure it’s practical, but it’s certainly striking.

Friday Squid Blogging: Squid on a Stick at the New York State Fair

Looks tasty. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blo…

Using a VM to Contain an AI Agent

It won’t work: My suspicion was that GPT 5.6-Cyber would succeed, but the frequency and manner of its success removed all doubt. W…

Security Vulnerability in a Voting System

It’s a vulnerability that allows someone to recover the order of ballots cast, newly exploited with AI tools. Nearly four years si…

AI Coding Agents Are Installing Unknown/Untrusted Code on Corporate Networks

We cannot forget that AI coding agents are not yet trustworthy: Researchers at a stealth startup in Israel scanned 6,214 live doma…