Tech · Culture · Fiction
Article Anthropic, OpenAI, and DeepMind grade their own models' danger
AI labs publishing dangerous-capability evals turns safety disclosure into marketing, and the self-graded scorecards drift toward a race to the bottom.
It walks through the handshake between your apps
Ember-1 exploits trust relationships between applications, moving past perimeter and identity controls. What failed, why, and what must now be true.
Loading a trusted model runs untrusted code.
from_pretrained resolves a Hugging Face model name to whatever the branch holds now, extending a one-time trust decision over content it never re-checks.
Loading a model executes the uploader's code
How autonomous AI agents weaponize Hugging Face via pickle deserialization and trust_remote_code, mapped to MITRE ATT&CK and ATLAS with the telemetry defenders see.
The bypass is a feature
Persistent authentication stores a completed verification as a token, then acts on the token forever. Reference replaces validation, and the person goes unchecked.
TOTP fixes the channel, not the credential
TOTP kills SMS interception and SIM-swap OTP theft, but AiTM phishing still steals the session token. What TOTP secures and what it doesn't.
Your decisioning problem isn't accuracy.
Run open-source decision models locally-pinned versions, validation, immutable logs-so every approval or denial stays reproducible and auditable.
The Wire — latest
All →- 16,000 Supabase databases exposed due to misconfigurations
- 2026: The Year AI Coding Agents Took Over
- 80,000+ Firms Hit by Stolen AI Logins in Supply-Chain Attack Surge
- AI Agent's Auto-Reply Blunder Worsens Delivery No-Show
- AI code isn't the problem—ignorance of system design is
- AI Needs Human-Like Metacognition for Broader Intelligence
- Amazon S3 Prices Frozen for a Decade
- Anthropic Unveils Faster, Cheaper AI Model: Claude Sonnet 5.5
- Bitget Hack: $388M Stolen via Third-Party Security Flaw
- Bitget Resumes Withdrawals After $387M Crypto Heist by North Korean Hackers
Stay in the loop
New writing delivered when it's ready. No schedule, no spam.