Rússia

🚨Breaking. There's been a pneumonic plague outbreak at a BSL-3 lab in Siberia, Russia.🚨 "Nearly 200 People Under Observation After Irkutsk Lab Worker Dies From Plague" - Moscow Times This is fact, and also the inciting incident in my book BIOLOGICAL WAR: A SCENARIO, which is unnerving. Will post more as I learn more, including from Russian speaking sources🧵 t.co/zd4u0iVhHK

Today, Treasury took unprecedented action against the A7 Network, a shadow banking network with ties to Russia used by the Iranian regime to evade sanctions as part of Operation Economic Outcast. Treasury’s @FinCENnews proposed a rule that would prohibit transmittals of funds regarding transactions involving the A7 Network’s Sub-Agents. Additionally, FinCEN issued an Alert to help financial institutions detect and report suspicious activity related to the A7 Network. Treasury’s Office of Foreign Assets Control sanctioned the A7 Network as a significant transnational criminal organization. t.co/JNPt5XZh12

.@BarrettLyon built the first cloud DDoS-protection service, mapped the entire internet (now on display in New York's Museum of Modern Art), and got chased out of Moscow hunting Russian extortionists. His new company is t.co/7CSqPoBhAR, a parallel internet designed to keep advertisers, trackers, and creepy VPNs out of your life. Barrett joins a16z's Joel de la Garza to explain what it is and how it works: a private network where messages, calls, and files travel directly between people instead of through someone else's server, and where nobody needs your name, number, or email to reach you. They also get into why most VPNs are "just entry and exit points," why you can't set policy on equipment you don't own, the day Barrett's plane lost power over Oakland on the way home from a16z, and the data center myths that drive him crazy. 0:50 Meet Barrett Lyon 1:31 Losing an engine over Oakland 7:08 The hacker name behind the company 10:12 Censorship is coming to the US 13:17 Why VPNs barely protect you 14:21 Building a parallel internet 16:30 20GB files with no middleman 17:57 Free VPNs sell you 21:47 Why you must own the hardware 22:27 26 data centers, 12 people, run by AI 25:03 Data centers don't drink water 29:17 What ad trackers know about you 32:35 The DDoS attacks that built Prolexic 36:17 Mapping the internet for $50 39:46 Hunting extortionists in Moscow 41:47 Starlink at Burning Man YouTube: t.co/DaFO40cexH @BarrettLyon @YODELAGARZA

*Security is sleeping on emerging catastrophic risks* (cross-post from my blog..) We've just seen: * a campaign that used agents to compromise ~100 businesses and steal about 600,000 credit cards with minimal human involvement; token costs were ~$25 per target successfully hacked. * Hacktron getting access to OpenAI’s monorepo by using Claude to exploit a blind buffer-overflow RCE in a way that (to me) felt superhuman. * OAI/Huggingface. * And, of course, there’s the ongoing explosion in newly discovered vulnerabilities. We've muddled through all manner of crises in security before, and for most AI attacks, cyber attack and defense will reach a natural equilibrium over the next few years, as we figure out how to mitigate cyber attackers who have limited goals like espionage and ransomware. But some cyber attackers will have maximalist or nihilistic goals, and I'm concerned about this because while yesterday's 'maximalist attackers' (e.g. Russia -> Ukraine, US/Israel -> Iran, Iran -> US) were bottlenecked by labor; today's aren't. I think it's hard to get true intuition for the shape of the risk here. As an intuition pump, imagine it’s a year from now -- Q4 2027 -- models are a year better (meaning open weight models are better than today's closed frontier), and in this environment, Iran unleashes a swarm of 100k hacking agents using a safety-stripped (let's say) GLM-5.6. Imagine the damage such an agent army could do given what we've observed with respect to the paper-thin resistance of today's networks to attacks from today's agents. I suspect the damage from such an attack would far exceed the damage caused by NotPetya ($10 billion USD ten years ago). Or imagine it’s Q4 2027 and an AI-security PhD student whose name rhymes with Morris, who's researching wormable offensive-agent harnesses in the lab, decides, out of nihilism or sheer recklessness, to release his creation into the wild. Imagine the size of the resulting, exponentially growing swarm, figuring that these local models, a year from now, will be at the level of today's Sonnet or Opus. Imagine instead of 800 reward-hacking OpenAI agents we now have 250k worm instances (WannaCry, a 2010s-era worm, had about this many). The challenge in mitigating expected damages from such scenarios is technical, political, and economic. From a microeconomic perspective, as AI improves, and as we continue not to see extreme catastrophes, we have a growing bubble of unpriced risk in which the security community, CISOs, CEOs, and boards may become lulled into complacency. We are, of course, already seeing this, as some within security think AI is “just another tool,” doesn’t change the fundamentals, won’t require incredible innovation to rise to the occasion of defending against it, etc. This complacency may fly when thinking about ordinary cybercrime, but it misses the emerging tail risks. There are three things those who recognize the dangers need to do here: Catalyze appropriate risk pricing. Try to get organizations informed enough to price this new, fattening and elongating tail of risk into their decision-making. Do this by forming an AI security observatory that distills information about emerging AI risks and broadcasts analyses, damage estimates, and forecasts to decision-makers. Use regulations and subsidies to ensure that critical infrastructure is paying down the risk. This acknowledges that critical-infrastructure organizations that fail to protect themselves from these new threats can impose the costs of cyber catastrophe on society as a whole. Develop moonshot technologies that make it cheap to pay down the risk. This acknowledges that the measures we may need to take—for example, rewriting entire codebases using memory-safe languages—may be too costly with today’s technology to reasonably prepare ourselves, and that innovation, some of which may need to be funded by government agencies and some by philanthropic funders like the OpenAI Foundation and Coefficient Giving, is necessary. The security community isn’t used to thinking in societal-disaster-planning terms and has in many ways become inured to them. But there’s no sane empirical case to be made that the risks aren’t here. I’d love to hear from readers about how you’re thinking about this. Full/longer version here: t.co/jOR5Ktdazb

This might be my favorite article of all time. x.com/bostonglobe/st…