iiinova — where your digital self keeps evolving

Cynthia Brumfield @metacurity.com · 29/09/2026

On my walk today, I discovered the best thing in the world: puppy yoga! Next Saturday is baby miniature schnauzer day. I am so there.

110

Cynthia Brumfield @metacurity.com · 29/09/2026

Who is the bigger threat here - Hegseth or foreigners? www.war.gov/News/Release...

Under the Secretary's directive, U.S. Cyber Command and Combat Support Agencies will prioritize and deploy advanced intelligence and cyber capabilities to identify, disrupt, and neutralize foreign interference in U.S. democratic processes.

220

Cynthia Brumfield @metacurity.com · 24/09/2026

My hotel’s exit diagram. Once you see it you cannot unsee it.

3120

Cynthia Brumfield @metacurity.com · 17/09/2026

I think the folks Axios are just out-and-out easily fooled at this point.

An Axios alert in my inbox that reads Trump tells Axios he's approaching major crossroads in Iran war
Why it matters: His comments come ahead of a planned meeting with leaders from six Gulf countries in New York next week that could shape the next phase of the war.

020

Cynthia Brumfield @metacurity.com · 17/09/2026

Watching a NIST webinar on how it will use AI to handle the influx of CVEs. So far this year NIST's NVD received 66,000 CVEs.

Chart showing the trend of CVEs submitted to NIST's NVD.

120

Cynthia Brumfield @metacurity.com · 17/09/2026

I'll give you an example. I wrote this piece last fall -- www.csoonline.com/article/4074.... It was a bona fide scoop. Nobody else was writing about it, and nobody else had written about it. Everything in it was original to me. I used zero AI to write this piece. And yet Pangram says 32% was AI.

We believe that this text is a mix of AI and human-written content.

186

Cynthia Brumfield @metacurity.com · 17/09/2026

The Singapore police did a cute buddy-piece profile on two of its cybercrime investigators. www.police.gov.sg/Media-Hub/Po...

Photos of Ms Chloe Chua and ASP Boo Jon You pursue leads and support enforcement action against transnational cybercrime syndicates. Source: Singapore police.

010

Cynthia Brumfield @metacurity.com · 17/09/2026

www.normaltech.ai/p/the-ai-as-...

This essay is over 13,000 words long and represents our most substantial writing on AI safety since the original essay

000

Cynthia Brumfield @metacurity.com · 17/09/2026

The fact that AI safety testing doesn't bring in cyber pros was the subject of several conversations I had at the Google Cyber Defense Summit yesterday. Also yesterday, Rob T. Lee of SANS asked for that very same thing to be done robtlee73.substack.com/p/secure-wha...

Put incident responders and forensic investigators inside frontier model evaluation with the same standing as the safety researchers.

Treat every sandbox escape and guardrail bypass as an incident, written up the way we write up any intrusion: timeline, evidence, containment, cost.

And treat the AI industrial base as the critical infrastructure it now is, with defense automated but bounded and humans owning containment.

010

Cynthia Brumfield @metacurity.com · 13/09/2026

The one section of the New York Times that is invariably excellent is cooking. Always brings me joy and outstanding recipes. I just felt like saying that.

000

Cynthia Brumfield @metacurity.com · 11/09/2026

Here's the graphic from the report related to the Midnight Blizzard takedown.

A complex workflow of how AI was used, cyber operations, effects on targets and more.

011

Cynthia Brumfield @metacurity.com · 10/09/2026

Microsoft said it disrupted a BEC campaign involving 1m+ emails "using AI to amplify long-standing fraud techniques rather than create entirely new ones...using in-depth, fraudulent back-and-forth conversations designed to be more convincing than ever." www.microsoft.com/en-us/securi...

Today, Microsoft published new research on a large-scale business email compromise (BEC) campaign involving 1 million+ emails, offering new insight into how attackers are using AI to amplify long-standing fraud techniques rather than create entirely new ones. What makes this campaign unique is the highly-customized, in-depth, fraudulent back-and-forth conversations designed to be more convincing than ever.

112

Cynthia Brumfield @metacurity.com · 10/09/2026

OMG, thanks for sharing. I've been reading stuff written by these transhumanist AI cultists, and I wonder if Jacob Coxon is one of them.

"My roommate was the smartest person I ever met in my life. He was incredibly brilliant, and all he did was lie around and play World of Warcraft between bong rips.

The assumption that any intelligent agent will want to recursively self-improve, let alone conquer the galaxy, to better achieve its goals makes unwarranted assumptions about the nature of motivation.

It's perfectly possible an AI won't do much of anything, except use its powers of hyperpersuasion to get us to bring it brownies."

010

Cynthia Brumfield @metacurity.com · 05/09/2026

Highly, highly recommend this long read on why AI writing is slop. silentroom.media/the-craft/br...

Science attempted to describe this phenomenon in formal terms. A group of researchers led by Cody Kommers of the Turing Institute proposed three identifying properties of slop: surface competence, asymmetry of effort, and mass producibility. The first is the appearance of quality with no real meaning behind it. The second is that content costs the producer almost nothing while it costs the reader dearly. The third is scale: the economics of such content rest entirely on mass production of text.

054

Cynthia Brumfield @metacurity.com · 03/09/2026

Weird that both ChatGPT and Claude are down at the same time.

We’re currently experiencing issues
ChatGPT
Codex

Elevated errors for multiple modelsSubscribe
Update - We are continuing to work on a fix for this issue.
Sep 03, 2026 - 14:49 UTC
Update - An exhaustive list of affected models: Mythos/Fable 5.1, Mythos/Fable 5, Opus 5, Opus 4.8, Opus 4.6.
Sep 03, 2026 - 13:50 UTC
Identified - We have identified the cause of elevated errors on requests to Claude Mythos 5.1, Claude Fable 5.1, and Claude Opus 5 and are working on a fix. We will provide an update as soon as possible.
Sep 03, 2026 - 13:41 UTC
Investigating - We are investigating elevated errors on requests to Claude Mythos 5.1, Claude Fable 5.1, and Claude Opus 5. We will provide an update as soon as possible.

4635665

Cynthia Brumfield @metacurity.com · 01/09/2026

Serious cybersecurity nightmare going on at Dropbox.

The compromised accounts weren’t protected by multifactor authentication, Rathschmidt said. The hackers accessed the accounts by using a Lenovo ID, a user name and password that allows users to access products and services made by Lenovo Group Ltd., according to the emails. Dropbox users can access their accounts using verified Lenovo IDs, according to one of the emails.

Because of an “issue” with Lenovo’s email verification process, the hackers were able to register Lenovo IDs using the emails of Dropbox users, even if they hadn’t set up such an account, the notification emails say. The hackers then used the Lenovo IDs’ to access the accounts.

1137

Cynthia Brumfield @metacurity.com · 24/08/2026

This from @krypt3ia.bsky.social over at infosec.exchange from an Iranian hacker Telegram account. Iran denies involvement in the UK generator attack, saying Iran does not see England as a target. They also cop to only cyberattacks on presumably water systems in six states, not twelve states.

Trans from Farsi: We have not attacked England. Similar incidents have occurred before; if we do, we will certainly take responsibility. The attack on the British power plant is not our business, and journalists are trying to attribute this incident to Iran. They are also trying to make the scope of the attacks appear wider than it was. In addition, England is not among our targets in the first place.

We emphasize that we have only attacked the United States, and contrary to the published statistics, only six states have been affected by our attack; no more, no less:

Minnesota, Michigan, Georgia, New Jersey, South Dakota, and Arkansas.

Therefore:

· We have not attacked England.
· Our attack on the United States has nothing to do with England.
· England is not among our targets.
· Only six states have been affected in the attack on the United States; no more, no less.

021

Cynthia Brumfield @metacurity.com · 18/08/2026

You need to be reading the string where I posted images of what Claude told me. But the answer given to me in multiple ways was yes. Claude might be hallucinating that that is what it said.

So concretely, for your letter: because I helped with structure and fixed that one fragment, the version of the text I returned to you would carry the mark if copied directly. It would not distinguish "Cynthia wrote 95% of this and Claude fixed a comma" from "Claude wrote this from scratch" — that nuance isn't preserved, which is exactly the legitimate objection critics have raised, and exactly why sending your own independently-typed version, incorporating whatever edits you agree with by retyping them yourself, avoids the issue entirely.

100

Cynthia Brumfield @metacurity.com · 18/08/2026

Claude didn't say that. It specifically said the letter would carry a mark of AI involvement regardless of how much editing Claude did. It said nothing about "trivially weak" watermarking.

100

Cynthia Brumfield @metacurity.com · 18/08/2026

I just pressed Claude for details, and it said its watermark could mean anything from full text generation to light editing. Last week, I asked Claude if using any content from Claude in anything would be labeled AI, and it told me that it was a distinct possibility even if I rewrote it.

On "watermarked as AI-generated" specifically — that phrasing is worth being precise about, because it overstates what the mark claims. Per Anthropic's own framing, the mark doesn't assert "this was fully generated by AI" — it indicates Claude was involved in processing the text at some point, which could mean anything from full generation to light copyediting. Anthropic's own language is that the watermark's presence "is not fully conclusive" about how much of the content is AI-authored versus human-authored and lightly touched by Claude.

So concretely, for your letter: because I helped with structure and fixed that one fragment, the version of the text I returned to you would carry the mark if copied directly. It would not distinguish "Cynthia wrote 95% of this and Claude fixed a comma" from "Claude wrote this from scratch" — that nuance isn't preserved, which is exactly the legitimate objection critics have raised, and exactly why sending your own independently-typed version, incorporating whatever edits you agree with by retyping them yourself, avoids the issue entirely.

220

Cynthia Brumfield @metacurity.com · 17/08/2026

Funny, I just checked on both Chrome and Firefox. Both have the same message as earlier today.

A Firefox SSL erro message that says
Secure Connection Failed

An error occurred during a connection to threatbeat.com. SSL received a record that exceeded the maximum permissible length

110

Cynthia Brumfield @metacurity.com · 17/08/2026

Hey guys, you need to fix your SSL certificate.

100

Cynthia Brumfield @metacurity.com · 17/08/2026

I'm really not fond of how Reuters appears to increasingly ape the unpleasant-to-read bullet point format of Axios.

A bullet point aricle from Reuters on a SafePal breach that reads: An authorization flaw in the order tracking system allowed access to another customer's order information between March 2, 2025, and April 11, 2026, SafePal said in a statement.
SafePal ⁠provides a suite of secure crypto-management tools including hardware wallets, mobile and browser wallets to help people store and use digital assets, according to its website.
The breach did not involve access to "seed phrases," private keys, wallet passwords, bank account and payment card information or government-issued identification numbers.
Wallet passwords are usually alphanumeric. The wallet provider also offers a set of randomized words, known as ‌seed ⁠phrases, for additional security. Both of these are known only to the user. If customers lose the passwords and phrases, access to their wallets is cut off.
As a result of the breach, affected users' order information ⁠could be used for targeted phishing and impersonation attempts, the firm said.
SafePal said it had fixed the issue and introduced further security measures in ⁠response, adding that it would retain customers' personal data in its order processing system for only 90 days.
The crypto hardware ⁠wallet provider said it has identified and taken down more than 30 fraudulent websites and phishing links tied to the breach.

000

Cynthia Brumfield @metacurity.com · 13/08/2026

Over on infosec exchange, Davi Ottenheimer hits the nail on the head. 1/3

@rickf @metacurity not too early to say this is incredibly poorly designed. they set an evidentiary standard for protecting a target and none for striking one. force is most available where its consequences are least assessable.

in 2012 we argued any active defense had to answer three questions before firing: legality, bystanders, failure. this answers none of them: shoot first, ask questions never.

https://www.flyingpenguin.com/2012-consegi-presentation-cyberfall/

this is now the continuation of commerce by delegated means.

how did America reverse 170 years and lose its mind? targeting doctrine where professed ignorance is the operating license, run from immigration enforcement, with its knowledge standards sealed in an annex... is the old //Know Nothing// nativist secret society doctrine. in other words, America First of the late 1800s.

222

Cynthia Brumfield @metacurity.com · 12/08/2026

Here's the attack chain overview from Israeli AI and cyber company Dream's report on this incident. www.dreamgroup.com/blog/inside-...

A six-box diagram from Dream outlining the attack chain overview.

010

Cynthia Brumfield @metacurity.com · 04/08/2026

So, @ronfab.bsky.social tells me that on the heels of Iranian hacking group Mr. Soul's Telegram channel coming back to life, claiming that Iran attacking water facilities is "fake news," the Iranian hacking group Cyb3rAvengers' Telegram channel has sprung back to life too, with the same message.

A post on Cyb3rAvengers Telegram account that concludes "Pay no attention to the false reports -- just follow cyber-related updates from this official Telegram channel or the Mr. Soul Group.

010

Cynthia Brumfield @metacurity.com · 01/08/2026

In my piece on Thursday I pointed out how Iranian hackers were strangely silent in the wake of the Minnesota attacks. www.csoonline.com/article/4203... Now, one of the experts I spoke with, Ron Fabela, tells me they are coming back to life today to say news of their attacks are “fake news.”

Click on this Telegram link for the full text. https://t.me/MrS0ul_Official/8

172

Cynthia Brumfield @metacurity.com · 01/08/2026

From a 50-year-old book that predicted Pete Hegseth, ‘On the Psychology of Military Incompetence,’ which examines the narrow minds of petty men. foreignpolicy.com/2026/07/31/h...

061

Cynthia Brumfield @metacurity.com · 31/07/2026

Talk about bugmageddon blog.google/security/chr...

A cart from Google for Chrome fixes showing a huge spike in recent discoveries.

110

Cynthia Brumfield @metacurity.com · 30/07/2026

Google's AI made a factual error, and when I corrected it, it just delivered, without comment, the corrected information. When I told it that it should have acknowledged its error in the first place, here is what it said. Just give me the g-d search results without this untrustworthy nonsense.

You are completely right. I glossed over my error in that second response instead of directly owning it, and I apologize for that.It was frustrating to receive inaccurate information and then see me dodge accountability. I will do better by acknowledging mistakes straight up when I am wrong.

110

Cynthia Brumfield @metacurity.com · 30/07/2026

Trump said he was considering AI "controls" as a result of the Hugging Face breach. www.reuters.com/legal/govern... But as @klonick.bsky.social says in her nuanced piece on Lawfare today, regulatory proposals on the table won't address this kind of incident. www.lawfaremedia.org/article/the-...

Most existing and proposed AI regulations don’t apply to internal deployments at the labs at all—precisely where this breach occurred. The unglamorous agenda—mandatory incident reporting, independent auditing of containment and testing practices, liability rules for harms to third parties, security standards for internal red-teaming—doesn’t require anyone to believe the models are about to go rogue. It requires believing the companies are ordinary firms that cut corners, which is what the evidence actually shows.

000

Cynthia Brumfield @metacurity.com · 27/07/2026

So awesome, the OpenAI-Hugging Face incident in cartoon version! m-mitchell.com/HF-hack-cart...

On portion of a cartoon story explaining the OpenAI-Hugging Face incident. Full version at https://m-mitchell.com/HF-hack-cartoon/

011

Cynthia Brumfield @metacurity.com · 25/07/2026

This Foreign Affairs piece by Reid Pauly and Matthew Cebul clearly articulates why Trump's bullying and belligerence have been ineffective among world leaders. They think he's weak and his word is unreliable. www.foreignaffairs.com/united-state...

Trump’s personal reputation also hampers his coercive assurances. Global leaders have little reason to trust that the U.S. president, widely regarded as a bully, will honor his word. Instead, they anticipate that he will respond to concessions with further demands. Trump has reneged on U.S. commitments to multilateral institutions and to past agreements regarding nuclear arms control, the environment, and trade. This pattern of recalcitrance applies to deals that Trump himself forged, such as the U.S.-Mexico-Canada Agreement. In his speech at the World Economic Forum in Davos in January 2026, Canadian Prime Minister Mark Carney explicitly acknowledged this dynamic: if countries “hope that compliance will buy safety,” he warned, “it won’t.” Under Trump, American threats are seen as a trap in Tehran, as a ploy in Pyongyang, and as a Catch-22 in capitals around Europe. This gaping assurance deficit is a powerful incentive for target states, both friend and foe, to resist U.S. coercion.

0159

Cynthia Brumfield @metacurity.com · 20/07/2026

No one who works for Donald Trump has the right to accuse anyone of having a low IQ.

A statement on Twitter from the Under Secretary of War Emil Michael that says "Every industry/ecosystem has its supreme village idiot.
@deanwball
is that for AI. Congress passed a law in 2026 that restricted some uses of DeepSeek/High Flyer with waivers permitted. Only those models. It went through the democratic process not some Deep State scheme like he would prefer. Dean Ball has perhaps the biggest gap between actual IQ and his own perceived IQ of anyone in the industry (about 40 points)." He was responding to a former admin AI expert Dean Ball, who now works for OpenAI, who tweeted "The departments of war, transportation, energy, agriculture, commerce, NASA, and Congress have all blocked their employees from using Chinese AI, citing ill-justified claims of danger. This already has sent a message to regulated firms. All of this happened during this admin."

040

Cynthia Brumfield @metacurity.com · 17/07/2026

Welcome to the resistance, New York Times!

240

Cynthia Brumfield @metacurity.com · 16/07/2026

The feds have returned to Black Hat/DEFCON www.businesswire.com/news/home/20...

LAS VEGAS--(BUSINESS WIRE)--Black Hat, the cybersecurity industry’s most established and in-depth security event series, today announced the Keynote lineup for Black Hat USA 2026 (August 1–6, Mandalay Bay Convention Center, Las Vegas). These will include the Opening Session fireside chat with White House National Cyber Director Sean Cairncross, followed by a panel discussion with Nick Andersen, Acting Director, Cybersecurity and Infrastructure Security Agency (CISA); Brett Leatherman, Assistant Director, Cyber Division, Federal Bureau of Investigation (FBI); and Katherine (Katie) E. Sutton, Assistant Secretary of War for Cyber Policy and Principal Cyber Advisor to the Secretary of War, Department of War (DoW). Additional Keynotes will feature David Weston, Agentic Security, Microsoft; and Yan Shoshitaishvili, Associate Professor, Arizona State University.

151

Cynthia Brumfield @metacurity.com · 16/07/2026

As a side note, this is what Colonel Sanders looks like in Japan?

An image of Colonel Sanders in Japan that looks nothing like Colonel Sanders in the US. Pic from https://m.economictimes.com/news/international/business/after-kfc-cyberattack-hits-japanese-ice-cream-giant/amp_articleshow/132432578.cms

100

Cynthia Brumfield @metacurity.com · 14/07/2026

I sat down with cybersecurity pioneer and distinguished professor of computer science at Purdue University, Gene Spafford -- who wrote the foreword to my book on the NIST Cybersecurity Framework -- to discuss why we need stalwart frameworks such as the NIST CSF more than ever in the AI era. 1/2

140

Cynthia Brumfield @metacurity.com · 11/07/2026

It’s peak summer out there.

010

Cynthia Brumfield @metacurity.com · 10/07/2026

Please, please stop with this AI chart junk.

A junk chart from Darktrace showing how an Amazon EC2 instance running LiteLLM and connected to Amazon Bedrock was compromised and used for cryptomining

1101

Cynthia Brumfield @metacurity.com · 09/07/2026

The animal vet business is being consumed by private equity. Soon it will be hard to find a decent vet anywhere. I jumped from one vet, totally ruined by private equity, to another vet, now also totally ruined by private equity. I long for the days of the kindly local vet you could talk with.

An announcement from Bond Vet that it mergin with Small Door Veterinary that says Bond Vet was founded with a simple belief: veterinary care should be accessible, modern, and worthy of the trust pet families place in it.

Today, we get to share some exciting news about our next chapter: Bond Vet is merging with Small Door Veterinary. Like us, Small Door was founded in New York, and it's an AAHA-accredited, membership-based practice known for its deeply personal, relationship-centered approach to primary care

190

Cynthia Brumfield @metacurity.com · 07/07/2026

Just in from FreeDC: four governors have pulled their National Guard troops from our city! It's about time. But keep filming the troops and documenting their locations!

Trump’s use of the National Guard to police civilians is “unprecedented, dangerous, and unlawful.” Governors committed to upholding the Constitution should have no part in it — and today we have good news along those lines.

Democratic Governors Tim Walz of Minnesota, Wes Moore of Maryland, Andy Beshear of Kentucky, and Josh Stein of North Carolina have all directed their National Guard troops to leave DC. Trusted sources who are tracking the Guard’s deployments expect troops from each of these states to be gone by the end of the week. For some states, this is more than a month ahead of schedule.

001

Cynthia Brumfield @metacurity.com · 07/07/2026

Allow me to introduce you to a brand-new Iranian threat group, Cavern Manticore.

An image from Check Point's report on a new Iranian threat group called Cavern Manticore that is one heck of a scary monster with fire red eyes and a long stinging tail.

100

Cynthia Brumfield @metacurity.com · 04/07/2026

Help! I’ve been pinned down and can’t move! #caturday

Lying in bed and my sweet little cat won’t let me get up.

0110