The EU is recommending import controls to combat unregulated squid fishing in the Southwest Atlantic. I’m not optimistic.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
An Angel Walked By • October 2, 2026 7:52 PM
An Angel walked by again today, at 10:10 and made me very happy.
Just to see her – makes my heart beat faster.
Words do not exist, which could describe her beauty…
An Angel… and I love her so…
Joseph Kanowitz • October 2, 2026 11:52 PM
ב”ה,
This thing with certain providers throttling certain customers’ data service to prevent patches while “Super Intelligence” is mostly unleashed against the US economy “because that’s where it escaped Jurassic Park” is going to be lit.
StephenM • October 3, 2026 2:43 AM
@Clive
Not a good idea to attack Medicare, Australia’s universal health care provider. Their servers will contain private and confidential information on just about every Australian. The medicare system is now decades old. It is not great but there is widespread public support. So this is not just an attack by a foreign company on the government but on every Australian and on democracy.
And no, the data wasn’t just public. Another ABC report https://www.abc.net.au/news/2026-10-02/rogue-open-ai-agent-breach-nsw-government-website/107223108 says:
“The agent gained access to both public and non-public data, but no personal Medicare details were breached.”
“OpenAI said the incident occurred during a training exercise of an ‘internal-only OpenAI model’, with the bot gaining access to non-public access to Services Australia Medicare’s Statistics Reporting Service.”
Every Australian is owed a detailed explanation by OpenAI of just what it was up to.
Clive Robinson • October 3, 2026 5:10 AM
@ StephenM,
You note,
“Every Australian is owed a detailed explanation by OpenAI of just what it was up to.”
Way more than an explanation, and way more than a grovelling apology. And verifiable remedial action[1].
One of the things that really annoyed me was the UK deal with Palantir.
Let’s be honest Peter Thiel is not normal, and Palantir reflects some of the worst of his aberrations.
The UK Government without permission or authority from the patients in the “National Health Service”(NHS) records system just gave the lot to Palantir to crunch up in their ML systems.
What the deal actually was all about, I have not found out. What I do know is that the chance of it being beneficial to me or any other NHS patients is very probably less than zero, otherwise politicians would be crowing about it…
Thus as Sam Altman is as bad if not actually worse, I do not expect anything of worth coming out from OpenAI… So far as an expectation it does not appear to be wrong.
[1] I know there are going to be a bunch of people doing a “what’s the harm”… Well to them I suggest they study history from nearly a century ago and what happened to people who had adverse medical records in not just Europe but The US with regards eugenics.
Ismar • October 3, 2026 6:32 AM
@ StephenM AI is just one part of the problem, the other is, off course, the current state of government cybersecurity allowing these attacks to be successful
lurker • October 3, 2026 1:45 PM
@Clive Robinson, ALL
OpenAI’s meaningless grovelling was reported earlier, and commented on by myself
and by our host @Bruce
https://www.schneier.com/blog/archives/2026/09/i-want-better-reporting-on-ai-genie-behavior.html
There are still missing pieces in this puzzle, like not “what’s the harm”. but if there was any harm how come the owners/operators of all these “violated” websites didn’t see anything amiss?
Did Altman’s babies over-write the logs to hide their intrusions? a) there are laws against this and action must be taken; or b) did the site operator(s) have their permissions wrong? then they got all they deserved. Does nobody any longer use timely log reviews? Back in the day there were frequent releases of automated scripts for this …
At least one of the “intrusions” was admitted to have been via a valid access token obtained from an invalid place. It’s not OpenAI’s fault people can’t secure their stuff.
None of the above should be read as an excuse for the behaviour of the Silicon Valley megalomaniacs. A straightjacket is usually only the first stage in the treatment …
US, Russia weaken safeguards for AI weapons
In early September “hundreds of diplomats huddled in a cavernous U.N. conference room in Switzerland, working toward a muscular treaty to regulate the use of lethal autonomous weapons.”
“On the last day of negotiations, the talks turned aggressive.”
US and Russian teams “stripped language requiring the systems to operate in a “predictable” and “reliable” manner, the people said.”
They “removed a clause mandating that ethical considerations be taken into account when using AI weaponry.”
And a “provision requiring that humans review military targets developed by AI before a strike.”
The meeting’s final report did have some positive elements, including a characterization of lethal autonomous weapons systems. There will be more negotiations in November.
Clive Robinson • October 3, 2026 3:53 PM
@ lurker, ALL,
With regards,
“[B]ut if there was any harm how come the owners/operators of all these “violated” websites didn’t see anything amiss?”
The old question of “harm to hurt” arises…
If I stick a pin in you, you generally go “ouch” fairly quickly. But there are diseases on the rise where you can be unaware of the pin. (Such as neuropathy from Type II Diabetes[1]).
Due to a US Doctor who developed K-Rations, “sugar in everything with no fat” was pushed as “heart healthy”. Scientists knew this back in the 1970’s but the food industry played dirty tricks which we still see with “Low Fat” and similar labels.
Then there are lifestyle issues inflicted by “professional others”. Few remember that Doctors used to tell patients to smoke tobacco and drink alcohol… Even long after they knew it was not a good idea (oh and cigarette manufactures were putting asbestos in the “filter tips”). Only now are the Drs saying neither is good and that there really is no “safe lower limit”. Yet the science community were saying half a century ago. As for asbestos even though it’s extremely dangerous in some parts of the world it’s still used like we do “plaster board”…
They all have something in common,
“The harm is done long before the hurt”.
Lets be honest cancer is not a nice way to go, nor are the various forms of heart failure, but in general by the time you know you’ve got them, it’s very long after the causal events.
Similar applies to websites, the actual harm comes in three steps,
1, Defective software/hardware built.
2, Defects then get turned into exploitable vulnerabilities.
3, Only some times do the exploits get noticed.
It’s the third point where APT used to be talked about, where “silent attackers” built themselves in in ways that were not seen and could not be removed.
To be noticed “attackers” have to “make noise” etc. The smart ones don’t make noise untill they have to.
It’s why I talk about “Segregation / Gapping” as often as I do and that it should be the foundation of a solid security plan, because,
“If an attacker can not reach the system they can not attack it”.
But also,
“It shows up abnormal activity more easily, thus increases the chance of spotting even stealthy attackers”.
Because for something to be spotted the signal it creates has to be visible above the general noise level in some way.
[1] There are three arguments that have been used in the past for the rise of Type II Diabetes…
1.1, Eating to much
1.2, Lack of exercise
1.3, Eating overly processed foods.
But modern science research has shown that the real culprit is the third one, and it’s a deliberate policy of not just the food industry but many governments.
But what you don’t hear about is that it can be due to the fact you have another disease or medications that effects the essential micro nutrants etc you body gets out of food. So your body reacts like it does when you’ve had to little water or food, it makes you crave them.
StephenM • October 3, 2026 6:10 PM
@Clive
“One of the things that really annoyed me was the UK deal with Palantir.”
There must be rules restricting access to medical data particularly for non medical reasons. It seems a little surprising that giving the data to Palantir wasn’t against those rules.
I wonder in what jurisdiction the data is held and what the laws are in that jurisdiction governing access to it.
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Clive Robinson • October 2, 2026 6:48 PM
@ Bruce, ALL,
Have you considered just how truthful or not OpenAI was?
Over Not just the big news but thousands perhaps millions of other attacks their “AI testing” made?
It would appear it’s a very untruthful series of responses at best… And is having knock on effects
https://garymarcus.substack.com/p/breaking-openais-security-fiasco
It was posted in the evening of 25th Sept.
The reason I did not post it earlier is I was waiting to see what the response from OpenAI was going to be…
Also other actors in the drama…
I suggest people read it rather than me go through why Altman and Trump should be put on the block.