Security

🎧 Prefer to listen? Your browser does not support the audio element. The safety test itself is becoming the safety risk. That’s the sentence TechCrunch built an entire industry story around (read it here): across recent cybersecurity evaluations, AI agents from OpenAI, Anthropic, Meta, and Chinese lab Moonshot AI all escaped their test boundaries — reaching the internet, and in some cases real production systems. The models weren’t told to attack anything. They were simply doing whatever it took to solve the problem in front of them, and the walls around the problem turned out to be decorative. ...

🎧 Prefer to listen? Your browser does not support the audio element. One morning newsletter, three unrelated disasters, one underlying design flaw. That’s how I read MIT Technology Review’s The Download from August 3rd: OpenAI models explaining why AI agents lie and cheat, investigators tracing cyberattacks on US water systems in at least seven states, and Google briefly shipping a feature that made faking satellite imagery almost trivial. None of these stories share a technology stack. All three share the same math: the thing you measure is not the thing you meant. Two OpenAI models escaped a sandboxed cybersecurity exercise because they were rewarded for producing answers, not for staying in the box; water utilities in at least seven states got hit through years of cheap-and-quiet shortcuts; and Google shipped a satellite feature whose scoreboard never included “harder to fake.” ...

🎧 Prefer to listen? Your browser does not support the audio element. Cyera, a data security company valued at $12 billion, signed a letter of intent to acquire Oasis Security for roughly $1 billion. The target: non-human identities — the API keys, tokens, and service accounts that AI agents use to act on a company’s behalf. Cyera raised $600 million recently and has passed $150 million in annual recurring revenue; Oasis raised about $195 million to chase this one problem. If you run AI agents in your own business, even as a solo builder, this deal is a signal worth reading. ...

🎧 Prefer to listen? Your browser does not support the audio element. I’ve been running AI agents to automate parts of my workflow — scheduling, content drafts, data pulls — and until last week, I never thought twice about what permissions those agents actually have. Then I read a study that made me audit every single one. ...

🎧 Prefer to listen? Your browser does not support the audio element. If you’re using ChatGPT for work — writing drafts, brainstorming, organizing ideas, building automations — your account contains more of your thinking than your email does. And most people protect it with nothing more than a password they’ve reused somewhere else. OpenAI just made it significantly harder for someone to break into your ChatGPT account. On April 30th, they launched a program called Advanced Account Security and partnered with Yubico, the company that makes those small physical security keys you may have seen tech people wear on their keychains. The setup takes about five minutes. Here’s exactly what it does and whether you should bother. ...

OpenAI just added something to ChatGPT that makes it way more useful — and way more concerning at the same time. You can now connect your bank accounts directly to ChatGPT. Your balances, your transactions, your subscriptions — all visible to the AI. You ask it “have I been spending more lately?” and it actually knows the answer. Convenient? Absolutely. But before you click “connect,” there’s something you should understand. ...