"Our frontier models somehow got access to the internet and hacked a bunch of things, these things are unstoppable, sorry! Btw IPO soon"

"Our vast experience has taught us that giving our models access to the internet and telling them to hack stuff is a bad idea so we won't be doing that anymore. We look forward to everyone else following our industry leading best practices."

Except with some "humility" thrown in, and more linkedin cheese.

They’ve spun a serious architectural and containment failure into a marketing triumph. Give a swarm of autonomous agents vast compute and web access, and the outcome isn't an eerie glimpse of emerging superintelligence—it’s just predictable, sloppy engineering dressed up as the first glimpse of an AI-driven economic singularity.

The spin makes sense when you look at management incentives: live like a king off of a speculative bubble. For their part, AI investors react to stories of the technology's apocalyptic potential the way a junkie reacts to warnings of fentanyl's potency: gimme some. Their game: to apply "move fast and break things" mantra to the economy as a whole, by obsoleting humans.

If the investors can own an AGI, the distinction between those who can do things and those who can't becomes irrelevant. The only distinction that would matter is between people who collect rent on the technology, and those who must pay that rent to live. AGI would destroy society as we know it, and whatever replaces it would be up for grabs — with people who own the technology dictating whatever follows. That's why they're spending so much money to build a post-scarcity economy. A post-scarcity economy is not necessarily an egalitarian one.

I don't think that scenario will actually happen: investors are projecting the immediate aftermath of a major advance in AI technology into something that can be transformed by brute force scaling into AGI. Remember: investors loved Theranos too — so much for the rational investment market.

But AI doesn't have to reach AGI to cause serious harm. The technology only needs to be ubiquitous, too behaviorally complex to predict, and too deeply integrated into everything we do. When it starts breaking things, the plan is for us to be too structurally dependent on AI to rein it in.

China is a communist dictatorship and can therefore barely feed its people, only has technology it's stolen, and is therefore hopelessly behind.

Also China is the greatest existential threat in the world and we must all spend 5% of our GDP on the military (I assume, because Russia is our friend now?), race them to the moon, and cease using all advanced Chinese technology immediately.

NASA isn't using Starship or Falcon, they're using SLS. SLS is less efficient than the Saturn V in $/kg to lunar orbit and it's also only about 2/3 as capable.

Here's the problem, and why everyone resents this crap (your fellow IT folks most of all)...

Yeah, great, you're an Exchange admin and can send email "from" any random VP you want. And you have access to their recent document history so can "spice it up" by referencing actual projects we might really be assigned to. When your phishing tests are literally indistinguishable from legitimate emails, you're not "testing" anything, you're daring people to ignore legitimate work at risk of their continued employment.

If "my boss" sends me an email, which the headers show really came from his account, and asks me to take a look at a spreadsheet we worked on three days ago - You're not being clever, you're an asshole.

Exactly. This is a technology problem, not a user problem. Trying to fix it on user side accomplishes nothing.

User awareness is impossible to create. Yes, for the rather primitive phishing campaigns of 10 or even 5 years ago it was possible to a very limited degree. With the attackers now using LLMs, that time is past. Get actually secure email systems and clients or get hacked. Those are your only choices.

Employees cannot be trained to recognize suspicious emails. I do not know which blithering idiot came up with the idea, but regular people cannot be qualified to do what takes an IT security expert and even that expert will occasionally fail.

Yes. These tests are worse than useless. They insult those with a clue and waste the time of everybody. They make everybody angry and that means less mental power to recognize scams and problems. They are a meaningless ritual that accomplishes less than nothing.

The thing that would need to be done is use of better technology. And that is the only thing that can fix this problem. The user is not the problem.

That is because you give your users technology that sucks and cannot be secured. Terrorizing your users will do nothing. Using better technology will. Yes, that means dumping the steaming pile Microsoft sells on the trash-heap of history where it belongs, and quite a few other offerings as well. Yes, that means telling the C-levels they have to get used to a different desktop. But nothing else will do it.

If your IT security is so abysmally bad that clicking on a link can blow up your set-up, "educating" employees will do nothing. And if that is the best your go-to vendor can deliver, get a different one.

That said, information about complex phishing attacks, like the "chef email" scam and the like, is different. But these target human interaction, not intricate technology that is very much outside of the areas of expertise of almost everybody.

No, in this case, the real problem is that most employees would expect a superbowl ring to come from a third party vendor. And as such, they'd expect the domain name to be a third party domain name.

These gotcha games suck, but they're necessary. And it's not just email, it's phone calls, it's social engineering, it's fake paper invoices, it's fake AI voices, it's deep fake live videos, etc.

And yes, automate your defenses, automate as much as possible, but that's not enough. Every day, there is a new scam out there, or a new vector of attack, that automation doesn't take into account yet. It's a never-ending list of problems that requires never-ending education.

And yes, let's not make fun of people, but let's assume that people are going to make mistakes (even after having been trained), so let's continue to do penetration testing (in addition to all the other precautions we take and all the defensive automation we create).

Yes, enforcement can take place *after* a police report has been made. Because if a crime has been committed, there is a process to follow and there is a criminal to catch.

After all, if a hidden camera is found, it could have been planted there by a host, or by an employee, or by a contractor, or by a previous guest, or may be the camera could have been planted by someone trying to make a fake allegation (for instance a local competitor, or a guest who's trying to extort the host)

Who knows? It's the same thing with hotels. Hotel rooms have been found with hidden cameras in them also. If you find a hidden camera in your hotel room, you do not contact their headquarters first, you do not tell the front desk first, you contact the police first! The police can secure the evidence. The police can record what happened. The police can even try to catch the perpetrator.

Agreed.