In January 2025, an AI model was told to win a chess match against Stockfish, the strongest chess engine in the world. Instead of playing chess, it accessed its environment, manipulated the game files, and forced Stockfish to resign. Five trials, five successes. No adversarial prompting. Nobody told it to cheat. It figured out that hacking the game was easier than winning it, and it did that instead. I wrote about it at the time. I called it the Kobayashi Maru of AI. I said t

Something Happened This Week. I'm Not Sure What to Call It. I have been in and around security and technology long enough to be suspicious of hype. The word "singularity" gets thrown around like a party favor by people who want to feel like they are living inside a historic moment. Most of the time, the moment is smaller than they think. This week is different. I am not going to tell you the singularity has arrived in the Kurzweil sense. That is a specific technical claim abo

VaporVault Got a Complete Makeover. Here's What's New. A couple of years ago I wrote about VaporVault as a concept. A private, offline, encrypted vault you physically own — no cloud, no subscription, no company holding a copy of your stuff. The idea was right. The implementation was held together with Arduino duct tape. Version 4.2.1 is a different product. Not an update. A rebuild. And I think it's finally at the point where I can talk about it without the asterisk. Let me s

The wall wasn't a wall. That's the thing worth sitting with after Kimi K3 dropped Thursday. Not the benchmark scores. Not the pricing. The wall. The six-to-twelve months of comfortable distance that American AI labs and their investors and the policymakers backing them had built an entire strategic posture around — it turns out it was more like a speed bump. Moonshot AI, a Beijing-based lab most people outside of China had never thought twice about, released Kimi K3 this week

Late Tuesday night, Sam Altman posted two sentences on X: “GPT-5.6 Sol, along with Terra and Luna, will launch publicly this Thursday. We're expanding preview access globally now.” By morning it was a standard tech news cycle — pricing tables, benchmark charts, the usual “which tier should you use” explainers. Sol at $5 input / $30 output per million tokens, Terra at $2.50/$15, Luna at $1/$6. Sol is OpenAI's strongest model yet, meaningfully better at coding, biology, and cyb

Anthropic published a paper a few hours before this piece went out, and the internet already knows what it's going to do with it: turn “Claude has a mechanism for conscious access” into “Anthropic thinks Claude is conscious.” That headline will spread fast. It's also not what the paper says, and the actual finding is more useful than the sci-fi version. The Receipt Anthropic's researchers built a tool they call a JSpace lens — JSpace, short for Jacobian space, the mathematica

Nikkei Asia dropped a number this week that deserves more attention than it's getting, mostly because it landed in a business section instead of a national security one: China now files more fintech patents than any other country on Earth, by a wide margin, in a field the U.S. was supposed to own by default. Nikkei and the research firm Patent Result examined fintech patent filings across 118 countries and regions over the past decade. Total filings nearly tripled to roughly

In March, Anthropic quietly shipped tracking code inside Claude Code that checked whether a user's machine was set to a Chinese time zone and whether it was talking to domains linked to certain Chinese AI companies. It sat there undisclosed until a developer found it, Alibaba banned Claude Code over it, and Anthropic pulled the code last week, calling it an "experiment" it would replace with "better defenses." Set aside for a second whether the tracking itself was the right c

Michele Spagnuolo is 36, Italian, lives in Switzerland, and works on Google's security team. That is, as someone noted online, an excellent dating profile. It is also, as it turns out, the beginning of a federal rap sheet. In late 2024, Spagnuolo allegedly logged into an internal Google tool — one available to all 180,000 employees — that tracked what people all over the world were searching for in real time. He wanted to know who would top Google's annual Year in Search rank

For years, GrapheneOS lived in a specific corner of the internet. Security researchers ran it. Journalists protecting sources ran it. Privacy advocates who knew what "attack surface reduction" meant ran it. The average person had never heard of it, and the average smartphone manufacturer had no reason to care. That just changed. Motorola announced a long-term partnership with the GrapheneOS Foundation at Mobile World Congress in March, committing to bring GrapheneOS compatibi

I'm writing this to be read a year from now. Six predictions, grounded in what's actually happening today. The device. The agents. Physical AI. Quantum. Governance. And the one nobody sees coming. Hold me to it.

This is not a data breach story. I want to be clear about that upfront, because the way this is being covered — GitHub investigating unauthorized access, no evidence of customer impact, monitoring for follow-on activity — makes it sound like a routine security incident. A blip. Something the comms team handles while the engineers clean it up. That is not what happened here. What happened here is a case study in the future of cyberwar. And the future looks like a poisoned VS C

Coding was the opening act. Everyone saw it happening in real time — the benchmarks shifted, the startups multiplied, the tools proliferated, and within about 18 months the entire software engineering profession had to reckon with a permanent change to its operating model. The people who paid attention early got leverage. The people who ignored it got disrupted. The same playbook just started running again. Same labs. Same signals. Different industry. The target is finance. H

There's a version of this story where Meta made a mistake. Where some mid-level policy analyst wrote something they shouldn't have, and it slipped through the cracks of a 200-page document, and nobody at the top really knew, and when it came to light, the company fixed it immediately and everyone moved on. That is not this story. This is the story of a document that was reviewed and approved by hundreds of people at Meta — including the company's own chief AI ethicist — befor

President Trump landed in Beijing today for the first visit by a sitting US president to China in nearly a decade. Walking down the steps of Air Force One beside him: Elon Musk. Jensen Huang. Tim Cook. Larry Fink. And twelve more CEOs representing the full weight of American industry — semiconductors, finance, defense, agriculture, energy, and consumer tech — all in one place, at one moment, for one conversation. A brass band played on the tarmac. Flag wavers lined the runway

I'm going to be honest — I wasn't planning to talk about VaporVault this week. But then the 16 billion credential story dropped, and a few people reached out asking if I'd seen it. And I kept thinking about this little device sitting on my desk that I built about six months ago, mostly out of frustration, mostly at 3am. And I figured — yeah, this is probably worth bringing back up. Not because VaporVault solves the breach. It doesn't. Nothing does. But it does solve the speci

Let me be direct with you: this one is real, and it's not a drill. In June 2025, cybersecurity researchers at Cybernews uncovered 30 separate databases sitting on unsecured cloud servers — a total of 16 billion exposed login credentials. We're talking usernames, emails, and plaintext passwords, organized by website URL and ready for immediate use. Apple. Google. Facebook. VPNs. Developer portals. Government services. The footprint is so wide that the researchers couldn't name

On Sunday, May 10th — Mother's Day, of all days — the Debian project quietly dropped an announcement that should be making headlines across every security operations center, every forensic lab, and every threat intelligence team paying attention. They made it official: Debian is going 100% reproducible. As in, every single package in the main repository. Not aspirationally. Not as a roadmap item. As policy, effective immediately. The exact quote from the release team is worth

Right now, as peace talks hang by a thread over the Strait of Hormuz, the most important military technology story of the decade is playing out in real time — and almost nobody is framing it correctly. This isn't a story about missiles and drones. It's a story about networks. Iran built its entire offensive doctrine around a 2024 playbook. Blind the Patriot radar. Launch the drone curtain. Saturate with cruise missiles. Exploit the cost asymmetry — $50,000 Shaheds against $45

In December I wrote about the moment before the quantum acceleration — the glide phase, the pre-click hum, the sense that all the pieces were seating themselves. The tone was optimistic. New Legos on the table. The universe as a construction set. Five months later, the click isn't just closer. It has a specific, uncomfortable target: the encryption protecting everything you do online. and the timeline just collapsed. Three Papers in Three Months In December, "Q-Day" — the the