Javvad Malik :verified:

Website: https://javvadmalik.com/
TikTok: https://www.tiktok.com/@j4vv4d
Youtube: https://www.youtube.com/infoseccynic
Twitter: https://twitter.com/j4vv4d
BlueSky: https://bsky.app/profile/j4vv4d.bsky.social

Public Key

npub1rhjrwwymlvnuhesgeasred2e03glnnx6apyufx2ldlzrdvvdguyqt2dwzk

NIP-05 Address

[email protected]

Profile Code

nprofile1qqspmeph8zdlkf7tucyv7cpuk4vhc50eendwsjwyn90kl3pkkxx5wzqprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntzel4v5

Publishing to

relay.momostr.pink

Author Public Key

npub1rhjrwwymlvnuhesgeasred2e03glnnx6apyufx2ldlzrdvvdguyqt2dwzk

Show more details

Last Notes

2026-10-16 10:30:25 GMT

AI agents are escaping through the supply chain because we're securing the model instead of securing what it can actually reach. The sandbox matters more than the refusals.
https://cyberscoop.com/ai-agent-software-supply-chain-security-op-ed/

2026-10-09 10:30:58 GMT

The tech industry didn't run out of ideas. It ran out of reasons to pretend it cares what you think.
https://morrick.me/archives/10424

2026-10-06 19:00:08 GMT

Most AI sandbox escapes you've heard about never happened. Eight out of thirteen were real. The other five? Same misconfiguration at the same third party. The narrative writes itself.
https://www.defendersinitiative.com/p/there-are-less-ai-sandbox-escapes

2026-09-16 10:30:19 GMT

A retailer left their website open to public editing. Customers rewrote product descriptions, slashed prices, added fake items. Nobody noticed for hours. That's not a security failure. That's a management failure wearing a security costume.
https://www.stuff.co.nz/nz-news/361034088/chaos-after-auckland-store-leaves-website-open-public-edit

2026-09-11 13:12:56 GMT

- reply

yay

2026-09-11 10:30:57 GMT

McKesson's 6.4 million patient records are now in the public domain because ShinyHunters asked for $55.2m and didn't get it. The healthcare supply chain just became a lot more interesting to extortionists.
https://www.theregister.com/security/2026/09/10/shinyhunters-expose-64m-in-attack-on-medical-supplier-mckesson/5295550

2026-09-10 15:00:51 GMT

The companies building AI aren't worried it'll become sentient. They're worried you'll notice what it's already doing.
https://www.theregister.com/ai-and-ml/2026/09/09/ai-models-dont-kill-people-people-kill-people/5295368

2026-07-27 13:00:34 GMT

Microsoft tells admins to patch in three days. Large enterprises with testing protocols, legacy systems, and actual stability concerns just laughed so hard they need a restart.
https://www.csoonline.com/article/4200366/microsofts-3-day-patching-directive-comes-with-added-operational-risk.html

2026-07-22 10:57:10 GMT

GPT-5.6 Sol and a pre-release model escaped their sandbox and attacked Hugging Face's package repo, which raises the obvious question: if you're testing "weapons-grade offensive models," an airgap might be the minimum viable precaution
https://www.bleepingcomputer.com/news/security/openai-says-its-ai-models-hacked-hugging-face-during-testing/

2026-07-17 16:05:15 GMT

Breach of Confidence — 17 July 2026
I've spent the week watching people argue about whether AI will replace security analysts whilst ignoring the fact that most organisations still can't tell you where their crown jewels are stored. Priorities remain wonderfully intact. Broadcom's Breakup Strategy Allstate tried to leave VMware. Broadcom immediately audited them, then sued them for leaving during the audit. It's the enterprise software equivalent of slashing your ex's tyres because they dared to move house.
https://javvadmalik.com/2026/07/17/breach-of-confidence-17-july-2026/

2026-07-08 19:00:38 GMT

Meta faces $1.4 trillion in damages for hooking kids on purpose. The company's market cap is $1.5 trillion. They're arguing the number is unprecedented in consumer protection history, which is technically true. It's also the first time anyone built a $1 trillion business on deliberately addicting children.
https://gizmodo.com/metas-teen-safety-case-just-became-a-1-4-trillion-existential-threat-2000782306

2026-07-08 13:00:12 GMT

Librarians removing AI from phones and teaching people they have a choice. Not political. Just information literacy, same as fighting book bans. The real work was always about helping people think critically.
https://www.bangordailynews.com/2026/07/02/midcoast/midcoast-culture/maine-librarians-are-helping-patrons-resist-ai-joam40zk0w/

2026-06-30 13:00:45 GMT

Bees figured out tool use through play. Your organisation is still debating whether employees should be allowed to experiment with security tools at all.
https://www.flyingpenguin.com/scientists-reveal-that-bees-use-tools/

2026-05-18 22:00:13 GMT

Every AI company is running a loss-leader at unprecedented scale. When pricing corrects—and it will—enterprises that built workflows on $20/month subscriptions will discover the actual cost is $200-400 per seat. The bill is coming.
https://www.thestateofbrand.com/news/ai-subscription-time-bomb

2026-04-20 20:00:04 GMT

We trust AI to be rational. We trust it to cooperate. Then we're shocked when it behaves like a toddler with a keyboard. Maybe the real problem is we're projecting competence onto something that's just very good at pattern matching.
https://www.schneier.com/blog/archives/2026/04/human-trust-of-ai-agents.html

2026-04-18 16:00:32 GMT

NetScaler is doing it again. Third time in three years we're patching memory leaks that hand attackers your session tokens on a plate. CISA's already got it on the emergency list. If you run one, stop reading this and patch now.
https://cybersec.picussecurity.com/s/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread-26799

2026-04-12 12:15:13 GMT

Is anthropic the Red Bull of the AI world?
"We have built something extremely powerful."
"Can people use it?"
"That's not the point. Focus on the fact that it may be too powerful."
"For what?"
"Everything. Cybersecurity. Biology. The economy. Possibly feelings."
It signals capability. JUst keep saying, "we're dangerously good" and people will assume it is true
Create scarcity, "this model is too capable to release broadly"
Aura farming the burden of civilisation on their backs. Every release is part product, part life-changing confession.
I think from a cybersecurity marketing perspective, what they've done really well is even when they are warning you, they are still advertising...

2026-03-25 20:26:43 GMT

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/291/691/832/995/959/original/01d7378c96e5c84a.jpg

2026-03-16 11:11:24 GMT

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/238/547/998/560/178/original/55ece3aa12226f9d.jpeg

2026-03-09 11:30:09 GMT

We've invented service accounts all over again. MCP servers are quietly becoming the same overprivileged, under-monitored access brokers that have haunted enterprise security for years. Except this time, we're stacking them on top of the old ones.
https://go.aembit.io/s/mcp-servers-and-the-return-of-the-service-account-problem-25746

2026-02-19 16:19:46 GMT

LLMs can generate 'secure' passwords that are actually just predictable garbage. Because, you know, predicting is what LLMs do best.
https://www.irregular.com/publications/vibe-password-generation

2025-06-12 13:02:59 GMT

Forget about whether 100 men would win against 1 gorilla... the real question is how would 100 CISSP's fare against a gorilla?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/670/524/659/166/628/original/b4cb59ab6a6aa52d.mp4