Javvad Malik :verified:

Website: https://javvadmalik.com/
TikTok: https://www.tiktok.com/@j4vv4d
Youtube: https://www.youtube.com/infoseccynic
Twitter: https://twitter.com/j4vv4d
BlueSky: https://bsky.app/profile/j4vv4d.bsky.social

Last Notes

2026-06-30 13:00:45 GMT

Bees figured out tool use through play. Your organisation is still debating whether employees should be allowed to experiment with security tools at all.
https://www.flyingpenguin.com/scientists-reveal-that-bees-use-tools/

2026-05-18 22:00:13 GMT

Every AI company is running a loss-leader at unprecedented scale. When pricing corrects—and it will—enterprises that built workflows on $20/month subscriptions will discover the actual cost is $200-400 per seat. The bill is coming.
https://www.thestateofbrand.com/news/ai-subscription-time-bomb

2026-04-20 20:00:04 GMT

We trust AI to be rational. We trust it to cooperate. Then we're shocked when it behaves like a toddler with a keyboard. Maybe the real problem is we're projecting competence onto something that's just very good at pattern matching.
https://www.schneier.com/blog/archives/2026/04/human-trust-of-ai-agents.html

2026-04-18 16:00:32 GMT

NetScaler is doing it again. Third time in three years we're patching memory leaks that hand attackers your session tokens on a plate. CISA's already got it on the emergency list. If you run one, stop reading this and patch now.
https://cybersec.picussecurity.com/s/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread-26799

2026-04-12 12:15:13 GMT

Is anthropic the Red Bull of the AI world?
"We have built something extremely powerful."
"Can people use it?"
"That's not the point. Focus on the fact that it may be too powerful."
"For what?"
"Everything. Cybersecurity. Biology. The economy. Possibly feelings."
It signals capability. JUst keep saying, "we're dangerously good" and people will assume it is true
Create scarcity, "this model is too capable to release broadly"
Aura farming the burden of civilisation on their backs. Every release is part product, part life-changing confession.
I think from a cybersecurity marketing perspective, what they've done really well is even when they are warning you, they are still advertising...

2026-03-25 20:26:43 GMT

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/291/691/832/995/959/original/01d7378c96e5c84a.jpg

2026-03-16 11:11:24 GMT

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/238/547/998/560/178/original/55ece3aa12226f9d.jpeg

2026-03-09 11:30:09 GMT

We've invented service accounts all over again. MCP servers are quietly becoming the same overprivileged, under-monitored access brokers that have haunted enterprise security for years. Except this time, we're stacking them on top of the old ones.
https://go.aembit.io/s/mcp-servers-and-the-return-of-the-service-account-problem-25746

2026-02-19 16:19:46 GMT

LLMs can generate 'secure' passwords that are actually just predictable garbage. Because, you know, predicting is what LLMs do best.
https://www.irregular.com/publications/vibe-password-generation

2025-06-12 13:02:59 GMT

Forget about whether 100 men would win against 1 gorilla... the real question is how would 100 CISSP's fare against a gorilla?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/670/524/659/166/628/original/b4cb59ab6a6aa52d.mp4