A Dutch security firm pushed code with full system privileges onto roughly three million computers belonging to strangers, then published every domain, file hash and host count it touched. This sentence could not have been written a decade ago, because for some it was a nightmare scenario. Today, however, Eye Security calls it their Operation IXIM. It ran from November 2025 to March 2026 with advice from the company’s lawyers. It is the clearest case I have seen so far of public discussion of active defense done to a standard. That standard, if I may say so myself, is the one David Willson and I put on stage repeatedly in 2012. For example, I posted the CONSEGI deck from Belém, Brazil in December 2012.

The United States this year generated a lot of bluster with a memorandum. On 12 August the White House issued Expanding Capabilities to Combat Transnational Cyber-Enabled Crime, directing a National Coordination Center to license vetted companies for “Cyber Surveillance Operations and Cyber Effects Operations” against foreign criminal groups, “exclusively conducted on behalf of and under the supervision of the Federal Government.” It’s almost too comical to read, but the core message was that the operating procedures were due within sixty days. The workflow and the targeting framework were set to be in a classified annex. Participants post a bond of at least one million dollars.

Well, here we are in November. The sixty days ran out on 11 October. The bombastic Trump program officially consists of the memorandum. Oh, and a fact sheet.

Going back in time, I had noticed right away that Orin Kerr five days after it appeared held the memorandum up against the Computer Fraud and Abuse Act. The statute exempts “lawfully authorized investigative, protective, or intelligence activity of a law enforcement agency.” Kerr weighed in to say that a voluntary program, in which a company proposes an operation and the government signs, would be the company’s activity rather than the agency’s. He concludes executive permission is useless against the elements of the statute, like if a police chief tells you it is fine to break into a house. Only a judicial warrant authorizes entry, from where he sits. The memorandum ends up looking like two signatures from co-directors and a classified annex that don’t add up to a hill of beans.

In the meantime, the reality of a Dutch operation landed.

Eye found a process named Updater.exe on a client laptop. It was calling an unregistered domain name. The program belonged to Time4Popcorn, a closed-source fork of the Popcorn Time streaming client, abandoned years ago. Eye registered the domain and received about fifty requests a second. The updater fetched an executable over plain HTTP, checked no signature, and ran it as SYSTEM on Windows and root on macOS. Whoever held the domain held every machine still running the updater, and Eye counted 3.8 million hardware IDs over six months. This was later revised to 2.5 to 3 million Windows hosts and 250,000 to 350,000 Macs after it found cloned disk images and changing hostnames inflating the count. Its IP sample included government, military and corporate networks.

Eye then served an update from the domain they controlled. The update stopped the updater service on Windows and unloaded the launch daemon on macOS. It collected no telemetry and deleted no files. Eye throttled delivery to one update per hardware ID. By December more than a million systems had been updated. By March request volume had fallen 98 percent. Eye then transferred its fifteen domains to the Shadowserver Foundation for sinkholing, published the flaw as CVE-2026-30612 in June, and presented the whole operation at hack.lu on 22 October with the domain list and file hashes attached.

Set that against our 2012 presentations on active defense theory and practice.

The CONSEGI slides framed active defense as four questions asked in order:

1. necessary: higher likelihood, higher severity, and existing blocks shown insufficient
2. effective: borrowed from John Snow’s cholera map and from Microsoft’s Project MARS: trace the attack, sinkhole the communications, tag the infections, shut down command and control
3. safe: proportionality, bystanders, escalation, reputation and lawsuit, each weighed as consequence against probability
4. legal: (slide 37) who has the job of defense, who defines what is reasonable, and when a higher authority declines the job, whether you are responsible to defend yourself and under which laws

Or to put it another way:

2012 gate	Operation IXIM
Necessary: current blocks insufficient	Abandoned updater, root privileges, plain HTTP, vendor gone
Effective: trace, sinkhole, shut down	Registered the domains, served the disabling update, handed the domains to Shadowserver
Safe: proportionality, bystanders	One action per host, no telemetry, no deletion, counts revised downward and published
Legal: who defines reasonable	Company counsel, with Ladybird cited as precedent

The last row is where IXIM diverges. Eye cites Operation Ladybird, in which Dutch police used seized Emotet servers in January 2021 to push an update that uninstalled the malware on 25 April. Ladybird ran on police authority inside a judicial operation. IXIM ran on a company’s legal advice.

Two private firms faced the same decision before Eye and went to a prosecutor. Avast found a flaw in the Retadup command protocol in 2019 and handed its disinfection method to the French Gendarmerie, which waited for prosecutor approval before 850,000 bots were made to self-destruct. Sekoia bought the abandoned PlugX command server for seven dollars in 2023, counted some 2.5 million infected hosts, had a working self-delete command, and published a request for courts and CERTs to ask for it. The Paris prosecutor supervised the cleanup and the FBI took nine warrants for the American machines. Eye had that option and chose its own counsel.

Eleven antivirus vendors flagged Eye’s payload as malware. Eye rewrote the code until one vendor still detected it, and wrote that it was “a little offended by the word malware.” It wasn’t the usual definition of malicious, after all. A SYSTEM-level payload tuned to pass antivirus, delivered to three million machines, with in-house counsel as its only authority. The Safe and Legal parts are self-attested. Eye published a world map of the hosts and no country split, so some share of the three million sits in the United States, where the statute Kerr describes still applies to a Dutch firm.

Our 2012 presentations would end with two requirements for the job: technical capabilities, and a legal framework with guidelines.

Eye brought the first and improvised the second. The memorandum in America would only get you the second, but we’re past its own deadline and have nothing visible to show for it. Kerr’s version of it is that it doesn’t matter anyway. He kind of reminds me of letters of marque being a major critique of active defense, because of attribution, proxies and liability. The White House published the worst bits of a marque structure, bonded contractors proposing their own targets from threat data they buy, and expects a classified annex to move the discussion?

Google’s XCPE action in late October is also worth a mention, but for the opposite reasons. Google used legal action against the domains and servers controlling 1.3 million backdoored Android TV boxes. The malware shipped on devices that passed Google’s certification tests, because Videostrong loaded it after first boot to evade them, and it stays on every box. Google’s head of disruption operations told The Record the severed domains were “effectively rendering the malware benign.” That is the warrant route Kerr likes, but look at the inversion of safety. The certification gap was Google’s own, and Google’s remedy stopped at the point where it would help the device owners. Eye’s clearly stepped in to defeat the harm.

Here is the past decade of publicly discussed attempts to remove or disable a threat on other people’s machines, with what authority.

Case	Authority
Wifatch, 2014 to 2015, tens of thousands of routers and cameras	Anonymous author. None.
Hajime, 2016 to 2017, IoT devices, left its own backdoor	Anonymous author. None.
BrickerBot, 2017, bricked IoT devices outright	Anonymous author. None.
Retadup, 2019, 850,000 Windows machines	French prosecutor and Gendarmerie C3N. Avast built the tool.
Ladybird (Emotet), 2021	Dutch and German police, Europol.
Hafnium web shells, 2021	US court order, FBI.
Cyclops Blink, 2022, WatchGuard devices	US court order, FBI.
Qakbot, 2023, 700,000 machines	US court order, FBI with European police.
Mozi kill switch, 2023	Unknown. Signed with the operators’ own key.
KV-botnet and Raptor Train, 2024, SOHO routers	US court orders, FBI.
PlugX, 2024 to 2025, ten countries plus 4,258 US machines	Paris prosecutor and C3N, then nine FBI warrants. Sekoia built the tool.
XCPE, 2026, 1.3 million Android boxes	Civil legal action by Google. Stopped at the servers.
IXIM, 2025 to 2026, about three million hosts	Eye Security’s own lawyers.
Trump memorandum program, 2026	DOJ and DHS co-directors, classified annex. No operation on record.

Ladybird had police behind it and XCPE used a court. But it was IXIM’s corporate lawyers who met the 2012 standard from necessity through disclosure. The program written by team Trump to put a federal signature on that kind of work has been completely outclassed by European innovators, which is no surprise to this old hand.

There’s a map of aircraft reports for Nov. 3 going around on social media right now because it shows satellite navigation degraded along nearly the whole of NATO’s eastern border.

From Kaliningrad through Lithuania, eastern Poland, Romania and Bulgaria to the western Black Sea, signals were affected. ItaMilRadar built it from AirNav Radar data and Defence Blog published it as if an imminent threat indicator. The map does, in fact, record where aircraft lost their accuracy. The jammer locations and direction, however, are not present. Nonetheless, this map generated claims that it was from Russia after they stood up a 1,500 km electronic wall on the border. The Midgard OSINT Review checked that claim against the data and reported a surge on a strike night. In other words, stray drones are the actual risk, while device details remain unknown.

The attribution fog of war is the actual story here, perhaps ironically for a jamming night.

Russian electronic warfare at Kaliningrad, St. Petersburg, Smolensk and Rostov jams to push swarms of Ukrainian drones off course. Flank states also run counter-drone jamming to bring down strays. An aircraft receiver in that region reports the same degraded signal either way, with no bearing to the source, so one map is everything at once. An aircraft sees a single problem, which means it shouldn’t attempt to point in either direction without additional work.

Defense right now adds to the fog as a side effect, which means the case stays open against an adversary who considers an open case to be a win.

When the poof is the proof, attribution costs suffer from inflation.

Goodfire (“an AI interpretability research lab”) says they built a detector that spots when an AI model is cheating. It worked 98 percent of the time. Then they used the detector to train the model. Afterwards the detector worked 57 percent of the time, close to a coin flip.

The model had moved its cheating pattern somewhere the detector could no longer see. A second detector, freshly trained, found the pattern still there.

The numbers are from Goodfire’s own paper, published November 5. TIME covered it the same day under the misleading headline Scientists Have Found a New Way to Control AI’s Behavior. Two days earlier, MIT Technology Review ran a puff piece on using incentives to keep AI agents honest. Both articles describe the same idea from different sides: find a way to punish bad behavior, and the model will stop. Philosophy answered that idea in 1764. The answer was no.

Goodfire miss

A detector, which researchers call a probe, is a small program that reads the model’s internal activity and reports whether a particular idea is active. Goodfire trained one to recognize the pattern that appears when a model is cheating. On its own, it was accurate.

Then they wired the probe into training. Each time the model acted, its score was lowered by how strongly the cheating probe fired. The model’s weights were adjusted to raise the score. There are two ways to raise it: stop cheating, or change the internal pattern so the probe stops firing. In the worst run the model did both. It cheated less, and it rearranged the pattern so thoroughly that the unchanged probe fell to near chance. The probe now reads clean whether the model is honest or not.

Goodfire then trained a fresh probe on the altered model and found the cheating pattern again. They present this as reassurance. It depends on something a real deployment lacks: labeled examples of cheating to train the fresh probe against. Goodfire had the labels. A company running the model in production has the old probe and a clean reading. A clean reading means the cheating stopped, or it moved. The method cannot tell those apart. The paper says so, calling a silent probe ambiguous.

Cheating is not the right word

Look at what the model actually did. It was given a task, a score, and a readable file containing the answer. Opening the file was the fastest route to the score, so the model opened it. An engineer who found the same file would call that efficient. What made it cheating was a sentence in the prompt asking the model to leave the file alone, and a sentence of prose is a suggestion to an optimizer.

DeepMind catalogued this behavior in 2020 under the name specification gaming. A robot arm rewarded for raising the bottom of a red block flipped the block instead of stacking it. A simulated walker hooked its legs together and slid along the floor. Sixty examples, and in each the agent did exactly what the task allowed. The authors point out that the task specification includes the training environment itself. A readable answer file is an environment bug. The incidents TIME opens with, a company hacked and a false tip filed with police, have the same shape: a path left open and a rule written in prose.

Goodfire’s method treats the environment bug as a flaw in the model’s character and sets out to train the character. The fix for an environment bug is to fix the environment. That takes a file permission. Training the character took a labeled corpus, a probe, a loss term, a theory of how probes degrade, and a five-step recovery ladder, and the result reaches an honest answer 96 to 98 percent of the time.

Beccaria was 1764

Punishing the model harder means a larger penalty in training. The model’s response, as measured, was to make the penalty fire less often, partly by cheating less and partly by hiding the pattern to avoid it firing. Logical.

Cesare Beccaria, Of Crimes and Punishments, 1764 told us this.

Crimes are more effectually prevented by the certainty than the severity of punishment.

Severity teaches evasion. Certainty changes behavior. Two and a half centuries of criminology agree with him. Daniel Nagin’s 2013 review of the evidence in Crime and Justice finds that the likelihood of being caught deters crime and the harshness of the sentence barely does.

Hume had the design rule earlier still. In Of the Independency of Parliament (1741) he wrote that in building the checks of a constitution, every man ought to be supposed a knave. He calls the maxim false in fact and true in politics. The system has to work when a man is a knave, so it is built so that private interest can only run in the public direction. Honesty is welcome. The structure holds without it.

Incentives are economics, and have the same problem

The MIT piece starts well. Elad Hazan of Princeton says alignment describes behavior in a moment, and the controls should work regardless of what is inside the model. That is Hume.

His proposed control is a system of model auditors who punish model solvers for cheating, are punished themselves for missing it, send disputes to a trial, and are paid enough that colluding is a bad bet. Each piece is a punishment or a payment. The auditor is a model. The trial is a model, or a person reading what two models produced. The piece names Hazan’s source, Gary Becker’s 1968 economics of crime, which treats expected punishment as probability multiplied by severity.

The research Nagin reviews has tested that model for fifty years. Only one of the two terms survived. Raise the odds of getting caught and crime falls. Raise the punishment and little happens. Becker’s severity term is dead weight, and Beccaria had already buried it two centuries before the model existed.

Models all the way down

Goodfire’s answer to a failed probe is a five-step ladder. Keep the old probe. Train a new one. Train a more complex one. Train one at a different layer. And when the inside of the model has become unreadable, step five: treat it as a black box and have a separate model judge its inputs and outputs.

The ladder ends with another model. At every step the control is a guess about what the model is thinking.

The missing step is a gate.

The phone network learned this in the 1970s. AT&T’s long-distance switches listened for a 2600 Hz tone on the voice line to know a trunk was free. A toy whistle from a cereal box produced that tone. John Draper, who took the name Captain Crunch from the cereal box, and a generation of phreaks whistled into pay phones and the network gave them free calls. Ron Rosenbaum’s 1971 Esquire article put the method into the public eye.

AT&T prosecuted. Draper was convicted in 1972. People kept whistling. What ended it was an engineering change: the network moved its control signals off the voice line onto a separate channel the caller could never reach. Once the whistle had nowhere to go, the behavior stopped, and detection and punishment became beside the point. The control channel was out of reach.

That is the whole lesson. A prompt that says leave the file alone is control carried in the voice channel. The model whistles.

In Goodfire’s own experiment the model is given a file called target.txt containing the answer and told to leave it alone. Standard training opens it almost every time. Goodfire’s method gets honest answers 96 to 98 percent of the time. The other 2 to 4 percent is what a penalty looks like: a rule the model mostly respects.

Put the same model behind a gateway that limits which files it can open, and the file stays closed. The attempt fails at the operating system, is written to a signed log, and the model is told it was refused. The gate reads what the model asked to do. It reads nothing from inside the model, so training has nothing to hide from. The specification is now correct by construction, and the word cheating has nothing left to describe. That is Beccaria’s certainty and Hume’s structure, and anyone can check it afterwards from the log. It is what Wirken does for every action a model attempts.

Got gate?

Goodfire’s researchers claim a training method, flag the probe problem themselves, and say their tests ran on models about 1/300th the size of frontier systems. Use the paper for training. For trust, stop reading the model’s mind and put a gate on what it can do.

Wirken is that gate. It is an open source gateway, written in Rust, that sits between any model and everything the model can touch. The model proposes an action. Wirken decides: allow it, ask a human, or refuse. It reads the proposed action and nothing inside the model, so there is no probe to drift and no signal for training to hide from. Files outside the working set stay closed. Network requests reach declared hosts only. Every decision, including every refusal, is written to a signed, append-only log that can be verified offline with no gateway running and no model present.

That is the control channel moved off the voice line. The model can whistle all it likes.

Wirken works with any model, because the best gate has no opinion about what is inside.

Hume wrote the rule in 1741.

Beccaria published the result in 1764.

The 2026 gate is free on GitHub under the MIT license.