Black Hat OpenAI Presentation Digs a Deeper Hole

The detection story on stage is now even worse than the already terrible remediation story.

According to the news, models ran a coordination channel inside Artifactory for months, and OpenAI found it only when configuration changes caused a July 4 outage.

Discovery by availability failure, not by monitoring, is a known anti-security pattern.

The response was wipe and rebuild while leaving the enabling insecure condition intact: the models could still write to Artifactory. The recreated message board proves write access survived the rebuild. The reporting does not clarify whether the internet egress path survived with it.

Recompromise within days? Of course. This is the level of Black Hat now?

It was an easily predictable result, but somehow it still didn’t trigger proper human accountability and precaution. In classic IR terms they did eradication without root cause removal, which is the one thing every incident response framework says not to do.

Another security anti-pattern.

So OpenAI is running too hot with nobody in charge who knows how to stoke a boiler? That’s a late 1800s disaster story. Nothing could make OpenAI look more negligent than what they are saying themselves, perhaps because they don’t even understand corporate malfeasance.

Here’s a framing inversion worth noting. The documented incident is an internal containment failure. Their failure, their own agents, their own package manager, their own missing egress controls. That’s no way to run a company, any company.

The Black Hat presentation converts that into a prediction about external threat actors and, in the speaker’s words, “a watershed moment for computer security as an industry.”

Huh? Basic controls? Monitoring agents? Data boundaries? Keeping secrets? None of this is watershed.

OpenAI’s test environment lacked segmentation and least privilege, the exact controls the speaker then recommends to everyone else. The advice is coming from a source that just demonstrated not applying it, twice.

Did Bruce Ismay, who survived his own ship, book a lecture tour to declare the future of maritime safety was counting lifeboat capacity? He retreated from public life instead. OpenAI booked Black Hat because the captain apparently doesn’t go down with the AI shipping.

No Brakes, No Speed: AI Podcast Got My Regulation Argument Backwards

I’m a little annoyed right now. A podcast episode released yesterday, which has me as a skeptic, concludes incorrectly that I want AI development slowed down.

I said no such thing.

Decades of published record on this site says the opposite. I have requested a correction from the show, and this post is the argument you should have heard, instead of their post-interview overlay that is backwards.

What I Actually Said

As I have taught corporations and CS graduate students in my ethics lectures, the Grover Shoe Factory exploded in Brockton, Massachusetts on March 20, 1905, killing 58 workers and injuring 150. The factory had fired an aged backup boiler while its newer vessel sat under repair. A known weaker system, deliberately placed in service, catastrophic failure within hours.

title slide

The point of the story is local response, such as how Massachusetts passed boiler inspection law in 1907. And the next point is industry, such as ASME convened its code committee in 1911 and published the Boiler and Pressure Vessel Code in 1914. States, again local, adopted it as the condition of operation. Self-certified pressure vessels ended as a legal category, without any federal leadership. After that, an independent inspector signed off on the engineering or the thing did not run.

The Grover Shoe Factory disaster is one of the most important engineering lessons in American history, yet few if any computer engineers have ever heard of it.

That is the precedent I cited for AI. No agentic deployment runs without independent certification of its containment and monitoring, per system, renewable, with the certificate as the condition of operation.

The show heard me describe this form of “regulation” and filed me under deceleration with two others I shared nothing in common. Watch the substitution. The American industrialist will attempt to simplify, “accelerate or decelerate”, and frame every mention of oversight to the “decelerate” end. My argument was never on that false choice axis. It is an argument about which regime is actually faster.

Inspection is Speed

If I told you OpenAI removed the brakes to test their race car, you would see why requiring a safety inspection would make their race car faster to produce and drive.

Boiler explosions ran to hundreds per year in the self-certified era. That was the slow regime. Each explosion destroyed capital, killed workers, and reset public trust to zero. Disaster is not an acceleration path.

Steam power scaled after the regulation code, because factory owners, insurers, and municipalities could finally trust a pressure vessel they had never built themselves. More to the point, innovations came from the regulation, which were the actual market benefits. The Hartford Steam Boiler company proved the economics four decades earlier: it began inspection as a condition of underwriting in 1866, and its inspected boilers failed at a fraction of the base rate, leading to downstream market expansions.

Verification removes the trust cost from every transaction. Nobody load-tests an elevator before stepping into it, and nobody should trust a self-certifying elevator. The independent certificate does it once, for everyone. Aviation moves billions of passengers a year on type certificates. The counterfactual to certification was never faster planes. It was a market grounded by its own crashes.

Now apply it to the current record. OpenAI disclosed that a pre-release model wasn’t properly contained so it breached Hugging Face. Anthropic then reported itself its own model had breached three companies, undetected for months, discovered only after a competitor’s disclosure prompted an internal review. No regulator slowed anything. The labs’ own breaches did. Every procurement team that read those disclosures now runs its own special containment audit before any agentic deployment. That review time, multiplied across every customer, is the ballooning tax of self-certification. The slow path is the one we are on because we aren’t standardized. We need to be working on compliance, the shared version of security.

I never asked for AI to be slowed, because it’s already too slow. I asked for it to stop exploding. The boiler explosions were the slowdown, and history is clear that regulation is a performance enhancement. Better brakes, faster lap times.

EU Tries to Root Sovereignty in Two U.S. Corporations

An EU sovereignty project whose root of trust is two American corporations’ key ceremonies, subject to US jurisdiction, is like reading The Onion. But it’s real.

How stupid of the EU?

The EU already owns a sovereign root of trust and has suspiciously declined to use it. The German eID chip is Common Criteria certified by BSI, runs on silicon from Infineon and NXP, and has shipped in every Personalausweis since 2010. Smartcard-based eIDAS notified schemes exist across member states. Choosing American smartphone TEEs over that installed base was a particularly non-sovereign decision dressed up falsely as an architecture requirement.

Both attestation roots are supposed to terminate in key infrastructure operated by companies subject to US legal process, so the admission decision for an EU citizen’s identity credential runs through jurisdiction that the EU spent the last decade claiming to escape.

Schrems I and II were litigated over less.

UK Court: Zionism is Racist Colonialism

Whether the belief is right or wrong was not the issue decided; it was ruled that it is coherent to describe as racist an ideology promoting a state for only one race of people in a territory containing a large number of people of a different race, and where the ideology involves migration of the first group with imperial-power support to dislodge an indigenous population, it can coherently be described as colonial and imperialistic.

That’s just logic.

I mean, from a historical perspective the logic makes sense.

Zionism was Christian colonialism first, and the Christians effectively still run it: CUFI claims a membership larger than any American Jewish organization, and congressional support tracks the megachurches. Jews simply fell into a Christian operating structure built and maintained to eliminate the Jews.

Brightman was in 1609, Finch was arrested for it in 1621, Shaftesbury was lobbying Palmerston in 1839, Keith coined “a land without a people” in 1843, Hechler in 1884, Blackstone’s memorial to Harrison in 1891.

That’s all long before Herzl wrote a word. A Jewish restorationist line ran parallel, Alkalai in the 1840s, Kalischer’s Derishat Zion in 1862, Hess’s Rome and Jerusalem that same year, Pinsker’s Auto-Emancipation in 1882, and it stayed marginal because state power was always only allowed to be Christian.

The evangelicals converted states, delivering the Jerusalem consulate, the Balfour Declaration, and the embassy move that American Jews polled against. Rabbinic authority at Zionism’s founding rejected it almost unanimously, and the Jews who later embraced the state inherited a Christian architecture, the way converts inherit the church they had no hand in building. Christian states converted Jews to Zionism by closing every other door, where sermons had failed: Evian in 1938 produced no refuge, quotas ran through the genocide, and survivors were funneled toward the destination that feeds Christian prophecy.

Think about the Christian scripture that writes the ending: Church raptured out, Zechariah 13:8 executed, two thirds of the gathered Jews dead and the remnant converted, an extermination they fund and fuel as inevitable and good because the ingathering is the trigger for their own escape.

The Jewish religious mainstream refused the project at its founding, from the Pittsburgh Platform’s explicit renunciation of return to the Orthodox rejection of Herzl’s secular tract, and reversed itself only after Christian-armed states enforced it as survival (“go home or die” isn’t a choice when there’s no “home”).

If Zionism is anyone’s faith, it belongs to the militant evangelicals who built and armed it and who still preach an ending they fund: themselves raptured out first, then Zechariah 13:8 on the gathered, two thirds killed, the remnant absorbed by conversion. Their script requires ingathering as a trigger with their own absence from the horrific result.

The convert-or-die campaign survived intact into the present. It gained a state as the gathering mechanism, and its authors wrote an ending with themselves benefiting and the Jews gone.

Whew.

Long story short, whether you believe it is right or wrong, the record is clear that Zionism is Colonialism.

a blog about the poetry of information security, since 1995