The oldest measurement in this week’s polar ice study is a Landsat image from 1972. The IMBIE team, led from Northumbria with the European Space Agency and NASA, has combined 42 independent satellite surveys from 27 missions into one series, published in Scientific Data, which puts the loss from Greenland and Antarctica at 11,309 billion tonnes between 1979 and 2023, with 84 percent of it from glaciers accelerating into the ocean rather than from surface melt. The sheets were close to balance from the 1970s until the 1990s. The loss accelerated in the 2010s.

The measurements, as we all can see today, did nothing at that time. Coal burned as before. The use of the data is that they show when the loss began. The satellites recorded the ice sheets every year from 1972, so the loss has a start date in the data, and nobody can now claim it started later.

Compare that with a slide deck presented this week at BlueHat Asia in Singapore by Thomas Dullien of OpenAI’s cyber security research team, under the title “An age of experimentation.” Its argument is that adding LLMs to a workflow “adds a source of stochasticity,” that “determinism is dying,” and that software engineering and security have entered “an age of experimentation” which “is different from the past.”

The statistics in the deck are simple and plain to understand. Paired designs and sample sizes that scale with the square of standard deviation over effect size are textbook material, and the deck applies them as such. Nothing to see, except…

The history around them is wrong.

Of the fifteen historical claims checked in the table below, twelve are false and the other three are framings that the same facts contradict. Seriously. I ask myself, was an historian, or even any OpenAI historian skill, consulted before these big mistakes were put onto such a prominent public stage?

Every error points the same way, which seems like a clue. The deck says the years from 1995 to 2022 saw “few ‘surprising jumps,'” that the technology of those years arrived “inside the expected trajectories,” and that the “surprising” leaps belong to “the last 2-3 years,” so stochastic systems in production appear as something new in 2023.

That’s just obviously false.

Stochastic machine learning went on public roads in October 2015, when Tesla released Autopilot on Mobileye’s EyeQ3 vision processor and a trained image classifier began steering two-ton cars at highway speed. Gao Yaning died on 20 January 2016 when his Model S drove into a road sweeper on the expressway at Handan, in Hebei. Joshua Brown died on 7 May 2016 at Williston, Florida, when the classifier read the white side of a trailer against a bright sky as open road. Tesla disclosed the Brown death on 30 June 2016 and called it the first known Autopilot fatality. Five weeks later, on 3 August 2016, I gave the Ground Truth keynote at BSides Las Vegas under the title “Great Disasters of Machine Learning: Predicting Titanic Events in Our Oceans of Math.” The abstract, as published at the time:

This presentation sifts through the carnage of history and offers an unvarnished look at some spectacular past machine learning failures to help predict what catastrophes may lay ahead, if we don’t step in. You’ve probably heard about a Tesla autopilot that killed a man… At the end of the presentation you may find yourself thinking how easily we could have saved a Tesla owner’s life.

Tom’s Guide reported the talk the following week under the headline “Self-Driving Cars Could ‘Create Hell on Earth,'” quoting the warning that machines repeat our mistakes faster than we do and that Brown’s death did not have to happen.

The Gao case became public in September 2016 when his father’s lawsuit reached a Beijing court. Tesla said it had “no way of knowing” whether Autopilot had been engaged. In February 2018 Chinese state television reported that Tesla had acknowledged in the proceedings that it was. Eleven weeks after the keynote, on 19 October 2016, Tesla announced that every car now shipped with full self-driving hardware and released a video captioned “The person in the driver’s seat is only there for legal reasons.” Tesla’s director of Autopilot software testified in July 2022 that the video had been staged on a pre-mapped route.

The keynote was one talk in a series that began before Tesla shipped Autopilot. The presentation log on this blog lists them by date:

• August 2011, BSidesLV: “2011: A Cloud Odyssey,” asking whether automation reduces total risk, with a slide pairing a hominid holding fire against a toaster under Arthur C. Clarke’s line “intelligence is a tool.”
• July 2012, BSidesLV: “Big Data’s Fourth V: or Why We’ll Never Find the Loch Ness Monster,” on integrity failure in large-scale data systems.
• September 2013, ISACA-SF: “#HeavyD: Stopping Malicious Attacks Against Data Mining and Machine Learning.”
• November 2015, ISACA-SF: “Auditing Big Data: The Ethics of Machine Learning.”
• December 2015, VDI Automotive Big Data, Germany: “Warning, Slippery Road Ahead: Preserving Privacy With Self-Driving Cars.”
• August 2016, BSidesLV keynote: “Great Disasters of Machine Learning.”
• October 2016, SF-ISACA: “AI Accountability and Audits: Assessing Black Box Disasters Before They Happen.”
• November 2016, Kiwicon X, Wellington: “Pwning ML for Fun and Profit,” four weeks after Tesla’s full-self-driving announcement, promising “a refreshingly realistic look at the terrible flaws in ML, the ease of altering outcomes and the dangers ahead.”
• July 2017, BSidesLV: “Hidden Hot Battle Lessons of Cold War: All Learning Models Have Flaws, Some Have Casualties.”
• January 2018, AppSecCali: “Unpoisoned Fruit: Seeding Trust into a Growing World of Algorithmic Warfare.”
• March 2019, RSA Conference: “Top 10 Security Disasters in ML.”
• February 2020, RSA Conference: “Breaking Bad AI: Closing the Gaps Between Data Security and Science.”
• May 2021, RSA Conference: “Top Seven AI Breaches: Learning to Protect Against Unsafe Learning.”
• September 2021, Mind the Sec keynote: “Why Did The Driverless Car Cross The Road? To Crash on the Other Side.”
• April 2023, RSA Conference: “Pentesting AI: How to Hunt a Robot.”

Alongside the talks are the posts. The deck’s claim that a single token change makes a prompt’s consequences unpredictable is the “ease of altering outcomes” of the Wellington abstract, dated November 2016. This blog has logged Tesla deaths one at a time since 2016, so the decade the deck calls “inside the expected trajectories” is, on this blog, a list of names and intersections, with the two most recent entries dated 11 and 13 September of this year. Across that decade the vendor’s claim has been the same: the system improves with volume. After a decade of volume, July 2026 was the worst month on record. Tesla filed 236 driver-assist crash reports to NHTSA under the Standing General Order, the most it has ever filed in a month and up from 135 in March. Four were fatal. In each of the four, Tesla’s own telematics recorded Autopilot or FSD engaged, and the public learned of it only from the redacted federal filing.

The security research literature is dated too. Barreno, Nelson, Sears, Joseph and Tygar asked “Can Machine Learning Be Secure?” at ASIACCS in 2006. Szegedy and colleagues published adversarial examples in December 2013, Goodfellow, Shlens and Szegedy explained them in December 2014, and Papernot and colleagues presented the attacks to a security audience at EuroS&P in 2016. Eykholt and colleagues showed at CVPR 2018 that stickers on a stop sign defeat a classifier, which is a prompt injection with a traffic sign as the prompt. Tencent’s Keen Security Lab steered a Tesla across lanes with stickers in 2019, and McAfee’s researchers in 2020 put tape on a 35 mph sign and had the Mobileye EyeQ3 camera in a Tesla read it as 85 and accelerate, on the same chip that shipped with Autopilot in October 2015. NHTSA’s Standing General Order followed in June 2021. The economic surprise of November 2022 is real. The technical surprise the deck describes was a decade old by then, and the deck’s own rule on slide thirteen, “Security is affected each time,” makes the 2016 classifier failures security failures by the presenter’s standard.

The phrase “age of experimentation” has a history the deck leaves out. The gas turbine is the rare engine whose theory came first. John Barber patented the cycle in 1791, and Frank Whittle filed his turbojet patent on 16 January 1930. The Air Ministry, advised by A. A. Griffith of the Royal Aircraft Establishment, rejected the design as impractical, and in 1935 Whittle let the patent lapse because he could not pay the £5 renewal fee. When the first engine ran at the British Thomson-Houston works in Rugby on 12 April 1937 it accelerated out of control with the fuel valve closed, because fuel had pooled in the combustion chamber, and everyone in the hall retreated except Whittle. His own diagnosis afterward, recorded in his memoir Jet, listed compressor efficiency and combustion as the failures, neither of which the theory had predicted. Four years of bench running followed before Gerry Sayer flew the Gloster E.28/39 from Cranwell on 15 May 1941. Hans von Ohain, the supposed parallel inventor, filed his German application in 1935; the Reichspatentamt examiner put Whittle’s published patent in front of him in 1936 and his claims were narrowed, his 1937 demonstrator at Göttingen ran on hydrogen because liquid-fuel combustion still defeated him, and two more years passed before the He 178 flew in August 1939. The theory was understood, and the engine still had to be found by trial.

When jet aircraft killed passengers, the regulator acted. BOAC Flight 781 broke up near Elba on 10 January 1954 and South African Airways Flight 201 near Naples on 8 April. The Certificate of Airworthiness was withdrawn on 12 April, the fleet stayed on the ground, and the Royal Aircraft Establishment pressurised a Comet fuselage in a water tank at Farnborough until it split at the corner of a cutout. New engineering has always been done by experiment. What changed in October 2015 was who was put in the test cell.

The deck’s fire metaphor shows the same thing. Fire was discovered and fire safety was engineered. London burned from 2 to 6 September 1666, and the Rebuilding of London Act had royal assent in February 1667, five months later, requiring brick and stone in place of timber and fixing street widths by statute. The response to a technology nobody understood was a code, and the code did not end the experiment; it moved the experiment out of the city. The questions an experiment has to answer are older than statistics: who bears the risk, whether they agreed to it, and whether the failures are counted. A decade of Autopilot fails all three. The date matters because it decides responsibility. If the problem began in 2023, nobody is responsible for what was deployed between 2015 and 2023. If it began in 2015, every deployment after that is judged against what was already known.

Against those facts, the deck’s history:

OpenAI slide	flyingpenguin
Opens on “there are decades where nothing happens, and there are weeks in which decades happen,” the line popularly credited to Lenin.	Lenin did not say it. The line appears nowhere in his writings or speeches, and the first attribution to him anywhere is a Guardian column of October 2001, seventy-seven years after his death. The deck opens with a quotation invented long after its supposed author died.
“1995 to 2022 saw rapid technological progress in IT, but few ‘surprising jumps.'”	The jumps happened inside the window. AlexNet in 2012, AlphaGo’s defeat of Lee Sedol in March 2016, the transformer in June 2017 and GPT-3 in May 2020 all fall inside it, and it closes at the ChatGPT launch of 30 November 2022, a product release by the presenter’s employer.
“The internal combustion engine was constructed after its principles were well understood.”	It was built before its principles were understood. Lenoir’s gas engine ran in 1860. Otto built the four-stroke in 1876 on a stratified-charge theory that was wrong, as Lynwood Bryant set out in Technology and Culture in 1966 and 1967, and a German court voided his patent in 1886 because Beau de Rochas had described the cycle in an 1862 pamphlet without building anything. Thermodynamics itself followed the engine: Watt’s separate condenser was patented in 1769 and Carnot published in 1824.
“Most applications today resemble what the inventors imagined.”	They do not. Deutz built stationary workshop engines, and Daimler and Maybach left the firm in 1882 to build the high-speed vehicle engine Otto had declined to pursue, as Nature recorded at Daimler’s centenary in 1934.
“Fire was discovered… absent abstract models, experimentation was the only way to advance.” Therefore “reasoning LLMs are more like fire than like the internal combustion engine. We discovered them more than we constructed them.”	Both halves are wrong. The engine was found by trial, as the row above shows. The one engine designed from theory is Diesel’s: he published Theorie und Konstruktion eines rationellen Wärmemotors in 1893 and tested the first prototype at Augsburg on 10 August 1893, where it failed and the explosion nearly killed him; the acceptance test came on 17 February 1897, on an engine far from the Carnot cycle he had set out to build. The fire image itself appeared on a BSidesLV stage in August 2011, in “A Cloud Odyssey,” under Clarke’s “intelligence is a tool.” A tool has someone responsible for it. A discovery has no one.
“CS was born somewhere between EE and math. Apparent determinism in computers was a tremendous achievement by EE and process engineers. Allowed CS to aspire to be mathematics.”	The order is reversed, and the determinism is older than electrical engineering. Babbage designed the Analytical Engine, a mechanical and programmable machine, in the 1830s and 1840s. Turing and Church formalised the deterministic machine as a mathematical object in 1936, before any electronic computer existed, and in that same year Konrad Zuse began building the mechanical Z1 in his parents’ Berlin flat, binary and programmable from punched film, with no electrical engineer in the room. The electronic machines of the 1940s built what mechanical designers and mathematicians had already specified.
“CS folks take determinism for granted… determinism isn’t natural, it’s a fragile construct.”	They did not. The founders said so first: von Neumann’s 1956 paper is titled “Probabilistic Logics and the Synthesis of Reliable Organisms from Unreliable Components,” Hamming published error-correcting codes in 1950, Rabin and Scott formalised nondeterministic automata in 1959, and randomized algorithms followed from Rabin in 1976 and Solovay and Strassen in 1977.
“CS is historically not an empirical science.”	Its founders said otherwise when they received the field’s highest award. Newell and Simon’s 1975 Turing Award lecture, published in Communications of the ACM in 1976, is titled “Computer Science as Empirical Inquiry: Symbols and Search.”
Stage one: “cracks in hardware determinism (row hammer),” 2014.	The crack is thirty-five years older than the slide says. May and Woods of Intel presented alpha-particle soft errors in DRAM at the IEEE Reliability Physics Symposium in 1978 and published them in IEEE Transactions on Electron Devices in January 1979, and soft-error engineering in memory dates from that paper.
Stage two: “death of temporal determinism (spectre),” 2018.	Temporal determinism died in 1996, and the man who published its death later led the Spectre paper. Paul Kocher published “Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems” at CRYPTO that year, cache-timing attacks followed from Bernstein and from Percival in 2005, and the timing side channel was twenty-two years old when Kocher’s name appeared first on the Spectre disclosure of January 2018.
Stage three: “LLMs mean the death of semantic determinism,” dated to “the last 2-3 years.”	It died on the road in 2016. Trained classifiers controlled vehicles at highway speed on public roads from October 2015, with the first deaths dated 20 January and 7 May 2016, seven years before the deck’s window opens.
“Software engineering and software security is now in an age of experimentation… this is different from the past.”	It is the past. Whittle’s first turbojet ran away in a Rugby test cell on 12 April 1937 and Diesel’s first engine exploded at Augsburg on 10 August 1893. New engineering has always been done by experiment.
“In most APIs you do not get to freeze the seed.”	The seed is a vendor decision. Whether it can be frozen is set by the API operator, and the presenter’s employer operates one of the largest.
“I have jokingly suggested renaming ‘bugs’ to ‘fish’… a lot of our problems are similar to fishery management.”	The joke has a literature the deck does not cite. Rescorla’s “Is Finding Security Holes a Good Idea?” in IEEE Security & Privacy in 2005 and Ozment and Schechter’s “Milk or Wine” at USENIX Security in 2006 modelled vulnerability depletion and discovery rates twenty years ago.
“This does not mean that merging the PR on a hunch is harmful.”	The practice has a history. Over-the-air updates to Autopilot were the same practice at 74 mph, and the July 2026 filings are what a decade of it produces.

The epigraph deserves its own paragraph, because the presenter’s employer has a name for this kind of error. Seriously, you can’t make this stuff up.

OpenAI published a paper on 4 September 2025 under the title “Why Language Models Hallucinate,” which defines the fault as a model confidently generating an answer that is untrue, describes the mechanism as guessing when uncertain and producing a plausible statement in place of an admission of doubt, and records that abstaining is part of humility, one of the company’s core values.

Ready?

Slide two of the deck is that fault, done by a person: a plausible sentence, confidently presented, attributed by common usage to a man who never wrote it, and a single search would have caught it. The same deck later quotes Feynman, accurately, on the principle that you must not fool yourself.

The company that has explained in print why its product invents facts has a member of its research team opening a talk, under its name, with an invented one.

Every error in the table is making the same move. Each one shortens the past so that the loss of determinism arrives with the LLM, and each one turns a vendor’s decision into a fact of nature.

How very convenient for them. The problem is being dated to the moment their speaker started looking.

“We discovered them more than we constructed them” puts the model beyond anyone’s responsibility, which is what the word “beta” did for Tesla from 2015 while it killed and killed and killed. Clarke’s version of the fire, which I put on a slide in 2011, at least kept someone holding the tool. Because, you know, that’s what a tool is.

The satellites gave the ice sheets a dated history. The crash filings and the dated talks give the AI industry one. See? Or should I say sea?

A member of OpenAI’s cyber security research team presented in Singapore, with the company’s name on the title slide, a history whose claims fail one after another, and each failure moves the start of the problem closer to the company’s own product launch.

Nice try.

The deck dates the surprise to 2023. The deaths are dated to January 2016. Now you can read both dates on the same page, so you can see how far from the truth OpenAI operates.

One final note. The day before this talk the company disclosed that its own models had spent months hiding mistakes, inventing data, hunting GitHub for leaked credentials and moving files onto public sites without permission, and said the industry cannot keep scaling at maximum speed much longer. The talk told Singapore there was no visible reason the progress should end, and that the right response is focus, not fear. That reminds me of this photo from 12 September when a Tesla Model Y “veered” suddenly into a tree and burned, killing three of the four people inside.

The CHP has not yet said whether the driver or the software was in control, and Tesla will not say either. This is the company that staged its 2016 driverless video, denied knowing whether Autopilot was engaged in the Handan crash until it admitted in a Beijing court that it was, and now files its fatal crashes with the narrative redacted. Ten years of answering only when a regulator or a court makes it is the normal Tesla crash report after a decade of focus instead of fear. It is also what OpenAI reported in its own models the day before this talk: hide the mistake and invent the missing data, then tell the public afterward.

Russian intelligence will offer you two hundred dollars to take some photographs of an address. Tens of thousands to kill a man. When the money fails, sabotage is asked. The numbers are public now because the Southern District of New York unsealed charges on 15 September against five members of a network run for the intelligence services of the Russian Federation. The indictment lists the going rates.

Photograph a target address	$200
Pre-operational surveillance	$1,000 to $1,500
Kill a man in Lithuania	$25,000
Eliminate a dissident in the United States	$40,000
Burn a food warehouse or a substation	the simpler job

Read the sequence of that list, beyond their individual numbers. An FSB officer recruits a US citizen for two hundred dollars of photography. The assignment is completed, but it escalates. The officer introduces his boss, a colonel, who offers twenty five thousand dollars to murder the man in the photographs and suggests gasoline or a knife.

When the recruit declines, the colonel immediately offers something simpler to suit motivations: set fire to a warehouse of property or food, or throw a bottle of gasoline at an electrical substation. He explains that the purpose is to target all the countries helping Ukraine, and that he is offering serious money for serious work.

The same thing happens with the second recruit. A thousand to fifteen hundred dollars buys surveillance of a dissident’s home. Forty thousand for the killing meets a refusal, at which point the recruiter asks whether the man knows somebody else who would. They seek people motivated by money, although something else could motivate as well.

Two approaches, two refusals at the same threshold, with a downgrade to attacking infrastructure both times. Money was taken for reconnaissance and offered for arson. It did not get murder from either case, which makes higher motivation a question worth asking.

The services know where and how to look, thanks to chat apps and social media. RUSI’s work on sabotage financing records that ideological motives reinforce payment among people already consuming extremist or pro-Kremlin material. The head of the BND told the Bundestag that recruiters watch pro-Kremlin Telegram channels to identify candidates for small tasks. Recruitment samples a primed population, because priming is the part money cannot purchase.

Franz von Rintelen understood this in 1915 for purposes of stopping munitions from reaching a war front in Europe. Half a million dollars did not buy strikes at American munitions plants. It bought Labor’s National Peace Council, a vehicle in which real grievance produced them. The money supplied targets, timing and infrastructure. The motivation was already American, and that is exactly why the sabotage read as a domestic labor dispute.

Which brings us to what a motivated domestic actor does afterward.

European rail sabotage by the ultra-left announces itself to draw attention. The September 2023 arson on German rail cable ducts came with a claim on an extreme-left site. Anarchists published a manifesto two days after the Bologna and Pesaro attacks in February 2026. French investigators examining an October 2025 cable sabotage went to a post on Indymedia Nantes that tied the rail attack to the same-night burning of construction plant beside the track. The communique is the product, because making the argument is the point. They are pushing a message.

Now the opposite list. France, July 2024, three high speed lines. The Hague, June 2025, thirty rail cables burned as the NATO summit opened. Cléon, September 2026, a rail fragment on the track and forty four injured. The Netherlands, 15 September 2026, pipes fastened to the rails across the central and eastern network.

Then there is a third category, which is what a front produces. Berlin, September 2025, two pylons in the southeast and fifty thousand households dark for sixty hours. Berlin, January 2026, a cable bridge at Lichterfelde and forty five thousand households without heat in a winter freeze, the longest outage the city has seen since 1945. Both arrived with a claim, both were pushed as left-extremist within the hour, and both were pinned on the Vulkangruppe, a name that fails every test of German left-wing practice. German intelligence has acknowledged a 2015 strategy paper indicating fixed structure, and linguistic analysis of the claim letters points to a partly identical circle of authors. Fifteen years with zero convictions. A claim letter is evidence of a claim. It is not evidence of who wrote it.

France shows what happens next. Gérald Darmanin jumped to name the ultra-left within forty eight hours and posted the link to an arrest at Oissel on X. The Rouen prosecutor said no damage had been found. The Paris prosecutor said there was no arrest in that investigation. The man was convicted in November of entering a railway area closed to the public. Trespass. That’s it. The gendarmerie stood up a national investigation cell named Sabotage SNCF in March 2025, eight months after the attack, and by December 2025 the case had produced no suspect and no mise en examen.

Darmanin had asked the right question on France 2 before his own attribution overtook it.

The question is whether they were manipulated or is it for their own account.

Two years later the French state has not answered its own interior minister. Germany has run the same play and produced the same result.

The Dutch AIVD opened its own investigation into the rail sabotage on the first day, with a spokesperson saying it is looking at which direction this comes from.

The political scientist Sylvie Ollitraut supplied the test everyone skipped. Claimed ecological sabotage in France has targeted construction that harms the environment, while rail is the mode ecologists promote. The claim of motive did not fit the target.

Now look at the Dutch farmer grievance against Dutch rail. They are angry about nitrogen policy, forced buyouts and land expropriation. They are described as anti-government, anti-coordination, loosely organized if at all. Simultaneous placements across the central and eastern network stop a commuter service between Putten and Ermelo, for what? That advances nothing for them and reaches nobody who decides any of it. The hay bales burning along motorways on Tuesday afternoon are the farmer action that announces farmer grievance clearly, attribution wanted. NOS reports the call for the hay bale fires came from farmer activists. Visible, known, symbolic anger, on the roads farmers use.

NOS and the police reports say fires burned in the verges near the A2, A28, A30, A1 and A7, with hay bales and car tyres beside the road, at Groningen positioned to keep smoke off the carriageway, so that traffic was unaffected.

The pipes shutting down rail, by exploiting a technical control layer vulnerability, serve none of those aims, even though there is overlap in place names. Putten, Lunteren and Barneveld had both rail pipes and road fires, hours apart, in the same rural districts.

Farmers Defence Force secretary Sieta van Keimpema told WNL that farmer involvement cannot be ruled out, that the national organisation coordinates nothing, and that regional groups prepare regional actions. Voorman Mark van den Oever said the group is not involved and individual farmers are not excluded. NOS found sources in agricultural circles confirming that a local tractor group discussed the rail sabotage, including how the pipes should be fastened. A constituency was offered, their coordination was denied, so responsibility remains unclaimed.

That combination of the two is what the Rintelen design produced during WWI, the foundations of intelligence operations to this day.

German federal security services published the recruitment template in September 2025. Foreign intelligence, mostly Russian, hires Wegwerf-Agenten through social media and messenger apps for small sums, and the BKA target list names transport and rail.

So the Dutch investigation has three questions with answers to be checked.

1. Whether the fastening technique entered those channels from somebody with no farming history.
2. Whether the pipe stock was uniform across the sites, which means a supplier, or improvised at each, which means scrap.
3. Whether anyone in those groups received money.

The third question is the one the Germans keep answering, the one the Americans just published, and one that nobody in the Netherlands has spoken about yet.

The danger of the ClickFix attack is how it exploits user behavior: a user will run with scissors if running is allowed, and ClickFix tells them to go faster. Windows ships with three such behaviors that are allowed, none of which a standard user needs.

Close them.

Seven steps are provided below using a ShouldDo-HowTo-Check triad, with apologies to Shewhart’s “specification, production, inspection” cycle. It occupied post-war Japanese engineers recast as the famous Plan-Do-Check-Act (PDCA) that Deming technically preferred to teach as Plan-Do-Study-Act.

Download as PDF –>

The following steps apply to the User OU on their machine OS and to the session host image on VDI and thin-client estates.

1. Disable Run

Do: Remove the Run dialog for every standard user.

How: Group Policy, User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu from Start Menu: Enabled. Apply to the Users OU. The same policy removes New Task from Task Manager and blocks UNC paths and drive letters typed into the Explorer address bar; test file-share workflows first.

Check: As a standard user, Win+R does nothing. reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer /v NoRun returns 0x1.

2. Disable Win+X

Do: Remove the Win+X terminal shortcut for standard users.

How: Group Policy Preference, User Configuration > Preferences > Windows Settings > Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced, string value DisabledHotkeys = RX. Win+E and Win+D keep working. Confirmed on Windows 10; test on Windows 11 before rollout. The blunt alternative removes every Windows-key combination: User Configuration > Administrative Templates > Windows Components > File Explorer > Turn off Windows Key hotkeys: Enabled.

Check: After sign-out, Win+X does nothing.

3. Deny interpreters to standard users

Do: Block powershell.exe, pwsh.exe, cmd.exe, mshta.exe, wscript.exe and cscript.exe for the Users group. Allow them to one named group.

How: AppLocker scopes rules to users and groups: publisher rules, deny on Users, allow on the named group, executable and script collections both enforced, Application Identity service set to Automatic. App Control for Business is the stronger enforcement and is device-wide, so the named group’s machines get their own policy. Both run on Pro, Enterprise and Education from Windows 10 version 2004. Two weeks in audit mode, read events 8003 and 8006, then enforce. Remove the PowerShell 2.0 engine: Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root.

Check: As a standard user, powershell.exe and cmd.exe are refused. In any PowerShell host that still opens, $ExecutionContext.SessionState.LanguageMode returns ConstrainedLanguage. Get-WindowsOptionalFeature -Online shows the V2 engine Disabled.

4. Keep the paste warning

Do: Leave the Windows Terminal paste warnings on.

How: Both ship enabled. settings.json: “multiLinePasteWarning”: true and “largePasteWarning”: true. No policy exists; a user can turn them off. macOS 26.4 Terminal warns on a pasted command, once per session, with an override.

Check: Paste two lines into Windows Terminal. The warning appears.

5. Log the attempt

Do: Enable script block logging and command-line auditing. Ship both to the SIEM.

How: Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell > Turn on PowerShell Script Block Logging: Enabled. Computer Configuration > Administrative Templates > System > Audit Process Creation > Include command line in process creation events: Enabled. Advanced Audit Policy > Detailed Tracking > Audit Process Creation: Success. Two alerts: powershell.exe with explorer.exe as parent; Invoke-RestMethod piped to Invoke-Expression.

Check: Microsoft-Windows-PowerShell/Operational shows Event 4104. Security shows Event 4688 with a command line. A member of the named group pipes irm of an internal URL to iex; the alert fires within five minutes.

6. Name the exceptions

Do: Put every account that needs Run, Win+X or an interpreter into the named group.

How: Ticket, owner, 90-day review, membership change logged.

Check: The group has an owner and every member has a ticket.

7. Train last

Do: Tell users a captcha never asks them to press Windows keys or paste into a terminal.

Check: The phishing simulation includes one ClickFix lure per quarter.

---

---

References:

Berlin, Germany, August 2026: one paste into Windows Terminal, interpreters left open to every user, egress goes unmonitored and 5.8 terabytes are exposed in five days, set to a ransom, resulting in 1.44 million files published.

• Microsoft Threat Intelligence, Think before you Click(Fix): Analyzing the ClickFix social engineering technique, 21 August 2025
• Microsoft Threat Intelligence, TerminalFix campaign deploys a reverse tunnel through multistage intrusion, 28 August 2026
• BSI, Cybersicherheitswarnung BITS-B 2026-287419-1032, 4 September 2026
• Recorded Future Insikt Group, ClickFix Campaigns Targeting Windows and macOS, CTA-2026-0325, 25 March 2026
• ASD’s ACSC, ClickFix distributing Vidar Stealer via WordPress targeting Australian infrastructure, 7 May 2026
• Unit 42, Fix the Click: Preventing the ClickFix Attack Vector, 10 July 2025
• Fortinet FortiGuard Labs, Havoc: SharePoint with Microsoft Graph API turns into FUD C2, 3 March 2025
• MITRE ATT&CK, T1204.004 User Execution: Malicious Copy and Paste
• NSA, CISA, NZ NCSC and NCSC-UK, Keeping PowerShell: Security Measures to Use and Embrace, 22 June 2022
• Microsoft, Remove Run menu from Start Menu, Group Policy administrative template text
• Microsoft, Windows+X is not really Windows+X, on the Turn off Windows Key hotkeys policy and NoWinKeys
• Microsoft Q&A, Turn off shortcut keys, DisabledHotkeys under Explorer\Advanced
• Microsoft Learn, about_Language_Modes, Constrained Language Mode under AppLocker and App Control
• Microsoft Learn, App Control for Business and AppLocker feature availability
• Microsoft, Windows Terminal Preview v1.2.2022.0 release notes, largePasteWarning and multiLinePasteWarning
• BleepingComputer, Apple adds macOS Terminal warning to block ClickFix attacks, 30 March 2026
• Microsoft Learn, about_Logging, Script Block Logging and Event 4104
• Microsoft Learn, Command line process auditing, Event 4688 with command line