A Munich penetration testing firm is running Berlin’s stolen files through open-weight AI models on its own hardware. Sascha Herzog of NSIDE ATTACK LOGIC told iX that his team uses models such as Qwen, operated purely locally, to pre-sort the Rhysida dump for its customers. One search run across the archive takes twelve to fifteen hours.

That is what I described on September 8 in RAIV in Berlin Says the Senate Has Time for Breach Triage. Ten RAIV (GPU rigs) of used video cards would have cost 35,000 euros, and finished in two weeks, while keeping the data in Berlin. The Senate’s Chief Digital Officer had told the Innenausschuss that “AI tools” would rank the files by risk. A private firm in the far away state of Bavaria has now shown that local open-weight models carry the work.

Herzog also reports he has hit some limits, which are well known. His model marked a document as classified because it contained the word “geheim” (secret). I mean, it does have the word secret. Context is hard. He says his customers in some cases assign staff for a week to read the filtered files by hand, which sounds light to this historian. Can you imagine if Germany had used that attitude to read their own archives? Just think of what would have happened to Siemens. Anyway, the AI model sorts and people do an actual finding, which is the division of labor a Berlin RAIV was built for. It’s not unlike how archaeologists and war crimes investigators work. They fly a plane over, using modern tools like radar, land and then dig by hand.

His download took two and a half weeks over Tor, while Rhysida rearranged the file structure three times. He reports only 5.25 terabytes and 1.431 million files. The archive published in September ran to 1.44 million. About nine thousand files are unaccounted for. Herzog says either his download missed them or Rhysida changed the archive after publishing, and he can’t say which. He says his firm has yet to analyze any of the 7-Zip archives inside the dump.

Herzog also makes the rather bizarre and unsafe comment that he personally feels that Berlin should have paid a ransom. What? What? Why? His argument is that the harm comes from publication. Rhysida took the data between August 7 and 12 and held it for three weeks before the deadline passed, but Rhysida sells to whoever pays. Whoever. Payment buys nothing but a promise from a criminal with zero enforcement. A paid Rhysida still has the files and still has a buyer, and can still leak. This is not news to anyone, hopefully.

Herzog then describes his work as a product. Customers name email domains, project names and keywords. His analyzer sells them the hits. The matching files are packaged and sent to the customer with a preliminary report and an HTML index that links to each file. Those files include the emails exchanged with two Senate administrations. They carry the names, addresses and words of Senate staff and of every other party on the thread. That seems rather broad, no? This guy is a leak administrator over all of it?

The legal basis receives one sentence in the interview:

we of course always observe the necessary legal framework.

How? Explain! But the interviewer moves on, leaving the most crucial detail unexplained. Herzog is handing leaked files to his customers on what basis? I turned down requests for hosting a free mirror of the dump just for journalists in September for exactly this reason. A copy of stolen files means holding a copy of third parties’ data, right?

Herzog says he saw data on critical infrastructure operators outside his customer base and calls them enormously affected. He says he is in contact with federal agencies and declines to say more. Again the interview moves on, and leaves open whether anyone has told those operators. Do they know he’s telling people other than them, if they don’t know themselves?

The interview is a bust. It ultimately skips the findings that matter most to Berlin, perhaps because, I don’t know, the expert sits in Bavaria? Does that explain anything?

The 21 administrative passwords that only vendors can change go unmentioned.

So do the Payone credentials and the water supply vulnerability analyses, and the intrusion detection budget the CDU-SPD coalition cut.

The article states that Berlin found the intrusion while investigating a domain controller fault on August 13. The interviewer never asks why a fault found what monitoring missed. Herzog’s advice to affected companies is boring and bog-standard: ask the authorities, warn staff about phishing, check what the leak says about your IT, tell the others on the thread.

Rotating every credential that touched the Senate, THE MOST IMPORTANT STEP, goes unmentioned.

The Senate told the Innenausschuss it needed AI tools. A firm in Munich has them running on local hardware and sells the leak without a clearly stated legal basis. The duty to tell the people in those files? Where does that sit, Berlin?

A copper line upgrade at a remote FAA site shut down every departure in the United States. Yeah. Telco engineers, you know what I’m talking about.

A contractor was switching the old line to new fiber on Friday afternoon. The router then flooded the rest of the air traffic network with more than 1,000 connection attempts every four to five seconds. That is about 250 a second, a trickle for any modern network. The FAA’s acting CTO said two sources were hammering the network and it settled down once both were switched off. That artificially created storm, as a self-Denial-of-Service, meant controllers lost reliable radio and radar.

This has been a known way to lose a whole network since way back in October 1980, when one faulty ARPANET node flooded every other node with bad routing updates and took it down for several hours.

Transportation Secretary Sean Duffy gave the above account on Saturday. The explanation came right from the top. On Friday night he had been singing a different tune. He told the White House briefing that it was the failure of old hardware and “our new IP switches did not go down.” Homeland Security Secretary Markwayne Mullin stood beside him and said the FAA was putting in new equipment and “it was overwhelming the older system.” Mullin was right, in the sense that a Friday afternoon upgrade went sideways. Yeah. Server engineers, you know what I’m talking about.

The FAA, unable to handle their own upgrade storm, held every departure from 3:54 p.m. to 8:15 p.m. Eastern. FAA Administrator Bryan Bedford counted 12,000 flights lost on Friday and expected 4,000 to 5,000 more cancellations on Saturday. The old network was fine carrying about 30,000 flights that day before a botched upgrade plan took it down.

On Friday a reporter asked Duffy directly whether FAA caused the outage with an upgrade. He answered by describing the old analog system. Cute. Asked what was different about the system that day, he said “we’re still working on the details of what went wrong today.” He named a cause and then claimed he didn’t know the cause in the same briefing. Because Duffy is actually spelled with two Ms. How do we know? He asked Congress for $50 billion to do more upgrades faster, and the next day said doing the upgrade is what caused the outage. Talk about a sense of fail-faster privilege.

The reporting was flying by this time, even though the planes could not. CBS sources described a botched network update within hours, and Bloomberg reported the FBI was examining whether a software update did it. CBS said the failure was Cisco routers built between 2001 and 2006 that fed out-of-sync data into the wider system.

Running Cisco gear that was built between 2001 and 2006, in other words staring down two decades of reliability, means having redundancy plans for redundancy plans for redundancy when anything is changed. Bedford said the FAA is replacing 2,000 of these Cisco routers with Juniper ones, so Friday’s swap is one of two thousand, supposedly following a playbook. Yeah. Disaster recovery engineers, you know what I’m talking about.

Secretary Duffy replied to a reporter asking why the FAA didn’t have an emergency backup plan:

I didn’t anticipate we’d have an outage like this.

Saturday’s accounting brought more clarity. An upgrade job caused the outage. Duffy revealed himself to be unfit for the role as he started calling the switchover straightforward work at a small location that should have had a small impact. Yeah, my man, I think everyone knows by now that it was not a small impact at a small location. It was a national security level disaster caused by a cascading fail-unsafe, on your watch. Service returned once engineers isolated the work that should have been isolated from before anyone put hands on the network. I can’t emphasize enough the self-incrimination of someone in charge who looks at the Hindenburg in flames and only offers the explanation that it was supposed to be a straightforward landing at a small location.

Is there someone else we can put in charge here? Someone who not only can anticipate but knows that prevention of outages, regardless of anticipation, is the actual job.

Duffy’s defense, almost unbelievably, is that doing nothing adds more risk that his fire, ready, aim approach. Ok, so Friday tested that claim and Duffy is exactly upside down and backwards. Doing something is what created the largest failure. The old copper line was carrying traffic until the switchover began. A rush into a changeover brought down the country. Without having any isolation, without having a clear idea of what could happen, doing nothing seems pretty damn smart. The line was due to be discontinued, so there was a need for work. The quality of a changeover, a safety procedure following decades of migration planning, was the FAA’s to manage. An upgrade managed this way is far, far more dangerous than the network it replaces.

The whole country had to be shut down! How much worse could the migration be managed?

Every part of the Duffy changeover plan failed.

The hour chosen was a peak moment of traffic, Friday afternoon with 3,500 aircraft in the air. Controllers told a Washington Examiner reporter that work like this is done midweek in the middle of the night (one of my favorite times to fly, especially into Dallas where you can skateboard all alone all night inside the airport). A reporter asked Duffy why the department did it at such a dangerously busy time, and he said small remote sites get switched over during the day while big facilities like Newark get done at night, and that the timing will be reevaluated. For what? Friday afternoon was the policy working as designed. It couldn’t be more obvious that the policy was approved on a dummy’s watch.

The impact was the whole country. Bedford said 17 of the 22 en route centers went unstable, and after 45 minutes of failing to find the cause the FAA grounded everything. He also said maintenance on this network is logged on paper, so officials had to dig through paper records to find out who was working where. Duffy said he was under the impression a small wire at a small site would have a small impact. Apparently his team assumed a network fault would stay local and not cascade everywhere. The recovery timeline was more than four hours, which itself negates the “small” framing. A day later the FAA is still choosing between contractor error and faulty equipment, which itself negates the “small” framing. The correctness of the installation and its configuration is still an open question requiring more research, even after it went live.

Richard Clarke, the former White House counterterrorism chief, told CNN Saturday morning that he expected a higher standard. New equipment is tested under high load in a sandbox before it goes live. Under Duffy, apparently America rams new equipment straight into the national airspace on a Friday afternoon without a clue.

Duffy pointed his finger at a contractor. He said L3Harris carried out the upgrade and it owns that legacy network. He told reporters he’s the victim of this story because “I’m stuck with L3Harris.” That seems suspect, because the FAA has had this contractor’s number for two decades. The technicians’ union warned after a 2007 Memphis outage that the network’s design made failures like it likely to happen again. In 2009 Harris installed a replacement router with a bad route configuration during planned maintenance, and the inspector general counted 129 air traffic facilities disrupted. Harris, now L3Harris, has held the contract since 2002. The FAA knew its performance, and even knew its priors in this exact context. After a Dallas outage in September 2025 the FAA said an L3Harris oversight failed to make sure the backup systems worked. In other words, when a manager already has faulted a contractor in writing, and then supervises that contractor’s next switchover, the finger pointing changes. The copper-to-fiber work is an FAA program on an FAA schedule. Who knows this? Duffy knows this. Why? Because in 2025 he was the guy who blamed Newark outages on a mishandled move of that airspace to Philadelphia. He called it the fault of… wait for it… the previous administration. Now his own FAA attributes those Newark outages in part to a move made before adequately testing the telecommunications lines. Friday was the same failure Duffy had criticized for failing before, now under his management.

You see the problem with him claiming he was surprised? It was supposed to be small. And the problem with him claiming it was the contractor? It was supposed to be someone else’s fault. And the problem with him claiming it was old equipment? It was supposed to be a win for upgrades.

The Government Accountability Office audited the program two months ago, just to give some idea of how this outage fits into Duffy’s risk management gaffe. Its September 2026 report records the FAA’s finding on the Newark failure. It also mentions that the FAA pulled the copper replacement deadline forward by 21 months, to December 2028. As of May it had replaced 2,560 of 5,170 copper lines. On Saturday Duffy said 69 percent are done, which works out to about a thousand switchovers in six months and about 1,600 still to go. Bedford called Friday’s router work routine maintenance outside the $12.5 billion modernization, yet GAO lists the copper replacement as a line in that very program. Each one of those 1,600, if Duffy doesn’t step up to the job required, has the risk we just witnessed on Friday.

To make a finer point, there’s other evidence Duffy is in a rush to fail faster. In August 2025 the FAA Administrator issued a blanket waiver that exempted the whole program from the agency’s acquisition rules, including its technology and security reviews. The waiver’s stated reason was that those reviews add months or years. GAO found 11,389 separate project schedules that the FAA had yet to join into one master schedule. FAA officials told the auditors that integrating them would be of little use. GAO said the installations were being scheduled with little attention to disruption of air traffic operations, and it warned of “more system outages, ground stops, flight delays, and safety incidents.” The Transportation Department partially concurred and claimed an integrated schedule already existed. GAO disagreed.

Speed was the stated goal. More national disasters, faster, as the predictable outcome. Just because someone put a Duffy in charge.

Duffy told Friday’s briefing the FAA is moving faster than it ever has. As if we needed to be told that after a botched upgrade shut down national airspace. His 2025 announcement of the program promised “we will not let government bureaucracy get in the way of results.” Yeah, he’s turning off all the safety. Man in a rush to stomp on the accelerator for air travel says he has no time to think about consequences. The department’s September release described spending $12.5 billion at “breakneck speed” calling all 13 workstreams on track. More like derailed by speed as the only measure. The FAA hired Peraton in December 2025 to be their single integrator, with the end of 2028 as the deadline.

Duffy Statement	Reality
The old hardware went down.	A contractor’s copper-to-fiber switchover at a remote site flooded it.
The new IP switches stayed up.	The upgrade work was the trigger.
The fix points to a legacy network problem.	The fix was isolating the upgrade work at the remote site.
Doing nothing adds more risk.	The old line worked until the switchover began.
Congress owes the program $50 billion.	Congress gave $12.5 billion in 2025. GAO is still waiting for a reliable cost estimate.

The old network has been declared obsolete. A November 2023 safety review commissioned by the FAA said so and warned that an unexpected failure could cut an entire regional center off from the network. After Friday’s nation-wide outage I think we can all agree a regional one would be lesser. The report should have raised the standard of care for every change that is meant to upgrade anything. A fragile, obsolete system is a known state in technology circles. It gets a digital twin, a sandbox, a parallel with a fail safe, a tested change in a quiet hour, with a rollback plan. The Duffy version of the FAA waived its reviews to hit a deadline Duffy set by one man’s calendar, done by the time Trump leaves office, like a rushed SpaceX rocket exploding on the pad.

On Friday Duffy had said he is happy to take the blame when the fault lies with the FAA. On Saturday he blamed the contractor. In 2025 he blamed the previous administration. Now that Bedford has promised a root cause analysis, it will be written by the agency that ran the program. Will it name who approved a Friday afternoon switchover? Will he point fingers and rush the next 1,600 if it doesn’t?

The bottom line is congress should cut-off Duffy from the upgrades and certainly not give him any more money, unless he demonstrates the minimum level of competency for the job. You don’t get to run with scissors and shutdown the entire nation on the basis you’re trying to prevent a small regional outage.

Duffy’s proof that the old network keeps failing is the local outages at Newark and New York, and then his Friday switchover took down the whole country instead. What a complete Duffy, spelled with Ms.

It’s been over six months since I wrote “The Boy That Cried Mythos“, and Anthropic’s vulnerability dashboard has been growing.

Let’s take a look at the 8,527 findings added in its latest month. During this same month, human reviewers checked 253 findings and maintainers pushed 113 patches. These three numbers come from Anthropic’s own counts. I got them by comparing the 2 November snapshot of its disclosure dashboard with the 2 October snapshot.

In April, in my section 8 of “The Boy That Cried Mythos”, I presented eleven things that a security capability claim should carry (things the Mythos system card lacked). Seven months later Anthropic’s own dashboard and Patrick Garrity’s November audit at VulnCheck reveal where we are now.

Missing in April	November Review
CVSS distribution	Anthropic reports 88% severity agreement between Claude and its external triage firms on 1,868 findings. Against maintainers, VulnCheck’s September cut had Claude at 91.5% critical or high and maintainers at 51.3%.
CVE enumeration	VulnCheck traces 442 CVEs to Anthropic, 0.5% of the 93,450 published this year. Anthropic’s dashboard counts 230.
Disclosure timeline	A public ledger of 7,349 entries, updated in bulk batches. The other 30,617 findings, 80.6%, have no ledger entry.
Comparison baseline	Still absent. Anthropic now describes its OSS Scanner as inspired by Google’s OSS-Fuzz.
False-positive rate	94.2% true positive, measured on the 6,376 findings that humans reviewed. That is 17% of 37,966. The other 83% are unreviewed.
Rediscovery ratio	1,654 ledger entries are marked duplicate, up from two in September.
Patching velocity	629 patched, which is 1.7% of findings. The month to 2 November added 113 patches and 8,527 findings.
Independent replication	curl published all 45 Anthropic reports with its verdicts. Seven were confirmed, all low.

Then in May I laid out the funnel behind the headline: 23,019 findings, about 8% of them checked by a human, and a true positive rate that described only the checked ones. The funnel continues to have a similar look in November. It has 37,966 findings and 17% are checked, where the dashboard’s patched count has gone from 97 in May to 629. That’s not nothing, but it’s still hardly something to get excited about. I feel like I’m reading about a security team doing security work, which usually has to pay to get a press release.

The true positive rate is the number Anthropic naturally leads their overheated marketing with, and it rose from 92.7% to 94.2% in a month. That’s a 1.5. Over that month the reviewed count rose by 253, from 6,123 to 6,376. The confirmed count rose by 335, from 5,674 to 6,009. That seems to show the confirmations were higher than reviews by 82. The dashboard shows a single snapshot instead of explaining the trend line. It does state that a duplicate counts as valid finding, and on that note the same update marked 1,654 entries as duplicates.

I’m not sure why duplicates are valid except as an attention inflationary tactic. Accountants know better, and so does every bug bounty program that credits the first report and cancels every single duplicate as nothing to see.

The dashboard’s count of findings reported to maintainers fell in the same month from 6,157 to 5,087, and Garrity’s own count reaches even lower to 4,866. The count that maintainers replied to fell from 5,103 to 3,635. The 94.2% covers only findings that went through triage. Of the 5,087 the dashboard counts as reported, 3,225 went out untriaged and carry this rather inconvenient label:

May contain false positives.

Yeah. Probably should say will contain false positives.

Anthropic’s two versions actually disagree on fixes. Garrity counts 217 marked fixed in Anthropic’s ledger while Anthropic’s dashboard says 629 patched. In September the same pair read 202 and 421. This interesting integrity gap has nearly doubled. I use the larger number in the table because it is the most generous reading available, and it still comes to only 1.7%.

I think it makes sense to check curl, because it has been so well documented.

First, in May a Mythos report claimed five confirmed vulnerabilities in curl and one survived as a low.

Second, in October the scanner found a real one. Daniel Stenberg called CVE-2026-92392, a high-severity use-after-free in HTTP/2 uploads, “one of the worst vulnerabilities in curl in a long time” and credited it to Luna Tong at Anthropic using OSS Scanner. curl fixed it in 8.23.0 on 14 October. That is a scanner working as a patch accelerator, which is exactly what section 10 of the April post predicted.

Third, this month Stenberg received 45 more reports from the scanner, each filed as a vulnerability, with one rated medium and 44 rated low. He estimated four hours of triage per report, so about four weeks of full-time work, and published all 45 as GitHub issues. His tally on 10 November accounts for all 45: seven confirmed at low severity, 37 “just a bug” and one completely false. Seven of 45 is 16%. Anthropic told maintainers at launch to expect a true positive rate above 90%.

The scanner can claim 44 real defects out of 45 as a headline driving announcement, while curl can count seven vulnerabilities, all low. The difference between them is the marketing, because Anthropic filed all 45 as vulnerabilities. It’s like when Ed Bernays ran propaganda to get people to eat more fatty, unhealthy bacon. He had a doctor ask 5,000 physicians whether a hearty breakfast beats a light one, about 4,500 agreed, and the newspapers ran it as 4,500 physicians urging hearty breakfasts, with bacon and eggs served up as the example. Nine out of ten doctors recommend. Recommend what? Look away, don’t check the details. That’s how disinformation tactics in America made bacon so popular, manipulating a report that never said eat bacon.

One report claimed request smuggling. Hah, gotta love that phrase. Stenberg’s verdict:

Sounds like a bug, not a vulnerability.

Classic. Every security professional hates to hear that. It’s like nails on a chalkboard. Each report now arrives with a reproducer and candidate patches, which answers some of what I was talking about last May. It still drops a bill of four hours on a maintainer. The same morning Stenberg counted 218 bugfixes merged from 49 authors in the 27 days since the last curl release, with 19 CVEs queued for the next one. Anthropic accounts for at most seven out of those 19.

We focus on curl when it is among the most fuzzed and audited C codebases known. The May report and this month’s batch produced eight lows between them, and October produced the one high. Results on other targets are notably different. Grav, a PHP content management system, turned 99 scanner findings into 22 advisories, and wolfSSL’s founder told Anthropic that 72 of 74 reports were valid. Stenberg wrote in May that any project new to this generation of tools will find a large pile of bugs, because that’s how technology works. New tools, new batches of bugs. It’s the obvious progression. A new analyzer behaves newly on code it has yet to see. By August Stenberg posted that Mythos was delivering nothing more in curl, and AISLE says its own tool still produced 29 reports and six CVEs. AISLE is the firm in April that reproduced the Anthropic launch showcase bugs on small open models, throwing a wet blanket on the whole announcement. Each tool, each pivot, will deliver bugs that others missed. In other words, finding bugs continues to be a commodity market.

Attackers are also ignoring the marketing, making use of bugs found by other means. Jeremiah Grossman’s Vulnpocalypse Report for Root Evidence went looking for an AI surge in exploitation across 253,912 CVEs published since 2018, of which 3,769 were exploited. The exploited share held flat to falling and the median time from patch to exploitation widened. Its conclusion:

AI has changed one group so far, and we can name it: researchers.

That’s basically what this blog has argued since April. The proof is in. A follow-up Root Evidence chart of this year’s CVEs entering VulnCheck’s exploited list shows weekly additions rising from six in the first quarter to 16 in the third, with WordPress plugins left out. The bars sum to roughly 500 exploited CVEs through 8 November. Root Evidence notes that later weeks draw on a larger pool of CVEs, so part of the climb is just dumb math. VulnCheck’s list holds two CVEs credited to Anthropic. Glasswing launched on a claim of thousands of high-severity vulnerabilities in every major operating system and browser. Shocking if true! But then all but two of the bugs that attackers used this year came from NOT the cartel of Anthropic. When Mythos 5 came out in June, the successor to the preview that had been billed as too dangerous to release, Anthropic put the same underlying model on general sale as Fable 5 behind a filter.

Also in June I set a test for the 90-day report Anthropic promised at launch. A verified CVE list with reproduction steps would substantiate the claims they had made. Headline figures restated without independent verification would confirm the pattern. The deadline passed by July 6th and the May update remained our only report to chew on. What exists for us since is just the dashboard and an October announcement. The open source side of the program met part of it with 230 CVE records on the dashboard and scanner reports that ship with a reproducer. However, the partner side is what the consortium launch was supposedly all about, and it closed with… a survey. Glasswing ended as a named program on October 6th (what is it about the 6th?), when Anthropic merged it into its Cyber Verification Program. The closing number was 129,000 verified vulnerabilities found by partners, based only on a survey from some of those partners. It all seems shady, because the two partner counts I checked earlier both shrank against the published advisories. Mozilla’s 271 reconciled to three Anthropic-credited CVEs, and Palo Alto’s 26 falls to 20 once its own exclusion is applied.

Section 9 of my Cried Mythos post said this about speed:

A tool that accelerates discovery without accelerating remediation grows the backlog; it does not shift the threat model.

In May I called the result a firehose in a blizzard.

Section 10 of my Cried Mythos post said a defensive tool calls for a CVE velocity report in place of a fire alarm. The dashboard is that report, and it reads 113 patches against 8,527 new findings.

On 8 October Anthropic wrote that verifying, disclosing and fixing vulnerabilities “is slow and still depends on people”.

The billions and billions of dollars spent on Anthropic now pumps out raw sewage reports unreviewed to the projects that opt in, while the humans cleaning up the spill are volunteers known as maintainers.