Author: Kayne

Wait, what? Original research on a Friday? I was chatting with a friend recently, and they started asking about the “risks of MCP.” And I wasn’t sure if they were talking about the protocol (the code, the specifications) or the MCP servers that companies have been deploying as a shim for systems that don’t have…

Key quote: An expert witness’s methodology is fair ground for discovery, see, e.g., Macchia v. ADP, Inc., 711 F. Supp. 3d 162, 167-68 (E.D.N.Y. 2024), and under the facts of this case, the process by which Dr. Oreskes culled down the defendants’ document production into a subset to be worked with is an aspect of…

Key quote: “An operator shall not knowingly and intentionally cause or program an AI companion chatbot to make any representation that it is licensed, certified, or otherwise authorized to provide professional mental health, behavioral health, medical, or counseling services, unless the operator is lawfully authorized to provide such services.” Why it matters: Georgia isn’t just…

Key quote: The guidelines are intended to support providers, deployers and other relevant actors in determining whether an AI system falls within the high-risk category. They offer clarifications on the relevant provisions of the AI Act and include practical examples to illustrate how the classification should be assessed in different areas and use cases. Why…

Key quote: “General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so. This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians… companies can’t just hold on to data and…

Key quote: Based on the review to date, the information involved varies by individual, the affected information may include one or more of the following, though not every data element was involved for every affected individual: … Biometric information (including fingerprints and palm prints); … precise geolocation data, credit or debit card numbers, financial account…

Key quote: 1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub’s internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately. Why it matters: One developer at…

Key quote: The use of an automated employment-related decision technology, as defined in section 7 of this act, shall not be a defense against a complaint alleging a discriminatory practice in violation of this subdivision. Why it matters: Connecticut’s SB 5, currently awaiting the governor’s signature, fundamentally breaks the “black box” defense for employers. While…

Key quote: Among the customer information the Bank has determined was disclosed are customer names, social security numbers and dates of birth. Why it matters: This probably isn’t just another boring data leak; it’s looks like this is the first time an employee YOLOed non-public banking data into a public LLM and forced their CEO…

Key quote: “There are — I mean, literally, at this point — hundreds and hundreds of studies involving thousands and thousands of people to show that when it comes to emotion, variation is the norm. The idea that emotions can be objectively measured or analyzed at all, in other words, is fantasy.” Why it matters:…

It was a pleasure joining Aashis Luitel and Tristan Ingold on Sprinto’s webinar today. We covered a lot of ground in an hour, but here’s what I keep coming back to: the worst thing leaders can do right now is wait. The timing of the webinar was comedy gold. Days before we chatted about AI…

I loved being a guest on today’s Cyber Risk Alliance webinar with Adrian and wanted to share some of my additional notes and thoughts in case you missed the live show (or prefer reading my weekly newsletter). The Mythos and Daybreak hype cycle’s missing the whole point. Niels Provos proved it with his IronCurtain framework: swap…