Author: Kayne

Key quote: “MCP itself cannot enforce these security principles at the protocol level.” Why it matters: I finally had time to sit and read the NSA’s most recent report on Model Context Protocol (MCP) security that landed in my inbox earlier this week. It’s 17 pages of fun that make you wonder what else the…

Key quote: China’s military intelligence services ultimately seek to acquire privileged military, political and economic intelligence that can provide China with a strategic and tactical advantage over the Five Eyes. Why it matters: Everyone’s complaining about LinkedIn right now, mostly because of the low-value AI slop, the ghost jobs that sit live for months, and…

Key quote: Here, Workday has represented that its attorneys curated the data it used in the bias testing, the overall purpose of the testing was to provide legal advice and not to be used in a business capacity, and it has not submitted the data to a regulatory body. The plaintiffs’ assertions that Workday’s purpose…

Key quote: A producing party’s good-faith averment of nonexistence resolves a production dispute. Why it matters: Welp, I’m *not* an attorney, but I’m tracking this one closely. In our last episode of How the Conservation Law Foundation, Inc. v. Shell Oil Company Turns, CLF had been ordered (PDF) to produce the prompts that were used…

Key quote: The risk zone includes sectors with lower-than-average maturity and criticality that exceeds their maturity. Its composition changes over time as overall maturity improves across sectors. This is one of the reasons why three sectors previously at the risk zone boundary rail, drinking water, and waste water are now within the risk zone. Why…

Wait, what? Original research on a Friday? I was chatting with a friend recently, and they started asking about the “risks of MCP.” And I wasn’t sure if they were talking about the protocol (the code, the specifications) or the MCP servers that companies have been deploying as a shim for systems that don’t have…

Key quote: An expert witness’s methodology is fair ground for discovery, see, e.g., Macchia v. ADP, Inc., 711 F. Supp. 3d 162, 167-68 (E.D.N.Y. 2024), and under the facts of this case, the process by which Dr. Oreskes culled down the defendants’ document production into a subset to be worked with is an aspect of…

Key quote: “An operator shall not knowingly and intentionally cause or program an AI companion chatbot to make any representation that it is licensed, certified, or otherwise authorized to provide professional mental health, behavioral health, medical, or counseling services, unless the operator is lawfully authorized to provide such services.” Why it matters: Georgia isn’t just…

Key quote: The guidelines are intended to support providers, deployers and other relevant actors in determining whether an AI system falls within the high-risk category. They offer clarifications on the relevant provisions of the AI Act and include practical examples to illustrate how the classification should be assessed in different areas and use cases. Why…

Key quote: “General Motors sold the data of California drivers without their knowledge or consent and despite numerous statements reassuring drivers that it would not do so. This trove of information included precise and personal location data that could identify the everyday habits and movements of Californians… companies can’t just hold on to data and…

Key quote: Based on the review to date, the information involved varies by individual, the affected information may include one or more of the following, though not every data element was involved for every affected individual: … Biometric information (including fingerprints and palm prints); … precise geolocation data, credit or debit card numbers, financial account…

Key quote: 1/ We are sharing additional details regarding our investigation into unauthorized access to GitHub’s internal repositories. Yesterday we detected and contained a compromise of an employee device involving a poisoned VS Code extension. We removed the malicious extension version, isolated the endpoint, and began incident response immediately. Why it matters: One developer at…