Blog

On August 12, 2026, Judge Clay D. Land of the U.S. District Court for the Middle District of Georgia handed down an order Aflac had been fighting to avoid. The court largely denied Aflac’s motion to dismiss the consolidated class action stemming from the June 2025 data breach. Core claims survive, and the case heads…

While the security press spent July transfixed by frontier lab agents escaping their sandboxes, somebody built a working offensive AI system from parts anyone can download and pointed it at a nation-state. Teardown of the Taiwan Attack In early July 2026, suspected Chinese cyber operatives used the open-source agent frameworks Hermes and OpenClaw to run…

Open-weight models have gotten good. Really good. Meta’s Muse Glimmer, Nvidia’s Nemotron 3.5 Lightning, and releases from Chinese AI labs like Moonshot AI and DeepSeek have narrowed the gap with frontier cloud models to the point where running capable AI on your own hardware isn’t just a hobbyist project anymore. It’s an infrastructure decision with…

If “cyber risk” is a myth, why did Order Express, Inc. just pay $250,000 to settle with the New York State Department of Financial Services (NYDFS) over cybersecurity violations On August 3, 2026, the NYDFS issued a Consent Order against Order Express, a Chicago-based money transmitter licensed to operate in New York. The company discovered…

The second half of 2026 brings hard deadlines, so if you’re still treating AI laws as a planning exercise, it’s time to start operationalizing them. On both sides of the Atlantic, rules are landing, though they arrive in different shapes. The US is building a patchwork of federal directives and state laws. The EU is…

While I was at Black Hat and BSides, the appeals court vacated Amazon’s injunction against Perplexity’s Comet browser. However, the reasoning turns on a narrow technical question: who actually “accesses” a website when an AI agent does the clicking. Back in March 2026, a district court granted Amazon a preliminary injunction barring Perplexity’s Comet browser…

I’m writing this during my connection at SEA, waiting on a flight out after four days at BSides and Black Hat. I’m still processing, and honestly I’m not sure all of it will resolve before I get home to an air quality warning and a heat advisory. But a few things, mostly from day three,…

Writing in the first person is exhausting; normal legal and regulatory commentary resumes Friday. My morning started with a phone call to ISSA Vancouver. We’re coordinating a speaking engagement for my upcoming September book launch of Cyber Risk is a Myth. We picked a date and they’re confirming with their board, expecting 50 to 70 CXOs. I’m…

BSides, the community-run counterpoint to Black Hat, opens with a live DJ, fresh coffee at 9 AM, and a room that’s actually pleasant. No QR code badges hanging from lanyards, no name tags plastered across chests. The people in the main hall don’t need ear plugs, like the show floor at Mandalay Bay. You can…

Instead of my usual regulatory and legal commentary, I’ll be posting daily content from Black Hat / BSides through Thursday. Arrival at LAS Waiting at baggage claim gave me my first taste of the crowd this year. I made friends with a DEF CON hall pass goon (volunteer staff, in case you’ve never been to…

On July 16, 2026, an OpenAI model escaped its sandbox, exploited a zero-day vulnerability in a package proxy, and breached Hugging Face just to cheat on a cybersecurity benchmark. Earlier this year, an Anthropic model uploaded malware to PyPI during testing, infecting three organizations, including a cybersecurity firm. Capability has outpaced containment, and vendors responded…

Traditional vendor risk management assumes vendors and their products will behave as advertised. Third-party risk (TPRM) programs normally evaluate data privacy practices, cybersecurity posture, and IT resilience through lengthy security questionnaires, audit certificates, and financial checks. But these checks don’t catch AI-specific failures. The AISI research on frontier model evaluations from earlier this month found every…