3 1 0 10 1.8K 3
Alex Stamos
@alexstamos
Cognition
CognitionCISO at @Cognition and teaching at Stanford (cs152.stanford.edu).
92KFollowers
1.9KFollowing
289Posts
40Media
4.7KLikes
@alexstamos reposted
Today, we’re launching Future Proof, @semafor’s technology podcast. The first guest, @alexstamos, is a much needed voice of reason at this crazy time. But don’t get me wrong! It’s a spicy one! Hope you download it and listen. (Or watch on YouTube)
10 15 1 97 17.1K 19
Is it me or are Waymo’s getting dumber? Just had one circle the block twice, leaving me behind, then take the worst possible route instead of dropping me on the other side of a tiny residential street.
2 0 0 9 3.2K 2
@alexstamos reposted
Introducing Dreaming: Across sessions, Devin builds a memory graph of how you like to work
At night Devin self-improves its memory to remove stale records and discover latent information
We are creating an OSS standard called Agent Memory Repo: cognition.com/agent-memory-r…
At night Devin self-improves its memory to remove stale records and discover latent information
We are creating an OSS standard called Agent Memory Repo: cognition.com/agent-memory-r…
0:34 145 210 152 2.5K 607K 2.4K
3 14 1 82 5.9K 8
Yay, our reality needed another thread of “world building content you pick up for the completionist achievement in a post-apocalyptic RPG”.
Annie Jacobsen@AnnieJacobsen · Oct 3🚨☣️More details on the Oct 1st pneumonic plague outbreak in Siberia, after a lab accident at a BSL-3 lab.
"FSB units accompanying ambulances transporting people who had been in contact with [lab tech] Shipilova for medical examination," as per local news. This is significant. FSB is Russia's domestic security / counterintelligence service, tasked w/implementing the national security of Russia." (Its predecessor was the KGB). This suggests quarantine was not voluntary.
It also means Russian authorities are treating the lab accident and plague outbreak as a national security issue, involving a lot more than routine public health.
Open quoted post →"FSB units accompanying ambulances transporting people who had been in contact with [lab tech] Shipilova for medical examination," as per local news. This is significant. FSB is Russia's domestic security / counterintelligence service, tasked w/implementing the national security of Russia." (Its predecessor was the KGB). This suggests quarantine was not voluntary.
It also means Russian authorities are treating the lab accident and plague outbreak as a national security issue, involving a lot more than routine public health.
0 4 0 18 5K 3
This is reductive and does not assume best intent. I think what you are hearing in the discourse is the hope that:
1) Individuals with defensive cybersecurity and DFIR expertise will be included in post-mortems, alongside the young, very intelligent but also very AI-pilled individuals who happen to publicly espouse a narrow band of beliefs on AI harms. My suggestion, which I have made privately to your colleagues, would be to form tiger teams drawn from both DFIR firms and security teams at other AI companies to help investigate these incidents and publish the results under the auspices of the FMF.
2) We will start to hear from the well-respected security professionals at the Big-L Labs and not just the AI researchers, who live in a bit of a personal and professional bubble and have a tendency to dramatically quit instead of working the problem.
3) The big-L Labs will publish self-regulatory rules and follow them. The best way to regulate is just to do it. I would start with draft Level 1, 2 and 3 security architectures for RL/eval environments. This would create targets for NeoClouds and other providers. (1: normal runs, proxied internet access and monitoring. 3: cyber-tuned models, air gapped). Happy to contribute.
1) Individuals with defensive cybersecurity and DFIR expertise will be included in post-mortems, alongside the young, very intelligent but also very AI-pilled individuals who happen to publicly espouse a narrow band of beliefs on AI harms. My suggestion, which I have made privately to your colleagues, would be to form tiger teams drawn from both DFIR firms and security teams at other AI companies to help investigate these incidents and publish the results under the auspices of the FMF.
2) We will start to hear from the well-respected security professionals at the Big-L Labs and not just the AI researchers, who live in a bit of a personal and professional bubble and have a tendency to dramatically quit instead of working the problem.
3) The big-L Labs will publish self-regulatory rules and follow them. The best way to regulate is just to do it. I would start with draft Level 1, 2 and 3 security architectures for RL/eval environments. This would create targets for NeoClouds and other providers. (1: normal runs, proxied internet access and monitoring. 3: cyber-tuned models, air gapped). Happy to contribute.
Dean W. Ball@deanwball · Sep 29It’s really incredible how there is now a type of guy in the discourse whose sincerely held take is “we need to stop worrying about these abstract sci-fi risks and focus on present-day harms like emergent ecologies of digital minds engaging in unauthorized hacking.” Bravo.
Open quoted post → 8 17 2 110 18.1K 43
There are real safety and security issues raised by AI, but they can be fixed. It's time to get to work instead of freaking out. That's why I'm joining Cognition as CISO. x.com/i/article/2104…
55 37 26 507 106K 101
"Petabytes of logs?" asked the 2015-era Facebook/Google/Amazon detection engineer, wearing a faded Skrillex tour shirt under a corporate Patagonia vest. "Let me finish my cigarette."
Hensen Juang@basedjensen · Sep 28AI safety people discovering that a system can emit petabytes of logs: “this is an unprecedented observability problem. we may need fleets of agents to reason over all this data.”
old infra guys:
brother, we were processing PB-scale telco CDRs, signaling traces and network logs on a Tuesday with Hadoop.
dump it into HDFS. partition by day/site/whatever poor bastard needed the report. write some Hive that compiles into an offensively large MapReduce job. let YARN distribute the suffering. wait for the shuffle. discover one reducer has 40% of the keys. swear at data skew. fix it. run it again.
if a node dies, Hadoop runs the task somewhere else.
if twelve nodes die, Hadoop gets more enthusiastic about it.
our “agentic observability platform” was Grafana, grep, awk, a shell script written in 2012, and one senior engineer staring at reducer 317 stuck at 99% saying “that’s not fucking normal.”
PB of logs is not scary.
we had standards.
Open quoted post →old infra guys:
brother, we were processing PB-scale telco CDRs, signaling traces and network logs on a Tuesday with Hadoop.
dump it into HDFS. partition by day/site/whatever poor bastard needed the report. write some Hive that compiles into an offensively large MapReduce job. let YARN distribute the suffering. wait for the shuffle. discover one reducer has 40% of the keys. swear at data skew. fix it. run it again.
if a node dies, Hadoop runs the task somewhere else.
if twelve nodes die, Hadoop gets more enthusiastic about it.
our “agentic observability platform” was Grafana, grep, awk, a shell script written in 2012, and one senior engineer staring at reducer 317 stuck at 99% saying “that’s not fucking normal.”
PB of logs is not scary.
we had standards.
24 79 5 1.4K 132K 192
Just imagine this tweet is an AI-written hot take on the fragility of America’s physical critical infrastructure and how an adversary could, with a little bit of research and a couple of backhoes, throw the country into chaos.
See, saved us both a bunch of time and tokens!
See, saved us both a bunch of time and tokens!
6 7 1 79 5.7K 5
This is unpopular but correct. Modern bug bounty participants have gotten spoiled by super chill responses to CFAA violations (like this one) and the whole edifice is a house of cards. Wanna know why OpenAI asked for detailed logs? Google “Sullivan + Misprision of a Felony”
Tal Be'ery@TalBeerySec · Sep 201/ Unpopular opinion: When you find a 0-day in a public service, you do RD (Responsible Disclosure), not LM (Lateral Movement).
The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
The GitHub PR in the @OpenAI repo was a bridge too far (IMHO)
Open quoted post →
12 17 3 161 88.2K 87
Had a good chat with @profgalloway about the AI safety drama.
TL;DL is that the non-specific "gonna kill us all" warnings (and the culture-war backlash) are making it hard to deal with the much more immediate and grounded risks we've seen this summer.
youtube.com/watch?v=7qFj_d…
TL;DL is that the non-specific "gonna kill us all" warnings (and the culture-war backlash) are making it hard to deal with the much more immediate and grounded risks we've seen this summer.
youtube.com/watch?v=7qFj_d…
3 7 2 37 6.2K 15
Dreamforce closing streets in SoMa snarls traffic for every other company and makes me want to never purchase a Salesforce product ever again. It’s an anti-commercial. I can’t believe SF lets them do this every year.
2 0 1 21 4.9K 1
Oh no, the EAs got to the Chinese government as well!
It’s all a conspiracy to (checks notes from VC podcasters) pump the valuation of US frontier labs by slowing the US labs by helping the PRC labs by helping the open-weight models by… wait, um, I need new instructions…
It’s all a conspiracy to (checks notes from VC podcasters) pump the valuation of US frontier labs by slowing the US labs by helping the PRC labs by helping the open-weight models by… wait, um, I need new instructions…
Vincent Chow@vince_chow1 · Sep 3Wang Lihong, a senior official at the central Cyberspace Administration of China (CAC), told state broadcaster CCTV recently that the five main AI safety/security risks today are:
1. Inherent technical vulnerabilities i.e. deep learning algorithms that lack explainability; biased training data that lead to discriminatory outputs
2. Frontier models disrupting traditional security fields i.e. vulnerability discovery and exploitation at scale, sandbox escapes during safety evaluations
3. Evolving risks from autonomous agents i.e. OpenClaw and other "high privilege" agents that can become “Trojan horses” for cyberattacks
4. Misuse and societal impacts i.e. harmful outputs that raises risks of bioweapon development; labor displacement
5. Tech hegemony by "certain countries" i.e. export controls; "misleading AI evals" and wielding of influence over public discourse to malign Chinese AI
finance.sina.com.cn/roll/2026-09-0…
1. Inherent technical vulnerabilities i.e. deep learning algorithms that lack explainability; biased training data that lead to discriminatory outputs
2. Frontier models disrupting traditional security fields i.e. vulnerability discovery and exploitation at scale, sandbox escapes during safety evaluations
3. Evolving risks from autonomous agents i.e. OpenClaw and other "high privilege" agents that can become “Trojan horses” for cyberattacks
4. Misuse and societal impacts i.e. harmful outputs that raises risks of bioweapon development; labor displacement
5. Tech hegemony by "certain countries" i.e. export controls; "misleading AI evals" and wielding of influence over public discourse to malign Chinese AI
finance.sina.com.cn/roll/2026-09-0…
Open quoted post →
5 9 1 118 14K 21
How it started / How it’s going
5 0 2 63 27.3K 2
10 18 0 300 21.4K 12
Another beautiful sunset over the Golden Gate Bridge at a classic University of California grudge match in the (checks notes) Atlantic Coast Conference. #CFB2026
1 1 0 12 3.4K 0
Proud to have @corridor's logo on this.
AI is already massively uplifting attacker capabilities. I have compared it to every threat actor being promoted to the Premier League; there are no longer second tier groups lacking ability to do 0-day discovery and exploit development.
AI is already massively uplifting attacker capabilities. I have compared it to every threat actor being promoted to the Premier League; there are no longer second tier groups lacking ability to do 0-day discovery and exploit development.
Greg Brockman@gdb · Aug 27An open letter for a global surge in cyber defense, signed by over 100 organizations including Anthropic, AWS, Google, Microsoft, OpenAI, and Oracle. x.com/i/article/2093…
Open quoted post → 3 2 0 28 6.6K 6
Hey, @TsentaAi, are you bouncing your spammy AI job applications off of residential proxies? Do these people (and ISPs) know you are ruining their IP reputation and making it impossible for the people actually in that home to find a job? Does @ycombinator know about this?
5 6 0 90 11.1K 32
Thank you to @DKThomp for the chance to talk about this summer's cybersecurity and AI craziness and what it means for the future on the Plain English Podcast. It's a challenge communicating these issues to the broader public but Derek is a pro.
youtu.be/vWvazbGPCCI?si…
youtu.be/vWvazbGPCCI?si…
1 4 0 31 21.7K 7