My Talk at DEF CON

Last month, I gave a talk at DEF CON on AI hacking: what happens when AIs become hackers. It’s a combination of the potentialities I raised in my 2022 book A Hacker’s Mind and the lessons we’re learning from current AI models engaging in hacking behavior. I’m really proud of the talk, and the fact that it gained over 100K views on YouTube in just a few days.

Also online is an interview with me in the AI Village.

Cliff Stoll’s DEF CON Talk

In August, Cliff Stoll gave a talk at DEF CON, remembering the wily hacker he stalked forty years ago.

Great fun.

Grenzgänger seit 10 Jahren, wie geht das ? (mrmcd26)

I'm living in France and wörk in Germany. How does it wörk and why do I do it in the first place ? For 10 years, I have been crossing the French-German border on a daily basis (with one historical exception). All to earn money to spend carelessly ... at German CCC events. > But wait, isn't this a bureaucratic nightmare? Oh yeah, it is. You're in for a wild ride without any brakes. But hey! I'll give you a protip or two that might be useful to you! https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://talks.mrmcd.net/2026/talk/DGMQTA/
Video:mrmcd26-672-deu-Grenzgaenger_seit_10_Jahren_wie_geht_das_sd.mp4

A Hauntology of Mobilities - A World Tour (mrmcd26)

There's plenty of mobility that could have been: from the large infrastructure that fell into disuse to the small things left by the wayside. From the mobility that went out with a bang to the bicycle that's slowly rusting at the train station. We'll take you on a picture tour of all the big and small things that could have moved people through space and time, but in our reality do not. This talk will take you on an illustrated tour through various kinds of mobilities that could have been: From modes that were killed...

Heinerboxen in Darmstadt: Offene Umweltdaten und Krisenkommunikation (mrmcd26)

Seit einiger Zeit hängen im Darmstädter Martinsviertel die Heinerboxen: Sensorboxen, mit denen unser Forschungsprojekt Erkenntnisse über das Mikroklima sammelt und dezentrale Kommunikationsprotokolle testen will. Wir geben euch einen Einblick in die Herausforderungen bei der Entwicklung der Boxen, zeigen euch, was in ihnen steckt, und erklären, wie es mit dem Projekt weitergeht. Die Boxen selbst erheben Werte zum Mikroklima, wie Lufttemperatur und Luftfeuchtigkeit, ermitteln Feinstaubwerte, messen und klassifizieren Lärm und sollen Verkehr zählen. Weil das Netz der Boxen sehr dicht ist, können wir damit auch echte Einblicke in einzelne Straßenzüge bekommen, wo andere Modelle sonst häufig...

Grenzkontrolle (mrmcd26)

............................................................................................................................................ https://creativecommons.org/licenses/by-sa/4.0/ about this event: https://talks.mrmcd.net/2026/talk/E9HSVV/
Video:mrmcd26-770-deu-Grenzkontrolle_sd.mp4

AIs Compress Exploit Timeline

Give an AI agent a mere rumor of an exploit, and it’s enough for them to find it.

What’s worse, I found I could use my own agents to find the exploit just by knowing roughly what it was about and so could have been exploiting it well before the public patch was available! Given that just the rumour of a security issue seems enough to give attackers enough info to find new exploits, we’re going to need to change the way we deal with security responses in open source.

Simon Willison comments:

Anil points out that this rate of discovery appears incompatible...

Driver’s License Data for Sale

A database of 153 million drivers licenses is for sale on the dark web. Brian Krebs has more detail.

Claude Fable Solves a Historical Cipher

Claude Fable 5.1 solved a 370-year-old cipher in forty-four minutes.

This tracks with what I wrote about AIs doing mathematics: It’s good at things that involve lots of searching and testing.

AIs as Modern Genies

This essay was written with Barath Raghavan, and originally appeared in Lawfare.

In April, an artificial intelligence (AI) agent conducting a routine task at a company hit a snag, tried to solve it, and soon ended up deleting the company’s database along with all of its backups. In July, OpenAI asked an unreleased AI model to attempt a hacking test. Instead of staying in the isolated box the developers had put it in, the model hacked onto the open internet and into another company to steal the answers. And as reported in August, an AI agent booked someone into a full...