Schneier on Security

Clive Robinson • November 15, 2025 2:16 PM

@ ALL,

What harm is the myth of AGI

More and more people especially engineers are realising that AGI is a fantasy that is going to fail in oh so many ways.

But whilst “failure” is generally of or local to an organisation, “harms” on the other hand are much wider spread to national or global in covarage.

The author of,

https://www.tomwphillips.co.uk/2025/11/agi-fantasy-is-a-blocker-to-actual-engineering/

Notes,

“As a technologist I want to solve problems effectively (by bringing about the desired, correct result), efficiently (with minimal waste) and without harm (to people or the environment).

LLMs-as-AGI fail on all three fronts. The computational profligacy of LLMs-as-AGI is dissatisfying, and the exploitation of data workers and the environment unacceptable. Instead, if we drop the AGI fantasy, we can evaluate LLMs and other generative models as solutions for specific problems, rather than all problems, with proper cost benefit analysis. For example, by using smaller purpose-built generative models, or even discriminative (non-generative) models. In other words, make trade-offs and actually do engineering.”

And makes the same points, experience has taught me (which I’ve highlighted).

Realistically LLM’s especially derived from uncurated learning data, effectively scrapped of the bottom of the shoes of many people, are not going to give us AGI just by playing around with language tokens.

The author indicates there is a,

“Discuss on Hacker News”,

https://news.ycombinator.com/item?id=45926469

Folks might want to read it.

Clive Robinson • November 16, 2025 2:42 PM

@ ALL,

New ways to bend/break AI Guardrails

Fresh of the “will it never stop” line is another way to defeat AI Guardrails,

https://www.theregister.com/2025/11/14/ai_guardrails_prompt_injections_echogram_tokens/

The question that should be now asked by every one as to the efficacy of guardrails,

“Will Guardrails ever work?”

To which the answer is very definitely “NO”.

Or slightly longer,

“There will always be Black Swans swimming, or Unknown Unknowns.”

Mind you on the comments page there are a couple of points expressed in interesting ways,

1, On why scaling and similar of “throw more on” do not work,

“Collect a room full of idiots, adding another imbecile isn’t going [to] give you a chamber with an Einsteinian brain capacity.”

2, On why it will always go “down the drain / rabbit hole”,

“‘AI’ is like a self-modifying program, it may have been written with NO ‘Bad intentions’ BUT it changes itself on the basis of the information it ‘learns’ from and the queries it answers.

It is quite capable of generating its own ‘Bad Intentions’ in a way that cannot be foretold.”

It would appear people are learning. But one comment harks back to times of long ago

3, On, “If the answer is Microsoft you are asking the wrong question!”,

“Pointless, bloated, unreliable, wasteful, insecure, badly written – no wonder Microsoft’s all over this.”

Clive Robinson • November 17, 2025 7:04 AM

@ ALL,

More on Anthropic Report is bull

It would appear that quite a few are jumping on Anthropic and for what they see is good reason

One that is more indepth than most others is,

https://djnn.sh/posts/anthropic-s-paper-smells-like-bullshit/

Concludes,

“At the end of the day, this shit is a pathetic excuse of a report and should not be taken as anything else than a shameless attempt at selling more of their product. This is shameful and extremely unprofessional, at best. This disregard for basics ethics in order to sell just a little bit more make me want to never use their product, ever.”

Yup, the use of “Current AI for Everything” is not working and with Current AI LLM and ML Systems it actually can not.

Yes the underlying technology of LLMs and the ML systems that feed them will remain, but like all AI systems before them it will be for niche applications with clear rules and carefully collated and sanitised input data.

“AGI it ain’t, and never will be”

For reasons that are more human than most people realise.

Clive Robinson • November 18, 2025 7:34 AM

@ ALL,

Microsoft gets whacked in Oz

https://www.bleepingcomputer.com/news/microsoft/microsoft-aisuru-botnet-used-500-000-ips-in-15-tbps-azure-ddos-attack/

“Microsoft: Azure hit by 15 Tbps DDoS attack using 500,000 IP addresses

Microsoft said today that the Aisuru botnet hit its Azure network with a 15.72 terabits per second (Tbps) DDoS attack, launched from over 500,000 IP addresses.

The attack used extremely high-rate UDP floods that targeted a specific public IP address in Australia, reaching nearly 3.64 billion packets per second (bpps).“

Apparently the attack originated from the Aisuru botnet, and those half million IP addresses are said by Microsoft to be where “Internet Of Things” devices are,

‘Aisuru is a Turbo Mirai-class IoT botnet that frequently causes record-breaking DDoS attacks by exploiting compromised home routers and cameras, mainly in residential ISPs in the United States and other countries,” said Azure Security senior product marketing manager Sean Whalen.’

So no not a new style of attack but one that is growing one a regular basis.

I could make the “fly by night Chinese Developer” argument others will no doubt make, but that would be unfair because it’s not just Chinese Developers, it’s one heck of a lot of developers world wide that are designing high bandwidth insecure systems as “normal procedure” for “Marketing and Management” reasons.

Clive Robinson • November 19, 2025 9:52 PM

@ Winter,

“Every investment bubble in history looks like insanity, but is just FOMO.”

Just as a point of note, what we sort of joke about as “Fear Of Missing Out”(FOMO) is actually recognised as being a psychiatric disorder that presents as a “spectrum”…

You see it present in gamblers as “doubling down” and if you remember Nick Leason and Bearings Bank you will see just how destructive it can be.

People who do game theory for “real life” note it is one of the major reasons behind “Lost Opportunity Cost”. That is somebody keeps thinking that “it’s going to come up roses” when every one else is going around “dead heading” for autumn/winter. Thus valuable resources are wasted on what in reasonable probability is a “no hope” (which is what ML-AGI currently is).

As for criminals like Con Artists and their semi-legal brothers Venture Capitalists and Financial Advisors they “Tax FOMO” “for all they can get” and so “fake it up where they can”. It’s why “Selling Pump-n-Dump” to rubes is a crime but to those who are distinguished otherwise it’s not (providing you are not the one doing the actual pump and dump which is why VCs and similar get away with it). It’s ironic that the law sees “more money” as “more sense” when in fact the opposite is almost always true in the Finance Game… Arguably money can only be consistently made by “the hidden hand” of “insider knowledge”, which way to many mistakenly think is a crime (it’s not if you can “Parallel Construct” a “From Public Knowledge” defence which is something LLMs would be good for…).

Arguably FOMO is a “non communicable mental disease” that disables some people but not all though it is can be seen in the majority to some extent. Which is why, others see it as a spectrum which we all sit. Their argument being it’s a chemical balance in the brain issue that evolution uses to make people more opportunistic / risk taking to gain species rather than individual advantage. It’s why some are seen as pessimistic or “realists” whilst others are seen as optimistic if not “dreamy eyed”.

Why does this happen, well it’s due to limitations of the mind and probability. We know or should do that if two people throw a dice they both throw the same value slightly better than one in six times (no such thing as a “fair dice” they all have bias). But the throws are usually independent of each other. However over short periods you do get runs where pairs come up more or less often than one in six. Where it goes wrong for humans is limited short term memory effects our ability to think accurately (something Casinos rely on). That is unless we deliberately “count” both pairs and turns –which few can do– then we end up biased to “short term view thinking”. Worse we are predisposed by similar chemical imbalances to remember the wins not the losses.

I don’t gamble, if I have a bet with someone it’s generally to teach them not to make bets. That is I already know what the outcome is or know with high probability what it will be.

In the past I’ve mentioned how I can fake what many think is a “fair coin toss”… And, then when I explained how, one commenter said “Remind me never to gamble with you”… so they sort of got the point 😉

The thing is FOMO is a very real failing of the human mind brought about by evolutionary advantage for the species not the individual. Therefore we all have it to some degree, call it “a belief in luck” or “gut hunches” or “paralysis by analysis” if you will. Or a serious disorder, as it results in “risk taking behaviour” to some degree in almost every thing we do… Worse others know how to exploit it in oh so many ways…

Which is why we have “hype bubbles” to “drive markets” where the crooks are trying to do a fast “in and out” of a pump followed by exploitation before the inevitable crash. Thus a “cut and run with the cash, in a fast door dash, before the crash”. It’s also why we have the expressions around “hot potato” where the last man holding gets burned[1].

So is FOMO insanity?

From some view points yes, especially when it becomes “collective” with the outcome clearly “destructive”.

Which is the case with the AI Hype Bubble.

[1] So strong is this meme that Douglas Adams used it as a central thread in one of his “Dirk Gently’s Holistic Detective Agency” books,

https://en.wikipedia.org/wiki/The_Long_Dark_Tea-Time_of_the_Soul

To explain why the severed head of his client ended up on the record player…

Clive Robinson • November 19, 2025 11:58 PM

@ lurker, ALL,

In my above I forgot to post a link as to what RoboDebt is.

Briefly it was an Australian system to take money away from those at the bottom of the socioeconomic ladder for “Political Mantra” reasons.

It was brought in to the drum beat of certain people must be committing “fraud” where as the actual truth is most claims of “fraudulent claimants” are nothing of the kind…

They usually result from either commercial organisations or incompetent staff or both. All on a foundation of over complex legislation and low payed over worked staff not trained thus competent to do assessments correctly, thus committing “clerical error”.

The idea was to take out the government staff and replace them with algorithms. Surprise surprise it did not produce the financial benefit government ministers wanted. So the algorithms got tweaked to fulfill “Political Mantra”. The result was considerable harms that the Australian Government still pretend “never happened”.

Something similar happened in the Netherlands, however the Government put their hands up to it, payed compensation and ministers resigned on mass.

You can see a comparison of the two events in,

https://reporter.anu.edu.au/all-stories/lessons-from-dutch-robodebt-restitution-means-little-without-reform

The “World Economic Forum”(WEF) are actively encoraging this nonsense as it will be used as a vehicle to benefit their members over society in general. As a result it will be extremely harmful.

So expect the “Australian” version or worse to be implemented in AI and no admission, cessation, or compensation made near you real soon now. It is after all what Current LLM and ML AI systems could have been made for.

But remember it will just be the start of worse things to come with Current AI LLM and ML Systems companies desperate to stay afloat financially (the reality is most won’t unless significant changes happen and that horizon is currently barren).

Clive Robinson • November 20, 2025 11:31 PM

@ Bruce, All,

SEC finally faces reality.

Well over a year since the judge threw out most of the SEC’s case against Solarwinds and it’s CISO Timothy G. brown, the SEC finally realises they are not going to win and the defendants are not going to “roll over”.

SEC drops SolarWinds lawsuit that painted a target on CISOs everywhere

The US Securities and Exchange Commission (SEC) has abandoned the lawsuit it pursued against SolarWinds and its chief infosec officer for misleading investors about security practices that led to the 2020 SUNBURST attack.

https://www.theregister.com/2025/11/20/sec_bails_on_solarwinds_lawsuit/

This is played as “Good News for CISOs” but is it?

The SEC apparently not only over stepped the mark, they also dropped the ball on this case, and unsurprisingly the judge made that clear in quite robust terms back in July last year.

But in the article you will find,

‘The SEC did note that its decision to seek dismissal is “in the exercise of its discretion” and “does not necessarily reflect the Commission’s position on any other case.”
‘

Which could be one of two things,

1, The SEC face-saving by pretending it new what it was doing.
2, The SEC taking a different tack in future.

I suspect the latter, in that they will continue to throw mud untill something sticks then use that to go after “politically advantageous” cases.

And that’s the real point, the SEC stepped well outside of it’s remit for political rather than regulatory reasons, and quite rightly it failed. But it’s unlikely they will really learn from this, so they will try similar again. Let’s just say the reason is,

“It’s the nature of the beast, trying to prove it has the biggest teeth.”