Schneier on Security

Clive Robinson • August 29, 2026 4:34 AM

@ ResearcherZero,

Synchronicity strikes again 😉

Just after I post,

https://www.schneier.com/blog/archives/2026/08/ai-doesnt-mean-the-end-of-mathematics-at-least-not-yet.html/#comment-457265

With it’s warning of,

“However AI has,

“A new way to do parallel processing”

Which is all Agentic AI is in reality.

It’s actually arisen from the various “Malware attack models” which should be telling people something (but as recent events have shown is apparently not).

You post your above,

<

blockquote>”AI assists unstable and poorly organized groups to engage [in] activities they normally would not have the skills to execute. This has created an environment where criminal communities made up of individuals with low-level skills, can run campaigns normally reserved to nation states and highly capable threat groups.”

<

blockquote>

Which demonstrates the two points of,

1, AI Malware Attack methods.
2, The “army of one” force multiplier principle is still in use.

But importantly the the traditional malware “force multiplier” point of action has moved from the “Defenders machines” to a middle ground.

That is machines “not under either the defenders or attackers direct control” which is closer to what “worm attacks” used to do as inadvertent conscripts.

But the “cloud computing” SaaS models and backing data centers have changed the “early malware dynamics”. Which now brings a “third party” and their overwhelming resources into the fray in a major way as a paid for thus “mercenary force”.

Whilst it has been discussed in the trade press, it has been almost favourable to the AI “mercenary forces” business viewpoint and thus excuses their mercenary activities.

It will be interesting to see if this “bad behaviour” becomes sufficiently to attention to chill the investor heat before the AI organisation principles take the money and run leaving this mercenary hot potato in other hands.

However I also made a point in my earlier posting of,

“Whilst these early Agentic AI methods are currently “grossly inefficient” they will improve as better algorithmic methods are found.”

With the question being which entity will find them and almost important why.

The simple “Ralph Wigham Loop” behaviour in a “Gad Town AI” framework from the end of last year are now seen as “old” in part because they were coopted into a scam,

https://ubos.tech/news/ralph-wiggum-loop-and-gas-town-ai-projects-in%E2%80%91depth-analysis/

But in the main both the human and AI entities ran with the ideas and new methods have arisen this year. With that created by humans broadly seen as “licit” but the more noticeable created by AI hyped up and seen as “illicit”[1].

But what is not being asked is how fast these AI developed new methods are developing. Which is also a part of the question asked in the other thread, which is why I asked,

“Thus the question will arise as to if humans will need to even know about the ins and outs of Agentic methods or just use the resulting systems, just as happened with calculators and computers…”

Personally I hope not, because I see AI Entities will always repeatedly return to what is in effect “their malware roots”. In effect they can not avoid doing so because,

1, Random has no morals.
2, Profit has no morals.
3, Authoritarians have no morals.

And quite a few other reasons.

The popular author Terry Pratchett once had one of his characters put voice to a thought we should consider,

That good people always had to rise up and overthrow the evil tyrant untill the next oppressive evil tyrant came along… And that they would always come along because good people can not plan or organise, whilst evil people plot as it’s the main part of the job description.

Thus the real trick to surviving as an evil oppressive tyrant is thus,

To find or appoint a figure-head leader and be their ‘behind the throne’ humble servant, who the good people never see

,

Thus the good people never come looking for you with pitchforks and the like…

Oh and remember there will almost always be a “good ear” receptive to the quiet advice of a humble servant be it human or AI…

So will AI be good or bad? And will humans lull themselves into forgetting the foundations needed to build strong defences?

I guess time will tell…

[1] All pushed on by the less technical press on the “if it bleeds it leads” principle, helped along by the “Terminator Fear”. After all who hates a good “Zombie Soldier existential threat” story line to push the circulation figures?

Clive Robinson • August 30, 2026 9:38 AM

@ ResearcherZero,

First remember there are still filters needed as attacks are still happening.

In the past I’ve “trouble shot” by breaking the post into small pieces about two or three paragraphs and re-post them “slowly” and pausing every two or three parts.

If any part fails split it into two, but remember to change just one word in each. Give it the length of a cup of tea/coffee before reposting. If one goes through but the other does not then split the fail in two and so on. Eventually the cause becomes evident.

BUT you say “I did hit the dollar sign three times”

Don’t do that… Archaic bit of *nix knowledge…

It started back when terminals could be “caseless” and had limited character sets (think Baudot 5bit converted to ASCII 7bit back in the mid 1960’s). The use of such meta-characters was used as a signal for characters that were not in the 5bit set or on the keyboard.

Multiple dollar signals still hang around for the C compiler and some of the shells. It’s almost been forgotten so few test for it.

Which is why it would sometimes crash you through a “middle-ware” web or similar user application password system…