Schneier on Security

Clive Robinson • September 12, 2026 10:47 PM

@ Bruce, ALL,

AI will kill us all before the end of the decade.

Is an argument that pops up from time to time… And has done again with ex OpenAI and Anthropic insider Jacob Coxon being interviewed on CNN by Anderson Cooper.

As usuall there is much handwaving being done, but as normal nothing actually proactive is ever done…

Ever ask / wonder why?

Well firstly there is a strange –to my eyes– correlation between such “OMG we’re gona die” outbursts and VC funding of AI backed by

“Gulling marks who just see $$$ signs”

Call it a con, scam, or idiocy or some combination there of.

But “where did it start?” That’s actually hard to answer it was a regular feature of post WWII SciFi and traces can be found back in Victorian thinking over the works of Charles Babbage.

Driven by religion in conflict with what later became science, even Charles Darwin felt the pressure and delayed publishing his work on Evolution for quite a period of time (and apparently only published when finding out someone else was putting the same thinking into print).

Whilst “the church” had lost much power, and had even stopped executing people West of Rome, it still had sway with very many people. And the fear of being ruined by Churchmen was apparently palpable in even the nascent Victorian science community and well into the 1950’s.

But we can come up to nearly concurrent times with the book of Eliezer Yudkowsky and Nate Soares

“If Anyone Builds It, Everybody Dies.”

In which we find three basic propositions,

1, Superintelligence will inevitably come – and when it does it will inevitably be smarter than any human.
2, Any AI that is smarter than any human will inevitably seek to eliminate all humans.
3, There is nothing humans can do to stop this threat, aside from not building Artificial General Intelligence (AGI) in the first place.

The first proposition is only half true at best. Yes some form of non human intelligence will eventually happen. But will it be “Superintelligent”, probably not and certainly not at first.

We are now nearly a decade after the “transformer” was brought into existence and although it’s made things more interesting it’s not actually really progressed AI to AGI as promised. All we’ve really done with it is in effect “scale it up” and in the process discovered lots of limitations with this approach.

As for the second half of the proposition of “inevitably be smarter than humans” I very much doubt it. Even now it takes thousands of individual AI agents to not even get close to what humans can do. People need to study a little more about the ideas behind “An army of one” and parallel v serial actions.

The second proposition is one of those that fails to “where is the evidence”.

Human kind has in the past decimated wildlife for nothing more than entertainment and yes some are still doing this. But we’ve learnt that by doing so we are causing potentially existential issues for humanity. If AGI Superintelligence is more than human then it will be aware of human history and would we suspect try not to make the same mistakes.

The third proposition is just plain wrong, AI currently does not have “physical agency” unless humans give it access to physical world sensors and actuators, either directly or indirectly. So AI can be further deceloped provided certain sensible precautions are adhered to.

Which brings us around to the current nonsense about OpenAI, Anthropic, etc and “sandboxes”.

There is a very very mistaken belief that somehow “sandboxes can be perfect”. The simple answer is they cannot for two very basic reasons,

1, The observer problem.
2, Turtles all the way down issue.

I’ve explained these in some degree of depth in the past and provided info for people to look up if they want to go further.

But there is a more engaging reason to consider as to why sandboxes will always be permeable just as guardrails will always ve susceptable to prompt injections. That is AI and other similar systems can not understand context even remotely close to humans. So have no implicit sense of right or wrong and importantly when it should or should not apply.

It has been claimed that when Hugging Face was under attack, it sort AI help to defend it’s self. But due to provisions put in place in guardrails no help was forthcoming from the AI. Because the AI default context was incorrect.

There is a saying you can attribute to @Wael. Some time ago, it was pointed out that,

“All rules should have exceptions”

To which @Wael added,

“Except for this one.”

It made a point that legislators have now daftly walked into with,

“No defence permissable legislation”

Because it is seen by politicians as the only way of doing “think of the children” type legislation to “people please” quickly and conveniently.

The argument premises on there being so many ways to do certain types of should be illegal things, that you can not write specific legislation for each one. Because this risks missing some types of things or creating many loop holes. Thus the solution just make the legislation effectively infinite in scope…

History shows us that this is not a sensible idea due to the “human nature” of those in the legal profession. That is they try to push what ever they can “under the umbrella” by trying to create “case law” that they can then steadily walk in directions advantageous to them but distinctly harmful to society.

This has been seen in the US with what does and does not constitute as “being in plain sight” with regards data stored on electromechanical and electronic devices that may also be encrypted. Perhaps more famously was the FBI&DoJ v Apple over accessing content –alleged terrorist information– on a deceased persons work phone. Looking like they were not going to get advantageous case law, –in fact the opposite– the FBI&DoJ bailed at the last minute on the case. Using claims of a third party coming forth and eventually saying “no terrorist information” was on the phone… They tried the same thing again and a Magistrate made an unfavourable ruling that the FBI started to appeal but dropped,

As General Michael Hayden has indicated that the CIA considers cyber-attacks the number one threat to U.S. security and made the observation that,

“I think Apple is technologically correct when they say doing what the FBI wants them to do in this case will make their technology, their encryption, overall weaker than it would otherwise be. So I get why the FBI wants to get into the phones… but this may be a case where we’ve got to give up some things in law enforcement and even counter terrorism in order to preserve this aspect, our cybersecurity.”

‘https://web.archive.org/web/20210210092239/https://www.foxbusiness.com/features/fmr-nsa-cia-chief-hayden-sides-with-apple-over-feds

Clive Robinson • September 13, 2026 7:00 AM

@ lurker, ALL,

With regards,

“With the current bunch of incompetents and plain malicious lunatics in charge, somebody will give it access just to see what happens…”

They are not difficult to spot.

There is “Trunp the Stunp” and his Dept of War throwing the toys out of the pram with Anthropic, and then having OpenAI’s “Sam the can able” of OpenAI leap in and offer everything… That “Little Pete Hogs-meister swineherd/pigpoker” channeling “Dr Strangelove” by demanding troops get inappropriate hormone treatment, whilst starving the navy unto death. So you can only guess how AI will be used and abused…

All because “Net an yahoo as Dr Evil” wantonly “kills school girls at arms length through the AI the IDF built” just to stay out of jail whilst his whole families dirty laundry gets washed by the US State Dept…

So yeh “it happens” and will only get worse, a lot worse.

Clive Robinson • September 13, 2026 4:12 PM

@ Moderator, Bruce,

I’ve just tried to post about the deceitful, disrespectful, harassing and against the blog rules behaviour by “@This Hateful World” who is using yet another sock-puppet handle to try to hide behind.

Unfortunately it has been held by the auto-mod so you will have to read it from the cache.

Clive Robinson • September 13, 2026 6:51 PM

@ Weather,

The problem of auto-mod is the same one I identified about the effective uslessness of statically pisitioned CCTV.

I noted way back that CCTV 2as initially successful then became effectively useless except against idiots and drunks and the like. Thus as a crime solving tool they failed and in effect only of use in grabbing “anti-social behaviour” activities like putting traffic cones on your head whilst drunk.

The reasoning is,

“Static defence fails against an evolving attacker.”

When CCTV gets installed smart criminals either stop or move their criminal activities elsewhere.

It’s the incautious or desperate that get caught and sanctioned in various ways (jail, area banning / prohibition orders etc).

Idiots that are drunk enough just behave in antisocial ways (ir) regardless of the presence of CCTV. In fact some will “play up to it” by uncovering parts of their anatomy normally kept covered to “flash” the CCTV operator.

Thus the crime rate drops whilst antisocial behaviour tends to continue.

What also happens is the smarter criminal “learns and evolves” that is they find out where the CCTV “does not see” or in the case of “steaming gangs” and the like all turn up identically dressed. Or they swap bits of clothing in ways that can not be recorded by the CCTV. As long as faces and hands are covered then identifying individuals to the point a prosecution might be obtained is probably futile.

The smarter criminals by having the option of dynamic behaviour can out evolve any statically constrained security system.

It’s something I expect “flock” might find making their business plan quite a bit less profitable as the average person finally “thinks it through” thus,

“Learns and evolves”.

Similar reasoning applies to all filtering systems that remain static for any prolonged period.

Clive Robinson • September 14, 2026 12:13 AM

@ faux-Clive,

Your own behaviour is somewhat sad…

You say,

“This is frankly the worst I have come across and I’ve been dealing with clinically depressed patients for nearly 50 years now.”

Which would make you how old?

Yup well into probable senility or worse.

But we can infer other things from your behaviour,

Have a read of,

https://journals.sagepub.com/doi/full/10.1177/23780231261478215

If you are what you’ve claimed access should be no problem.

Clive Robinson • September 14, 2026 1:39 AM

@ Jack Mehoff / faux-clive

Anyone reading your diatribe will see the same “tells” running in both.

The fact you consistently get wrong factual things that other blog participants happen to know are true is perhaps just the most obvious.

There are a considerable number of other tells, such as your continuous false presentation of supposed expertise.

As far as can be told by all your long history of posting to this blog, you have never yet made a useful contribution of any form.

In fact it might be a more major tell against you, as it,

“Brings out the desperation from behind your eyes.”

Even when you are not behaving like a drunk Trumpian 400lb parental basement squatter bashing away at it for want of any natural life.

Oh and the playing at being a SJW is not going to improve your life in any way, in fact the exact opposite.

I guess you could dye your hair purple, or pink, but it’s never going to be seen by anyone who matters or for that matter match the colour of you eyes.

Clive Robinson • September 14, 2026 2:21 AM

@ Bruce, ALL,

Is ‘self reinforcement learning’ choking useful AI development?

It’s a thought several have had and researchers have run tests that suggest there may be substance in such a view,

Can AI agents conduct open-ended AI research?

Early evidence from two case studies

“Forecasts of explosive AI progress hinge on AI agents automating AI research. But evidence on whether agents can carry out open-ended AI research is thin. Current evaluations either test agents on narrow, verifiable tasks, which excludes open-ended research, or submit AI-generated papers to blind peer review, which is overstretched, stochastic, and suffers from poor review quality. We introduce a third way to measure progress towards AI R&D automation. An agent takes on the central, open-ended research question of a high-quality unpublished paper, and the paper’s original authors grade its output. We call these shadow evaluations. We ran shadow evaluations on two unpublished NeurIPS 2026 submissions, giving frontier agents six days and thousands of dollars of compute. The agents completed all of the engineering without human help, yet could not make substantial progress towards answering the research questions. As a result, both papers were unambiguously rejected by the authors. We identify five recurring failure modes: poor judgment about the bar for publishable research, uncreative responses to shortcomings in the research design, ineffective backtracking from dead ends, poor resource awareness, and instruction drift. A robustness check with a second model and scaffold reproduced these failures. We release the expert reviews, survey responses, agent repositories, and logs. Our results provide early evidence that today’s agents can do the engineering of AI research, but struggle with critical parts of the research lifecycle.“

https://arxiv.org/abs/2607.27191

For those with an interest in the “AI will replace researchers” question it makes interesting reading.

Clive Robinson • September 16, 2026 3:52 PM

@ Research Zero, ALL,

With regards,

“Tactical nuclear weapons are dumb say experts.”

Whilst that is true having looked at the “Forbs” and “Council for Strategic Risks”

I note they have errors some of which should have been spotted by any half competent technical eye.

The reason tactical nukes are “dumb” is “bang for your buck”.

That is they cost way to much to make to show any sensible return in most cases.

However such low yield devices may serve a purpose in launching heavy loads into space rapidly.

Apparently the idea came about back in the 1950s when testing was done down the bottom of a 10,000ft deep shaft. Somebody noted that it looked like an old fashioned muzzle loading cannon or rifle and somebody else had decided that welding a very thick steel plate across the shaft top might serve some purpose…

Apparently the plate went up at around six times earths escape velocity and probably ablated into nothing but plasma before reaching space.

Any way somebody did some maths and concluded you could make a 4.5 million pound lift plate that could use a stream of small nukes as the equivalent of a pulse jet…

This paper was from around the same time as the paper that actually started the design and build of the Pluto the unshielded RAM Jet engine.

Which if intelligence is correct Russia failed to get working just a few years back and set off just about every nuclear reactors alarms in Europe that were “down wind”.

Speaking of intelligence, you might find this of interest,

https://m.youtube.com/watch?v=PVdyBiAfoAc

As a rule of thumb what is reported is not fake or faux and unlike the MSM both timely, and accurate, as well as actually getting reported not blocked by “politically sensitive” editors or seniors not wanting “Executive upsetting issues” blow back hitting them.

In short with what has been reported expect the price of oil to go up quite a bit this year, even though certain people will desperately try to keep it down untill election seasons are over.

Clive Robinson • September 17, 2026 6:28 AM

@ lurker, ALL,

“Struth cobber, where will they come from next?”

Does that actually matter?

This site has commenters and readers from around the globe.

To me it’s,

“The message not the messenger”

that is what is important.

The next question that people should ask is,

“Is any crime being committed?”

Think about Northern Hemisphere journalists commenting on Antipodean politics, do they ever say where they were born, where they now work and where they live?

Now consider what happens on a Friday / Saturday evening.

When “the girls glam up”[1] and pack the “walk of shame bag” and also talk with “posher accents”…

Are they committing a crime because they slather-up and use enough fake tan and makeup to paint a portrait and enough hair products to create a “crowning glory” blond beehive etc[2].

We just excuse it as part of the mating game

[1] Yup I’m including “the boys that buff up” and similar of “pork chops trying to look like a lamb chop or beef steak”.

[2] Just be aware of the effects certain legal chemicals can have and then look up what some –neither young or ladies– get upto when they’ve “had a few” / “skin-full”… Lets just say that I’ve seen enough “flesh bared to CCTV” when doing research on “the effects of CCTV on Town Centers” to make me want to take up living at the top of a mountain in appropriate robes of a hermitage existence.

Clive Robinson • September 17, 2026 1:43 PM

@ Bruce, ALL,

Hands up, who did not see this coming?

Apparently even going after the “little fish” is not working for the UK OfCom in trying to enforce the very badly thought out and legislated “OnLine Safety Act”(OSA).

Which was a typical bureaucratic nonsense to implement “think of the children” as a way to enforce online ID on adults, thus has been a failure so far…

Ofcom discovers issuing Online Safety Act fines is easier than collecting them

Platforms comply just enough to avoid being blocked, leaving the regulator chasing debt

“
security
Ofcom discovers issuing Online Safety Act fines is easier than collecting them
Platforms comply just enough to avoid being blocked, leaving the regulator chasing debt

Connor Jones
Cybersecurity reporter
22
Thu 17 Sept 2026 // 10:08 UTC
Ofcom chiefs have acknowledged that most fines issued under the Online Safety Act (OSA) remain unpaid, highlighting limitations in the comms regulator’s enforcement powers.

The regulator’s director of enforcement, Suzanne Cater, told the House of Lords Communications and Digital Committee that although another payment arrived this week, “realistically the majority have not been paid.”

Ofcom has imposed fines totaling more than £7 million ($9.4 million) on 11 service providers under its OSA powers so far, but when asked, it refused to specify exactly how many have not paid, nor detail the payment that came in this week.“

https://www.theregister.com/security/2026/09/17/ofcom-discovers-issuing-online-safety-act-fines-is-easier-than-collecting-them/5297110

Clive Robinson • September 18, 2026 4:40 AM

@ lurker, ALL,

With regards to satellites just blowing up, yup it happens, as has been observed of everything,

“Entropy wins eventually”

And in engineering we have that infamous “Bath-tub curve”.

Made of three basic curves overlaid in time. Juvenile Failure is the one of major concern in Mil/Aerospace and is why there are such thorough “burn in / qualifying testing”.

The question of exactly when and how entropy claims a system is one of lifes great unknowns… The thing is we know we can design it further into the future by making components more robust.

The problem with that is it almost always carries a weight penalty (if not using new materials).

Likewise doing any sensible “End of Life”(EoL) has penalties as they actually add “more components”.

Thus everyone got behind the myth of,

“It will just burn up in the atmosphere eventually”

To keep mass down and utility up.

Whilst burn up is eventually true for low earth orbit satellites, it’s what happens in that “eventually” time period that is more important.

Spy satellites need to be not just maneuverable but effectively agile as well. This has ment in the past that they carry a very large amount of propellant.

In essence an explosive with significant mass to meet Sir Issac’s observations about “equal and opposite”.

The thing about all explosives and the fuels that make them is that they behave like organics and degrade with time. That is they degrade and can in the process become more volatile…

Thus they really are not “shelf stable” even when split into parts.

The reality of this was why it was eventually agreed that satellites would be designed such that they would have an operations life of less than a quarter century and then they would be implicitly deorbited in some planed and controlled way.

I’m guessing in this case the satellite was put up before the agreement, or that “US Mil” decided that it did not apply to them…

Clive Robinson • September 18, 2026 5:31 AM

@ Weather, ALL,

With regards,

“That way your not leaking keys by zero padding?”

You need to think to the side and ask yourself,

“Does that matter to the designers?”

And there are a couple of instances when it does not.

Firstly is “Super Encryption” where you,

First – Use a “deterministic cipher” to “flatten the statistics” and in some cases “compress the length” of the plaintext.

Second – Encrypt again with a “non deterministic cipher” that neets Claude Shannon’s “Perfect Secrecy” requirements such as a “One Time” pad or tape.

Secondly is where you are someone like Crypto AG supplying cipher machines to the world. Whilst being secretly guided by the man who was in effect the chief cryptographer for what became the NSA.

Where one trick was to sell a “super encryptor” that could be used by anyone, but also sell a “tape generator” that was fritzed.

That is the tape generator was actually fully deterministic, although it looked like it was “random”. But also make the “random additive” to leak the effective key setting in use to generate the supposed “One Time Tapes”.

Think about how “Direct Sequence Spread Spectrum”(DSSS) in “Low Probability of Intercept(LPI) radio systems works. Hence the reason in the 1990’s they developed “Watermarking” systems for “Digital Rights Management”(DRM) using the idea. In essence they generated a low level additive signal that looked like “white noise” which was added to the media. This noise signal had identification information “steganographically” added into it.