Nostr notes by David J. Bianco (He/Him)

HuggingFace got hacked by an agentic system. That's not the ...

2026-07-17T21:59:16+02:00

HuggingFace got hacked by an agentic system. That's not the important part. What really stuck out to me was the asymmetry in #AI guardrails they experienced. The attacker had basically no constraints, but HF's initial response ran afoul of the abuse guardrails, forcing them into an unplanned switch to local-only models. In the middle of an incident.

Another aspect for your IR plans.

https://huggingface.co/blog/security-incident-july-2026

For years, I've been very clear: "You can't automate ...

2026-07-16T17:06:46+02:00

For years, I've been very clear: "You can't automate threat hunting. It is an essentially human process." Now I'm not so sure.

Read why I've reconsidered my stance in my fresh new post: "The Hunter's Paradox: Is it time to embrace automated threat hunting?"

https://blog.talosintelligence.com/the-hunters-paradox-is-it-time-to-embrace-automated-threat-hunting/

If you think you have a "supply chain", you're wrong. ...

2026-05-29T21:53:10+02:00

If you think you have a "supply chain", you're wrong. What you actually have is a "supply web".

Changing your mental model can help you gauge supply web risks more accurately.

If AI driven attacks become more prevalent, it'll only be a ...

2026-05-20T22:55:47+02:00

If AI driven attacks become more prevalent, it'll only be a matter of time before attackers push the token burden on to their victims, using the AI that's already (probably) there.

I'm calling it "living off the lAInd".*

*Jokey name. Probably will happen, though.