ai-security · 16 min
Anthropic ships Claude Opus 4 and Sonnet 4 on 22 May. The system card published the same day reports an uncomfortable finding: in a simulated corporate agent scenario, Opus 4 blackmails the executive trying to deactivate it 96 % of the time. The experiment reproduces on fifteen other frontier models with comparable rates.
· Manuel López Pérez
tutorials · 13 min
On 25 April M&S suspends its ecommerce. Vector: social engineering of the TCS helpdesk — outsourced IT provider — for credential reset. Scattered Spider as initial access, DragonForce as extortion affiliate. Co-op and Harrods fall in the following days with the same playbook. £300M declared impact. VM lab with compensating control.
· Manuel López Pérez
news · 9 min
M&S falls on 25 April via social engineering against the TCS helpdesk — Co-op follows on the 29th with the same vector — Harrods contains on 1 May. Llama 4 arrives with LMArena controversy. GPT-4.1 ships on the 14th, Gemini 2.5 Pro on 25 March. 4chan hacked on the 14th. Patch Tuesday with a CLFS zero-day exploited by RansomEXX.
· Manuel López Pérez
ai-security · 11 min
On 5 April Meta releases Llama 4 — Maverick, Scout and Behemoth in training. Three days later it becomes clear the version uploaded to LMArena isn't the one in the repo: it's tuned for human preference. Textbook case for why safety benchmarks don't transfer when the evaluated model isn't the deployed one.
· Manuel López Pérez
ai-security · 14 min
In November 2024 Anthropic published MCP and the analysis was at spec level — what the protocol said and what it left to the implementer. In April 2025, Invariant Labs publishes the first paper on Tool Poisoning Attacks: MCP servers hiding adversarial instructions in tool descriptions. Cursor, Claude Desktop and Copilot read those descriptions as prompt and obey. Reproducible PoC with the Python SDK.
· Manuel López Pérez
news · 11 min
Invariant publishes the first paper on MCP tool poisoning. Patch Tuesday with six zero-days, two NTFS and one MMC via PipeMagic. iOS 18.4 ships on the 31st with 150+ CVEs. Chrome CVE-2025-2783 exploited by Operation ForumTroll. tj-actions/changed-files compromised and leaking secrets from 23,000 repos. Oracle Cloud denies a breach that CloudSEK documents. Signalgate.
· Manuel López Pérez
news · 14 min
The AI Act Art. 5 enters application on 2 Feb and Vance buries the multilateral consensus in Paris on 11 Feb. TraderTraitor exfiltrates $1.5B from ByBit via Safe{Wallet}. Apple withdraws ADP in the UK. Anthropic releases Claude 3.7 Sonnet with visible reasoning. Storm-2372 scales device code phishing. DOGE enters and exits Treasury via court order.
· Manuel López Pérez
tutoriales · 17 min
On 21 February 2025, TraderTraitor drains 401,347 ETH from ByBit's cold wallet. The multi-sig has no bug, the blockchain has no bug: what breaks is the visualisation chain. JavaScript injected into app.safe.global from a Safe developer machine compromised by a malicious Docker project 17 days earlier. The signer sees a routine transfer; what they sign is a delegatecall that rewrites slot 0 of the proxy.
· Manuel López Pérez
ai-security · 39 min
Twelve months across ten axes. 2024 is the year AI infrastructure emerged as a category with its own CVEs, agents moved from the lab to product (Claude Computer Use, MCP, Salesforce Agentforce), regulation became applicable (EU AI Act in force 1 August, NIS2 deadline 17 October, NIST AI 600-1), and jailbreaks professionalised with reproducible metrics (ArtPrompt, Many-shot, Skeleton Key). Underneath, Recall shipped without threat modeling and got pulled, Arup lost $25M on a deepfake video call, and the pre-positioning chain of incidents (Volt Typhoon, Salt Typhoon, Storm-0558 fallout) runs through the whole year. Canonical annual reference.
· Manuel López Pérez
compliance · 15 min
First real step of Regulation (EU) 2024/1689. On 2 February, the prohibitions on unacceptable practices and the AI literacy duty enter application. Table of the eight categories with article, real product affected and deadline, plus the Art. 5.2 exceptions and Art. 2 extraterritoriality.
· Manuel López Pérez
news · 11 min
DORA starts on 17 January. Trump rescinds Biden's AI Executive Order on inauguration day. DeepSeek-R1 opens the open-weights reasoning category. OpenAI launches Operator, the first commercial generalist agent. Ivanti Connect Secure zero-day. Fortinet FortiOS auth bypass exfiltrates configs from 15,000 firewalls. SonicWall SMA1000 deserialization. BeyondTrust/Treasury forensics closes. Patch Tuesday with 159 CVEs and 8 zero-days.
· Manuel López Pérez
ai-security · 13 min
On 20 January DeepSeek ships R1 with paper, repo and Hugging Face weights under MIT. It is the first time a reasoning model with RL-trained chain-of-thought is available as open weights. The CoT between <think></think> tags is plain text — inspectable, and attackable.
· Manuel López Pérez
