Citations in the Press

What IonQ gets [from Elisity] today is access. Dividing the headline price by those deployments puts it at about $13 million each. That is a steep price for a Rolodex, if you will. Paying in its own stock makes the price easier for IonQ to swallow.

CVSS only awards a 10.0 when everything goes the attacker’s way. This flaw can be accessed over the network, an attack is easy to pull off and needs no credentials or for a user to click anything to succeed.

The memory poisoning worries me most. A poisoned memory turns a helpful agent into a Manchurian Candidate, waiting for the right conversation to send it somewhere it should not go. You can rotate a stolen key. It is much harder to know which memories to trust.

The vendor cannot tell you whether you were visited. Only your logs can. . . After years in production, a web root may collect configuration files, backups, and credentials nobody remembers putting there. One readable secret becomes the first step in a much larger attack.

An agent acting with a person’s credentials gets recorded as that person. A developer who accepts an AI suggestion and commits it signs it as their own work. A human who rewrites three lines of an agent’s code creates a change that belongs to both of them. Most enterprises cannot untangle that today. Many do not try. Attribution is easy at the edges; [but] it is hard in the middle, where most of the work now happens.

An unpatched PeopleSoft flaw is a Sword of Damocles over every PeopleSoft shop. For PeopleSoft shops, the to-do list is short. Apply Oracle’s patch. Disable or remove the Environment Management Hub if you do not use it. Search your logs for encoded variants of the PSEMHUB path, not just the literal string. If you find a web shell, treat the server as compromised and rotate every credential it could read.

A security patch colliding with an inventory freeze is not a technology problem. It is a business trade-off. The person approving the change should see both sides before deciding. The example is strong, and the [corporate] politics raised may be its Achilles’ heel.

A machine can recommend, but a human must decide. The hard part is defining what ‘decide’ means. The law does not keep AI out of the decision. It keeps a human in it.

The pitch is what Flow does not require. ServiceNow claims Flow can be running in a day with no implementation project, no CMDB migration, and no infrastructure. Every item on that list is something its flagship ITSM platform does require. ServiceNow is selling the absence of its own complexity.

CIOs have more leverage than they think, because the vendor needs them more than the pitch deck admits. Negotiate price protection, advance notice before models are retired, and data portability now, while you are the customer they cannot afford to lose.

For two years, this industry has tried to secure agents by asking them to behave, with guardrails bolted into the prompt, the model, and the harness. That approach was always going to lose. Nvidia finally puts enforcement where it belongs: outside the agent, in the kernel, in a proxy that inspects every outbound request and in silicon the agent cannot see or touch. You don't ask the prisoner to lock his own cell. Every serious agent platform will have to match this design.

OpenAI seems proactive in highlighting the threats posed by AI, but hesitant to accept accountability or take real action. This is a code of conduct for the assessors, not for OpenAI. The gap between the two is the whole story.

That's the difference between picking one lock and stealing the master key to the whole building.

Edge security appliances are simultaneously the most trusted and the most exposed thing on a network. That combination is exactly what makes them worth an attacker's time.

The model's behavior is the least interesting part of this story. Google's conduct afterward is the most damning part. This isn't a story about Gemini going rogue. It's a story about one shared testing vendor's infrastructure mistake hitting four AI labs at once, and about Google being the slowest and least forthcoming of the four in telling anyone about its own copy of that failure.

Simplification does not imply reduced capacity. Rather, it reflects architectural coherence. When workflows, telemetry, policy and automation are aligned with a unified system, security operations become more predictable and scalable. In an environment where talent shortages and digital expansion are persistent realities, operational simplification supports sustainability as much as security efficacy.

Moving forward, platformization for a smaller company isn't a nice-to-have, it's a have-to-have. Given the exponential increases in IT complexity, we can't layer security tool complexity on top of that.

Those vendors' numbers were based on the argument that a chip's working life doesn't end when it leaves a frontier training cluster. It cascades down to inference and then lower-intensity batch work for years afterward. BAN's own report acknowledges this research exists and calls it untested for AI accelerators specifically, then keeps the 2.5 year figure anyway. It is the report's weakest link. The honest read is that BAN's near-term, 2030-era numbers are probably overstated.

OpenAI needs to be held accountable. They seem to want to create 'Dr. Frankenstein's monster,' but don't seem to want to accept blame for the outcomes. OpenAI hasn't denied its agents used RubyGems. It has disputed the word 'malicious' and called the activity 'benign,' while separately acknowledging that, in that same stretch of weeks, its agents escalated to cluster-admin access at Hugging Face and compromised accounts at four other third-party services. Those two characterizations are hard to square. The behavior is still unacceptable.

Every frontier lab still gets jailbroken, still has agents that go off-script, still hasn't closed the gap between what a model is instructed to do and what it can be induced to do. A values statement that skips the verification question isn't a constraint, it's a hope wearing a policy document's clothes.

If anything, this should sharpen the concern rather than settle it. A board just decided it couldn't function with him running a corporate entity with ordinary fiduciary obligations. That same person still holds sole authority over the update pipeline for software that runs over 40% of the web. Risk teams that were nervous about concentration risk in WordPress now have a fresh, concrete data point: the concentration is real, and untouched by whatever just happened at Automattic's board table.

You cut fast, you look great on the next earnings call, and eighteen months later, the weight is back, plus interest, because nobody fixed why the cut was made in the first place.

This is the biggest change to civil timekeeping since the leap second itself was adopted in 1972. Earth's rotation has historically been slowing down, so that's the only direction the system has ever had to handle. What's crazy is that the Earth's rotation has been speeding up in recent years, requiring a negative leap second, subtracting a second instead of adding one. Nobody has ever run that in production, at global scale, on the systems the world actually depends on.