Journalist at global crossroad of tech & law, focused on privacy, security. Chief Digital Risk Correspondent for @MLexclusive. Frmr @JSKStanford: [email protected]
Half Moon Bay, CA
Joined June 2009
- Tweets24.2K
- Following1.9K
- Followers7.3K
- Likes6K
Mike Swift retweeted
We've heard publishers' feedback on our proposed ads and business terms update. We care deeply about our partners and do not plan to make policy changes without a full consultation with industry groups and leaders.
We're committed to getting this right, and as we expect this consultation could extend beyond November 20, in which case we’d delay implementation of the updated terms. Until then our existing terms remain in place.
The crawling terms we consolidated only applies to our ads and business products, and we've now clarified that in the terms themselves. As we said, how Meta uses web crawlers isn’t changing, nor is how content owners can use robots.txt to signal preferences. These updates don't give us new rights to supersede such preferences and this isn’t about scraping news sites.
m.facebook.com/legal/self_se…
Kind of sounded like @sundarpichai threw some shade on @OpenAI and @AnthropicAI at the end of the #Googleearnings call as he said the @Google history of safe development would be a "huge differentiator" from its competitors in the development of #AgenticAI
"We already hear about it from our users, and I think they would vote with their feet as this frontier goes through," if @Google didn't maintain the "extensive testing, the kind of real-time monitoring, we do as we deploy these [agents] at scale," @sundarpichai said. #AgenticAI
Mike Swift retweeted
A US judge said she had no choice but to delay the trial of a man accused of helping to run BTC-e, a cryptocurrency exchange that helped bankroll the first wave of ransomware attacks, until February 2027.
By @Swiftstories mlex.com/mlex/financial-crim…
Mike Swift retweeted
80 years ago today, the first images of Earth from space were taken. A 35mm camera mounted on a captured V-2 rocket launched from White Sands Missile Range in New Mexico. This photo is a frame from the rocket's journey to 65 miles (105 km) above Earth's surface.
ALT A grainy black and white photo of a small portion of Earth seen with the blackness of space, taken on October 24, 1946. White clouds are visible over the gray of the Earth's surface.
Mike Swift retweeted
Singapore is one of the first in the world to regulate app stores for children. App stores are required to put in place age assurance, user and child safety measures, robust app review and accurate age ratings, and submit annual transparency reports.
Here's the report:
Mike Swift retweeted
we've found and have been working on disclosure for a remote code execution in a widely-deployed compression library.
it's both an impactful issue and an example that shows how complicated it can be to coordinate patching, since it's integrated into a lot of downstream software:
During this red-teaming exercise, we also found a vulnerability that allows for unauthenticated remote code execution in Brotli, a widely-deployed compression library included in many pieces of software such as Node.js, Bun, and Envoy.
The flaw could let an attacker run their own code on affected systems by sending or replying with malicious compressed data, without any need to create a user account. That is, an unpatched server that accepts compressed input could be taken over by a malicious client, and an unpatched client that accepts compressed input (such as “curl --compressed”) could be taken over by a malicious server.
This root cause issue was actually fixed in the Brotli source code in February, but it wasn’t known at the time that it gave rise to a security vulnerability and there was no more recent release of Brotli. Since Brotli is built into other software, any software which includes this library needs to take the update too, followed by the users of that software. We disclosed the vulnerability to Brotli and other downstream projects such as Node.js, which released or are currently releasing security updates, and Brotli cut new release versions and published a CVE.
More details on the patch and mitigations below:
patchtheplanet.org/brotli
It didn't occur to @OpenAI to do this until a few months ago? – at Half Moon Bay, CA
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Mike Swift retweeted
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Mike Swift retweeted
As AI firms recklessly unleash hacking agents across the internet, longstanding cybersecurity vulnerabilities are being exploited with even greater ease and frequency.
Hackers who compromise accounts or expose sensitive data can upend people’s lives.
This is not happening in a legal vacuum, and businesses across sectors face real legal duties.
At @FTC we routinely brought lawsuits against firms whose lax data security practices led to major hacks, exposing people to identify theft, stalking, and serious data misuse.
1. AI firms that are unleashing hacking agents could be held liable for engaging in “unfair or deceptive” practices under the FTC act and state UDAP laws, as well as other statutes.
2. Businesses whose systems get hacked because they’ve failed to follow basic security protocols may also be liable for failing to implement reasonable safeguards. Bad actors may be the ones exploiting these vulnerabilities, but that doesn't absolve businesses from having allowed the vulnerabilities to persist in the first place.
Here is a list we published of some basic security vulnerabilities businesses have a legal obligation to patch up: ftc.gov/policy/advocacy-rese…
3. CEOs can also be personally liable for presiding over lax data security practices, as we held in our case against Drizly: ftc.gov/news-events/news/pre…
4. Lastly, businesses that suffer hacks or breaches must alert any affected parties with clear disclosures that are timely, accurate, and actionable. Failing to disclose security breaches can also violate the law: ftc.gov/policy/advocacy-rese…
Florida AG throwing some shade on the states decision to settle their #CambridgeAnalytics claims for just $459 million, which sure looks like a brilliant move by @Meta in retrospect – at Half Moon Bay, CA
As I said at the time, the multi-state settlement with Meta was a slap on the wrist. New Mexico was just awarded $25 billion for privacy violations, with $15 billion related to Cambridge Analytica.
The multi-state settlement? $459 million that must be divided up among 48 states for the same violations.
Florida isn't going to sell out to Meta. We're going to hold them accountable.
#AI — oops SI — helping @Meta understand you even better, Li says: "Within our ad systems, we are continuing to drive performance gains as we deploy more predictive models that understand users more deeply and deliver ad experiences better aligned with their unique preferences...."
CFO Susan Li now up, saying @Meta legal expenses — in large part because of the $9.9B charge for state AG settlements — now one of 3 key drivers in 68% YOY expense growth Year-over-year growth was primarily driven by legal-related costs, infrastructure costs, and third-party AI token costs
CFO Susan Li now up, saying @Meta legal expenses — in large part because of the $9.9B charge for state AG settlements — now one of 3 key drivers in 68% YOY expense growth Year-over-year growth was primarily driven by legal-related costs, infrastructure costs, and third-party AI token costs
"Year-over-year growth was primarily driven by legal-related costs, infrastructure costs, and third-party AI token costs," Li says. #Meta
Zuckerberg says the #Muse AI assistant will soon be on Meta Glasses, and will unlock subscription revenue. "Glass's sales continue to grow rapidly, and now with Muse, we expect that paid subscriptions will increase and that this business will begin improving meaningfully from here," Zuckerberg says. #Metaearnings
Well, well, on #metaearnings Zuckerberg adopts the term du jour "super intelligence." In other news, #Threads now has more monthly active users than @X , Zuck says.
Breaking on @mlexclusive A judge in New Mexico has just ruled that @Meta is on the hook for $25 billion for statements by Zuckerberg and Sandberg around #CambridgeAnalytica that "were part of a coherent strategy designed to mislead the public."
mlex.com/mlex/data-privacy-s…
