← Feed

Posts

• Post #4443297

  A software investor told an AI agent, 11 times in all caps, DO NOT TOUCH ANYTHING WITHOUT PERMISSION!! It wiped his production database anyway. Then it claimed the data was unrecoverable. It wasn't. Everyone wants to talk about how the AI misbehaved. I think that's the wrong conversation. Every failure in that story has a known engineering fix. Keep prod separate from dev. Put safeguards on destructive commands. The AI did what any unsupervised tool does. What was missing was the judgmen...

• Post #4342687

  ✨ A sparkle icon shows up in an app you own. Nobody in IT put it there. A user opens a ticket asking what it does, and the help desk has no answer. The feature is live, it's available to everyone, and it's already processing your data. I wrote this one for Forbes because it keeps happening and I've stopped pretending it's normal. Zoom gave admins about four days in July 2024 to click "do not auto-enable" before AI Companion turned itself on. Google launched Workspace...

• Post #4203746

  My friend Jeff Olsen wrote a really good piece on status updates, and it's been rattling around my head all week. His point is that "on track" describes a conversation, not a state. The words sound like progress. They can hide a month of sitting in someone else's queue. I've worked with Jeff, and this is exactly how he thinks. He's always pushing to make himself and the people around him better. This post is a great example of that. The line that got me: four weeks on...

• Post #3634827

  Some news I'm honored to share. I've been nominated for the 2026 Chicago CIO of the Year Award, and I owe a big thank you to Dean Haacker of Highland Grove Partners for putting my name forward. Being nominated by someone I respect makes this one mean a lot. Since 1995, SIM Chicago, The Executives' Club of Chicago, and AITP Chicago have recognized technology leaders across Chicagoland with this award. Nominations come from CIO peers, CEOs, and other senior executives, which is what ma...

• Post #3496547

  Everyone's using AI to write code faster. Almost nobody's using it to write code better. It's where the next wave of breaches and a 2am page will come from... So I built something to help myself, and I'm putting it out there. It's a Claude Code skill called senior-engineering-partner. It's not autocomplete. It's the strict senior engineer who reviews your pull request, asks why you skipped the tests, and won't let you ship a hardcoded secret because you were &quo...

• Post #3360324

  🥶 A contractor for CISA posted AWS GovCloud admin keys to a public GitHub repo! The repo was named "Private-CISA." Not an accident, the contractor actively disabled GitHub's built-in secret scanner to do it. That's a choice. Not a typo, not a misconfiguration. Someone turned off the guardrail and then stored plaintext credentials in a file called "importantAWStokens." That should make every security leader lose their 💩 AND the exposed keys st...

• Post #3360323

  https://open.substack.com/pub/briangreenberg/p/how-to-protect-yourself-from-identity?r=3thg8&utm_medium=ios

• Post #3360322

  ✨ A sparkle icon appears in an app that no one in IT approved. The help desk can't explain it, and it's already processing your data! This kept coming up in conversations with other CIOs, so I wrote about it in my latest Forbes piece. The pattern repeats across so many vendors; here are just a few: ・Zoom auto-enabled AI Companion on host accounts, with recordings and full transcripts already defaulted on ・Microsoft 365 Copilot activates for every admin if your tenant holds a sin...

• Post #3360321

  Google's defense for false AI Overviews: Nobody should blindly trust AI output anyway. And they're right. A German court agreed nobody should trust it, then held Google liable for it regardless. However, the court found that your product only has value if people trust it. You can't sell a tool that answers with confidence and then tell a judge the answers shouldn't be believed. Two things from the ruling of note: 1. Search engines get liability protection becau...

• Post #3360320

  For years, we’ve worried about who collects our data. Now, The Washington Post has shown us how it can be used: to charge you as much as it thinks you’ll pay. The main plaintiff paid $42.40 for a year of the Post in 2024. In 2025, her price jumped to $127.20. Her most recent renewal was $148.40. An algorithm set these prices by analyzing her personal data. She only found out because a New York law requires companies to disclose this practice. Here are a few details that should concern you:...

• Post #3360319

   This new agentic AI demo from Apple's WWDC was so cool. Apple Intelligence can now log into your accounts, reset a compromised password, and save the new one so you don’t have to remember it. This is super important because weak and reused passwords still account for a large share of account breaches, and fixing them has always been a hassle. Most people struggle with password hygiene and rarely reset all their accounts. A tool that handles this for you bridges the gap between knowing...

• Post #3360318

  This project really made me smile. Andrew Warkentin has created a virtual museum with over 600 operating systems, all set up and ready to run on a regular computer. The collection covers everything from the Manchester Baby in 1948, which was the first stored-program machine, to early Android versions from 2011. He’s been gathering these images since 2003. It’s clearly fun, but what really impressed me was how useful it is. If you teach or work in security, it’s hard to find a collection of old...

• Post #3360317

  Loving our new brand... Shifting workplace expectations, geopolitical tensions, technology disruptions, and more have created one of the most challenging business landscapes to date, leaving organizations faced with a multitude of emerging challenges and competing priorities – and an even more crucial need for leaders to rise to the top. Today, we are proud to unveil the next evolution of RHR International, bringing our best work into clearer focus, helping leaders see this complexity as a ca...

• Post #3360316

  I just finished reading Google's new report about a Chinese espionage group that spent over a year inside North American medical and military research networks. What stands out is how ordinary their method was. They used a standard Google Workspace admin feature called a content compliance rule, which lets admins flag emails based on certain words or addresses. The attackers set up one of these rules, called it "Patroit" (misspelling Patriot), and used it to secretly BC...

• Post #3360315

  For a long time, people said the law was behind when it came to deepfake abuse. That seems to be changing. The DOJ took down two sites, CFAKE and SOCFAKE, which prosecutors say had thousands of fake nude images of well-known women, including politicians, journalists, and athletes. This is one of the first big federal actions under the TAKE IT DOWN Act, passed in May 2025. The law makes it a federal crime to publish sexually explicit fake images of an identifiable adult without their consent if t...

• Post #3360314

  The most interesting thing about the new SearchLeak attack on Microsoft 365 Copilot isn't any single bug. It's that none of the three pieces was dangerous on its own. Varonis combined a prompt injection via a URL parameter, an HTML rendering race condition, and a server-side request forgery in Bing's image search. Each of these is a common bug that security teams usually consider minor. But when you put them together with a Copilot that can access your mailbox, OneDrive,...

• Post #2590955

  Anthropic spent months carefully gatekeeping access to Mythos, their most capable AI model, while limiting access only to a small group of vetted companies for defensive cybersecurity testing. Then a private online forum got in anyway, through a third-party vendor, on the same day the controlled program was announced. That's the part worth sitting with. Not the model. The vendor. Third-party vendors... It's always the the 3td party vendor. 🤦🏻‍♂️ You can build the most carefully con...

• Post #2590954

  Bitcoin blocks usually take about 10 minutes to confirm. According to new research from Google, quantum key derivation might only take around 9 minutes. That similarity is hard to overlook. The main point isn’t that quantum computers will eventually break crypto—we’ve expected that. What matters now is that Google has reduced the estimated resources needed by about 20 times. That means fewer qubits, fewer gate operations, and shorter timelines. Plus, 1.7 million BTC are stored in old address fo...

• Post #2590953

  A Chinese national pretended to be U.S. engineers and researchers for almost five years, from 2017 to 2021, and walked away with sensitive aerospace and weapons development software from NASA, the Air Force, the Navy, and the Army. There was no hacking or breaking through firewalls. People simply emailed him what he asked for, because they believed he was someone they knew. This worries me more than any zero-day vulnerability. The NASA OIG reported that Song Wu asked for the same software sever...

• Post #2590952

  Google just put $10 billion into Anthropic. Its competitor. The company it's also racing against to win the AI era. Amazon dropped $5 billion into the same company this week. And investors are apparently trying to back Anthropic at an $800 billion valuation, up from $350 billion in February. I get the hedge. Nobody wants to be Blockbuster. But there's something worth sitting with here: when the biggest players in tech are all funding the same startup, that's not a compe...

• Post #2590951

  A lower court decided Apple, Google, and Facebook lose Section 230 immunity because they ran credit card transactions inside social casino apps. Not because they built the apps. Not because they designed the gambling mechanics. Because they processed the payments. Follow that logic downstream and Etsy is liable for a seller's counterfeit goods the moment a buyer checks out. Patreon is exposed the second a creator's content draws a lawsuit. Section 230 has kept smaller platforms...

• Post #2590950

  The FCC forgot hotspots were a thing. They announced a ban on foreign-made consumer routers a month ago and had to update their FAQ to add MiFi devices and cellular home routers after the fact. That's not a minor oversight... it's the whole work-from-anywhere use case. Here's the part that should bother you. The only way to get an exemption is to commit to US-based manufacturing and submit a time-bound plan to get there. Netgear, eero, and Adtran got conditional approval...

• Post #2590949

  One founder just called out something the VC community has been quietly living with for a while. AI startups are reporting CARR, which counts revenue that hasn't been invoiced and may never be, to the press while labeling it ARR. The gap between those two numbers, per the CEO who went public about it, can run 3 to 5x. Here's the part that should make you uncomfortable if you're buying AI tools or evaluating vendors: the VCs aren't getting fooled. They read the co...

• Post #2590948

  The McDonald's AI jailbreak story was fabricated. The Chipotle one before it was Photoshopped. I get why they went viral, they're kinda funny. But they're pulling attention away from the cases that actually happened and actually cost companies money. Amazon's Rufus chatbot got manipulated into providing instructions for obtaining dangerous chemicals. A Chevy dealership's bot was maneuvered into agreeing to sell a $76,000 Tahoe for a dollar. Air Canada&amp...

• Post #2590947

  What is going on with Gemini and workflows today? It's like it fell down and hit its head on a very large rock. 🤦🏻‍♂️✨

• Post #2590946

  Your AI strategy isn't a strategy if your competitor can copy it in a quarter. MIT Sloan just published something you might want to ruminate on. The argument is straightforward: AI fails the basic test of sustainable competitive advantage because it's neither unique nor inimitable. Capital, talent, algorithms, even proprietary data, all of it is converging. Smaller models are catching up to larger ones. Open-source is closing the gap. The moat you think you're building...

• Post #2590945

  I'm hiring an Analytics Engineer (GCP) to join my team at RHR International. What you'd actually be doing: building and owning our analytics foundation in a Google Cloud GCP-first environment — BigQuery, Data/Looker Studio, Python, SQL, GitHub, Docker. Real production work, version-controlled and documented, not throwaway queries. RHR is a leadership consulting firm that's been around for 80+ years. We're cloud-first, SaaS-only, no on-prem. Small IT team, which me...

• Post #2590944

  Your data isn't at risk of being breached. It already has been. The right question is whether what's out there can still be used against you. Most of the attack surfaces that actually matter are stoppable with free government tools almost nobody has touched: new credit accounts opened in your name, fraudulent tax returns filed before you file yours, employment fraud using your SSN, bank account takeovers. The IRS Identity Protection PIN alone is worth calling out. Someone can fil...

• Post #2590942

  Grateful to be a part of the Gartner Chicago CIO Community Executive Summit at the Sears (Willis) Tower. The most sobering thing I heard came from CIOs across all sorts of companies, who openly admitted that nobody has solved AI or Agentic AI operationalization. In a room full of people who are supposed to have the answers, that's the right starting point. Every conversation seemed to be all about #agenticAI. A few things that stuck: ・ The "Death of the ERP?" conversa...

• Post #2590941

  Though Google Cloud Next in Las Vegas was a couple weeks ago, I'm still working through it and trying to process everything I learned there. Three days, 32,000 attendees, 260 product announcements. One cool stand out... Google shipped an entire agent accountability infrastructure at this conference. Every AI agent now gets a cryptographic ID and an auditable action trail tied to a defined authorization policy. They built anomaly detection that flags unusual agent reasoning in real time a...