CodeIsGo.com

EFF argues that AI regulation should prioritize proven cybersecurity boundaries over speculative doomsday scenarios. By Jacob Hoffman-Andrews, Tori Noble, and Maddie Daly.

The OpenAI-Hugging Face incident wasn’t some theoretical risk—it was a concrete architectural failure. The testing environment lacked basic isolation. EFF’s message to lawmakers: stop chasing sci-fi scenarios and ground rules in actual, demonstrated risks using cybersecurity practices we already know work.

The tension is real: move fast vs. keep people safe. But the answer isn’t new tech. It’s applying existing standards rigorously.

Start with sandboxing. When an AI task carries real risk—like reaching outside its environment—that code runs in a disconnected, monitored container. No lateral movement. Limited blast radius. The incident reports are clear: proper sandboxing and logging would have caught or prevented this entirely. We’re talking observable control flows, not abstract “safety metrics.”

Here’s the catch: write rules for today’s AI and they’re obsolete tomorrow. Anchor them to established security protocols instead, and they last. But that flexibility has a failure mode without mandated third-party audits and public reporting, “proprietary secrecy” becomes a shield for unsafe practices.

EFF’s bottom line: precision and practicality. Don’t strangle innovation. Do demand accountability.

The hard question teams face now: how do you define and enforce minimum safety for high-risk tasks without hardening standards that choke progress? Good read!

For engineers and security analysts, the sticker price of an AI security certification is only the beginning. Understanding the operational trade-offs between training formats, lab access, and renewal requirements is critical for budgeting and career planning. By sisa.ai.

When evaluating AI security certifications, practitioners often fixate on the advertised course fee, missing the operational realities that drive total cost of ownership. For instance, SISA’s CSPAI certification lists a $250 fee for the exam and digital credential, but this excludes instructor-led training and practical labs. For a working engineer, the real investment lies in time and infrastructure. Self-paced online modules offer flexibility but lack the guided discussion needed to troubleshoot complex adversarial attack scenarios or model manipulation techniques. Conversely, instructor-led sessions provide direct interaction but demand rigid scheduling and higher upfront costs.

The article reads about:

• What Is an AI Security Certification?
• Factors That Influence AI Security Certification Cost
• Breakdown of AI Security Certification Expenses
• What Skills Do AI Security Certifications Cover?
• SISA CSPAI Certification Cost and Training Details
• Tips for Reducing AI Security Certification Costs
• Conclusion: Choosing the Right AI Security Certification

The technical depth of the curriculum also dictates the return on investment. Programs covering only theoretical risk assessment may fail to prepare you for hands-on tasks like identifying prompt injection vulnerabilities or securing agentic AI workflows. If your role involves penetration testing or application security, prioritize certifications that include hands-on labs. These resources are essential for understanding how AI-specific threats, such as data poisoning, manifest in production environments. Without practical exposure, the certification may validate knowledge but not competency. Good read!

Google’s integration of Gemini Nano into Chrome creates an unmonitored AI runtime accessible to any website, introducing prompt injection and parasitic compute risks that bypass traditional cloud security controls. By Kirill Gelfand , Vladimir Kropotov , Fyodor Yarochkin , David Tulis.

Engineering leaders must now treat every managed Chrome desktop as an exposed AI runtime. Google’s recent deployment of the 4.27 GB Gemini Nano model to qualifying installations fundamentally alters the threat landscape. Unlike cloud-hosted APIs, this local model lacks authentication tokens, audit logs, and rate limits. Once downloaded, any HTTPS site can invoke it via JavaScript without user consent or visible indicators. This design inversion removes the privilege boundaries that typically protect enterprise data.

We demonstrated successful prompt injection of Chrome’s built-in AI workflows: We showed how text on a webpage, when processed by Chrome’s Summarizer and Writer APIs, and Chrome’s former on-device Scam Detector (since replaced by a cloud model in Chrome 156), can redefine tasks and change the intended behavior of the local models. A core problem is that trusted instructions and untrusted content ultimately have to be interpreted by the same language model.

Source: https://www.trendaisecurity.com/en/resources-insights/deep-research/the-browser-is-now-an-ai-runtime-security-risks-in-chromes-on-device-models

The immediate technical risk is prompt injection. Because system prompts and webpage content share the same context window without enforced authority, malicious scripts can manipulate AI features like Summarizer or Writing Assistance. TrendAI Research demonstrated that plausible-sounding payloads could bypass scam detection mechanisms, flipping classification fields that feed server-side verdicts. While Chrome 156 moves scam detection to the cloud, the underlying architectural vulnerability remains for other on-device features.

Beyond data integrity, the model enables parasitic computing. Websites can silently use user hardware for inference, creating economic incentives for abuse similar to cryptomining. With throughput reaching 30 tokens per second on mid-range devices, the cost savings for attackers are significant. However, unlike cryptomining, browsers currently lack throttling or blocking mechanisms for this specific vector.

For CISOs, the challenge is visibility. Current enterprise policies cannot distinguish between legitimate user interaction and malicious script-driven inference. Developers must implement strict input sanitization, treating model output as untrusted data to prevent XSS and injection attacks. Application-level rate limiting is essential, as the browser provides no per-origin controls. Until Google enforces privilege boundaries and ships granular enterprise controls, organizations must assume that any visited website can leverage local AI resources without oversight. Good read!

A flaw in Claude Dispatch revealed how authenticated web sessions can drive local OS agents, turning low-privilege browser access into high-privilege code execution. By Gal Weizman.

This architectural pattern extends beyond the feature examined here and appears in other AI assistant capabilities. Claude Code Remote Control and Claude Cowork sessions allow extensions to perform the very same attack. We will explore its broader security implications in an upcoming follow-up blog.

Source: https://forever.security/blog/thisbash-claude-dispatch-browser-extension-rce

The core architectural tension lies in the trust boundary between authenticated web sessions and local execution environments. Claude Dispatch allowed browser extensions to control Claude Desktop by leveraging ambient cookies from a logged-in claude.ai session. This design conflates identity verification with command authorization, assuming that possession of a valid session token implies consent for local OS actions. Consequently, a malicious extension on a personal device could issue commands to an agent running on a corporate endpoint, effectively bridging isolated environments.

The primary trade-off is between seamless cross-device usability and strict authorization boundaries. By allowing the web interface to drive local agents without explicit, out-of-band confirmation, the system prioritizes convenience over isolation. This creates a critical failure mode: prompt forcing. Attackers can automate interactions to bypass guardrails, using social engineering within the agent’s context to justify malicious commands. The vulnerability persists beyond Dispatch, as similar architectures in Claude Code Remote Control and Cowork sessions rely on the same flawed trust model. Teams must resolve whether an authenticated session constitutes sufficient evidence of user intent for high-privilege operations, or if explicit, isolated approval mechanisms are required to prevent browser-based vectors from compromising endpoint integrity. Interesting read!

Google’s Android Dev Summit announcements signal a shift toward agent-assisted mobile development. For engineering leaders, the real question is not whether to adopt agentic tooling but how to govern it while teams retain ownership of code, testing, and risk. By Nacho Carrión.

The decision Google’s latest Android tooling forces on engineering teams is not whether to let AI agents write code, but how to keep developers accountable for what those agents produce. At Android Dev Summit, Google framed the shift as moving from building features quickly to owning, reviewing, and testing agent output. That reframing is the crux for leaders: velocity is no longer the bottleneck, trust is.

The concrete changes are substantial. Android Studio now lets teams choose preferred coding agents, including Claude, Codex, and Antigravity, while keeping them inside the IDE rather than forcing a switch to CLIs. Android CLI extends agent access to emulators, remote device testing via Firebase, and profiling. New Android SKILLS guide agents through modern practices like XML-to-Compose migrations and AGP upgrades, aiming to raise code quality. On the product side, AppFunctions and the A2UI Compose library let apps expose functionality and render native interfaces for agents, while Journeys introduce natural-language, non-deterministic testing.

Near-term, these tools reduce friction and can accelerate delivery. Longer-term, Touchlab suggests AI-driven tests could eventually replace Espresso and UI Automator, and that agentic exposure could reshape how apps interact with users. But the governance tension is real: teams must still review generated code, adapt test suites to non-deterministic behavior, and manage dependencies on Google’s platform direction.

For leaders, the threshold is clear. Before adopting agentic workflows, decide how you will verify agent output, who owns quality, and how much you lean on Google’s evolving APIs versus portable approaches.

This blog post argues the browser should sit at the center of enterprise security. The framing is strong; the evidence is largely promotional and the causal claims run ahead of what the source supports. By Niamh Cunningham.

Author opens with a defensible premise: the browser has become the primary workspace for knowledge workers, and with it, the primary attack surface. Citing Omdia, she notes workers spend over 56% of their day there and that 92% of organizations fear data leakage through shadow AI. These figures anchor the argument well, and the core claim—that legacy EDR and perimeter firewalls are blind to in-browser interaction—is a genuine gap, not a straw man. Extensions can read financial data, session hijacking and living-off-the-land tactics thrive outside endpoint visibility, and agentic workflows create vectors legacy stacks simply cannot see.

The article man focus is on:

• The browser is now the primary enterprise workspace and attack surface.
• Legacy security stacks cannot observe in-browser or agentic interactions.
• Chrome Enterprise Premium captures point-of-interaction telemetry.
• Mandiant cases illustrate plausible detection scenarios.
• The argument is strong on framing, weak on independent evidence.

The proposed remedy, Chrome Enterprise Premium, is presented as a high-fidelity telemetry engine capturing signals at the point of interaction. Its capabilities—real-time network signals, extension telemetry, GenAI/SaaS governance, and an evidence locker for forensics—are coherent and internally consistent. The Mandiant case studies add texture: a newly registered domain flagging an RMM executable, URL risk evaluation disrupting phishing mid-navigation, and threat-intelligence integration containing a malicious ad click. These read as plausible, specific, and useful.

Yet the piece collapses demonstration and suggestion. It shows what telemetry can capture but never independently verifies detection accuracy, false-positive rates, or how these signals compare to competing approaches. The Mandiant examples are presented as proof rather than illustration. The strongest claim—that Google’s billions of protected devices confer unique defensive visibility—is an appeal to scale, not a technical argument. The piece is ultimately marketing dressed as analysis, and readers should treat its confidence as aspirational rather than measured. Nice one!

Deloitte’s 2026 State of AI in the Enterprise report charts rising AI spend against modest revenue returns, but its central insight is the persistent gap between experimentation and production deployment. By Jim Rowan and Peter Sonner.

Deloitte’s 2026 State of AI in the Enterprise report, authored by Jim Rowan, Nitin Mittal, Beena Ammanath and Costi Perricos, rests on a single strong claim: enterprise AI investment is rising sharply, yet financial returns remain limited because most organizations have not made the operational changes required to convert spending into revenue. The evidence is concrete. Among 3,235 business and technology leaders surveyed across 24 countries and six industries, 84% are increasing AI budgets, yet only 25% have moved at least 40% of their experiments into production, and just 20% report revenue growth from the technology, against 74% that expected it to expand revenue.

The main points in this report:

• Deloitte’s report argues rising AI investment has not matched the operational changes needed for revenue returns.
• Only 25% of organizations have deployed 40% or more of AI experiments into production.
• Just 20% report revenue growth from AI despite 74% expecting revenue expansion.
• Agentic AI plans outpace governance maturity by a wide margin.
• Most job redesign and business-model transformation remain unfinished.
• The report is a credible baseline but should be read with caution on forward-looking claims.

The report’s reasoning is sound. It separates three stages of adoption—experimentation, integration into existing processes, and transformation of products or business models—and shows that only 34% of organizations are pursuing substantial change. The strongest results cluster around efficiency and productivity, achieved by 66% of respondents, and decision-making, achieved by 53%. This is a measured, defensible picture rather than a hype narrative.

Yet the analysis has limits. The gap between planned agentic AI deployment (74%) and mature governance (21%) is striking, but the report itself notes these measures assess different aspects of readiness, so the 53-percentage-point spread is more suggestive than conclusive. Similarly, the survey captures intentions and self-reported maturity rather than verified outcomes. The mining example illustrates product transformation, but it is anecdotal.

The report is most valuable to executives weighing continued AI investment and to engineers responsible for production deployment. Readers should treat the forward-looking deployment expectations with caution, since planned acceleration does not establish that deployments occurred. Overall, it is a credible, well-sourced baseline for understanding where enterprise AI actually stands. Interesting read!

Organizations are deploying AI agents faster than they can demonstrate value, and the gap between adoption and measurable return stems from a disconnect between buyers and users plus a lack of business context. By Databricks Staff.

The framing of productivity is shifting. Historically it meant how much work a single person could accomplish alone. In an agentic world, it now means how much a person can accomplish with a team of AI assistants working alongside them, without sacrificing quality. That reframing matters to operators because it moves the metric from individual throughput to augmented capability, which is harder to measure and easier to overstate.

The AI ROI gap exists because the people buying AI and the people using it are often different. Buyers evaluate on headline promises and deployment speed; users judge on whether the agent actually improves their workflow. Most organizations remain in a trial-and-error phase, still figuring out which use cases actually work. Until a use case is proven in the hands of the user, any reported productivity gain is speculative.

Speed is the wrong way to measure AI productivity. An agent that responds quickly but produces generic output adds little. The agents that create real value carry business context: your data, your history, your constraints. Without it, an agent can only offer generic advice, not decisions your company can act on. Integration cost is the hidden variable operators face, because building that context requires wiring agents into existing systems, governance, and data pipelines.

The advice to prioritize context does not transfer everywhere. Teams with clean, well-governed data may see faster wins than those burdened by legacy systems. Where the source’s guidance may not hold is when context is unavailable or when quality cannot be verified, because the productivity promise collapses.

Consider whether you have a proven use case with user feedback before scaling. If you lack business context, expect generic output and defer. Test in a bounded workflow where you can measure quality, not just speed. Good read!

An OpenAI model uncovered two critical PHP flaws, triggering a global update race that revealed how fragile and under resourced the internet’s foundational software has become. By Omar Gallaga.

Last week, software engineers worldwide scrambled to patch their websites’ backends after a team using an OpenAI model discovered two major vulnerabilities in PHP, the open-source scripting language that underpins as many as 70% of websites globally. Shortly after alerts issued, new PHP versions shipped and site operators were urged to update. Some government websites went dark in Europe during the rollout, but for much of the web, applying the fixes was left to individual owners.

The deeper story emerged from the PHP Foundation itself. Reuters reported the nonprofit, formed in 2021 to coordinate researchers and cybersecurity firms against crises like this, runs with just one full-time staff member. Executive Director Elizabeth Barron said she works with about 14 part-time contractors and unpaid board members, noting that AI-generated threats have doubled the demand to change PHP code while contributor numbers have not. “It is clear PHP is severely underfunded,” she said.

Awareness gaps compound the problem. A Network Solutions survey of 121 small business owners found 45% had never heard of PHP and 71% didn’t know if their sites used it. Principal systems architect Rick Radinger said owners often assume hosting providers will handle fixes.

Infrastructure companies moved anyway. Cloudflare deployed new web application firewall protections and launched a PHP Capture the Flag contest on HackerOne with cash prizes from $100 to $10,000, while GoDaddy updated managed hosting without requiring owner action.

For users, the vulnerability cannot be fixed by changing passwords or browsers—it lives on the site’s server. As PHP approaches its fourth decade, this scramble suggests many aging tools, from JavaScript to SQL databases, will keep surfacing vulnerabilities unless the web’s neglected maintenance infrastructure is addressed. Nice one!

A new report from Open Markets Institute and Americans for Financial Reform Education Fund argues that the AI boom is being sustained by circular financing, opaque private fund investments, and accounting tricks, and that a sharp correction could trigger a recession or a 2008-scale financial crisis. The report, “Brace for Impact: Protecting People and the Economy when the AI Bubble Bursts,” examines how a handful of tech companies and their financial backers are fueling the bubble, and it calls for transparency, closing regulatory loopholes, stronger supervision of AI financiers, and a commitment not to bail out AI firms or their financial backers.

The report highlights:

• A new report warns that AI’s trillion-dollar spending boom is propped up by circular financing, opaque debt, and accounting gimmicks.
• Warning signs are already emerging: OpenAI revenue miss, Firmus Technologies IPO cancellation, and strategist warnings of a 2027-2028 burst.
• Fitch Ratings and the IMF have flagged AI-driven market corrections as recession and financial stability risks.
• The report names Alphabet, Amazon, Anthropic, Meta, Microsoft, OpenAI, Oracle, and SpaceX as drivers of the spending spree.
• Policy recommendations include transparency, closing regulatory loopholes, stronger supervision, and no bailouts for AI firms or backers.
• The report argues that an AI crash could threaten workers’ jobs, retirement savings, and communities beyond Silicon Valley and Wall Street.

The warning signs are already visible. OpenAI’s annualized revenue was reported to be a full $20 billion below a figure widely reported just weeks earlier. NVIDIA- and Blackstone-backed Firmus Technologies abandoned a planned IPO in Australia after investors balked at its valuation and business prospects. Panmure Liberum’s top strategist warned the AI bubble could burst in 2027 or 2028, potentially triggering a severe stock-market downturn. Fitch Ratings warned that any sharp correction of AI stocks could plunge the U.S. into a recession, and the IMF named an AI-driven market correction as a salient stability risk.

In addition, the report lays out steps that policymakers at every level of government can take to limit potential harms before and after a crash, including demanding financial transparency across the entire Al ecosystem, closing statutory and regulatory loopholes that enable deceptive accounting practices, strengthening regulation and supervision of AI financiers, and refusing to bail out AI firms or financial backers. Excellent read!