Edition 15

Strip the espionage language and this is a fight about a business model. Distillation, learning from a stronger model's outputs, is how a lot of AI progress happens, including inside the US labs now crying foul. What the advisory really describes is a competitor doing at industrial scale, and across a geopolitical line, what the industry does routinely at small scale. That does not make China's version fine, extracting a rival's capabilities through millions of disguised queries is aggressive and, the agencies argue, coordinated. But the moral high ground is uneven when the models being defended were themselves built on other people's work without asking.

For you, the practical read is about your own AI providers and terms. If national agencies are worried about who is systematically querying frontier models and how they hide it, that is a signal about API abuse, credential sharing and third-party aggregators as a live threat surface, not a distant one. And it is a reminder that the value in an AI system, its behaviour, can walk out through the front door of an API without anyone breaching anything. Which is exactly what the next item is about.

Put the two items together and you get the joke. One arm of the story is the US treating AI-model capabilities as crown-jewel IP worth a federal advisory to protect. The other is a handful of researchers showing that the locks on those jewels can be picked with the provider's own weaker model, no sophistication required. The protection was an architectural assumption, that encrypted reasoning blocks were opaque and bound to their context, and the assumption did not hold. That is the recurring shape of this whole newsletter: a control that exists on paper with a gap nobody checked.

But do not file this under AI-lab problems, because two of the four attack vectors are yours. Developers are pasting session logs into public GitHub repositories with no idea those encrypted blocks contain recoverable personal data and credentials, hundreds of them in this study alone, so your secrets may already be sitting in a public repo inside a block you thought was noise. And the same blocks can carry invisible prompt injections into agent workflows, which connects straight to the memory-poisoning threat from a couple of weeks ago. If your developers use these APIs, what they share publicly needs the same scrutiny as any other credential leak.

The lesson here is one I keep coming back to, and a researcher on this one said it cleanly: a smart TV deserves the same security consideration as any other internet-connected computer, because that is exactly what it is, one with a microphone, an app store and a view of your whole network. The reason a bugged television feels absurd is the same reason it works, nobody threat-models the thing on the living-room wall. But it runs code, it has RCE bugs, and it sits on the same Wi-Fi as everything else you own.

For a home, the fix is boring, disable the microphone in settings and put IoT gear on a separate network from the devices that matter. For an organisation, this is the asset-inventory problem wearing a consumer disguise. The smart TV in your boardroom, the one nobody added to the asset register, is a networked computer with a microphone in the exact room where your most sensitive conversations happen. The officials in the next item spent a whole summit begging people to know what is on their networks. This is what they meant.

This is the exact lesson from a Patch Tuesday I wrote about back in the summer, and it is only getting sharper: the headline number is a distraction. 964 is unpatchable in any sane window, and it is designed to make you feel behind. The signal is the two zero-days, both privilege-escalation bugs that matter specifically because they turn a small foothold into full control. Sort your patching by what is actually being exploited and what is reachable in your environment, not by the size of the release, or you will spend the month chipping at the haystack while the needle sits in the door.

And Narang's line is the bridge to the final item, so hold it: AI is making the haystack bigger, not the problem worse. That is the same thing the officials at Billington are saying from the other direction. The volume goes up, the discipline that saves you does not change, prioritise, patch what is exploitable, know your environment. More noise is not more risk if you can still find the signal. The whole game this month, and this year, is keeping that ability.

I could have written this item myself, and in a sense I have, most weeks, for over a year. So let me just let the authorities carry it: the FBI, the NSA, and the cyber agencies of the UK, New Zealand and Canada, all on one stage, all saying that AI changes the speed and the volume of attacks but not what stops them. Identity, MFA, patching, knowing your assets, killing legacy tech. Horne's framing is the one to keep, AI is a spotlight on the organisations that skipped the basics. It is not making new kinds of failure. It is finding the old ones faster.

There is a trap in this message, though, and it is worth naming so you do not misread the summit as permission to ignore AI. The basics being decisive does not mean AI is hype, the same officials called it a genuine force multiplier for attackers and a real accelerant for defenders. Both are true, and they are not in tension. AI raises the tempo, so the cost of a missing fundamental gets paid faster and harder. That is the whole point of the phrase the basics are no longer boring. They were always what mattered. Now there is no slack left for skipping them.