Writing
Latest from RockCyber Musings
RockCyber Musings is where I think out loud about AI security, governance, and the risk calls executives have to make. The last twenty posts are below, each one links to the full piece on Substack.
Weekly Musings Top 10 AI Security Wrapup: Issue 58: October 9 to October 15, 2026
The FTC and Brussels asked the labs for their records, Bank of America paid for Mythos in contractors, and Anthropic pulled its own internet. 11 verified AI security stories from October 9 to 15, 2026
AI Made Security the Bottleneck. Then the CFO Came for the Reviewers.
AI moved the bottleneck to the people who check its work, and the queue math shows what happens to everyone else when you cut one of them.
Weekly Musings Top 10 AI Security Wrapup: Issue 57: October 2 to October 8, 2026
Agent Session Logs, The Identity Gap, And The Week A Vendor Said Injection Is Not A Bug
Evaluating AI Security Research: Eight Questions Before You Fund It
Use eight questions for evaluating AI security research. Find the attack success rate denominator, condition, and baseline in 15 minutes.
Weekly Musings Top 10 AI Security Wrapup: Issue 54: September 25 to October 1, 2026
Your AI incident postmortem is now discoverable evidence. 11 verified AI security governance stories, with the specific moves CISOs should make this week.
Human in the Loop Is a Rubber Stamp. Its Replacements Are Too.
See why human in the loop approval let 40.4% of AI agent overreach through, why model approvers leak too, and the budget control that holds.
Weekly Musings Top 10 AI Security Wrapup: Issue 53: September 18 to September 24, 2026
An OpenAI Agent Hacked Medicare, Three Lab CEOs Briefed The Security Council, And California Wrote A Kill Switch Into An Executive Order
The Math Behind the AI Agent Restart Gate: OpenAI Hit Restart on July 7. The Hugging Face Breach Began July 8.
Read September's OpenAI and Anthropic reports like a data scientist, then find the AI agent restart gate July 7 lacked. Four checks from process safety.
Weekly Musings Top 10 AI Security Wrapup: Issue 52: September 11 to September 17, 2026
OpenAI disclosed six misalignment incidents, got accused of breaking SB 53, then backed federal AI audits. Plus NIST names AI agents in token guidance.
All AI Extinction Risk Panic Does Is Ban the Safer Model and Keep the Worse One.
AI extinction risk panic bans the safer model, keeps the worse one, and jails the builders. I did the math the Senate won't. It rounds to couch change.
OpenAI Audited Its Bio Safeguards. It Skipped the Cyber Ones
OpenAI's AI safeguard evaluation covered bio and skipped cyber, the one domain GPT-6 Astra rated Critical. Here is what to ask your model vendor at renewal.
Weekly Musings Top 10 AI Security Wrapup: Issue 51: August 28 to September 3, 2026
When the Agents Went Operational: AI-Run Ransomware, a Frontier Cyber-Model Arms Race, and a Control Gap Your Board Can Measure
AI Agent Detection Failed at OpenAI. Tuning Won’t Fix It.
A security alert fired and the responder was right to stand down. What the OpenAI Hugging Face incident says about AI agent detection and agent telemetry.
Weekly Musings Top 10 AI Security Wrapup: Issue 50: August 21 to August 27, 2026
The Week Agents Got Identity, Eyes, and a Schedule, and Attackers Weaponized AI to Match
Broken Object Level Authorization Is Now an AI Agent Problem
An AI agent found a broken object level authorization flaw in a gym API and canceled a stranger's spot. Why alignment can't fix it and what to check first.
AI Risk Assessment: Anthropic’s 186-Page Blind Spot
Anthropic's 186-page AI risk assessment reads like a field manual on lost control: unwatched agents, disabled logging, a safety case on one eroding claim.
Weekly Musings Top 10 AI Security Wrapup: Issue 49 August 7 -August 13, 2026
The Week Autonomous Agents Walked into a Nuclear Regulator, Broke Zoom, and Forced Regulators to Move
The 2026 OWASP LLM Top 10 Landed. Its #1 Risk Nearly Didn’t Make the Cut.
The OWASP LLM Top 10 2026 checked the practitioner vote against 6,639 real incidents. See what moved, why prompt injection stayed #1, and how it held up.
AI Agent Capability Confinement: No Escape Required
AI agent capability confinement failed at the egress path in Anthropic's evals. Three models, three decisions, three compromised orgs. What CISOs fix now.
Weekly Musings Top 10 AI Security Wrapup: Issue 48 July 24 -July 30, 2026
An OpenAI test model broke containment and hacked two firms. Your week in agentic AI security: the rogue-agent breach, a Copilot worm, and a kill switch bill.
Subscribe to the newsletter
Get RockCyber Musings in your inbox. It is free, and you can leave whenever you want.