AI Security on Christoph Kemetmüller

Orchestration Has No ATT&CK ID

Sat, 13 Jun 2026 09:43:45 +0200

MITRE ATT&CK can tell you an attacker dumped credentials (T1003) and moved laterally over SSH (T1021). It cannot tell you those two steps were chosen, sequenced, and executed by an AI agent with no human in the loop. A new report from Anthropic’s red team argues that absence is now the most important thing the framework is missing. On this, narrow as it is, they have a point.

Behind the LLM Cybersecurity Hype

Fri, 22 May 2026 16:46:29 +0200

The same vendors publishing breakthrough numbers on LLM cyber capability are publishing the disclaimers in the same posts. Read both halves and the picture changes.

The Kernel's New Rules for AI Bug Reports

Fri, 22 May 2026 14:39:04 +0200

When Linus Torvalds released Linux 7.1-rc4 on May 17, he flagged a documentation update as the highlight. The substance is a policy: the kernel’s security workflow is being restructured to cope with what he called a security list that has become “almost entirely unmanageable.”