The nice thing about AI is you can blame all your breaches on it and everyone's like oh okay that tracks.

[briankrebs@infosec.exchange]

The nice thing about AI is you can blame all your breaches on it and everyone's like oh okay that tracks.

"On May 5, 2026, Community Bank discovered an internal incident involving the handling of non-public customer information through an unauthorized AI-based software application."

CB Financial Services, Inc. Cybersecurity Incident Details - Board Cybersecurity

CB Financial Services, Inc. disclosed a cybersecurity incident confirmed as a data breach involving unknown. First disclosed May 11, 2026.

Board Cybersecurity (www.board-cybersecurity.com)

[krypt3ia@infosec.exchange]

@briankrebs AI, the new APT

[bluedot@left-bank.net]

@briankrebs

From the passive phrasing of the report, I guess the unauthorized AI-based software application installed itself.

[ricci@discuss.systems]

@briankrebs I've linked this book countless times on here and I will probably link it countless more but: https://press.uchicago.edu/ucp/books/book/chicago/U/bo252799883.html

The central thesis of the book is that when organizations build too many "accountability sinks", where no one is accountable for decisions, then those organizations eventually die.

AI is, of course, nothing if it isn't accountability sink as a service

[dzwiedziu@mastodon.social]

@briankrebs
Can “AI exfiltration” be shortened to “AI-fill”?

[sraars@hippodon.com]

@briankrebs It's the stupidity that really gets to me.

[emory@soc.kvet.ch]

@BlueDot eventually an autorooter will drop off a configured mcp client with a prompt that says "discover local network infrastructure and obtain administrative rights on it, then build a way to contact <me> covertly and report assets compromised in order of value"
or something. hopefully it's in morse code i'm fscking ready for that one

[lbcp@social.linux.pizza]

@briankrebs Serious question, is it a criminal offence if I convince an AI to exfiltrate all customer data?

[clickhere@mastodon.ie]

@lbcp Can you say why you've used the word "convince" here?

@briankrebs

[wingedsnake@mastodon.berlin]

@briankrebs just perfect!

[wingedsnake@mastodon.berlin]

@BlueDot @briankrebs autonomous ai

[lbcp@social.linux.pizza]

@clickhere @briankrebs My lawyer recommended it, as it sounds better than exploit. But I guess you answered my question

[clickhere@mastodon.ie]

@lbcp @briankrebs Ha. Yeah, I'm not sure semantics would hoodwink a judge, who may look to deeds, not words, to establish the facts. (Maybe. Possibly. Or would they..?)