Dark mode: ON

Infosec Decoded Season 5 #56: Three Parents

With Doug Spindler and sambowne@infosec.exchange

Recorded Fri, July 18, 2025

AI

In order to generate excitement, AI companies try to scare non-technical politicians and investors with nonsense, so they can get more money.

That video is total nonsense. There's nothing to worry about. Here are a few reasons:

1. AGI is a pipe dream. It won't happen any time soon, and probably never. Gartner projects that there will be no significant progress towards AGI within the next decade:

From: What’s New in Artificial Intelligence from the 2023 Gartner Hype Cycle

2. That video breezily projects a datacenter 1000x more powerful than the one used to train GPT-4. GPT-4 required 3 months of training using 8000 H100 GPUs. Meta's AI Research SuperCluster has been operational since 2022. That cluster uses 16,000 Nvidia A100 GPUs. Elon Musk's xAI effort, Colossus, is powered by 200,000 Nvidia chips, but its power consumption already exceeds grid capacity, and uses 36 gas turbines, which produce so much pollution that there are lawsuits to shut them down. Scaling up by a factor of 1000 seems very unrealistic.

Basically, that video makes the same error Internet enthusiasts made in 1999: they project the rapid rise of an new technology into the future as if it will keep rising that fast, whereas tech innovations actually follow Gartner's Hype Cycle: rising quickly, peaking, then falling. AI is already at its peak, and falling, as companies face the grim reality that they are burning up billions of dollars in development with no realistic prospect of a product that will make a profit.

AI in Business

The best way to achieve business value from AI is to deploy it carefully on a small scale and measure the results, gathering feedback from the workers using it. Simply replacing large numbers of staff with AI quickly, believing the claims of vendors, will likely lead to chaos and waste time and money.
AI Translation Earbuds
Babelfish
Will AI end cheap flights? Critics attack Delta’s “predatory” AI pricing.
Delta has become the first airline to announce that it is using AI to boost profits by personalizing pricing through a pilot program that for months has caused customers to pay different prices for the same flights based on their data profile. Seats on about 3 percent of domestic flights were sold using the AI pricing system over the past six months. By the end of the year, Delta's goal is to boost that to 20 percent of tickets.

Most often when it's used, the best deals were offered to the wealthiest customers—with the worst deals given to the poorest people, who are least likely to have other options. The program shows 'amazingly favorable results.' They are increasing their profits, and those profits are coming from the consumers they are taking advantage of.

A summer of security: empowering cyber defenders with AI
Big Sleep, an AI agent developed by Google DeepMind and Google Project Zero, actively searches and finds unknown security vulnerabilities in software. Recently, Big Sleep discovered a critical SQLite vulnerability (CVE-2025-6965). Through the combination of threat intelligence and Big Sleep, Google was able to actually predict that a vulnerability was imminently going to be used and we were able to cut it off beforehand. We believe this is the first time an AI agent has been used to directly foil efforts to exploit a vulnerability in the wild.

Politics

Irish tourist jailed by Ice for months after overstaying US visit by three days: ‘Nobody is safe’
What the 'One Big Beautiful Bill' will change for students, schools and colleges
The bill expands Pell Grants, which help low-income students pay for college, to include job-training programs, which is a win for community colleges which offer a variety of certificate programs.

Infosec

Eight healthy babies born after IVF using DNA from three people
Genetic material from mother and father transferred to donor egg with healthy mitochondrial DNA.
A Little-Known Microsoft Program Could Expose the Defense Department to Chinese Hackers
Chinese Tech Support: Microsoft is using engineers in China to help maintain the Defense Department’s computer systems — with minimal supervision by U.S. personnel. Over the years, various people involved in the work, including a Microsoft cybersecurity leader, warned the company that the arrangement is inherently risky.
OMB draft memo sets agency and vendor quantum security standards
It directs federal agencies to fully migrate to a post-quantum cryptographic standard, and requests that vendors disclose their individual phased PQC transition timelines
Quantum code breaking? You'd get further with an 8-bit computer, an abacus, and a dog
Peter Gutmann thinks PQC is bollocks. To this day, quantum computers haven't managed to factor any number greater than 21 without cheating.
Defense tech startup Epirus raises $250M Series D to counter drone swarms
Epirus’ flagship product is Leonidas, which beams high-powered electromagnetic pulses to bring down drones.
SonicWall SMA devices hacked with OVERSTEP rootkit tied to ransomware
A threat actor has been deploying a previously unseen malware called OVERSTEP that modifies the boot process of fully-patched but no longer supported SonicWall Secure Mobile Access appliances.
Cambodia makes 1,000 arrests in latest crackdown on cybercrime
Amnesty International last month published the findings of an 18-month investigation into cybercrime in Cambodia, which the human rights group said “point towards state complicity in abuses carried out by Chinese criminal gangs.”

Human trafficking is closely associated with cyberscam operations, as workers are often recruited under false pretences and then held captive.

Did the Qantas hackers use AI voice deepfakes?
Experts say it is “highly plausible” Scattered Spider used AI-based voice deepfakes to trick Qantas contact centre staff in Manila into providing access to the data of almost six million customers.
An open letter to third-party suppliers
From J.P.Morgan. SaaS providers must prioritize security over rushing features. Comprehensive security should be built in or enabled by default.
Dictionary.com “devastated” paid users by abruptly deleting saved words lists
Logophiles are "devastated" after Dictionary.com deleted their logs of favorited words that they carefully crafted for years. The company deleted all accounts, as well as the only ways to use Dictionary.com without seeing ads —even if you previously paid for an ad-free experience.