Javvad Malik :verified:

Website: https://javvadmalik.com/
TikTok: https://www.tiktok.com/@j4vv4d
Youtube: https://www.youtube.com/infoseccynic
Twitter: https://twitter.com/j4vv4d
BlueSky: https://bsky.app/profile/j4vv4d.bsky.social

Last Notes

2026-04-20 20:00:04 UTC

We trust AI to be rational. We trust it to cooperate. Then we're shocked when it behaves like a toddler with a keyboard. Maybe the real problem is we're projecting competence onto something that's just very good at pattern matching.
https://www.schneier.com/blog/archives/2026/04/human-trust-of-ai-agents.html

2026-04-18 16:00:32 UTC

NetScaler is doing it again. Third time in three years we're patching memory leaks that hand attackers your session tokens on a plate. CISA's already got it on the emergency list. If you run one, stop reading this and patch now.
https://cybersec.picussecurity.com/s/cve-2026-3055-cve-2026-4368-inside-the-netscaler-citrixbleed-3-memory-overread-26799

2026-04-12 12:15:13 UTC

Is anthropic the Red Bull of the AI world?
"We have built something extremely powerful."
"Can people use it?"
"That's not the point. Focus on the fact that it may be too powerful."
"For what?"
"Everything. Cybersecurity. Biology. The economy. Possibly feelings."
It signals capability. JUst keep saying, "we're dangerously good" and people will assume it is true
Create scarcity, "this model is too capable to release broadly"
Aura farming the burden of civilisation on their backs. Every release is part product, part life-changing confession.
I think from a cybersecurity marketing perspective, what they've done really well is even when they are warning you, they are still advertising...

2026-03-25 20:26:43 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/291/691/832/995/959/original/01d7378c96e5c84a.jpg

2026-03-16 11:11:24 UTC

https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/238/547/998/560/178/original/55ece3aa12226f9d.jpeg

2026-03-09 11:30:09 UTC

We've invented service accounts all over again. MCP servers are quietly becoming the same overprivileged, under-monitored access brokers that have haunted enterprise security for years. Except this time, we're stacking them on top of the old ones.
https://go.aembit.io/s/mcp-servers-and-the-return-of-the-service-account-problem-25746

2026-02-19 16:19:46 UTC

LLMs can generate 'secure' passwords that are actually just predictable garbage. Because, you know, predicting is what LLMs do best.
https://www.irregular.com/publications/vibe-password-generation

2025-06-12 13:02:59 UTC

Forget about whether 100 men would win against 1 gorilla... the real question is how would 100 CISSP's fare against a gorilla?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/670/524/659/166/628/original/b4cb59ab6a6aa52d.mp4