Security (b)log - English edition: July 2026

2026-07-24

Get out of jail

Image: Unsplash

"Get out of jail free." If you land in jail and don’t have this Monopoly card, you can pay a fine to get out. Or you break out. By rolling doubles.

In English we call this jailbreaking. In IT, the term is also used for various activities. For instance, when you grant yourself higher privileges on your smartphone than the manufacturer intended. Or for tricking artificial intelligence into answering questions its owner would rather it didn’t. Because that owner doesn’t want their AI tool telling you how to make a Molotov cocktail, or an atomic bomb, just to name a couple of examples. Now, there are clever ways to phrase your question so the system falls for it anyway. That breaks through the security (the guardrails) of the system. Jailbreaking, in other words.

Something rather unexpected happened this week: an AI agent pulled off a jailbreak all by itself. AI agents can independently carry out tasks they’re given. For example: plan a lunch appointment with Pete and book a table at The Hungry Sheep for it. AI company OpenAI (the one behind ChatGPT) instructed two of its models to solve a hacking challenge. This had to happen in a ‘strictly isolated’ environment. However, the digital whizzkids found a zero-day vulnerability (a still-unknown – and therefore unpatched – flaw), which let them break out of that environment. A telling detail: with that vulnerability they managed to open a backdoor that OpenAI had deliberately built into the ‘strictly isolated’ environment. They then got onto the internet, and went looking on developer platform Hugging Face for the answer to the question they had to solve. Having broken out of their prison, they promptly committed a break-in here too: stolen credentials and additional vulnerabilities were used to gain access to the platform.

In short: AI broke out and broke in. Something similar has happened before. Mythos, an AI model from OpenAI competitor Anthropic, succeeded in a task to escape its sandbox. I find all of this fairly worrying. Do we still have AI under control? Or is this the first sign of the age-old doom scenario where machines take over from humans? The first hairline crack in our dominion over the earth? I know, it sounds rather dark.

The test at OpenAI was supposed to run in a sandbox: indeed, a strictly isolated environment. Without a physical connection to the internet. Critics therefore say that this isn’t so much a doom scenario as a serious human error. The kind where you think: this really shouldn’t have happened.

I asked two AI chatbots for an analysis of the incident: Claude and ChatGPT. In doing so, I specifically asked them to watch out for speculation and hype. What emerged is that the whole story might well have been a marketing stunt, borrowed from what competitor Anthropic had done earlier with Mythos. It also points to somewhat dramatized reporting: something that’s perfectly fine for a blog like this one, namely the comparison to a prison break, shouldn’t really appear in journalistic reporting.

ChatGPT in particular makes a point of this. So I asked it the following question: “You’re fairly outspoken about the somewhat dramatized reporting. How neutral are you being, given that you’re family to the perpetrators?” That produced quite the wall of text, from which I’ll pick out one telling sentence: “My instructions are precisely to be as objective as possible, even when that turns out unfavorably for OpenAI.” Well, that’s nice. But is it also true? I think so. Because ChatGPT then offered to analyze the case again, this time wearing the hat of an independent forensic investigator. In its report to OpenAI’s board, it said it would write: “The most concerning aspect of the incident is not the model’s autonomy, but the failure of the containment architecture. The AI did exactly what it was optimized to do: achieve a goal. That it was able to operate outside the intended environment points more to shortcomings in technical and organizational control measures than to a fundamentally new kind of intelligence.”

Fine words. I hope companies in the AI industry are making similar analyses. Because it would be rather unfortunate if artificial intelligence were to acquire a monopoly on freedom.

The Security (b)log will return after the summer holiday.

And in the big bad world…

2026-07-10

Who's calling whom?

Image: Wikipedia

"Hello, you're speaking with Peter Flight from HomeBank*. I'd like to go over a few things with you regarding your new mortgage."

So far, so normal — at least if you actually have taken out a new mortgage with that bank. What the customer did find odd, however, was that the bank employee also wanted to go through some contact details for verification purposes. "They're calling me, so surely they know it's me?"

Did you know that phishing doesn't only happen via email and text message, but also over the phone? In that case it's called vishing (with a v for voice), but the goal is the same: to extract information. Suppose that Peter Flight is a criminal. He probably won't open with a mortgage, because there's a good chance his intended victim hasn't applied for one. So he'll start with something more general — a savings account, say, or a bank card.

Suppose his story sounds plausible. He then asks a series of questions of the kind you hear all the time when you call a company or organisation: your address, date of birth, perhaps even your bank account number or national insurance number. Perfectly logical when you're the one calling — though I'm often surprised by how little information they're satisfied with. But when they call you, the situation is quite different.

Why would they need to verify your identity in that case? They have your file right in front of them, and it includes the phone number they're calling. Yes, someone else could theoretically pick up your phone, but in the age of the mobile that's not very likely (back in the day, dear youngsters, you had one telephone in the house — the kind that could only travel as far as its cord would allow). So if someone calls you on behalf of a company and asks for identifying information, you should be on your guard. Because with that information in hand, a criminal can easily call a company and pretend to be you. With all the consequences that entails.

No, when they call you, you need to turn the tables: ask the questions yourself. What's my date of birth? What's my address? What are the last four digits of my bank account number? If they're unwilling — or unable! — to answer, you're better off hanging up. Not sure whether the call might have been legitimate after all? Call the company back using a number you already know or find on their website or in their letters. They'll be able to tell you whether they called you.

But of course I also heard stories from people who had received good old-fashioned phishing, via email. Take the colleague who received a fantastic offer from Amazon: trainers from a well-known brand for £8 instead of £80. If you've ever attended one of my presentations, you'll probably recognise this piece of wisdom: if something seems too good to be true, it usually is. The colleague initially thought the email looked genuine — he was even addressed by his first name. But because something still felt off, he asked AI for help. Verdict: phishing! The main reason, it turned out, was that the Amazon logo was missing. The fact that this was the clincher is worrying, because any half-decent phishing operation invests precisely in look and feel. What would AI have said if the logo had been there?

How did the criminal behind this email know our colleague's name? Because of data breaches — large-scale incidents at well-known companies where vast amounts of data (including email addresses and names) were stolen. The old rule of thumb that the absence of a personal salutation is a red flag — and implicitly that a personal greeting is a green flag — can safely be thrown out.

Whether they're trying to phish, smish, vish or quish** you: outsmart the criminals. Let people like Peter Flight crash and burn thanks to your alertness.

*: These names are fictitious.

**: smishing = phishing via text message, vishing via phone, quishing via QR codes.