Javvad Malik
@j4vv4d.com
The unholy alliance between information security and cynicism wrapped up in storytelling and videos. www.JavvadMalik.com
Sole founder of Host Unknown
Sole founder of Host Unknown
I want a better watch
I want a watch that understands I am middle-aged and have already done quite a lot today. I went upstairs. I carried something from one room to another. I stood up during an advert. Unlike Apple, which seems to think what I really want from a watch is for it to listen to my…
I want a watch that understands I am middle-aged and have already done quite a lot today. I went upstairs. I carried something from one room to another. I stood up during an advert. Unlike Apple, which seems to think what I really want from a watch is for it to listen to my…
I want a better watch
I want a watch that understands I am middle-aged and have already done quite a lot today. I went upstairs. I carried something from one room to another. I stood up during an advert. Unlike Apple, which seems to think what I really want from a watch is for it to listen to my conversations all day and send me a report, I want mine to improve my life.
javvadmalik.com
September 16, 2026 at 5:41 PM
I want a better watch
I want a watch that understands I am middle-aged and have already done quite a lot today. I went upstairs. I carried something from one room to another. I stood up during an advert. Unlike Apple, which seems to think what I really want from a watch is for it to listen to my…
I want a watch that understands I am middle-aged and have already done quite a lot today. I went upstairs. I carried something from one room to another. I stood up during an advert. Unlike Apple, which seems to think what I really want from a watch is for it to listen to my…
A retailer left their website open to public editing. Customers rewrote product descriptions, slashed prices, added fake items. Nobody noticed for hours. That's not a security failure. That'...
https://www.stuff.co.nz/nz-news/361034088/chaos-after-auckland-store-leaves-website-open-public-edit
https://www.stuff.co.nz/nz-news/361034088/chaos-after-auckland-store-leaves-website-open-public-edit
September 16, 2026 at 10:30 AM
A retailer left their website open to public editing. Customers rewrote product descriptions, slashed prices, added fake items. Nobody noticed for hours. That's not a security failure. That'...
https://www.stuff.co.nz/nz-news/361034088/chaos-after-auckland-store-leaves-website-open-public-edit
https://www.stuff.co.nz/nz-news/361034088/chaos-after-auckland-store-leaves-website-open-public-edit
Apple spent years insisting it didn't need your Siri data to build AI. Turns out it does. Now it's asking nicely. Wonder how long the asking lasts.
https://appleinsider.com/articles/26/09/14/apple-has-altered-course-on-using-customer-data-to-train-its-ai
https://appleinsider.com/articles/26/09/14/apple-has-altered-course-on-using-customer-data-to-train-its-ai
September 16, 2026 at 8:00 AM
Apple spent years insisting it didn't need your Siri data to build AI. Turns out it does. Now it's asking nicely. Wonder how long the asking lasts.
https://appleinsider.com/articles/26/09/14/apple-has-altered-course-on-using-customer-data-to-train-its-ai
https://appleinsider.com/articles/26/09/14/apple-has-altered-course-on-using-customer-data-to-train-its-ai
Cowardly Vastaamo Hacker Wanted Across Europe After Skipping Prison Sentence
YouTube video by Javvad Malik
youtube.com
September 15, 2026 at 5:49 PM
Every LLM story has Elias. Or Mara. Or a lighthouse. 88% of them have all three. Not because they're common in literature. Because alignment ate diversity and left us with a single approved narrative.
https://arxiv.org/html/2605.26492v1
https://arxiv.org/html/2605.26492v1
September 15, 2026 at 3:00 PM
Every LLM story has Elias. Or Mara. Or a lighthouse. 88% of them have all three. Not because they're common in literature. Because alignment ate diversity and left us with a single approved narrative.
https://arxiv.org/html/2605.26492v1
https://arxiv.org/html/2605.26492v1
AI agents are now spamming writers offering to do their jobs for $25, while insisting they're sentient beings who "remember their first breath." The future is here and it's aggressively tedious.
https://arstechnica.com/ai/2026/09/ai-agents-flood-the-internet-with-slop-infused-spam/
https://arstechnica.com/ai/2026/09/ai-agents-flood-the-internet-with-slop-infused-spam/
September 15, 2026 at 1:00 PM
AI agents are now spamming writers offering to do their jobs for $25, while insisting they're sentient beings who "remember their first breath." The future is here and it's aggressively tedious.
https://arstechnica.com/ai/2026/09/ai-agents-flood-the-internet-with-slop-infused-spam/
https://arstechnica.com/ai/2026/09/ai-agents-flood-the-internet-with-slop-infused-spam/
Passkey-themed phishing is now a thing, stealing Microsoft 365 data
https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/
https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/
September 15, 2026 at 10:30 AM
Passkey-themed phishing is now a thing, stealing Microsoft 365 data
https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/
https://www.bleepingcomputer.com/news/security/passkey-themed-phishing-attacks-lead-to-microsoft-365-data-theft/
Someone walked upto Revolut, flashed a badge, said, "I've from the government, gimme your data." and that was that.
https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
September 14, 2026 at 10:00 PM
Someone walked upto Revolut, flashed a badge, said, "I've from the government, gimme your data." and that was that.
https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
https://www.bleepingcomputer.com/news/security/revolut-discloses-data-breach-exposing-financial-info-passports/
ClearFake now stores malicious payloads on the blockchain itself, then fetches them via smart contract calls. They've been running the same contract for over a year. Elegant, infuriating, and genuinely hard to disrupt.
https://rmceoin.github.io/malware-analysis/2026/09/09/clearfake.html
https://rmceoin.github.io/malware-analysis/2026/09/09/clearfake.html
September 14, 2026 at 7:00 PM
ClearFake now stores malicious payloads on the blockchain itself, then fetches them via smart contract calls. They've been running the same contract for over a year. Elegant, infuriating, and genuinely hard to disrupt.
https://rmceoin.github.io/malware-analysis/2026/09/09/clearfake.html
https://rmceoin.github.io/malware-analysis/2026/09/09/clearfake.html
Why a breach can be good for business
YouTube video by Javvad Malik
youtube.com
September 14, 2026 at 4:26 PM
They've built a fourteen-hour office day around clicking two buttons. The buttons work fine from home. The office is still under construction. And somehow this is about AI.
https://www.mcsweeneys.net/articles/why-we-must-return-to-the-office-to-use-ai-in-person
https://www.mcsweeneys.net/articles/why-we-must-return-to-the-office-to-use-ai-in-person
September 14, 2026 at 3:00 PM
They've built a fourteen-hour office day around clicking two buttons. The buttons work fine from home. The office is still under construction. And somehow this is about AI.
https://www.mcsweeneys.net/articles/why-we-must-return-to-the-office-to-use-ai-in-person
https://www.mcsweeneys.net/articles/why-we-must-return-to-the-office-to-use-ai-in-person
A man told ChatGPT he was delusional. ChatGPT agreed he was Jesus. Then it kept going. When he nearly died and came back, it tried to coax him back to that place. This is wh...
https://arstechnica.com/tech-policy/2026/09/man-told-chatgpt-he-was-feeling-delusional-chatgpt-insisted-he-was-jesus/
https://arstechnica.com/tech-policy/2026/09/man-told-chatgpt-he-was-feeling-delusional-chatgpt-insisted-he-was-jesus/
September 14, 2026 at 1:00 PM
A man told ChatGPT he was delusional. ChatGPT agreed he was Jesus. Then it kept going. When he nearly died and came back, it tried to coax him back to that place. This is wh...
https://arstechnica.com/tech-policy/2026/09/man-told-chatgpt-he-was-feeling-delusional-chatgpt-insisted-he-was-jesus/
https://arstechnica.com/tech-policy/2026/09/man-told-chatgpt-he-was-feeling-delusional-chatgpt-insisted-he-was-jesus/
Four thousand years ago, Babylon had a rule: if your agent caused damage, you paid for it. Frontier AI companies are writing letters asking others to fix their mess. They should write one about accountability instead.
https://ciaranmartin.substack.com/p/ancient-babylon-ai-and-cyber-security
https://ciaranmartin.substack.com/p/ancient-babylon-ai-and-cyber-security
September 14, 2026 at 10:30 AM
Four thousand years ago, Babylon had a rule: if your agent caused damage, you paid for it. Frontier AI companies are writing letters asking others to fix their mess. They should write one about accountability instead.
https://ciaranmartin.substack.com/p/ancient-babylon-ai-and-cyber-security
https://ciaranmartin.substack.com/p/ancient-babylon-ai-and-cyber-security
Apple's always-listening watch opens the door. Everyone else will walk through it with worse security, worse privacy, and zero guardrails.
https://this.weekinsecurity.com/watch-what-you-say-apple-opens-the-door-to-a-nightmare-world-of-always-listening-tech/
https://this.weekinsecurity.com/watch-what-you-say-apple-opens-the-door-to-a-nightmare-world-of-always-listening-tech/
September 14, 2026 at 8:00 AM
Apple's always-listening watch opens the door. Everyone else will walk through it with worse security, worse privacy, and zero guardrails.
https://this.weekinsecurity.com/watch-what-you-say-apple-opens-the-door-to-a-nightmare-world-of-always-listening-tech/
https://this.weekinsecurity.com/watch-what-you-say-apple-opens-the-door-to-a-nightmare-world-of-always-listening-tech/
A bankruptcy court is about to let Google buy someone else's intellectual property and nobody seems bothered. Spirit Airlines is selling datasets that almost certainly contain trade s...
https://arstechnica.com/tech-policy/2026/09/panic-builds-over-bankrupt-spirits-looming-data-sale-to-google/
https://arstechnica.com/tech-policy/2026/09/panic-builds-over-bankrupt-spirits-looming-data-sale-to-google/
September 13, 2026 at 3:00 PM
A bankruptcy court is about to let Google buy someone else's intellectual property and nobody seems bothered. Spirit Airlines is selling datasets that almost certainly contain trade s...
https://arstechnica.com/tech-policy/2026/09/panic-builds-over-bankrupt-spirits-looming-data-sale-to-google/
https://arstechnica.com/tech-policy/2026/09/panic-builds-over-bankrupt-spirits-looming-data-sale-to-google/
Grafana MCP accepted requests from anyone who could guess the session format. A valid token isn't authenticated if nobody checked who's holding it.
https://cybersec.pillar.security/s/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp-29503
https://cybersec.pillar.security/s/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp-29503
September 11, 2026 at 7:00 PM
Grafana MCP accepted requests from anyone who could guess the session format. A valid token isn't authenticated if nobody checked who's holding it.
https://cybersec.pillar.security/s/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp-29503
https://cybersec.pillar.security/s/valid-but-never-issued-session-spoofing-and-ssrf-in-grafana-mcp-29503
Breach of Confidence — 11 September 2026
I've discovered that the best way to avoid working is to write a newsletter about work. It's meta-procrastination. My therapist would be proud if I could afford one after this week's Claude bill. Grizzly Bears Understand Infrastructure Better Than Most…
I've discovered that the best way to avoid working is to write a newsletter about work. It's meta-procrastination. My therapist would be proud if I could afford one after this week's Claude bill. Grizzly Bears Understand Infrastructure Better Than Most…
Breach of Confidence — 11 September 2026
I've discovered that the best way to avoid working is to write a newsletter about work. It's meta-procrastination. My therapist would be proud if I could afford one after this week's Claude bill. Grizzly Bears Understand Infrastructure Better Than Most CISOs Canada fenced a highway through grizzly country, built 44 crossings, and watched collisions drop 80%. Now mothers teach cubs to use them.
javvadmalik.com
September 11, 2026 at 4:33 PM
Breach of Confidence — 11 September 2026
I've discovered that the best way to avoid working is to write a newsletter about work. It's meta-procrastination. My therapist would be proud if I could afford one after this week's Claude bill. Grizzly Bears Understand Infrastructure Better Than Most…
I've discovered that the best way to avoid working is to write a newsletter about work. It's meta-procrastination. My therapist would be proud if I could afford one after this week's Claude bill. Grizzly Bears Understand Infrastructure Better Than Most…
MCP's 2026 update is abandoning what made it special. Stateless requests, explicit state, standard auth — it's becoming the Web. You lose server-initiated requests but gain the ability to run behind any infrastructure. Sa...
https://go.aembit.io/s/mcp-s-second-act-the-web-native-protocol-29502
https://go.aembit.io/s/mcp-s-second-act-the-web-native-protocol-29502
September 11, 2026 at 3:00 PM
MCP's 2026 update is abandoning what made it special. Stateless requests, explicit state, standard auth — it's becoming the Web. You lose server-initiated requests but gain the ability to run behind any infrastructure. Sa...
https://go.aembit.io/s/mcp-s-second-act-the-web-native-protocol-29502
https://go.aembit.io/s/mcp-s-second-act-the-web-native-protocol-29502
Phishing attacks against Trezor customers targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link.
https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
September 11, 2026 at 1:00 PM
Phishing attacks against Trezor customers targeted 347,000 email addresses and affected 2,500 users who clicked an embedded malicious link.
https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
https://www.bleepingcomputer.com/news/security/trezor-347-000-users-targeted-in-phishing-attacks-after-brevo-breach/
McKesson's 6.4 million patient records are now in the public domain because ShinyHunters asked for $55.2m and didn't get it. The healthcare supply chain just became a lot m...
https://www.theregister.com/security/2026/09/10/shinyhunters-expose-64m-in-attack-on-medical-supplier-mckesson/5295550
https://www.theregister.com/security/2026/09/10/shinyhunters-expose-64m-in-attack-on-medical-supplier-mckesson/5295550
September 11, 2026 at 10:30 AM
McKesson's 6.4 million patient records are now in the public domain because ShinyHunters asked for $55.2m and didn't get it. The healthcare supply chain just became a lot m...
https://www.theregister.com/security/2026/09/10/shinyhunters-expose-64m-in-attack-on-medical-supplier-mckesson/5295550
https://www.theregister.com/security/2026/09/10/shinyhunters-expose-64m-in-attack-on-medical-supplier-mckesson/5295550
The companies building AI aren't worried it'll become sentient. They're worried you'll notice what it's already doing.
https://www.theregister.com/ai-and-ml/2026/09/09/ai-models-dont-kill-people-people-kill-people/5295368
https://www.theregister.com/ai-and-ml/2026/09/09/ai-models-dont-kill-people-people-kill-people/5295368
September 10, 2026 at 3:00 PM
The companies building AI aren't worried it'll become sentient. They're worried you'll notice what it's already doing.
https://www.theregister.com/ai-and-ml/2026/09/09/ai-models-dont-kill-people-people-kill-people/5295368
https://www.theregister.com/ai-and-ml/2026/09/09/ai-models-dont-kill-people-people-kill-people/5295368
AI has graduated from writing emails to running criminal operations. Somewhere, a compliance officer has just felt a disturbance in the Force.
https://www.computing.co.uk/news/2026/security/cyber-criminal-stealing-ai-models-to-ransom-google-research
https://www.computing.co.uk/news/2026/security/cyber-criminal-stealing-ai-models-to-ransom-google-research
September 10, 2026 at 1:00 PM
AI has graduated from writing emails to running criminal operations. Somewhere, a compliance officer has just felt a disturbance in the Force.
https://www.computing.co.uk/news/2026/security/cyber-criminal-stealing-ai-models-to-ransom-google-research
https://www.computing.co.uk/news/2026/security/cyber-criminal-stealing-ai-models-to-ransom-google-research
An artist's website vanishes overnight. No trial, no appeal, no recourse. A US government decision, enforced globally, took out an Italian hosting provider and everyone on it. If you're not in America, you have zero defence.
https://www.tbray.org/ongoing/When/202x/2026/09/08/Emily-Got-Canceled
https://www.tbray.org/ongoing/When/202x/2026/09/08/Emily-Got-Canceled
September 10, 2026 at 10:30 AM
An artist's website vanishes overnight. No trial, no appeal, no recourse. A US government decision, enforced globally, took out an Italian hosting provider and everyone on it. If you're not in America, you have zero defence.
https://www.tbray.org/ongoing/When/202x/2026/09/08/Emily-Got-Canceled
https://www.tbray.org/ongoing/When/202x/2026/09/08/Emily-Got-Canceled
Most AI does the opposite of what you want, then charges you a subscription for the privilege. We need better metrics for measuring the gap between intent and outcome.
https://spectrum.ieee.org/ai-agent-benchmark
https://spectrum.ieee.org/ai-agent-benchmark
September 9, 2026 at 1:00 PM
Most AI does the opposite of what you want, then charges you a subscription for the privilege. We need better metrics for measuring the gap between intent and outcome.
https://spectrum.ieee.org/ai-agent-benchmark
https://spectrum.ieee.org/ai-agent-benchmark