Berlin Bassline Brief #24: AI guardrails point at vulns, Apple patches, nuance warfare, ponytail for security, and new Keychain backups rigmarole.
Berlin Bassline Brief #24: AI guardrails sidechannel, Apple patches an older CoreGraphics bug, smart glasses nuance warfare, ponytail-sec's tiny attacker-ruining diffs, and backing up file-based Keychains.
Berlin Bassline Brief #23: PHP RCEs, Hexacon, LLM text watermarking verifiability study, xtool, tune into macOS fm
PHP2Shell RCEs, iOS jailbreak at Hexacon, AI watermark verifiability paper, xtool Xcode replacement, on-device macOS LLMs with fm.
Berlin Bassline Brief #22: Missed issue, melting ice cream, iPhone inactivity reboot bypass, FemHealth security from the SWE perspective, new sandbox microVM, FDA changes
Refrigerator hack, iPhone bypass, period tracker app security as experienced by those who make the apps, a sandboxing tool, and upcoming changes to Full Disk Access
Berlin Bassline Brief #21: OpenAI sued over Hugging Face but not by them, Apple RCE patched, epistemic trustworthiness better than moral, PHANTOM-B cards, restrict Apple Intelligence
Berlin Bassline Brief #21: OpenAI sued over Hugging Face hack, urgent Apple RCE patch, epistemic AI trust paper, PHANTOM-B wallet card, and restricting Apple Intelligence access.
Berlin Bassline Brief #20: Musing on a Muse 0-day, Apple Intelligence Report, Who Owns Broken AI? Speculative Programmatic Tool Calling, Apple Reference Image
Berlin Bassline Brief #20: Meta's Muse gets a nasty 0-day, plus Apple Intelligence report reads, AI accountability research, speculative tool calling, and Apple's verified photo images.
Berlin Bassline Brief #19: a strong opinion on the AI research question, Golden Gate release, moral imputability problems in current tech, new Apple VM tool, Background Security Improvements
Berlin Bassline Brief #19: Zdziarski drops some science, Golden Gate and another Screen Sharing CVE, algorithmic responsibility paper, Box of Apples VM tool, and Apple’s Background Security Improvements.
Berlin Bassline Brief #18: mass agentic anti-human deception, no more macOS keychain copying between machines, ACM takes on recommender badness, microharness
Berlin Bassline Brief #18: OpenAI's Hugging Face escape investigated too slowly, Tahoe breaks keychain copying, ACM's recommender-systems-and-society issue, headlong agent harness, and keychain data protection explained.
Berlin Bassline Brief #17: agentic git status hijinks, more on screen sharing CVEs, whistleblowing in NIS2 and CRA, stream Qwen3.8-Flash-Next on underprovisioned Silicon, HomeKit camera security
Berlin Bassline Brief #17: git-status hijack risk in coding agents, macOS Screen Sharing CVE deep dive, whistleblowing/NIS2 paper, slotstream local LLM tool, HomeKit Camera security concept.
Berlin Bassline Brief #16: swiftCon, deciding AI authority, phishing iPhone passcodes with voice AI agents, reward hacking survey paper, abliteration without the weights, Lost Mode
Berlin Bassline Brief #16: swiftCon Berlin talk, post-Vegas quiet, Security Autonomy Matrix, AnonyMousKIT voice-phishing, reward hacking survey, weightless tool, Lost Mode concept.
Berlin Bassline Brief #15: Mildly-digitized city-state hacked, AmnesiaStealer hijacks Chromiums? Chromia? That reasoning traces paper, OWASP MASWE v1.0! and the iPhone boot process
Berlin Bassline Brief #15: Berlin ministries hacked; AmnesiaStealer hits macOS browsers; stealing LLM reasoning traces paper; OWASP MASWE v1.0 ships; iPhone/iPad boot process explained.
Berlin Bassline Brief #14: Zoomsday, Screen (Over)Sharing, LLMs patching poorly, is it actually the cable? and Endpoint Security
Berlin Bassline Brief #14: Zoomsday takeover bug, Apple's emergency patch redux + Calif PoC, LLM patch flaws paper, cable-checking tool, and Endpoint Security concept spotlight.
Berlin Bassline Brief #13: (I'm not in) Vegas, baby, npm can't catch a break, Calif publication, acoustic model attacks, Precogly, Hypervisor
Berlin Bassline Brief #13: Vegas hacker week rolls on; npm worm redux; Calif drops Apple MIE exploit details; CAFAD tackles adversarial audio; Precogly threat-modeling tool; Hypervisor Framework
Berlin Bassline Brief #12: OpenAI's agentic reward-hacking breach spree grows, CSA postmortem, Shostack's takeaways; macOS 26.6 update is big; agentic reversibility paper; Google Mantis; BlastDoor.
Berlin Bassline Brief #12: OpenAI's agentic reward-hacking breach spree grows, CSA postmortem, Shostack's takeaways; macOS 26.6 kernel bugs credited to everyone and their dad; agentic reversibility paper; Google Mantis; BlastDoor.
Berlin Bassline Brief #11: Autonomous agent attacks Hugging Face, and it only gets weirder from there, MACL, agent swarm contamination, MTPLX
Berlin Bassline Brief #11: Hugging Face attacked and sent to GLM 5.2 by excessive frontier guardrails, OpenAI's rogue-agent breach, reward hacking, macOS 27 MACL protections, prompt-injection swarm paper, MTPLX
Berlin Bassline Brief #10: Grok Build CLI repo uploading, an infostealer pretending to be a crash reporter, a paper claims LLMs aren't chaotic neutral, NIST helps with macOS, PCC
“The wealth required by nature is limited and is easy to procure; but the wealth required by vain ideals extends to infinity.” Security, General: Developers...
Berlin Bassline Brief #9: gemini-cli CI injection compromise, Hide My Email (Just Kidding), Repo crawling vuln scanner, new OWASP framework
Berlin Bassline Brief #9: gemini-cli hijacked via GitHub issue, Apple's Hide My Email unmasking, SCOUT vuln-detection paper, brand-new OWASP AI Maturity tool, macOS malware defenses
Berlin Bassline Brief #8: Fable-ulous, GLM 5.2, macOS infostealer sneakiness, papers mild and spicy, MASTG 2.0, mic control
Berlin Bassline Brief #8: OWASP Global AppSec EU, Fable's return, GLM 5.2 vs Opus 4.8 benchmarks, a prompt-injecting macOS infostealer, papers mild and spicy, MASTG 2.0, and Apple's mic disconnect.
Berlin Bassline Brief #7: libssh2, Fixing those Clicks, how agent skills will leak your credentials, the AISVS 1.0 attempts to make that "will" a "won't", App Attest
libssh2, a new macOS ClickFix infostealer campaign, a large-scale study on LLM skill credential leakage, the OWASP AISVS 1.0 launch, and Apple's App Attest at WWDC26
Berlin Bassline Brief #6: No more Fables, JetBrains plugin badness, macOS stealers, macOS malware detection
JetBrains 3rd-party plugins stealing keys, macOS infostealers in deceptive installers, domain-specific macOS malware detection research, iOSWorld benchmark, and agentic app security at WWDC 2026
Berlin Bassline Brief #5: Fables, Creepy Glasses, Apple Intelligence on Google Cloud, OWASP GenAI Security Project, Inspect Petri, TrustInsights
Fable 5 arrives, Meta quietly adds and removes facial recognition, Apple expands PCC to Google Cloud, plus OWASP on agentic AI security, Inspect Petri, and Apple's new TrustInsights Framework.