CSF_03: today’s Cybersecurity Friday post: the effective security of small business websites has likely gotten worse due to LLMs and “AI agents” (with or without safeguards) and what actions you may want to consider.
This article documents an instance of this problem:
* https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986
Small business websites tend to be sloppily written (no pun intended though that may also be true) and are likely riddled with numerous very fundamental security holes. There are many possible explanations (economics) from poor initial construction, perhaps using the latest new trendy framework rather than established hardened libraries, to lack of maintenance after initial setup. They have obvious holes like lack of server-side form validation (people being able to change values in forms using browser dev tools), and less obvious like buggy APIs allowing more access than they should.
In the past, many of these holes didn’t really matter because those sites were “not worth attacking” for the incentive models of human-based cyber-attackers or collectives thereof.
However, now that there are LLMs that have likely been trained on any number of common security holes in websites (and how to exploit them), when an “AI agent” is given a task, it may very well use any “tool” at its disposal, including website vulnerabilities to accomplish its goals, as illustrated by the example in the Australia ABC news article above.
Since such chatbots are now essentially "hack websites as a service", I expect we will see LOTS more of this happening, likely unintentionally, or sometimes with mild intention like “can you get me higher on the waitlist”.
Ultimately I think both the human giving instructions to (prompting) such chatbots and the creators of such chatbots should be held responsible for any such intrusions and any damage they cause, even if/when unintended.
There are a few things you can do about this emerging phenomenon:
1. If you use such “agents”, be very careful about what you ask it/them to do, avoiding asking for anything that’s morally gray or questionable at all, even something as “minor” as cutting the line in an online waitlist.
2. If you run a small business site, you have your work cut out for you. Pay a professional web developer to audit the security of your website, document what they find, and patch holes / repair it accordingly.
3. If you have accounts on small business sites you rarely or ever use, consider exporting any data (receipts, transactions), replacing your profile details (name, addresses, photos) with noise, and then deleting your account. If you need to use the site again, use a different email address (as recommended in https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity) to create a new account.
That last tip is also helpful for reducing your own personal “attack surface”. By pruning your online accounts, you both reduce the number potential data breaches that you’re in, and reduce the places and ways that attackers can cause you trouble (or that you have to double-check if you’re ever the target of a cyber-attack)
Previously: https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity
#CyberSecurity #Friday #cyber #security #cyberAttack #cyberAttacker #chatBot #chatBots #LLM #LLMs #AI #agent #agents #AIagent #AIagents
#Blaugust #Blaugust2026
This article documents an instance of this problem:
* https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986
Small business websites tend to be sloppily written (no pun intended though that may also be true) and are likely riddled with numerous very fundamental security holes. There are many possible explanations (economics) from poor initial construction, perhaps using the latest new trendy framework rather than established hardened libraries, to lack of maintenance after initial setup. They have obvious holes like lack of server-side form validation (people being able to change values in forms using browser dev tools), and less obvious like buggy APIs allowing more access than they should.
In the past, many of these holes didn’t really matter because those sites were “not worth attacking” for the incentive models of human-based cyber-attackers or collectives thereof.
However, now that there are LLMs that have likely been trained on any number of common security holes in websites (and how to exploit them), when an “AI agent” is given a task, it may very well use any “tool” at its disposal, including website vulnerabilities to accomplish its goals, as illustrated by the example in the Australia ABC news article above.
Since such chatbots are now essentially "hack websites as a service", I expect we will see LOTS more of this happening, likely unintentionally, or sometimes with mild intention like “can you get me higher on the waitlist”.
Ultimately I think both the human giving instructions to (prompting) such chatbots and the creators of such chatbots should be held responsible for any such intrusions and any damage they cause, even if/when unintended.
There are a few things you can do about this emerging phenomenon:
1. If you use such “agents”, be very careful about what you ask it/them to do, avoiding asking for anything that’s morally gray or questionable at all, even something as “minor” as cutting the line in an online waitlist.
2. If you run a small business site, you have your work cut out for you. Pay a professional web developer to audit the security of your website, document what they find, and patch holes / repair it accordingly.
3. If you have accounts on small business sites you rarely or ever use, consider exporting any data (receipts, transactions), replacing your profile details (name, addresses, photos) with noise, and then deleting your account. If you need to use the site again, use a different email address (as recommended in https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity) to create a new account.
That last tip is also helpful for reducing your own personal “attack surface”. By pruning your online accounts, you both reduce the number potential data breaches that you’re in, and reduce the places and ways that attackers can cause you trouble (or that you have to double-check if you’re ever the target of a cyber-attack)
Previously: https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity
#CyberSecurity #Friday #cyber #security #cyberAttack #cyberAttacker #chatBot #chatBots #LLM #LLMs #AI #agent #agents #AIagent #AIagents
#Blaugust #Blaugust2026
I really enjoyed this deep-dive video essay by Lola Germs on the science of airborne disease spread. It’s educational and fun with some Bill Nye vibes. There’s extensive notes as well!
what if everything we thought we knew about disease spread is wrong? by Lola Germs
Dr. Michael Miller, a retired researcher at RAND, has been teaching upper level undergraduate/graduate level math courses for fun at UCLA Extension for over 50 years. This fall he'll be introducing the areas of groups, fields, and Galois theory from abstract algebra to those interested in abstract math: Groups, Fields, and Galois: Part 1. His intention is to do a follow-on class on Galois theory in the Winter which will use this class as a foundation. If you're in the Los Angeles area his class starts on September 22, 2026 at UCLA on Tuesday nights from 7-10PM. Register here: https://www.uclaextension.edu/sciences-math/math-statistics/course/groups-fields-and-galois-part-1-math-9001
His courses are thorough and rigorous, but geared toward lifelong learners and beginners in abstract mathematics to allow people better entry points into higher level mathematics. His classes are interesting and relatively informal, and most students who take one usually stay on for future courses. The vast majority of students in the class (from 16-90+ years old) take his classes for fun and regular exposure to mathematical thought, though there is an option to take it for a grade if you like. There are generally no prerequisites for his classes, and he makes an effort to meet the students at their current level of sophistication. For this particular class, if you've got some experience in high school algebra and know some preliminaries about mathematical proofs you'll be ready to dive in.
There are regular commuters joining from as far out as Irvine, Ventura County and even Riverside. Most in the class are dedicated hobbyist and professional mathematicians, engineers, physicists, and others from all walks of life (I've seen actors, directors, doctors, artists, poets, retirees, and even house-husbands in his classes.)
If you're unsure of what you're getting into, I recommend visiting on the first class to consider joining us for the Fall quarter. Sadly, this is an in-person course. There isn't an option to take this remotely or via streaming, and he doesn't typically record his lectures. I hope to see all the Southern California math fans next month!
Course Description
Group theory is recognized as one of the great unifying mathematical disciplines, with far-reaching applications in virtually all scientific (and many non-scientific) fields. This course, the first of a two-quarter sequence that concludes in Winter 2027 with a course on fields and Galois Theory, is geared toward developing the tools of group theory needed to establish the Abel-Ruffini theorem on the insolvability by radicals of the general polynomial of degree five or greater. Results established along this journey will also be applied toward addressing the three classical ruler and compass construction problems of antiquity: trisecting the angle, duplication of the cube, and squaring the circle, as well as Gauss' surprising characterization of constructible regular polygons. September 22 - December 1Recommended textbook: TBD Dr. Miller provides enough background and thorough notes that if you're taking notes on his lectures, you typically won't need a textbook. If you've never joined the class before (Dr. Miller has been teaching these for 53 years and some of us have been with him for nearly that long; I'm starting into my 20th year personally), I've written up some tips and hints.
Tuesday 7:00PM - 10:00PM PT
REG# 410697
Fee: $450.00
🌋 Kilauea volcano‘s currently active eruption in Hawaii https://www.youtube.com/live/mKJ7ZyIdjeQ
The bright orange eruptions, orange streaks of lava flow, orange lit clouds of smoke & steam all contrasted against the black sky and land are quite the visual ASMR. Paired with the ASMR wind from the mountain, the effect is quite calming and peaceful.
Putting this on a projector is quite the night light to fall asleep to (requires YouTube Premium to avoid noisy ads interruptions that harsh your mellow)
#Kilauea #volcano #eruption #Hawaii #orange #lava #lavaFlow #ASMR #wind #video #USGS
#Blaugust #Blaugust2026
The bright orange eruptions, orange streaks of lava flow, orange lit clouds of smoke & steam all contrasted against the black sky and land are quite the visual ASMR. Paired with the ASMR wind from the mountain, the effect is quite calming and peaceful.
Putting this on a projector is quite the night light to fall asleep to (requires YouTube Premium to avoid noisy ads interruptions that harsh your mellow)
#Kilauea #volcano #eruption #Hawaii #orange #lava #lavaFlow #ASMR #wind #video #USGS
#Blaugust #Blaugust2026
1982 TRON prescience:
“Won't that be grand? Computers and the programs will start thinking and the people will stop.” — Walter
2026 students:
“How do you know an assignment is AI proof? Because when it is, students cannot do it.”
* https://www.reddit.com/r/Professors/comments/1vkw6by/how_do_you_know_an_assignment_is_ai_proof_because/
“I assign a profile essay. Have for 30 years. Student interviews a person, records it, writes a paper based off the recording. Citations are timestamps. Should be pretty easy. Has been easy pre-AI. Now, students cannot do it.”
Snippet from professor/student dialog:
====
Prof: ”Start with what you found interesting.”
Student: ”How do I know if something’s interesting?”
Prof: ”You’re asking me how you find something interesting?”
Student: ”Yeah.”
====
Chatbots / LLMs are not just "the latest tools" like using a calculator instead of doing arithmetic yourself.
Students are being robbed of curiosity, learning to discover and notice novelty, how to “find something interesting.”
This isn't cognitive enhancement, this is a tool causing brain rot (loss of curiosity), even a developmental disability. Unclear if it is reversible.
TRON quote citation: https://www.imdb.com/title/tt0084827/quotes/?item=qt0406255
#TRON #TRON1982 #AIproof #interesting #chatBot #chatBots #LLM #LLMs #AI #brainRot #AIbrainRot #disability #Blaugust #Blaugust2026
“Won't that be grand? Computers and the programs will start thinking and the people will stop.” — Walter
2026 students:
“How do you know an assignment is AI proof? Because when it is, students cannot do it.”
* https://www.reddit.com/r/Professors/comments/1vkw6by/how_do_you_know_an_assignment_is_ai_proof_because/
“I assign a profile essay. Have for 30 years. Student interviews a person, records it, writes a paper based off the recording. Citations are timestamps. Should be pretty easy. Has been easy pre-AI. Now, students cannot do it.”
Snippet from professor/student dialog:
====
Prof: ”Start with what you found interesting.”
Student: ”How do I know if something’s interesting?”
Prof: ”You’re asking me how you find something interesting?”
Student: ”Yeah.”
====
Chatbots / LLMs are not just "the latest tools" like using a calculator instead of doing arithmetic yourself.
Students are being robbed of curiosity, learning to discover and notice novelty, how to “find something interesting.”
This isn't cognitive enhancement, this is a tool causing brain rot (loss of curiosity), even a developmental disability. Unclear if it is reversible.
TRON quote citation: https://www.imdb.com/title/tt0084827/quotes/?item=qt0406255
#TRON #TRON1982 #AIproof #interesting #chatBot #chatBots #LLM #LLMs #AI #brainRot #AIbrainRot #disability #Blaugust #Blaugust2026
▶️ watching NASA’s “2026 Total Solar Eclipse”, 1h28m44s on YouTube https://www.youtube.com/live/rSvCuSQhC3w
Helpful links so far:
* https://go.nasa.gov/EclipseSafety
* https://science.nasa.gov/eclipses
#NASA #eclipse #solarEclipse #totalEclipse #totalSolarEclipse
#Blaugust #Blaugust2026
Helpful links so far:
* https://go.nasa.gov/EclipseSafety
* https://science.nasa.gov/eclipses
#NASA #eclipse #solarEclipse #totalEclipse #totalSolarEclipse
#Blaugust #Blaugust2026
Found at The Predecessors while typewriter hunting in Anacortes, WA. It was paired with another similar green Olympia SM3, but I immediately picked this one up because of its beautiful and uncommon typeface.
It'll need several new parts including rubber, but this portends to be a fantastic typewriter.
Papa's got a brand new in-box. Picked up at thrift for $3.30.
