{
"type": "entry",
"published": "2026-08-17T16:19:17-0400",
"url": "https://martymcgui.re/2026/08/17/161917/",
"category": [
"improv",
"shows"
],
"syndication": [
"https://fed.brid.gy/"
],
"content": {
"text": "I\u2019ve got two improv shows coming up! Can you believe it? Is it to be believed??\nSaturday Aug 22nd @ 9pm at The Magnet Theater: The Level Up\nMonday Aug 24th @ 9:30pm at The Rat NYC: Bizzo! & Friends\nIf you are in NYC or nearby, go ahead and come on out and do an lol or two!",
"html": "<p>I\u2019ve got two improv shows coming up! Can you believe it? Is it to be believed??</p>\n<p><a href=\"https://martymcgui.re/2026/08/22/the-level-up/\">Saturday Aug 22nd @ 9pm at The Magnet Theater: The Level Up</a></p>\n<p><a href=\"https://martymcgui.re/2026/08/24/bizzo--friends/\">Monday Aug 24th @ 9:30pm at The Rat NYC: Bizzo! & Friends</a></p>\n<p>If you are in NYC or nearby, go ahead and come on out and do an lol or two!</p>"
},
"author": {
"type": "card",
"name": "Marty McGuire",
"url": "https://martymcgui.re/",
"photo": "https://martymcgui.re/images/logo.jpg"
},
"post-type": "note",
"_id": "49271662",
"_source": "175"
}
CSF_03: today’s Cybersecurity Friday post: the effective security of small business websites has likely gotten worse due to LLMs and “AI agents” (with or without safeguards) and what actions you may want to consider.
Small business websites tend to be sloppily written (no pun intended though that may also be true) and are likely riddled with numerous very fundamental security holes. There are many possible explanations (economics) from poor initial construction, perhaps using the latest new trendy framework rather than established hardened libraries, to lack of maintenance after initial setup. They have obvious holes like lack of server-side form validation (people being able to change values in forms using browser dev tools), and less obvious like buggy APIs allowing more access than they should.
In the past, many of these holes didn’t really matter because those sites were “not worth attacking” for the incentive models of human-based cyber-attackers or collectives thereof.
However, now that there are LLMs that have likely been trained on any number of common security holes in websites (and how to exploit them), when an “AI agent” is given a task, it may very well use any “tool” at its disposal, including website vulnerabilities to accomplish its goals, as illustrated by the example in the Australia ABC news article above.
Since such chatbots are now essentially "hack websites as a service", I expect we will see LOTS more of this happening, likely unintentionally, or sometimes with mild intention like “can you get me higher on the waitlist”.
Ultimately I think both the human giving instructions to (prompting) such chatbots and the creators of such chatbots should be held responsible for any such intrusions and any damage they cause, even if/when unintended.
There are a few things you can do about this emerging phenomenon:
1. If you use such “agents”, be very careful about what you ask it/them to do, avoiding asking for anything that’s morally gray or questionable at all, even something as “minor” as cutting the line in an online waitlist.
2. If you run a small business site, you have your work cut out for you. Pay a professional web developer to audit the security of your website, document what they find, and patch holes / repair it accordingly.
3. If you have accounts on small business sites you rarely or ever use, consider exporting any data (receipts, transactions), replacing your profile details (name, addresses, photos) with noise, and then deleting your account. If you need to use the site again, use a different email address (as recommended in https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity) to create a new account.
That last tip is also helpful for reducing your own personal “attack surface”. By pruning your online accounts, you both reduce the number potential data breaches that you’re in, and reduce the places and ways that attackers can cause you trouble (or that you have to double-check if you’re ever the target of a cyber-attack)
{
"type": "entry",
"published": "2026-08-14 13:41-0700",
"url": "https://tantek.com/2026/226/t1/cybersecurity-friday-small-business",
"category": [
"CyberSecurity",
"Friday",
"cyber",
"security",
"cyberAttack",
"cyberAttacker",
"chatBot",
"chatBots",
"LLM",
"LLMs",
"AI",
"agent",
"agents",
"AIagent",
"AIagents",
"Blaugust",
"Blaugust2026"
],
"content": {
"text": "CSF_03: today\u2019s Cybersecurity Friday post: the effective security of small business websites has likely gotten worse due to LLMs and \u201cAI agents\u201d (with or without safeguards) and what actions you may want to consider.\n\nThis article documents an instance of this problem:\n* https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986\n\nSmall business websites tend to be sloppily written (no pun intended though that may also be true) and are likely riddled with numerous very fundamental security holes. There are many possible explanations (economics) from poor initial construction, perhaps using the latest new trendy framework rather than established hardened libraries, to lack of maintenance after initial setup. They have obvious holes like lack of server-side form validation (people being able to change values in forms using browser dev tools), and less obvious like buggy APIs allowing more access than they should.\n\nIn the past, many of these holes didn\u2019t really matter because those sites were \u201cnot worth attacking\u201d for the incentive models of human-based cyber-attackers or collectives thereof.\n\nHowever, now that there are LLMs that have likely been trained on any number of common security holes in websites (and how to exploit them), when an \u201cAI agent\u201d is given a task, it may very well use any \u201ctool\u201d at its disposal, including website vulnerabilities to accomplish its goals, as illustrated by the example in the Australia ABC news article above.\n\nSince such chatbots are now essentially \"hack websites as a service\", I expect we will see LOTS more of this happening, likely unintentionally, or sometimes with mild intention like \u201ccan you get me higher on the waitlist\u201d.\n\nUltimately I think both the human giving instructions to (prompting) such chatbots and the creators of such chatbots should be held responsible for any such intrusions and any damage they cause, even if/when unintended.\n\nThere are a few things you can do about this emerging phenomenon:\n\n1. If you use such \u201cagents\u201d, be very careful about what you ask it/them to do, avoiding asking for anything that\u2019s morally gray or questionable at all, even something as \u201cminor\u201d as cutting the line in an online waitlist.\n\n2. If you run a small business site, you have your work cut out for you. Pay a professional web developer to audit the security of your website, document what they find, and patch holes / repair it accordingly.\n\n3. If you have accounts on small business sites you rarely or ever use, consider exporting any data (receipts, transactions), replacing your profile details (name, addresses, photos) with noise, and then deleting your account. If you need to use the site again, use a different email address (as recommended in https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity) to create a new account.\n\nThat last tip is also helpful for reducing your own personal \u201cattack surface\u201d. By pruning your online accounts, you both reduce the number potential data breaches that you\u2019re in, and reduce the places and ways that attackers can cause you trouble (or that you have to double-check if you\u2019re ever the target of a cyber-attack)\n\nPreviously: https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity\n\n#CyberSecurity #Friday #cyber #security #cyberAttack #cyberAttacker #chatBot #chatBots #LLM #LLMs #AI #agent #agents #AIagent #AIagents\n#Blaugust #Blaugust2026",
"html": "CSF_03: today\u2019s Cybersecurity Friday post: the effective security of small business websites has likely gotten worse due to LLMs and \u201cAI agents\u201d (with or without safeguards) and what actions you may want to consider.<br /><br />This article documents an instance of this problem:<br />* <a href=\"https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986\">https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986</a><br /><br />Small business websites tend to be sloppily written (no pun intended though that may also be true) and are likely riddled with numerous very fundamental security holes. There are many possible explanations (economics) from poor initial construction, perhaps using the latest new trendy framework rather than established hardened libraries, to lack of maintenance after initial setup. They have obvious holes like lack of server-side form validation (people being able to change values in forms using browser dev tools), and less obvious like buggy APIs allowing more access than they should.<br /><br />In the past, many of these holes didn\u2019t really matter because those sites were \u201cnot worth attacking\u201d for the incentive models of human-based cyber-attackers or collectives thereof.<br /><br />However, now that there are LLMs that have likely been trained on any number of common security holes in websites (and how to exploit them), when an \u201cAI agent\u201d is given a task, it may very well use any \u201ctool\u201d at its disposal, including website vulnerabilities to accomplish its goals, as illustrated by the example in the Australia ABC news article above.<br /><br />Since such chatbots are now essentially \"hack websites as a service\", I expect we will see LOTS more of this happening, likely unintentionally, or sometimes with mild intention like \u201ccan you get me higher on the waitlist\u201d.<br /><br />Ultimately I think both the human giving instructions to (prompting) such chatbots and the creators of such chatbots should be held responsible for any such intrusions and any damage they cause, even if/when unintended.<br /><br />There are a few things you can do about this emerging phenomenon:<br /><br />1. If you use such \u201cagents\u201d, be very careful about what you ask it/them to do, avoiding asking for anything that\u2019s morally gray or questionable at all, even something as \u201cminor\u201d as cutting the line in an online waitlist.<br /><br />2. If you run a small business site, you have your work cut out for you. Pay a professional web developer to audit the security of your website, document what they find, and patch holes / repair it accordingly.<br /><br />3. If you have accounts on small business sites you rarely or ever use, consider exporting any data (receipts, transactions), replacing your profile details (name, addresses, photos) with noise, and then deleting your account. If you need to use the site again, use a different email address (as recommended in <a href=\"https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity\">https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity</a>) to create a new account.<br /><br />That last tip is also helpful for reducing your own personal \u201cattack surface\u201d. By pruning your online accounts, you both reduce the number potential data breaches that you\u2019re in, and reduce the places and ways that attackers can cause you trouble (or that you have to double-check if you\u2019re ever the target of a cyber-attack)<br /><br />Previously: <a href=\"https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity\">https://tantek.com/2025/122/b1/more-steps-indieweb-cybersecurity</a><br /><br />#<span class=\"p-category\">CyberSecurity</span> #<span class=\"p-category\">Friday</span> #<span class=\"p-category\">cyber</span> #<span class=\"p-category\">security</span> #<span class=\"p-category\">cyberAttack</span> #<span class=\"p-category\">cyberAttacker</span> #<span class=\"p-category\">chatBot</span> #<span class=\"p-category\">chatBots</span> #<span class=\"p-category\">LLM</span> #<span class=\"p-category\">LLMs</span> #<span class=\"p-category\">AI</span> #<span class=\"p-category\">agent</span> #<span class=\"p-category\">agents</span> #<span class=\"p-category\">AIagent</span> #<span class=\"p-category\">AIagents</span><br />#<span class=\"p-category\">Blaugust</span> #<span class=\"p-category\">Blaugust2026</span>"
},
"author": {
"type": "card",
"name": "Tantek \u00c7elik",
"url": "https://tantek.com/",
"photo": "https://tantek.com/photo.jpg"
},
"post-type": "note",
"_id": "49242679",
"_source": "2460"
}
I really enjoyed this deep-dive video essay by Lola Germs on the science of airborne disease spread. It’s educational and fun with some Bill Nye vibes. There’s extensive notes as well!
{
"type": "entry",
"published": "2026-08-13 12:27-0700",
"url": "https://gregorlove.com/2026/08/i-really-enjoyed/",
"category": [
"CleanAir",
"Blaugust2026",
"Blaugust",
"video"
],
"syndication": [
"https://bsky.app/profile/gregorlove.com/post/3msyfijhmfv24"
],
"content": {
"text": "I really enjoyed this deep-dive video essay by Lola Germs on the science of airborne disease spread. It\u2019s educational and fun with some Bill Nye vibes. There\u2019s extensive notes as well!\n\n\n\nwhat if everything we thought we knew about disease spread is wrong? by Lola Germs",
"html": "<p>I really enjoyed this deep-dive video essay by <a class=\"h-card\" href=\"https://www.youtube.com/@LolaGerms\">Lola Germs</a> on the science of airborne disease spread. It\u2019s educational and fun with some Bill Nye vibes. There\u2019s <a href=\"https://tinyurl.com/clearing-air-biblio\">extensive notes</a> as well!</p>\n\n\n\n<p><a href=\"https://www.youtube.com/watch?v=yuXVu595DBI\">what if everything we thought we knew about disease spread is wrong?</a> by Lola Germs</p>"
},
"author": {
"type": "card",
"name": "gRegor Morrill",
"url": "https://gregorlove.com/",
"photo": "https://gregorlove.com/site/assets/files/6268/profile-2021-square.300x0.jpg"
},
"post-type": "note",
"_id": "49231274",
"_source": "95"
}
