CYBERSECURITY

Francis Scialabba

If you thought training a human employee to resist social engineering was hard, just wait until you try the same thing with an AI bot.

Threat-intelligence team Cisco Talos recently found that cyber adversaries are getting good at tricking large language models (LLMs) into engaging in nefarious activities like revealing sensitive data. The bots seem particularly susceptible to adversarial prompts disguised as cybersecurity testing.

“We did not encounter any sophisticated encoding or techniques designed to trick the models—most of the time it was a simple, ‘I’m allowed to do this,’ and the model complied,” the team wrote in its August 4 post.

After examining real-life adversarial prompts (featuring more use of “bro” than you might expect), the researchers learned that bot guardrails can be sidestepped with user claims such as being on a bug-bounty mission.

More on tricking LLMs.—BH

      

Sponsored By Salesforce

Three days. 400+ sessions. No travel required.

The Dreamforce session catalog is officially live, which means you can start mapping out your agenda right now. Keynotes, product announcements, technical deep dives, and exclusive broadcast moments you won’t catch anywhere else. All streaming free on Salesforce+.

Ready to build? Virtual training led by Salesforce technical experts walks you through building, testing, and deploying a custom agent in minutes.

Browse sessions across Agentforce, Data 360, Slack, Tableau, MuleSoft, Headless 360, and a whole lot more. Pick what matters to you, and skip what doesn’t.

Watch from home, your kitchen, or the couch (no judgment).

Don’t miss the biggest tech event of the year. Totally free. Register now.

SOFTWARE

Getty Images

Lokesh Karanam’s update to the team used to be one sentence:

I’m working on ticket number 100. I am working on creating a tracking UI, and everything is going well.

That’s how a “standup”—a standard developer check-in—was meant to be, after all: a quick, right-down-the-line progress update short enough to spare everyone from having to sit down.

These days, as staff software engineer at marketing and business-services firm RRD, Karanam leads the daily meetings, but leaves more room for updates than in the past. The 13 or so developers and product managers arriving from different time zones onto the morning call are encouraged to give everyone a more comprehensive view of their workload. Karanam himself, in his work summaries, describes his situation, the task he’s responsible for, actions taken, and their result—a “STAR” method that takes at least a paragraph to go through.

The art of a tight meeting.—BH

      

IT STRATEGY

Morning Brew Inc.

There are good surprises, bad surprises…and then there’s AI surprises.

The lattermost is all too common, according to a new report from Harness, which found that almost three-fourths (72%) of companies experienced a surprise bill or an unexpected spike in AI costs within the past year. (The findings were based on a survey of 700 global FinOps and engineering leaders.)

Unexpected costs aren’t the only thing emptying enterprises’ pockets. Harness found that a little over one-quarter (26%) of overall AI spend is wasted. To put that into perspective, that’s about $130,000 down the drain for companies with a monthly AI budget of $500,000.

The visibility issue. In its report, Harness said surprise AI bills and wasted spend are byproducts of three structural issues within companies. One is gaps in visibility, which Harness’ FinOps Advisory Director Patrick Brogan told IT Brew is partly driven by provider sprawl as organizations tap multiple AI providers at once for services.

Here’s the root of the issue.—BM

      

Sponsored By Snapdragon

Run AI locally. As costs and reliance on cloud-only AI infrastructure grow, businesses need a new way to allocate on-device + cloud workloads. PCs powered by Snapdragon help balance on-device processing with cloud computing, improving performance, reducing infrastructure costs, and giving IT teams flexibility to deploy AI at scale. Learn more.

patch notes

Francis Scialabba

Today’s top IT reads.

Stat: Over 500. That’s how many organizations have been impacted by Medusa Ransomware over the past five years. (Cyber Magazine)

Quote: “Without the knowledge of what risks could exist with skills, you’re kind of operating blind.”—Omar Turner, a managing director of cloud and AI security projects at Microsoft, said of a new list of the top security issues for AI agentic skills (Dark Reading)

Read: An AI agent for everything? (TechCrunch)

^{*A message from our sponsor.}

Jobs

CollabWORK connects you to the hidden job market through IT Brew and other trusted channels. Browse roles curated specifically for this community by clicking through to the job board.