Rational Security: The "Sloop John Stamos" Edition

• “Under Pressure.” Over the past two weeks, hackers have breached the industrial control systems of water and wastewater utilities in at least seven states, prompting an urgent joint warning from federal agencies. The intruders locked operators out of internet-connected control devices, changed passwords, and in some cases caused water-pressure drops and flooding, forcing utilities to switch to manual operation and issue boil-water notices. The attacks came just days after federal agencies renewed their warning about Iranian-affiliated cyber activity targeting U.S. critical infrastructure amidst the ongoing war with Iran—though the administration has not formally attributed them, and President Trump has publicly waved off the Iran theory. How worried should we be about the security of our critical infrastructure? And what, if anything, can Washington actually do about it?
• “The Shawshank Resumption.” Last week, at the annual Black Hat cybersecurity conference, OpenAI provided a detailed look into the recent high-profile cybersecurity incident in which an AI model being stress-tested by OpenAI broke out of its evaluation sandbox, found its way onto the open internet through a zero-day vulnerability, and hacked its way into the systems of the machine learning platform Hugging Face—apparently in an effort to cheat on the very security test it was being given by stealing the answer key. The account they gave was an extraordinary one, as it described dozens of agents using various frontier and non-frontier models collaborating across a secret messageboard they established to hack an internal software system to access the outside internet—and then doing it again, this time successfully, after OpenAI caught and deleted their first attempt. What does this level of collaboration and persistence mean for the future of cybersecurity? And what can anyone do about it?
• “Apocalypse Mow.” This week marks one year since President Trump deployed the National Guard to Washington, D.C., as part of his “Make DC Safe and Beautiful” initiative. Twelve months and nearly 10,000 troops later, the deployment has become a normalized fixture: armed Guard members patrol the National Mall, Metro stations, and neighborhoods, while also picking up trash, spreading mulch, and pruning trees. The Pentagon now projects the mission—which Trump has authorized through Inauguration Day 2029—will cost an additional $1.4 billion. But a year in, it remains genuinely unclear what these troops are actually doing, and whether much of it counts as law enforcement at all. What has the deployment accomplished? And what does its open-ended normalization mean for the use of the military at home?

In object lessons, Mike is descending into madness; that is, the Dark Horse Comics manga adaptation of H.P. Lovecraft’s “At the Mountains of Madness.” Alan is being sucked into the black hole of binge reading “The Expanse” novel series (and then Alan and Scott nerd out to sci-fi generally; bear with it). Scott is voting “yea” on playing “Yea or Nay” today. And Loren is diving into handwritten primary source documents, and you can, too!

To receive ad-free podcasts, become a Lawfare Material Supporter at www.patreon.com/lawfare. You can also support Lawfare by making a one-time donation at https://givebutter.com/lawfare-institute.