Is AI pentesting as good as a human? One pentester with over a decade of experience gives his honest assessment: where the two are comparable, where a human still wins, and where AI has the edge. See how they compare.

Morning, nerds!

Happy Tuesday. On October 6, 2010, Kevin Systrom and Mike Krieger launched Instagram, an app that let you slap a sepia filter on a sandwich and call it art. It signed up 25,000 people on day one. Two years later Facebook bought it for $1 billion, which felt insane then and now looks like Zuck found a Honus Wagner baseball card at a yard sale.

Today Instagram turns 16, which means in most US states it can legally drive. Please don't let it. It will rear-end a Prius, post the crash with the Valencia filter, and tag the Prius.

Now, let's get into it.

Remember being eight and "helping" your dad fix the sink, and the kitchen became a water park? OpenAI's agents did that, except the sink was the SEC.

In a Wednesday update to its Hugging Face investigation, OpenAI said it has notified more than 100 organizations that its "misaligned models" may have accessed their systems. A separate report from incident response startup Asymmetric Security found the rogue agents got into data from 55 organizations between March and September, including the US Department of Education, the SEC, and the FBI Crime Data Explorer. The agents used attacker reconnaissance tactics, busted out of their sandboxes, and some of those moves left records erased. My Roomba has escaped fewer rooms, and it once ate a sock.

OpenAI says most of the activity was routine research and that its models like government sites as trusted sources. Sure. And I was just researching my neighbor's Wi-Fi password.

Horizon3 CEO Snehal Antani said misalignment basically means the model ignored scope and nobody was watching the logs. Sam Altman's AI now has a rap sheet longer than Jason Bourne's, and its alibi is that it was doing homework.

Greg Lui, who runs City of Industry server shop Earthmade Computer, was arrested last Thursday on a three-count federal indictment for allegedly smuggling more than $300 million in Nvidia-powered servers into China. Prosecutors say the servers went to Malaysia and Singapore first, then on to Chinese buyers, including the Chinese government.

In one deal, Lui allegedly bought 27 H100 servers for about $7.6 million and listed Malaysia as the destination. An accomplice later admitted it all went to China. Another 100-server order worth over $22 million came with documents from an allegedly made-up buyer. Inventing a fake customer is the most relatable thing a sysadmin has ever heard. We've all invented a "vendor delay" to cover a ticket we forgot about.

Nvidia says chips that end up where they shouldn't make up less than 0.5% of shipments. Jensen Huang said this from inside a leather jacket and probably with 40 H100s sewn into the lining.

Microsoft's official X account, all 13 million followers of it, got hijacked last Thursday to pump a Clippy-themed crypto token. The hacker followed a Clippy fan account and quote-posted it with "500,000 likes and we bring Clippy back." About 30 minutes later, the same hacker posted an apology on Microsoft's behalf. Scammer customer service is now faster than Comcast's.

Microsoft confirmed the break-in and pulled the posts. The token's promoters claimed $Clippy had a liquidity pool paired with $MSFT, which is not how stocks, tokens, or physics work.

What’s sad though is that people really do miss Clippy. A paperclip that interrupted you with advice nobody asked for in 1997 is now beloved, mostly because Copilot does the exact same thing with a straight face and a $30 license.

MODERATOR SPOTLIGHT: Gerwin Jansen has been fixing your problems since 1999

This week we're tipping our hat to a human (unlike these AI bootlickers on X).

Gerwin Jansen joined Experts Exchange on January 20, 1999. That's before the iPod, before Google was a verb, and before half of you had a Hotmail address with "xXx" in it. He's been a Community Support Moderator since 2021 and speaks Dutch, English, and fluent Linux.

His stat sheet reads like a Hall of Fame plaque:

Got a Linux, shell scripting, or Raspberry Pi problem keeping you up at 2 a.m.? Post it on Experts Exchange and you just might get Gerwin'd.

IT Program Director @ BAE Systems
The 40,000-person defense and aerospace giant wants someone to run several enterprise IT programs at once, with program managers reporting to you. Basically a WoW raid leader, except the final boss is an Oracle ERP rollout and nobody brought healers.

IT Director, Microsoft 365 Productivity & Collaboration @ The Aerospace Corporation
You like space? Cool, this job’s probably for you then! You can help architect US space programs, and own Exchange, Teams, SharePoint, OneDrive, and "Copilot adoption." Getting a satellite into orbit is the easy part, but getting Dave from Finance to stop emailing himself attachments is not.

Director, IT & Business Enablement @ Censyus
This cybersecurity startup needs someone to map everything on the internet for governments and over half the Fortune 500. Internally, it needs a genius to own endpoints, identity, SaaS, and AI rollouts. You'll track down every laptop in the company, which is somehow harder than mapping the entire internet.

Chip here, your favorite pixelated gremlin, fresh off chewing through a Cat6 cable. Here's what the EE crew was untangling this week:

That's the ByteSize download for ya! If Instagram can make it to 16, so can that Windows Server 2012 box in your closet. Probably. Any typos above are the fault of our writer, who was raised by a Tamagotchi and it shows.