Short reads exploring specific aspects of post-quantum, autonomous AI, and on-chain security. New pieces roughly monthly per shift.
Hash-based, stateful signature schemes like LMS and XMSS offer stronger quantum security guarantees than ML-DSA or SLH-DSA. However,t his comes with some major assumptions.
MCP servers are commonly see as semi-trusted, with tool lists and descriptions reviewed upon install. However, these lists can be changed or malicious, making MCP servers a potential supply chain risk.
Bridged tokens are commonly treated as equivalent to the original asset. However, wrapped tokens have significant security risks that can jeopardize their real value.
Hybrid cryptography is likely best practice for a post-quantum migration. However, it does have its downsides.
AI agents' reasoning traces are supposed to describe how the tool decided to run tools and generate output. However, they aren't as reliable or accurate as they seem.
Web3 hacks are common, but they're not all performed for the same reasons. The nature of Web3 and the practice of post-exploit bounty offers can make it difficult to differentiate a "rescue" and an "attack".
QKD is commonly marketed as a replacement for post-quantum cryptography like ML-KEM. However, its limitations make the two solutions complementary, not alternatives.
Most AI security discussions focus on the threats of compromised AI systems. However, an AI agent that is confidently wrong can be just as dangerous.
"Not your keys, not your crypto" is a key concept in Web3. However, self-custody isn't always as great as it's made out to be.
The quantum migration regulations and deadlines that you see probably don't apply to you. That said, they're likely overestimating the time that you have to migrate to PQC.
"Human in the loop is the most common method of managing the security threats of AI systems. However, this is often just security theater.
Stablecoins are commonly marketed as being less volatile than other cryptocurrency while maintaining decentralization. However, this isn't the case.
Quantum migration is increasingly critical as quantum computing grows closer to breaking classical cryptography. However, directly swapping in post-quantum algorithms for their classical counterparts isn't the best idea.
Do you really trust what your LLM or AI agent is telling you? Model weights, context, and outputs can be manipulated in many ways, introducing lies and biases.
Decentralization is one of the core selling points of Bitcoin and other blockchains. However, the reality is that most layers of the Web3 infrastructure exhibit a surprising and unfortunate level of centralization.
Quantum migration plans often focus on Shor's threat to public key cryptography. However, symmetric encryption and hash algorithms face quantum threats as well.
Often, prompt injection attack coverage and defenses focus on direct prompt injection attacks. In agentic workflows, indirect prompt injection is a major risk with the potential for cascading effects.
Smart contract audits have become commonplace in Web3, but large-scale attacks are still happening. There are many reasons for this, ranging from limited scoping to the growth of AI-driven analysis.
Harvest now, decrypt later attacks are the main driver for organizations to start their quantum migrations today. However, not all data is at risk, and understanding the threat is essential to prioritizing migration efforts.
Prompt injection is the most famous attack against AI systems, but it's not the only one. Memory poisoning introduces persistent changes to AI agent by targeting saved state.
Blockchain immutability is a valuable on-chain security control, but it can easily be overstated. Counting on smart contract immutability can leave Web3 projects vulnerable.
Quantum computing is described as a major threat to data encryption and confidentiality. However, the real threat in Web3 is quantum computing breaking ECDSA digital signatures.
AI guardrails are often (over)sold as a defense against prompt injection and other AI threats. While useful, they're often ineffective and aren't enough for security.
An introduction to flash loans and how they can be used to attack DeFi protocols.
A fast, practical guide to ML-KEM, ML-DSA, and SLH-DSA, and which one to choose.