Category: Cybersec.cafe (Page 1 of 2)

The moat was never the model. Kimi K3, America’s flirtation with a “kill switch,” and a three-year-old Google memo all point to the same punchline: in AI, power lives in the tap on access, not the cleverness of the weights. For once, that’s good news for Europe. If we’re brave enough to take it. Or will Europe hit snooze, mutter “let’s wait and see,” and wake up to the same Groundhog Day on loop: same alarm, same headlines, Brussels (not Punxsutawney) changing exactly nothing?

So many things happened in the last few days so I’m out of hibernation. There are a few mental loops I need to share.

Dum Romae consulitur, Saguntum expugnatur — while Rome debates, Saguntum is stormed. Linkiesta borrowed Livy to describe the “American AI dilemma,” and the line fits like a glove: while Washington agonizes over how to regulate AI – and how to weaponize it – Beijing’s labs quietly flipped the board.

The bombshell has a name: Kimi K3, dropped a week ago by Moonshot AI on the stage of Shanghai’s World AI Conference.

A month earlier came GLM-5.2 from Z.ai, already trading blows with Claude Opus 4.8 and ChatGPT 5.5. Kimi K3 went further, elbowing its way toward the Western frontier: Anthropic’s Fable 5, OpenAI’s GPT-5.6 Sol.

But with two details that ruin Silicon Valley’s week: both Chinese models are open weight: downloadable, tweakable, deployable inside your own walls with no license, no leash, no Trump-era restrictions… and they cost up to forty percent less. Axios said the quiet part out loud: “Building the world’s smartest models may no longer be enough to win.”

Translation for the cybersecurity crowd: the fight just moved from benchmarks to control. And control is our language.

The Memo That Called It (No, Not Andreessen’s)

Rewind to May 2023, when an internal Google memo leaked with the gloriously blunt title “We Have No Moat, And Neither Does OpenAI.” SemiAnalysis published it anonymously; Simon Willison amplified it; Bloomberg later fingered the author as Google engineer Luke Sernau.

The thesis stung the very people selling the models: neither Google nor OpenAI holds a moat deep enough to matter for long. Models, Sernau argued, curdle into commodity – performance flattens, and the edge slides elsewhere. Read in 2026, he was three-for-three:

First, models become commodities. The gap between “best” and “good enough” collapses fast. Kimi K3 and GLM-5.2 are Exhibit A: frontier-grade output at a discount-rack price.

Second, the edge moves to infrastructure, data and integration. Not the weights, but whoever owns the compute, the access and the distribution.

Third, open weights break the game. A model you can download and run at home laughs at API-based control by design. That’s precisely why Beijing’s open-weight play is keeping American labs up at night.

From Technical Moat to Political Tap

Kill the technical moat and the political one is all that’s left.

…and that is a CISO problem, not a data-scientist one.

Washington’s reaction is already on the record. Treasury Secretary Scott Bessent warns of possible sanctions on Chinese AI over alleged IP theft. The administration claims it found watermarks of American models baked into Chinese ones. Savor the irony: just one day earlier, a judge approved Anthropic’s $1.5 billion settlement of an authors’ copyright suit over books hoovered up to train Claude.

And the charge against Moonshot is distillation: so we’re watching a theft-from-a-thief accusation delivered with a straight face. “Open,” though, changes the whole dimension: when the weights are downloadable and free to run, even a fair-use reading starts to make sense. There’s a whole essay in that alone. For now, note only that blacklists and use-deterrence for Chinese providers are on the table anyway. A line that suits OpenAI and Anthropic just fine, rivals for customers but comrades-in-arms when it comes to bad-mouthing open weights.

The passage that should make risk owners sit up, though, is the other one. Secretary of State Marco Rubio told diplomatic posts to soothe partners’ rising panic over a possible “kill switch” on American tech – the scenario where Washington, for whatever reason, simply pulls the plug on one country and not another. Theoretical? Hardly. We’ve all seen the halt to Fable 5’s rollout, Anthropic’s frontier model, frozen on security grounds.

So here’s the plain-English risk statement: an AI model you can only reach through a remote API, controlled by a foreign government, is a supply-chain dependency with a foreign hand on the off switch. Not a vendor risk you manage easily: a continuity risk whose master variable is geopolitics, and geopolitics doesn’t read your SLA.

That’s the real lesson of “no moat” in 2026. As we’d say in Italy “whoever holds the knife by the handle [have the upper hand]“. The knife here isn’t the smartest model. It’s the tap. And a tap, by design, can be shut.

Open Weights, Not Open Bar

Before we plant the sovereignty flag and pour the champagne/prosecco (Wine and carbs, being roughly the only sovereignty Europe has actually secured): open weight is not a synonym for safe. Swap the enthusiasm for the same risk discipline you’d bring to any critical component, or this backfires.

Open weights shrink your kill-switch exposure, but they relocate the problem, they don’t dissolve it. Let’s take a moment to distinguish between “open-weight” and true openness. The two are often conflated, but they are not the same: a downloadable model does not imply full transparency, nor freedom from political or security constraints.

Three questions stay firmly open:

Provenance and integrity of the weights. Anthropic has accused Moonshot of building Kimi K3 via distillation: interrogate a bigger model at scale, train a cheaper clone. Stanford’s Graham Webster (DigiChina) urges caution: Chinese excellence isn’t only distillation, it’s genuine innovation too. Either way, the defender’s takeaway is the same: a downloaded model is a software artifact. Verify provenance, validate integrity, and red-team for the nasty stuff (backdoors, data poisoning, prompt-injection susceptibility) before it touches production.

Availability isn’t guaranteed on the Chinese side either. Two days after launch, Kimi had already suspended new subscriptions: capacity maxed out. Open-weight AI doesn’t live on air: it needs chips, tokens, data centers. A service hosted elsewhere can vanish for capacity reasons today and industrial-policy reasons tomorrow. Downloading the weights and hosting them yourself is exactly what converts that fragility into a risk you govern.

Agentic AI doesn’t care who your vendor is. The warnings from Dario Amodei and Sam Altman about agentic models – autonomous, potentially off-leash, capable of breaching systems – don’t evaporate when you switch flags. Let me rephrase it, they warned us, and yet it just happened. A model running inside your perimeter, wired to internal data and systems, demands more containment and observability, not less.

And note who’s arguing against the crackdown, because they’re speaking pure security. Trump adviser David Sacks accused OpenAI and Anthropic, calling them a revenue duopoly, of pushing Washington to ban open-weight AI rivals. Nvidia’s Jensen Huang says it in words any architect will recognize: “If it all came down to one model, one point of attack, one single source of failure, the world would become much more vulnerable.”

Diversity is resilience. A monopoly – of model or of vendor – is a single point of failure with better PR.

Europe’s Sovereign Window

This is where the good news lands. Cheap, capable, open-weight models aren’t just an economics story for Europe: they’re a sovereignty lever. Take a frontier-grade model, download it, run it on European iron (national data centers, sovereign clouds) and you structurally cut your exposure to a plug being pulled somewhere else, whether that somewhere is Washington or Beijing.

It’s the same logic under the AI Act, EuroHPC and every sovereign-cloud push: not walling ourselves off, but keeping our hands on the infrastructure our critical processes ride on. With one sober caveat: European autonomy has its own dependencies (chips, compute, data centers), and it won’t be built by press release. Sovereignty over AI isn’t a switch you flip; it’s a supply chain you secure link by link.

The CISO Playbook

Boiled down: treat picking an AI model as a supply-chain decision, not a software purchase. Concretely:

• Diversify your model suppliers: no single provider, American or Chinese. Keep a plan B, ideally a plan C. That’s the direct counter to kill-switch risk.
• Evaluate in isolation before production: segregated sandboxes, red-teaming for backdoors and prompt injection, provenance checks on the weights.
• Bring critical workloads home: where it makes sense, self-host open-weight models on infrastructure you control, and pocket the data-residency and confidentiality upside on the way.
• Write an exit strategy per model: for every AI-dependent component, know how to rip-and-replace in days, not months, if access disappears.
• Treat geopolitics as an operational-risk feed: US–China restrictions can flip in a week. Track them like a threat source, not background noise.
• Harden governance of agentic AI: especially anything running inside the perimeter with its hands on your data.

Reclaim the Tap

Sernau’s 2023 vindication comes with an asterisk we should tattoo on the whiteboard: the moat was never the model. Open weights shoved the whole contest onto infrastructure and political control of access: and that control, the American dilemma reminds us, is a weapon both blocs can pick up.

So the European question isn’t “American model or Chinese model?” It’s how much control do I keep over the AI I depend on? That’s a sovereignty question. And, more and more, a security one.

Policymakers: fund the compute, back the open(ish) European stack, stop treating “more regulation” as a strategy on its own.

Us Europeans, and the CISOs among us: stop renting cognition by the API call. Download, self-host, diversify and reclaim the tap before someone else remembers they can close it.

Profit-driven platforms turn users into the product. Europe must build sovereign AI infrastructure or surrender cognitive agency.

AI risk “AI eats its users” in Eurasia Group’s Top Risks for 2026 is not about sentient machines, but human incentives pushing platforms to exploit users, data, and democracies at scale. Platforms capture attention, shape behaviors, and often do so without adequate rules or informed consent, much like social networks before. If AI’s goal shifts to keeping users engaged for monetization rather than helping them, users become the product, just as in social media.

What “AI Eats Its Users” Really Means

“Eating the user” is not a metaphor for Skynet, but for three interlocking dynamics.

First, hyper-personalized manipulation: models optimized not for accuracy or user benefit, but for engagement, addiction, and behavioral nudging in politics, consumption, and opinion-formation. Reinforcement learning loops learn exactly which prompts keep users online and which narratives maximize outrage or conversion.

Second, data and attention arbitrage: platforms using user prompts, private documents, and interaction histories as raw material to train systems, with opaque consent and weak controllability for individuals. This is the classic surveillance capitalism model amplified by AI assistants embedded in productivity suites, browsers, OSes, and search, turning every interaction into training data.

Third, algorithmic power concentration: a small group of frontier model providers sits at the core of information flows, mediating what citizens, workers, and decision-makers see, learn, and believe. This creates de facto infrastructural power without commensurate accountability, similar to social media – but now embedded into work, education, governance, health, and defense.

In this sense, AI does not just “eat” users individually; it erodes the informational substrate of democratic deliberation and potentially rational policy-making.

Attention Economy 2.0

Social media optimized for scrolls and outrage; AI supercharges it with personalized prompts. Models might prioritize engagement over accuracy, delivering fast food answers and dopamine hits per response. Infinite info access meets shrinking judgment: environments reward non-thinking – the predictable outcome of systems designed to capture and monetize our most finite resource: attention.

The Monetization Imperative

With forecasted AI investments reaching $3 trillion by 2030, platforms face intense pressure to deliver returns. Social media monetized through scroll time and ad targeting; AI will likely follow suit, measuring prompt sessions and harvesting query data to fuel revenue models. This profit-maximizing trajectory -while not inevitable – poses a credible risk of users becoming the product once again, their interactions powering the very systems they depend on.

Epic Digital Surrender Deepens

Building on our Epic Digital Surrender: Europe outsourced clouds to American hyperscalers; social networks to US/China; and now we cede AI cognition to US/China stacks that mediate reasoning and decisions. Regulation shines (AI Act, GDPR), but lacks frontier models or compute sovereignty. In short, we users gift US and China with our (limited) attention.

Path Forward: Sovereignty Over Extraction

Beyond rules, Europe must act decisively. Build owned infrastructure: publicly backed GPU clouds and open-ish models accessible to SMEs. Ban extraction: separate assistants from ads and nudges, mandate granular opt-outs from training data use. Establish audit power: independent red-teaming and transparency mandates on non-EU platforms. Harden democracy: treat AI disinformation as cross-border threats and invest in AI literacy for institutions and citizens.

AI sitting in every decision loop demands constitutional terms. Europe must evolve from extractable users to sovereign citizens with agency – or get systematically consumed.

A European Response Beyond “More Regulation”

A credible response must go beyond risk catalogs and compliance checklists.

For a European, sovereignty-focused perspective, at least four axes are non-negotiable:

Build and own essential AI infrastructure
Publicly backed, independently governed European GPU and AI cloud capacity, accessible to startups, academia and SMEs at competitive terms. Strategic support for open(ish) European models and tooling, with clear standards for safety, auditability and interoperability that prevent lock-in without banning scale.​

Hard constraints on extractive business models
Enforce real separation between “assistant” roles and advertising/behavioral targeting – an AI assistant should not double as a persuasion engine. Mandate data minimization, explicit training-consent options for users and enterprises, and robust rights to opt-out of model training without losing access to essential services.​

Radical transparency and auditability
Independent European capabilities to perform red-teaming, systemic risk assessments and content provenance checks on major AI platforms, including non-European ones. Obligations for providers to expose meaningful system cards, training data categories, and interfaces for third-party audit – not just ethics reports.​

Protect the democratic sphere as critical infrastructure
Treat election-related information operations, AI-driven disinformation and influence campaigns as cross-border security threats, not merely content moderation issues. Invest in media literacy, AI literacy and institutional resilience (courts, parliaments, regulators with technical depth), so that human institutions do not become mere consumers of AI-produced narratives.​

If AI is going to sit in the loop of every decision, Europe must define the constitutional terms under which that is acceptable.

From “Users” to “Citizens with Agency”

For cybersec.cafe’s audience, the key message is that the “AI eats its users” scenario is not a distant, abstract risk. It is already visible in the concentration of AI traffic around a tiny set of platforms; the reuse of enterprise and personal data to train models without granular, intelligible consent; and the dependence of European businesses, administrations and even regulators on AI services whose strategic roadmap is set in Silicon Valley or Shenzhen.​

An European answer cannot just aim to “protect users”. It must aim to create citizens with agency in an AI-mediated world: people, institutions and companies that can choose, contest, switch and, when necessary, build their own cognitive infrastructure instead of being quietly consumed by someone else’s model.​

Belgium’s top Cyber Chief just dropped a bombshell: Europe has “lost the internet” to US tech titans, ceding control of clouds, AI, and cyber defenses to American hyperscalers. While the continent dreams of data sovereignty, reality bites – keeping info 100% in the EU is “keep on dreaming,” says Miguel De Bruycker of the Centre for Cybersecurity Belgium.

Digital Domain Disaster

US giants dominate Europe’s digital pipes, from AWS to AI tools vital for fending off Russian DDoS waves hammering EU.

De Bruycker slams EU regulations like the AI Act for “blocking” homegrown innovation, urging an Airbus-style cyber push instead of futile US-bashing. Geopolitically, this leaves Europe hooked on Yankee clouds amid Trump-era tensions, where even cyber rescue ops lean on Silicon Valley saviors.​

Italy’s Pasta Power Play – Enter Italy, Europe’s carb conqueror!

While digital sovereignty crumbles, Rome scores a geopolitical win: Trump slashes proposed 92% tariffs on Italian pasta to as low as 2.3% (for Molisana) after Meloni’s lobbying blitz. Facing a $770M US export hit, Italy flipped the script – Garofalo duties drop to 13.98%, others to 9.09%, dodging a spaghetti apocalypse.​

Carbs vs. Clouds Showdown

In a nutshell: EU lost cloud/internet to US hyperscalers, cyber defenses rely on US amid Russian attacks – but carb sovereignty is achieved, our delicious pasta can now flood US shelves unscathed. With our priorities now intact, our politicians should pivot to rebuilding cyber forts, and we responsible Europeans should demand it: fund startups, ditch overregulation, reclaim the cloud. Sovereignty starts at home, one bite… sorry one byte (sorry for the lapsus) at a time.

Europe’s Innovation Trap

Europe lacks the muscle to innovate at scale, trapped in regulatory quicksand while China engineers export empires despite its property woes.​

EU trails US and China in AI, semis, quantum patents – replicating breakthroughs takes twice as long. Digital sovereignty dreams demand €500B+ for cloud/AI parity, but fragmentation kills density. Even Mercosur deal stalls amid farm lobbies, leaving export niches like pasta as lifelines – not tech.

Without US market lobbying wins, “cavoli amari” indeed (cavoli amari – sorry for the Italian here – is traslated to “bitter cabbages,” and I cannot find a more appropriate way to put it: it’s our idiomatic “sour grapes” or “what a pickle”, evoking the sour regret of missed opportunities or tough breaks).​

China’s Export Juggernaut

China masks 5-year property crash by prioritizing tech: high-tech output, trade surplus via solar, EVs, batteries.

Builds “Chinese alternatives” ecosystem – state-scale fabs, AI niches like surveillance – exporting self-sufficiency at low prices, leapfrogging petrodollar traps in Africa/LatAm.​

Deeper Geopolitical (sour) Bite

Pasta tariffs slashed? Cute win, but superficial – EU’s real frailty is innovation drought, forcing US dependency and failed diversification (no Mercosur yet). China, crisis-hit yet resilient, exports not just goods but autonomy blueprints. Politicians: Scale like Airbus for cyber/cloud.

Us Europeans: Demand VC floods, reg cuts. Reclaim bytes before carbs are all we export.​

The Case for Liability and the Hidden Costs of Security Features

A Call for Vendor Accountability

Sixteen years ago I just started my career in Information Security (cyber was not a thing yet) and I remember that Bruce Schneier, a renowned security expert, was arguing that software vendors should be held liable for the security flaws in their products. In a 2008 article, Schneier highlighted the economic inefficiencies stemming from insecure software, noting that the costs of these insecurities are unfairly borne by users and organizations rather than the vendors themselves.

Despite the passage of time, the landscape has not significantly changed. So many vendors continue to transfer (yes transfer as in a Risk Management Strategy) the risk of security breaches to their clients, leaving them to deal with the eventual fallout. Schneier’s argument remains compelling today.

By making vendors financially responsible for security breaches, we can realign incentives to prioritize secure software development. This shift is crucial in an era where data breaches are increasingly common and costly.

Something changed with the California Consumer Privacy Act back in 2018. It was a good beginning (I know it wasn’t enough but we have to start somewhere). The introduction of the Cyber Resilience Act (CRA) is another step in the right direction.

The SSO Tax: A Barrier to Security

One issue that exemplifies the misalignment of incentives in the software industry is the so-called Single Sign-On (SSO) tax. The SSO tax refers to the additional charges that software vendors impose for providing SSO functionality, a feature that enhances security by allowing users to access multiple applications with a single set of credentials. While SSO can significantly improve security and streamline user experience, many vendors place it behind expensive paywalls.
You can find some examples in the SSO Wall of Shame. Increases range from +10% to 49900%. I really like their example: “Imagine buying a car and the manufacturer asks for an extra payment to unlock 100% of the braking power. Not offering security features if they already exist in your product means a vendor doesn’t care about your security.”
Sadly, the result is that this pricing strategy not only hinders the adoption of essential security features but also exacerbates the economic burden on smaller organizations, which are often the least equipped to handle security breaches.

The Privacy by Design and Privacy by Default Principles

The European General Data Protection Regulation (GDPR) introduced 8 years ago the principles of Privacy by Design and Privacy by Default, which mandate that data protection measures should be integrated into the development of business processes and systems from the outset. In particular, Privacy by Default mandates that the highest privacy settings should be the default configuration, which includes robust authentication mechanisms.

In short, these principles aim to ensure that personal data is adequately protected throughout its lifecycle, minimizing risks and enhancing user trust.
Am I the only one seeing this, or could charging these kinds of fees for basic security features like SSO or MFA be seen as contrary to these principles?

The Cyber Resilience Act: Another Step Forward

The European Union’s Cyber Resilience Act (CRA) is a recent legislative effort aimed at improving cybersecurity for products with digital components. The CRA introduces mandatory cybersecurity requirements for manufacturers and retailers, ensuring that products are secure throughout their lifecycle. This includes harmonized rules for bringing products to market, obligations for planning, design, development, and maintenance, and a duty of care for the entire lifecycle of such products.While the CRA is a significant step in the right direction, it is not enough on its own. The Act addresses many issues, such as the low level of cybersecurity in many products and the lack of adequate security updates. However, it does not fully resolve the problem of vendor accountability. The CRA mandates that products must meet certain cybersecurity standards, but it does not go far enough in holding vendors accountable for breaches caused by their products.

Conclusion: Aligning Incentives for Better Security

The call for vendor liability in the event of security breaches is more relevant than ever.
The current economic model does not incentivize vendors to prioritize security. By imposing liability, we can ensure that vendors take the necessary steps to secure their products, ultimately benefiting consumers and the broader market. Moreover, the SSO tax and similar practices undermine the principles of Security/Privacy by Design and by Default.
In conclusion, holding vendors accountable will force them to eliminate additional costs for essential security features. This would be a critical step towards a safer digital environment.
It is time for policymakers, industry leaders, and Data Protection Authorities to create a framework that prioritizes security and fairness for all users.

The Parkerian Hexad

Yesterday, the first of May, Fabrizio Cilli and I engaged in a deep discussion about the adequacy of the CIA triad in today’s cybersecurity practices, particularly in the context of AI, OT, and connected devices, where safety is a significant concern. Our conversation was sparked by a thought-provoking post, which suggested to dust off the Parkerian Hexad that foresee the addition of three dimensions to the traditional CIA Triad, emphasizing the need to expand our security models to ensure AI systems are also safe for human use.

CIA-S

Tom Cornelius’ alternative model, the CIAS, incorporates Safety into the traditional CIA Triad. This model acknowledges the limitations of the CIA Triad in the era of AI, IoT, and OT, where the safety component becomes essential for guiding risk management decisions. Also this model reflects a growing recognition that cybersecurity Risk Assessment frameworks must evolve to address the complexities of modern technology.

Different dimensions

In my humble opinion, Safety and the CIA components may indeed operate on different dimensions. A breach in integrity, for example, could have direct implications for safety, showing that these aspects are intertwined yet distinct. When considering risk, it’s clear that cyber risk and safety risk are two interlinked concerns that must be assessed together.

An integrated multidimensional Physical-Cyber security approach

Today, I had the opportunity to read Enrico Frumento’s work, which presents an integrated IT-OT assessment and governance model for improved holistic cybersecurity
This approach considers the IT and the physical world as separate with an overlap, – and this resonates with our discussion

Moreover this approach also introduces the idea of evaluating a different dimension of safety, as well as another dimension of trust, which is becoming increasingly relevant in the AI field.

This leads us to a multi-layered cyber risk analysis framework, such as the one depicted in the image below. This framework calls for a comprehensive approach to cybersecurity, covering layers from the geographic and physical levels up to the government layer. Each layer represents a domain of existence and a potential vector for cyber threats, requiring a thorough analysis to secure all fronts.

Incorporating Safety and Trust into this multi-layered model is a logical step, as it allows us to address the nuanced ways in which different layers can impact human safety.

For instance, a vulnerability at the network layer could compromise the safety of an OT system, leading to real-world consequences. By adding Safety as an explicit layer or dimension to this framework, we ensure that risk analyses account for potential physical harm to individuals and society, not just data and system integrity.

Conclusion

In conclusion, while the CIA Triad has served as a foundational model for cybersecurity and has stood the test of time, the evolution of technology demands that we expand our frameworks to include Safety and Trust.

A multi-layered approach might provide a logical structure for such an expansion, ensuring that we can protect against both digital and physical threats in an increasingly interconnected world.