Alberto Bartoli - Blog

 Questa volta in italiano. Ogni tanto vedo notizie strettamente collegate ad argomenti di cui ho parlato a lezione pochissimi giorni prima ( esempio ). Ieri sera ne ho visto una molto interessante, legata proprio alla lezione di Cybersecurity di ieri mattina. La lezione era la prima sull'argomento "Memory corruption". Tra le varie cose, ho detto che: Non tutti gli errori ("bug") sono vulnerabilità ; non tutte le vulnerabilità sono sfruttabili ( exploitable ). L' impatto di una vulnerabilità dipende non tanto dall'errore ma dal programma in cui è stato commesso l'errore. Tale dipendenza è estremamente complessa e pressoché impossibile da prevedere in generale. Uno stesso errore in programmi diversi può non avere alcun impatto di sicurezza, avere impatto marginale, avere impatto potenzialmente catastrofico. Le stesse considerazioni valgono per la possibilità di sfruttare una vulnerabilità conseguente ad una particolare tipologia di errore: può essere ...

UPDATE AT THE END I am playing with Gemini for extracting MITRE ATT&CK techniques from cybersecurity incident reports automatically (MITRE ATT&CK is a powerful framework for reasoning about attacks and I use this framework intensively in my Cybersecurity course ): you give Gemini the URL of a report and will immediately obtain the attack techniques used in that attack campaign. Here a spreadsheet with some of the outputs. This usage of "the AI" is potentially very useful for grasping the essentials of an attack campaign quickly and providing students with concrete examples. It is also an usage that fits an essential but often overlooked requirements of AI applications: the cost of a mistake must be small . The prompt I give to Gemini actually asks to extract another important piece of information: the vulnerabilities possibly used in that campaign. In my early attempts I asked Gemini to tell, for each listed vulnerability, whether it was still unknown to software...

A follow-up to my previous post on Mythos Preview. The AI Security Institute (AISI) has published a very interesting analysis of Mythos Preview . Very interesting because: AISI is " a mission-driven research organisation in the heart of the UK government ". Its reports are clearly much more credible than claims of the form " our last product is too strong to give you, believe us " by a private US company, that is currently losing lot of money, that is fiercely battling against other  companies in the AI arena, that is extremely good at fuelling hype about their products and capabilities. They consider complete cybersecurity tasks, i.e. CTF (capture the flag) competitions and attacks to a simulated organization. They compare the behavior of different models for a given "token budget". Not surprisingly, Mythos Preview is indeed very good and better than previous models, but it is definitely not the coming Apocalipsis. In particular, it is the first tool th...

(updated twice after first posting, see below) On April 7-th 2026, Anthropic issued a technical report titled  Assessing Claude Mythos Preview’s cybersecurity capabilities . This report has quickly sparked the all-too-common (and deeply misleading) narrative of an imminent cybersecurity apocalypse due to the (supposedly) immense and groundbreaking capabilities of AI. For example, The New York Times :  I’m really not being hyperbolic when I say that kids could deploy this by accident. Mom and Dad, get ready for: "Honey, what did you do after school today?” “Well, Mom, my friends and I took down the power grid. What’s for dinner?” That is why Anthropic is giving carefully controlled versions to key software providers so they can find and fix the vulnerabilities before the bad guys do — or your kids. What does Anthropic say? The following paragraphs contain a slightly edited AI-generated summary of the Anthropic report Anthropic has introduced Claude Mythos Preview, a langu...

My Cybersecurity course has a lot of technical detail. Maybe not as much as some students wish, at least in certain topics, but finding the appropriate balance between breadth and depth is difficult. I try to convey to students an important message, though: in order to understand the dynamics of cybersecurity in the real world (" why we are still not applying fundamental principles formulated 50 years ago? ", " why there are so many vulnerabilities? ", " why such an obvious defense is not ubiquitous? "), one must never think solely in technical terms or even worse, in moral terms (" you have to make sure that your code does not have any vulnerabilities, otherwise you will be a sinner and go to hell!",  " company X is evil because does not release patches for its vulnerable software! "). What I tell to students is that one must always think in economical terms ( "yes, this defense is interesting...but what is its cost in terms of f...

I have recently read in a newspaper the claim " once quantum computers are sufficiently advanced, they will render current cybersecurity technologies completely ineffective ". As a civil servant "sufficiently expert" in this field, I feel it is my duty to point out that this claim is deeply wrong. I will do so at least in this web blog. Quantum computers and Post-quantum cryptography (PQC) Once so-called ‘ quantum computers ’ become available in practice, they will be capable of breaking certain cryptographic algorithms that have been widely used for many years and are still used today. For this reason, for years now, there has been a huge push worldwide to accelerate the transition to so-called ‘post-quantum cryptography’ (PQC): cryptographic algorithms that can be executed by the standard computers we already have today , but which cannot be ‘decrypted’ even by the quantum computers of the future . Various PQC algorithms have already been developed and standardise...

Maybe I should prove that I am not against AI and that I do use AI for my daily job. In this post I will describe how I extracted  MITRE ATT&CK  techniques from an incident report automatically , by using Gemini (MITRE ATT&CK is a powerful framework for reasoning about attacks and I use this framework intensively in my Cybersecurity course). First a bit of context. Yesterday I posted this note on the team of the course: A recent technical report by Google is a concrete example of many of the concepts discussed in some of the recent lectures. New attack campaigns are discovered by highly skilled organizations, there is an infection chain leading to the final malware, the infection chain may be composed of multiple obfuscated scripts downloaded and executed from different locations, vulnerabilities that may or may not be publicly known at the time of their exploitation allow escalating privilege, IoC and YARA rules are released for the benefit of the rest of the world ....

The impact of so-called "AI" in coding, programming, cybersecurity is deep and will be more and more so. Many kinds of activities will become much faster or are already so. Predicting the implications of these facts on the job market is hard, though, as predicting the future always is. When I was a student I used to buy the BYTE magazine  every now and then. In September 1990 I bought this issue, that I still have in my library:  The Internet had been "invented" several years earlier ( TCP September 1981, DNS November 1983). I took my degree in December 1989 and at the time we did have the ability to download files from very far away and obscure locations, with ftp . A couple of lectures about computer networks were part of one of the courses I took in 1988. Yet, in 1990, none (none) of the " 63 of the World's Most Influential People in Personal Computing " included the Internet in their " predictions of the future ". One of the few truly ...

I am using NotebookLM more and more, for various tasks related to teaching and research. I have to read quite a lot of technical and scientific reports as part of my job and I find it really hard to keep track of all the important insights and news that I discover every day. One extremely useful application of NotebookLM is summarising such sources: sources that I have actually read and that I actually find important . I have decided to start sharing some of these reports publicly. I think some of these topics are very important and maybe there is someone interested in looking at an automatically-generated summary ( that I have read and checked ) of sources that I have carefully selected . Clickable links here : AI-assisted coding Selection of highly insightful analyses of the state of LLM-assisted coding (March 2026) Agents of Chaos An exploratory red-teaming study concerning autonomous language-model-powered agents. The study involved deploying agents in a live...

I wish I had the time to write down my thoughts on all the important news and misleading information related to 'AI and cybersecurity'. I don't expect people to be interested in reading my thoughts on this topic, but I feel the need to write something down anyway. Even though I don't have enough time to write a clear and concise summary, recent news has urged me to write something, if only to get my thoughts down on paper. While reading the following, please bear in mind that it is an incomplete summary of my views. Why should I study Cybersecurity? I can defend my systems by asking the AI. AI is going to harden my defenses and solve all my defensive problems. Microsoft is one of the companies trying to convince us that AI, including in the field of cybersecurity, will solve all our problems. They are heavily pushing us to use Copilot — one of many incarnations of the LLM models that support ChatGPT — in almost all Microsoft tools. One of the most heavily promoted appl...