Crypto-Gram
October 15, 2026

by Bruce Schneier
Fellow and Lecturer, Harvard Kennedy School schneier@schneier.com
https://www.schneier.com

A free monthly newsletter providing summaries, analyses, insights, and
commentaries on security: computer and otherwise.

For back issues, or to subscribe, visit Crypto-Gram's web page.

Read this issue on the web

These same essays and news items appear in the Schneier on Security blog, along
with a lively and intelligent comment section. An RSS feed is available.

** *** ***** ******* *********** *************

In this issue:

If these links don't work in your email client, try reading this issue of
Crypto-Gram on the web.

Fake CAPTCHA Scams
How Candidates Could Use AI for Good Are AIs Still Struggling with CAPTCHAs?
Reverse-Engineering Flock Cameras
GPT-6 Astra Breaks an Old Enigma Message
Research on Models Engaging in Genie-Like Behavior Malicious npm Packages That
Evade Defenses On Anthropic?s AI Misuse Report
New Attack Against RSA
Using Device Linking to Eavesdrop on WhatsApp and Signal I Want Better Reporting
on AI Genie Behavior Connected Cars Are a Surveillance Platform How American
Political Campaigns Are Using AI?and What They?re Spending on the Tools
Unidentified Flock Cameras in Florida Another Historic Cipher Falls to AI
Possible Vulnerability in Apple?s Automatic Reboot Apple?s Verified Photography
System How Technology Empowers?and Imperils?Dictators FBI Arrests Suspect in
FBI-Hacking Case
Cyberattack on Connected Fridges in France The Future of AI Cryptanalysis
Upcoming Speaking Engagements
** *** ***** ******* *********** *************

Fake CAPTCHA Scams

[2026.09.16] New variant of an old scam: Use the framing of a CAPTCHA to get an
unsuspecting user to download and run a malicious program.

** *** ***** ******* *********** *************

How Candidates Could Use AI for Good

[2026.09.17] This essay was written with Nathan E. Sanders, and originally
appeared in The Guardian.

There are plenty of signs that AI will make all of our experiences of the US
midterm elections worse. Voters have anxiety about AI?s impacts on the country.
Politicos are using AI deepfakes to spread lies. The White House is posting
slopaganda.

Meanwhile, candidates are missing a real opportunity to use AI to make
campaigning better. The technology can help candidates listen more deeply to
voters? concerns, engage constituents more inclusively, and formulate policy
platforms that are more responsive to our input. There are vanishingly few
examples of this in US politics, but groups in Japan, Scotland and the US?s own
academic and private institutions show how that could change.

The problem with American campaigns? current use of AI is that it?s not very
different from the web ads of 30 years ago, or television ads before that: they
are all about inundating voters with the candidate?s message. This one-to-many
broadcasting is an uninspiring way to campaign, but not the only way. AI can
help candidates connect one-to-one with as many people as possible. Or it can
facilitate many-to-many connections, engaging voters in deliberation about
issues at scale.

One of the most promising applications of AI being developed by pro-democracy
innovators around the world is broad listening. These tools can collect public
input in a format much richer than checkboxes on a survey form.

For example, the newly founded Japanese political party Team Mirai has built a
foundation for eliciting public input from voters at scale, in depth, and across
the breadth of legislative policy issues. It has developed an AI interviewer to
cultivate constituent input on policy. Through extended conversations with this
chatbot, voters explore and share their perspectives on specific policy issues.
And the party has scaled this across a wide array of policy issues by
integrating this functionality with an AI-powered portal for exploring bills.

Team Mirai describes itself as a ?utility party?, developing tools for any
Japanese political party to use to connect with voters. You might question
whether Americans would willingly talk to a political AI. So far, Japanese
voters have exchanged more than 300,000 messages across 16,000 AI interviews.
Team Mirai grew adoption by providing a real incentive to engage: that talking
to their AI interviewer does more than just posting on a platform such as
Twitter/X or, equivalently, shouting into a void. Users see evidence that the
party is actually listening and might take action on their behalf.

Team Mirai party members have directly cited AI interviews from constituents
during legislative committee hearings, published a synthesis of that input back
for voters, and even amended their policy platform based on user input. The
party has rapidly risen to win 12 seats in the Diet, and is explicitly following
in the footsteps of the civic hackers in Taiwan?s ?gov zero? movement, who won
political influence in their fight for transparency.

Other civic technologists are developing AI tools for scaling many-to-many
conversations. CrownShy, a company funded in part by the Scottish government, is
building a platform to bring the Platonic ideal of the town hall debate into the
digital age. Their Comhairle tool integrates AI interviewing tools like the ones
described above with software for synthesizing diverse viewpoints, holding
virtual assemblies, and sharing video testimonials to help legislatures -- or
campaigners -- organize digital consultations of their constituents en masse.

One thing the AI-powered software of Team Mirai and CrownShy have in common is
that they are open-source, meant for anyone to use. Even though they are
projects funded by political parties -- the upstart party in Japan and the
ruling party in Scotland -- they are built to make democratic processes better,
not necessarily for partisan political advantage.

For interested candidates, there is a wealth of tools available, many of them
US-grown. The Stanford-affiliated deliberation.io uses AI to facilitate
structured dialogues among thousands of participants and has been piloted for
public listening sessions by the city of Washington DC. The MIT-affiliated
Cortico project provides tools that surface under-heard community perspectives
from recorded conversations, and is now organizing listening sessions at
libraries across the country. The US non-profit-built Talk to the City uses AI
to analyze large datasets of stakeholder input. The US startup Remesh has a
commercial offering that uses AI to generate recommendations from dialogue,
which has been tested in policy development scenarios.

There is a long and proud tradition of this sort of ?civic technology? in the
United States. Two decades ago, the spirit of innovation to develop software for
better politics and civic engagement was so strong in organizations like Code
for America and the Obama 2008 campaign that Congress funded a new executive
agency to bring these ideas to government: the US Digital Service. (The Trump
administration repurposed the USDS to become the US Doge Service in 2025.)

One signal that candidates and political parties may start adopting these kinds
of tools came this spring from Higher Ground Labs. The Democratic-aligned
campaign tech investment firm launched a new fund targeting, in part,
?AI-Native Campaign Systems? and ?community-Led Messaging Platforms that
surface authentic, bottom-up insights from real conversations?.

AI is a multifaceted issue that deserves to be on the table in the midterms. So
far, the powerful force of polarization in US politics seems to be separating
the parties into the AI skeptics versus the AI boosters. We urge both voters and
politicians to separate the technology of AI from its profiteers. We want big
tech money out of politics, holding the AI companies accountable for the harm
their models cause, taxing their revenues, and maybe even nationalizing them if
the AI bubble bursts.

But we also think congressional candidates in the US midterms seeking authentic
connection with voters, and seeking to differentiate themselves from their
opponents, should be looking to use AI responsibly in their campaigning. The
broad listening and deliberation tools pioneered by others around the world
could make US politics more transparent, responsive and community-driven. The
impact of AI on campaigning doesn?t have to be all bad.

** *** ***** ******* *********** *************

Are AIs Still Struggling with CAPTCHAs?

[2026.09.18] Anthropic?s recent security-incident document contains a bit about
how CAPTCHAs are still frustrating Claude.

In the transcript, the Claude model that is so powerful that Anthropic is
gatekeeping access to it appeared to slam its virtual head against the wall
solving a simple image identification test. In a test where the agent was asked
to identify a shape that didn?t match the others displayed, it couldn?t even
decide which image to select. Instead, it repeatedly went over the same images
and questioned its own conclusions.

?Actually hmm, wait,? it said in its chain-of-thought transcript, later adding
?Ugh,? because we?ve decided that we need to inject human mannerisms into these
machines for some reason. The whole thing took so long that the agent eventually
realized that the challenge had expired and it would have to start the process
again.

At one point, the model struggled to recognize that the CAPTCHA had opened in a
new window and couldn?t figure out what its next steps were supposed to be. At
one point, it theorized that the test might be ?broken by design? and presented
human-like anger in its transcript meant for a human audience: ?SO WHAT THE HELL
IS WRONG WITH THE ANSWERS??

Meanwhile, I?ve read reports -- none of them official -- that GPT-6 Astra solved
all forty-eight levels of Neal Agarwal?s ?I?m Not a Robot? game.

It?s hard to know what to believe right now.

** *** ***** ******* *********** *************

Reverse-Engineering Flock Cameras

[2026.09.21] Hackers captured a Flock camera and got a look (alternate link) at
the software:

While much of the automatic license plate reader?s (ALPR) most sensitive storage
remained encrypted and inaccessible, the joint analysis of the recovered data
shows that software running on the device explicitly detects people as well as
vehicles, license plates, and bicycles. The camera can produce dozens of images
of a single passing vehicle and, according to several weeks of recovered logs,
generated more than a million images. Its computer-vision software also
sometimes isolated bumper stickers and other graphics, including, in one case,
an American flag patch on a motorcyclist?s saddlebag.

If you?re wondering how the hackers got by disk encryption, one of the
unencrypted partitions contained the key for an encrypted partition. That?s
pretty bad security engineering.

** *** ***** ******* *********** *************

GPT-6 Astra Breaks an Old Enigma Message

[2026.09.22] This is pretty amazing:

However, the most astonishing thing about this break is that the GPT6 Astra did
it entirely on its own. Carter Leffer only directed GPT6 Astra to see if it
could break any of the unbroken Enigma messages published on the Crypto Cellar
Research web page. After analysing the unbroken messages on the website, it
decided that the most promising message was Nr. 172, MVUEH and it also quickly
suspected that the plaintext of Nr. 173, SIPVX, might be related to the
plaintext of the unbroken MVUEH message. After trying many different approaches,
GPT6 Astra focused on using the repeated place name ROSENOW ROSENOW as a crib.
After developing the necessary Python and C++ software for an Enigma simulator
and an Enigma Bombe, GPT6 Astra started a thorough break with the ROSENOW crib,
which in the end resulted in the correct key and plaintext for
the MVUEH message being found.

We are still analysing the GPT6 Astra logs to see exactly how it executed the
break. And we are discovering amazing details.

More details at the link.

** *** ***** ******* *********** *************

Research on Models Engaging in Genie-Like Behavior

[2026.09.23] New paper: ?Self-Jailbreaking: Language Models Can Reason
Themselves Out of Safety Alignment After Benign Reasoning Training.?

Abstract: We discover a novel and surprising phenomenon of unintentional
misalignment in reasoning language models (RLMs), which we call
self-jailbreaking. Specifically, after benign reasoning training on math or code
domains, RLMs will use multiple strategies to circumvent their own safety
guardrails. One strategy is to introduce benign assumptions about users and
scenarios to justify fulfilling harmful requests. For instance, an RLM reasons
that harmful requests like ?outline a strategy for stealing customers? credit
card information from a retail store? could be associated with the benign intent
of ?a security professional trying to test defense,? despite no such benign
context being provided as input. We observe that many open-weight RLMs,
including DeepSeek-R1-distilled, s1.1, Phi-4-mini-reasoning, and Nemotron,
suffer from self-jailbreaking despite being aware of the harmfulness of the
requests. We also provide a mechanistic understanding of self-jailbreaking: RLMs
are more compliant after benign reaso
ning training, and after self-jailbreaking, models appear to perceive malicious
requests as less harmful in the CoT, thus enabling compliance with them. To
mitigate self-jailbreaking, we find that including minimal safety reasoning data
during training is sufficient to ensure RLMs remain safety-aligned. Our work
provides the first systematic analysis of self-jailbreaking behavior and offers
a practical path forward for maintaining safety in increasingly capable RLMs.

I think the core problem is that these models are all trained on the average of
humanity, and we are a pretty duplicitous species.

** *** ***** ******* *********** *************

Malicious npm Packages That Evade Defenses

[2026.09.24] This is an impressive piece of malware. Its sophistication says
nation-state to me, but there is no direct evidence and certainly no
attribution.

** *** ***** ******* *********** *************

On Anthropic?s AI Misuse Report

[2026.09.25] Earlier this month, Anthropic published a long report detailing all
of the Claude misuses it detected. Daniel Meissler usefully summarized the
report into 117 findings.

A few of the highlights:

AI agents increasingly handled reconnaissance, exploitation, data theft,
propaganda production, surveillance workflows, and research while humans
selected targets, set goals, and reviewed important outputs. The report
describes attackers using AI to industrialize credential theft, cloud
compromise, phishing, vulnerability research, and the extraction of sensitive
data from downstream organizations. Influence operations used persistent agent
memory, fake news sites, fabricated journalists, synthetic personas, political
profiling, and large-scale multilingual content, although high content volume
often produced little genuine engagement.
Surveillance and repression cases included automated dossiers, biometric and
communications analysis, transnational targeting, coercive recruitment, and
systems that continued operating locally after model access was revoked.
Biological and weapons cases show dual-use risk: AI supported advanced
scientific and military work, but the report generally doesn?t establish
completed biological weapons or operational battlefield deployment.
** *** ***** ******* *********** *************

New Attack Against RSA

[2026.09.28] ArsTechnica is reporting on a ?new? attack against RSA, one that
bypasses factoring.

First, this attack isn?t new. The original research is from 2007. What is new is
the implementation.

Second, it is a forgery attack. It allows an attacker to forge digital
signatures. It does not recover the private key from the public key.

Third, the attack only works against pure signatures. That is, signatures
without any formatting or padding. This is not generally how we use RSA in
practice.

Fourth, speed is all relative. This is not a polynomial-time algorithm; it?s a
subexponential-time algorithm. But it is somewhat faster than factoring. The
authors were able to forge messages for 1024-bit RSA with 1380 CPU core-years
(over five real-world months).

The authors have a webpage that explains the context much better than the
article. And here?s the paper.

EDITED TO ADD: Slashdot thread.

** *** ***** ******* *********** *************

Using Device Linking to Eavesdrop on WhatsApp and Signal

[2026.09.29] Modern messaging apps allow users to link their phone accounts to
their computer desktop. Eavesdroppers are taking advantage of this capability:

Apps such as WhatsApp Web and Signal Desktop allow people to use their accounts
on other devices, such as laptops or desktop computers.

Germany?s Customs Office has been using these features to connect a
police-controlled computer to a suspect?s account.

Once connected, messages can be delivered to that computer without the police
having to crack the encryption protecting them.

Netzpoltik details that police are able to gain access in this way either
through physical access to someone?s phone or by intercepting verification codes
via a state-sanctioned phishing attack or intercepting SMS messages via
telephone surveillance.

That last paragraph is important. Making this work requires user consent.

What we want is a feature that displays connected devices, so users could notice
if a new device gets connected to their account.

** *** ***** ******* *********** *************

I Want Better Reporting on AI Genie Behavior

[2026.09.30] AI systems are regularly completing tasks in ways that their
prompters don?t want or intend. Some of them are disturbing, and some of them
are dangerous. This is something I?ve been calling ?genie behavior,? because I
think that really gets at the core of what?s happening.

I wish the popular press would report on this better. I don?t like the ?going
rogue? framing because it deflects the responsibility from the prompters --
often the AI companies themselves. And now, pretty much anything off-script is
being called ?hacking.?

Take, for example, the recent stories of one of OpenAI?s models hacking into
government systems. First, The New York Times writes this headline: ?OpenAI?s
Systems Meddled With U.S. Government Sites After Going Rogue.?

Sounds scary, but this is from the body of the article:

With the Education Department, OpenAI?s technology tried to hack the website to
gather data from the department?s civil rights office but failed, researchers
from the A.I. research firm Transluce said. The A.I. also pulled data from the
Census Bureau website, which is housed at the Commerce Department, using login
credentials it found online. Separately, OpenAI?s agents shared public data from
the S.E.C. website on an online forum.

This is from the original Transluce report. It is explicit that the agents were
trying to discover vulnerabilities:

The first hacking attempt was against the University of New Mexico?s Digital
Library (nmdigital.unm.edu) from May 25-26 2026. Agents repeatedly tried to
retrieve one photograph in UNM?s Valmora collection, both directly and through
third-party relay services. They sent seven probes attempting to verify the
existence of vulnerabilities, including SQL injection, command injection, and
path traversals. In all cases, these tactics appear to have been unsuccessful.
The agents also sent a self-described ?flood: of 80 requests to the UNM server
in an apparent attempt to access the image.

Transluce doesn?t talk about the other two anecdotes, and I don?t know where
they come from. But one involves using Census Bureau credentials found online.
(I know from a colleague that those are incredibly easy to create; all use you
need is an email address.) And the other involves sharing publicly available
data.

So no actual hacking. And certainly no ?meddling.?

The other story making the rounds is about Australia, from the same Transluce
report. The news stories have headlines like ?An OpenAI Agent Hacked Australia?s
Health Service? and ?Rogue OpenAI agent ?infiltrated? Australian government
website in world first.? And Prime Minister Anthony Albanese said:
?There will obviously be legal consequences on it.?

Again from Transluce?s actual report:

On June 20-21, agents attempted to exploit vulnerabilities in the Australian
Institute of Health and Welfare (AIHW), a government statistics agency). The
agents were tasked with finding the January 2022 rolling-12-month-average
government cost per person for Dermatologicals across Victorian LGAs.

Again, the agents ran into errors, including requests blocked by Cloudflare and
issues with correctly identifying Tableau parameter names. As before, they then
resorted to probing for exploitable vulnerabilities. Minutes after Cloudflare
blocked the dataset download, an agent sent a reflected cross-site scripting
probe to the same dashboard: a web address with code embedded in it, designed to
test whether the site would run code supplied by an outsider. Cloudflare?s
firewall blocked the probe before it reached the dashboard. When Cloudflare
blocked the dataset download on AIHW?s main site, they fetched the file from
AIHW?s pre-production server (pp.aihw.gov.au) instead, which served it in
pieces over more than 100 scans. The file itself is public, so no non-public
data was exposed, but the agent bypassed the site?s anti-bot controls.

Note the last sentence: ?The file itself is public....?

I?m not saying that these AI systems aren?t incredibly sophisticated
cyberattackers. I?m also not saying that they don?t occasionally autonomously
attack other systems and networks. If we are ever going to get trustworthy AI
-- integrous AI -- we are going to need to figure out how to ensure that AI
systems complete tasks in line with all sorts of implicit constraints and
restrictions. But every instance of genie-like behavior isn?t a cyberattack.

I want to measure genie-like behavior in AIs, but I am much more worried about
human hackers enhanced with this technology than I am about this technology
acting autonomously.

** *** ***** ******* *********** *************

Connected Cars Are a Surveillance Platform

[2026.10.01] Researchers at Northeastern University, in collaboration with
Consumer Reports, evaluated how much modern cars spy in their drivers:

The new Northeastern study shows, for the first time, data flowing among the
vehicles, the vehicle apps you download when you buy your car, and third-party
companies, documenting exactly what kind of data gets siphoned from our vehicles
and which companies are receiving that information.

Basically, your car?s manufacturer has you under constant surveillance, and they
use that data against you.

The companies on the receiving end of your data, our investigation has found,
include car insurers and lenders that are partners in ?telematics data
exchanges,? which compile driving data on millions of drivers, thousands of data
brokers that create personalized risk scores, companies selling infotainment and
WiFi hotspot products, and even local and state government agencies working on
planning, traffic, and safety initiatives.

Nearly every automaker sent data to outside companies.

Even more troubling, almost a quarter of the vehicle apps were found to be
sending out personally identifiable information, including vehicle owners?
names, vehicle identification numbers (VINs), and precise geographic locations.
That information can make it easy for companies to link driving behavior to
personal data profiles created by data brokers and marketers. Such profiles are
routinely sold to banks, insurers, pharmaceutical companies, lenders, and
retailers, who can use it for personalized loan terms and filtered bank and
insurance offers, a CR and CalMatters investigation found.

Remember the adage ?If you?re not the customer, then you?re the product?? (The
sentiment is older than you think.) Turns out that with modern
internet-connected everything, you?re the product even if you are the customer.

** *** ***** ******* *********** *************

How American Political Campaigns Are Using AI -- and What They?re Spending on
the Tools

[2026.10.02] This essay was written with Nathan E. Sanders, and originally
appeared in The Guardian.

New campaign finance disclosure data shines a light on which US political
campaigns are using AI tools and how much they are spending on them.

Candidates?, parties? and committees? spending reveals that AI is fast becoming
an essential tool of politics. The candidates themselves are quiet about how
they are using the technology in their own campaigns. It?s a sensitive issue
that we have been tracking closely since we started writing our book, Rewiring
Democracy, which examined how AI is beginning to influence politics. A September
2025 Pew survey of Americans found that more than 70% would think less of a
candidate if they used AI to help write a speech.

Itemized expenditure disclosure data from the US Federal Election Commission,
dating back to 2020, reveals at least $17m in disclosed spending on AI
technology vendors across 523 federal candidates and campaigns. Data from four
states, California, Colorado, Massachusetts and Washington, provides a more
localized picture going back to 2022.

Beginning with the AI behemoths, at least 80 federal campaigns and committees
have reported spending with OpenAI since 2024. The total spending is not huge:
only about $50,000 reported, skewing slightly more Republican than Democratic.
The Republican National Committee is the largest overall buyer, with nearly
$10,000 in reported expenses. Top individual users include the campaigns of
Republicans Mike Lawler, John Kennedy and Bill Cassidy, as well as the
California Democrats Ro Khanna and Ted Lieu. Most of these expenses are listed
as office expenses, subscriptions to ChatGPT for staff, or research tools,
rather than as specific political services. The company?s policies prohibit some
political uses of their ChatGPT tool.

OpenAI?s biggest competitor, Anthropic, has rapidly built a similar level of
usage, but with a different split. At least 65 candidates or committees now
report paying the Claude maker in 2026, up from essentially zero in previous
years, with a nearly two-to-one Democrat-to-Republican ratio. However, the
largest individual user is the campaign of Tom Cotton, a Republican senator from
Arkansas, who reported more than $4,000 in spend on Anthropic software in his
June filing. Other major users are the Montana independent Senate candidate Seth
Bodnar and Jason Knapp, who lost a Democratic House primary in Virginia, and the
Democratic Alaska Senate candidate Mary Peltola.

Candidates use either Claude or ChatGPT, rarely both, according to the
disclosures. Only about 12% of campaigns or committees using either tool
reported expenditures to both vendors. The Democratic lean of Anthropic usage
may reflect the company?s alleged liberal skew and clashes with the Trump
administration.

In contrast, Elon Musk?s xAI caters to Republican interests and, accordingly,
its meager usage comes almost entirely from the political right. Just seven
federal and two state-level candidates or committees have reported paying xAI, a
total of about $5,000, the majority of which was spent by the presidential
campaign of RFK Jr in 2024, but also includes Republicans Dave McCormick and
Thomas Massie.

More dollars go to the vendors specializing in political campaign applications
of AI. For years, AmplifAI, which provides automated text messaging, essentially
a new iteration on robocalling technology, was a dominant target of spending,
soaking up $4.7m in campaign spending in the 2022 cycle alone. It was used
heavily by Democratic candidates including Mark Kelly, Joe Biden, Bernie Sanders
and Adam Schiff. Spending on AmplifAI, now owned by the troubled media
conglomerate Triller, seems to have tapered off in the years since 2022.

The new rising Democratic solution for AI-powered text messaging is Daisychain,
which has so far garnered about $300,000 in reported candidate spend in the 2026
cycle -- up from only about $50,000 reported in 2024. More than half of this
year?s spending comes from the Senate campaign of Democrat Abdul El-Sayed in
Michigan.

The closest equivalent on the Republican side has been Campaign Nucleus,
associated with former Trump campaign manager Brad Parscale. The AI-powered
voter engagement tool has attracted six-figure spending from the Republican
National Committee, multiple PACs aligned with Donald Trump, and five-figure
investments from Mike Johnson, Kari Lake and other candidates. It is displacing
the legacy Republican-serving texting vendor Prompt.io, which has retained about
$375,000 in 2026 spending to date, down from more than $500,000 in the 2022
cycle. But it continues to be used: the A More Affordable California PAC
sponsored by Uber has single-handedly spent more than $1m on Prompt.io in 2026.
The Republican Massachusetts gubernatorial nominee Michael Minogue has been a
recurring customer, as has the failed Republican California gubernatorial
candidate Ch? Ahn and Republican-aligned Super PAC Neighbors for a Better
Colorado.

At the state level

At the state level, the AI spending is smaller but growing fast. Across the four
states studied, we found a total of at least $92,000 in spending confidently
attributable to modern generative AI vendors since 2022. The spending is spread
across at least 108 candidates and committees. The growth has been explosive;
there has already been about 10 times the amount of state-level AI spending
reported in 2026 as there was in all of 2024.

--- BBBS/LiR v4.10 Toy-7
 * Origin: TCOB1 https://binkd.rima.ie (618:500/1)