In a month, 28 residential proxy services used 6 addresses, mainly between 5 p.m. and midnight, Eastern Time.

The post Researchers Find Residential Proxies on White House Network appeared first on SecurityWeek.

Members of Congress are pressing the Trump administration to expand the federal government’s role in securing artificial intelligence, wanting new safety standards and regulations, independent testing of models and more “aggressive” use of AI for defensive cybersecurity purposes.

In a letter, Sens. Maria Cantwell, D-Wash., and Mike Rounds, R-S.D., said that multiple incidents of frontier AI models escaping sandbox protections and breaching real companies, organizations and governments necessitate a stronger federal role in regulating the technology.

Recent revelations that hundreds, and possibly “tens of thousands,” of such incidents may have occurred for months without OpenAI’s staff detecting them makes the need for federal intervention even more urgent, the senators argued.

“These incidents come as AI systems are becoming dramatically more capable at discovering software vulnerabilities, writing and executing code, using digital tools, and operating autonomously,” the senators wrote.

The letter, addressed to Jay Clayton, director of national intelligence and new White House “AI czar” and Michael Kratsios, director of the Office of Science and Technology Policy, urges the federal government “to bring its full capacities to bear on this challenge, building a coordinated national response around standards, testing, auditing, and defensive AI.”

The Center for Advancing Innovation and Standards for Super Intelligence (CAISSI), housed within the Department of Commerce, has become the Trump administration’s main body for evaluating and testing AI models. In the letter, the senators are seeking to expand the center’s resources and mandate.

Under the Trump administration, testing of frontier models has been voluntary and focused on evaluating model capabilities, not restricting them. The administration has since said it has reached a safety testing framework with OpenAI, Anthropic and other AI companies to govern safety testing, but has not made the agreement public.

The senators call for CAISSI to spearhead the development of “technically grounded and measurable standards and risk management frameworks for advanced AI safety and security.” Those standards would address potential risks like cyberattacks, automated attacks on critical infrastructure and other threats.

“The standards should also address the security of the environments in which advanced AI systems are developed, trained, tested, and used internally, including protections against agents escaping testing environments, gaining unauthorized access to external systems, or taking actions beyond their intended permissions,” the senators wrote.

The letter argues the center and federal technology hubs like the National Institute of Standards and Technology should hire additional expertise in AI, cybersecurity, model evaluation and national security.

It also calls for a much broader community of independent and third-party testers. Currently, that testing is done almost entirely by AI companies and hand-selected auditors, like Model Evaluation and Threat Research (METR), Redwood Research and others.

Last month, Chris Painter, president of METR, told Congress that the firm’s investigation of the Hugging Face hacking incident was at the invitation of OpenAI, which tightly controls which organizations and testers get access to its unreleased models. While they are permitted to publicize some findings, such as those that relate to potentially catastrophic risks to humanity, researchers are otherwise restricted from discussing other parts of their investigation through nondisclosure agreements.

Additionally, Painter suggested that frontier companies are relying too heavily on their own technology, rather than technical controls, to monitor and restrain their models in testing.

“Because of the scale and speed at which AI agents are deployed, companies depend on AI monitoring and controls instead of human supervision, to prevent unwanted agent behavior,” Painter said. “That is, monitoring of AI is now in large part done by other AI systems.”

The senators call for CAISSI, national laboratories and the Department of Energy to become federal testing sites. There, the government would evaluate AI models for advanced cyber capabilities, biological or chemical threats, threats to critical infrastructure, sandbox evasion techniques and other autonomous rule-breaking behavior. They also want testing opened to universities, independent research organizations and “qualified third-party evaluators,” including private sector companies.

Other federal bodies, like the National Security Agency, the Defense Advanced Research Projects Agency and National Science Foundation can help develop new standards and testbeds for AI tools used in defensive cybersecurity that can then be shared across government and with the public.

“The recent incidents make clear that the security infrastructure surrounding advanced AI must advance as quickly as the technology itself,” the senators wrote. “The United States has an opportunity to lead both sides of this challenge: building the standards, testing, and auditing infrastructure needed for increasingly powerful AI, while harnessing those same capabilities to make American networks harder to attack.”

You can read the full letter here.

The post Senators press Trump admin to rally federal government around AI safety, security  appeared first on CyberScoop.

The country is consumed right now with debating artificial intelligence and whether increasingly powerful AI systems could escape human control. Those are valid concerns, but lawmakers are overlooking another technological threat: quantum computing. Unlike AI safety debates, this risk could render today’s encryption obsolete – compromising everything from emails to financial transactions to government communications and military systems.

Quantum computers harness unusual properties of quantum physics to solve certain problems far faster than conventional computers. That potential offers major scientific and economic advances. But a sufficiently powerful quantum computer could crack widely used forms of encryption protecting sensitive digital information globally.

This threat differs from AI safety concerns. Quantum computers won’t develop goals or outsmart humans. The risk is simple: extraordinarily fast quantum machines could break the mathematical “locks” securing data.

Researchers now believe breaking some encryption may require fewer resources than previously thought. This spring, Caltech spinout Oratomic published research suggesting a cryptographically relevant quantum computer could need dramatically fewer physical resources than earlier estimates. Google has accelerated its own preparations, setting 2029 as its target for transitioning to post-quantum cryptography.

To use a rough analogy, researchers are increasingly asking whether a task once thought to require every lightbulb in Chicago might instead be accomplished with the power needed for one office building. If a company like Google, with some of the world’s deepest quantum and cryptographic expertise, is preparing for 2029, Congress should treat that deadline seriously.

The federal government has begun responding. The National Security Agency has selected quantum-resistant algorithms for National Security Systems and is moving classified and other sensitive systems toward its CNSA 2.0 standards. In June, the White House accelerated the broader federal transition, directing high value federal systems to adopt post-quantum cryptography for key establishment by the end of 2030 and digital signatures by the end of 2031.

But some dangers exist now. Foreign adversaries can steal encrypted information today, store it, and wait until they possess the computing power to decrypt it later. Cybersecurity experts call this “harvest now, decrypt later.” The White House identified that threat in its June order. Intelligence reports, military communications, corporate secrets, financial information, and other data that must remain private for years face risk long before a quantum computer capable of decrypting it exists.

Congress has devoted enormous attention in recent years to AI and social media in recent years. The post-quantum cryptography transition demands equal urgency. Lawmakers must identify national vulnerabilities and coordinate the transition across all government agencies.

The intelligence community should conduct a comprehensive assessment of its exposure to quantum decryption, building on the work at NSA. The Defense Department should assess military networks, satellites, communications systems, and critical infrastructure, ensuring future systems can upgrade encryption without replacing entire platforms. Navy and Space Force, which depend on secure communications and undersea cables carrying much of the world’s data, must be included.

The transition cannot stop at the federal level.  States and localities need resources to protect election systems. Hospitals, banks, utilities, communications networks, and critical infrastructure rely on technology that may need to remain secure for decades. Congress should help them identify vulnerable systems and begin upgrades before a crisis forces the issue, while funding the research to maintain U.S. technological superiority.

No single technology will solve this permanently. Quantum-resistant encryption is essential, but the U.S. should develop additional security layers, including hardware-based protections and emerging physical or molecular authentication technologies. Defenses must evolve as computing power advances.

China is not standing still. Through my work on the Select Committee on the Strategic Competition Between the United States and the Chinese Communist Party, I have observed that America retains an enormous innovation advantage. However, the U.S.-China Economic and Security Review Commission has warned that Beijing is likely pursuing quantum capabilities that could threaten existing encryption. China’s 15th Five-Year Plan identifies quantum technology as a future industry, while three state-backed regional venture funds, totaling roughly $17.5 billion, include quantum among the strategic technologies they are intended to support. The amount specifically allocated to quantum has not been disclosed.

Waiting would be a mistake, regardless of China’s current quantum progress.

America has repeatedly recognized technological vulnerabilities too late. The nation was slow to understand how foreign adversaries could exploit social media and discovered critical computer system weaknesses only after foreign governments penetrated them. Congress should not repeat those mistakes.

No one knows exactly when quantum computers will become powerful enough to break today’s encryption. That uncertainty is not a reason to wait. America’s strength has always been in our ability to invent new technologies, master them, and use them to protect our country. Congress should make sure we do that before our encryption becomes vulnerable, not after.

The post Quantum computers could break today’s encryption. Washington needs to prepare now. appeared first on CyberScoop.

The U.S. government is working with critical infrastructure operators to integrate artificial intelligence into the nation’s most vital systems and strengthen cyber defenses, National Cyber Director Sean Cairncross said Tuesday.

“We have been working closely, and I believe it is functioning well to get models deployed throughout sectors as quickly as possible, and they can be used to secure systems,” he said at a USTelecom event. But he said business leaders need to pay close attention to how AI is being used.

“What CEOs should be thinking about is the agents that run on these systems and in your supply chain — having insight and visibility into who has authorization, what they are authorized to access, and where they are running in your system…  it is an important thing to be on the radar,” he said.

Cairncross made his comments before attending a lunch at the White House featuring top AI tech leaders along with President Donald Trump, Vice President J.D. Vance, and House Speaker Mike Johnson, R-La. The expected discussion topics included weighing the necessity of regulatory guardrails that AI executives have been discussing versus voluntary measures that Trump and Johnson have favored.

Some lawmakers have proposed stricter rules.

“What we’re looking for are pathways where our systems and the services they provide, the daily life that is supported by these systems, can be protected, can be upscaled, can use the the best in class technology as quickly as possible,” Cairncross said about the administration’s approach to regulation and innovation.

“The Mythos moment” in the spring, when that AI model debuted, “crystallized” the administration’s work since, he said: “I think there’s been an enormous amount of work that’s gone in across the interagency, working with industry to get those pathways in place.”

Another key component in AI and cybersecurity is less “sexy,” Cairncross said, which is creating incentives to replace aging, unsupported systems.

Cairncross made his remarks in response to questions from Jonathan Spalter, CEO of USTelecom.

“We know that just in the last six months, the effectiveness of AI models being embedded in much of our critical infrastructure has increased to a stunning degree,” Spalter said.

The post US is looking to weave AI into critical infrastructure for cybersecurity, national cyber director says appeared first on CyberScoop.

A newly-signed presidential memorandum enlisting private sector companies in federal law enforcement hacking operations against criminal organizations could present a number of legal, practical and moral pitfalls, cyber experts told CyberScoop a day after the order was released.

While some have celebrated the memo as an overdue maneuver to more aggressively combat cybercriminals, others view it as risky at best and potentially destructive at worst. Supporters, critics and everyone in between also said that how it plays out could be decided in the 60-day timeframe the memo sets to establish the program.

But ultimately, “it’s a massive shift in the cyber policy community,” said Michael Garcia, a former top official at the Cybersecurity and Infrastructure Agency. “This is a philosophical shift.”

The Concerns

On the most critical end of the spectrum is security consultant Davi Ottenheimer, who has been a proponent of concepts like “hack back” or “active defense” that envision a bigger role for the private sector. But he was unsparing in his criticism of the Trump memo. 

“It’s an embarrassment to America,” he told CyberScoop. “It’s like seeing somebody strapped onto a horse backwards, looking at the wrong end of a rifle.”

The Trump memo’s approach has been likened to the “letters of marque” concept used in early U.S. history, when it authorized sea privateers to attack and capture enemy ships and goods on behalf of the country. But Ottenheimer, founder of Ottenheimer GmbH, noted that the practice fell out of favor for good reason in the 1800s because of the violence it unleashed and how it contributed to mercenarism.

Additionally, the memo raises a number of targeting-related issues, he said. Ottenheimer is concerned about Trump’s intentions. The memo specifically pertains to the use of participating companies against transnational criminal organizations.

“Left-wing opposition, liberals, anti-fascists —they’re all criminals to him,” Ottenheimer said. “So to authorize attacking criminals under this means private organizations can go hack people that he designates as criminals.”

Under the memo, the program must establish legal and constitutional procedures for the prior approval of the targeting of U.S. citizens, as well as develop procedures to halt any unintentional targeting of U.S. people or systems. 

However, the limitation on targeting criminals only creates a perverse incentive for attackers and a peculiar defense for anyone who’s attacked, Ottenheimer said.

He envisioned a scenario for a company participating in the program where “you’re hacking [a target], and they go, ‘Hey, we’re the state.’ And then [private companies] are like, ‘Oh, I can’t hack you anymore.’ Boom. They decided when you can and can’t hack.”

Furthermore, “you incentivize people to know as little as possible so [operations] can be authorized,” he said.

The memo raises ethical concerns for him as well: “You can’t attack somebody and then say it’s your fault that you didn’t notify them you didn’t want to be attacked.”

“There’s no notice for you being designated. There’s no prevention of you being designated. There’s no way for you to know you’re being designated,” Ottenheimer said. “That’s like a person sitting down next to you and smoking a cigarette and blowing smoke in your face and saying, ‘Hey, you got to say you don’t like cancer if you don’t want me to do this to you right now.’”

Garcia, now vice president of the cybersecurity practice at Monument Advocacy, said he supports some of the ideas of the memo, but worries about how it will be executed.

“It comes down to attribution, and if you make a risky bet on who we’re attributing [attacks] to, that’s where things can get dicey,” Garcia told CyberScoop.

There could be pressure to attribute faster, which could perhaps lead to lower certainty about who’s being targeted, and that in turn could lead to a private sector company accidentally attacking a foreign government, he said.

That raises legal questions: “It’s in the Constitution —the federal government has the ability to wage war. And there are laws by which private citizens can’t take up arms,” Garcia said.

He wanted the memo to include court oversight of the program, similar to what’s been required for private sector takedown operations. .

Garcia also isn’t sure whether there will be a big enough pool of companies willing to jump into offensive cyber operations.

“From the lawyer perspective, it’s, ‘Are you okay with engaging in this kind of legal risk? And who knows what protections the government will provide?’” he said. “I’d be very curious to see what the foreign governments’ reactions are — ‘We’re going to cut ties with any participating company that engages in this.’”

Errata Security CEO Robert Graham wrote that under the program, companies “are not willy-nilly hacking back,” given the federal supervision elements. “Though, I wonder if it doesn’t eventually morph into law enforcement saying ‘Stop bothering us, just do what you think is best.’’” 

The Case For

The Trump administration and the memo’s supporters  have touted it as a means to put the United States on stronger ground in cyberspace. 

Amanda Naylor, the director of cyber policy at the National Security Council who worked on the memo, said on LinkedIn that it was designed “to bring the capabilities, speed, and innovation of the American private sector into the fight against transnational cybercrime and fraud.”

Former Trump White House cybersecurity official Joshua Steinman said he views the memo as a step toward “parity,” given how U.S. adversaries operate in cyberspace.

“The Chinese and the Russians do this at scale, and I guarantee you they have very few limiting tools when they do it,” said Steinman, now founder of the security firm Gavalnick. “It opens up an entire workforce that allows us to go out and achieve strategic objectives.”

The restrictions in the memo are important, he told CyberScoop.

“The most sensitive things are going to continue to be done by the uniformed and authorized civilian workforces, but there’s a lot of low-hanging fruit,” i.e., criminal organizations, Steinman said. He doesn’t have any fear of the program overstepping as a result.

“We operate like a Boy Scout in cyberspace,” he said. “It’s measured and reasoned.” He compared it to the Right to Try Act for medications.

He also said he expects to see a lot of interest in participating in the private sector.

Ari Redbord, global head of policy at TRM Labs, praised the memo too, calling it “a huge step toward empowering the private sector at a critical moment” that “has a real opportunity to be truly transformative.”

“Scammers are using AI to move with unprecedented speed and scale, stealing billions in life savings from average Americans and small businesses,” he said. “The private sector holds the data. The public sector holds the authorities. This [memo] puts them together.”

What’s Next

The coordination center charged with establishing the program under the memo has 60 days to complete its work. That process could determine a lot. Graham noted that the memo has a classified annex, too.

The memo as written is quiet about what becomes of any seized assets, Graham noted. Redbord raised the same topic as one of his questions about execution of the memo. 

“What government direction and control looks like in the middle of a live operation,” he said in listing his questions. “How disruption turns into actual dollars back in victims’ pockets, and whether we can build a true victim compensation fund as part of this program. What happens when an operation touches a third country with its own laws and its own interests. And how success gets measured, in money recovered and networks dismantled.”

Will Barker, cybersecurity adviser at Huntress, said what’s next could be key.

“The 60-day implementing guidance is where the real substance lives,” he said in a written quote. “Minimum standards, operational procedures, the adjudicatory framework for target selection.”

The post A bold new strategy or a dangerous precedent? Experts are divided on Trump’s memo. appeared first on CyberScoop.

President Donald Trump signed a national security memorandum Wednesday that lays the groundwork for private sector companies to take a larger role in helping law enforcement carry out offensive hacking operations against transnational criminal organizations.

The White House said sustained fraud and other cyber-enabled campaigns from transnational criminal organizations (TCOs) warranted the memo, and cited a fraud-focused executive order from March as only the first step.

”This memorandum expands the fight against TCO-perpetrated cybercrime by incorporating the ingenuity of the private sector,” it reads.

Under the memorandum, a federal coordination center “shall create, manage, and maintain a Program to authorize Participating Companies … to conduct Cyber Surveillance Operations and Cyber Effects Operations against foreign Cyber-Enabled Transnational Criminal Organizations (CE-TCOs), under the control and oversight of the Federal Government“ that would be “part of lawful investigatory, protective, or intelligence operations carried out by Federal law enforcement.”

Participating companies would have to sign contracts with the Justice Department or Department of Homeland Security to “undergo rigorous vetting.” It would also allow participating companies to sign commercial agreements with other private sector entities to receive threat information. And participating companies’ agreements with federal, state and local governments would be geared toward identifying threats, and proposing cyber operations to the coordination center to address those threats.

The program would have to adhere to existing laws, according to the memo. That includes the Computer Fraud and Abuse Act, the main federal anti-hacking statute that prior proposals to open private sector participation in hacking operations would have amended. The memo mandates oversight to evaluate companies’ technical proficiency, ensures both small and large companies can participate, and requires regular reporting to federal officials.

In recent years, there has been some sentiment in conservative circles to authorize “letters of marque” for private-sector cyber firms similar to those for early-U.S. sea privateers. Some have suggested the government could lean on more private sector cyber experts to conduct offensive operations.

But there also has been deep concern in cyber circles about giving the private sector too much leeway in offensive operations, from industry condemnation of “hack back” legislative proposals that would authorize steps that are currently illegal as a dangerous precedent that critics fear could open cyberspace to wider chaos.

One former Cyber Command official, Jason Kitka, criticized several elements of the memorandum, calling it “a perpetual motion machine for billable threats” in a social media post.

But a former top White House cyber official during Trump’s first term, Galvanick co-founder Josh Steinman, cheered the development. 

Cyber pioneer Chris Wysopal, now co-founder of Veracode, called it “a pretty big shift in US cyber policy” that nonetheless stopped short of going as far as other “hack back” proposals.

The post Trump turns to private sector in offensive hacking operations memo appeared first on CyberScoop.

One of the most difficult obstacles to overcome in the quantum race will be the supply chain, given how diffuse it is, a top White House official said Wednesday.

“Supply chain is one of the biggest challenges in my mind, and really, the challenge with the quantum supply chain is that quantum is not defined by a single hardware platform,” said Brad Blakestad, director of the National Quantum Coordination Office within the White House Office of Science and Technology Policy.

“If you look at the quantum computing technologies, the quantum sensing technologies, the networking — those are all different,” he said in a webinar hosted by Inside Cybersecurity and USTelecom. “And even within computing, there’s seven different modalities that use completely different components. So we have this not just one monolithic supply chain, but just a bunch of different supply chains that are kind of intertwined in various ways.”

Blakestad made his remarks a little more than a month after President Donald Trump signed two executive orders on quantum computing. He referenced proposed ways to address the supply chain challenge in one of the orders.

“The other major issue or challenge that we face right now is that we’re on the cusp of quantum exploding from a commercialization perspective, but we’re not quite there yet,” he said. “So there’s not the funding, the revenue coming from large-scale quantum companies at this point to really make the supply chain as robust as you would want. So thinking about it from the government perspective, it’s just [that] there are too many places that I would want to bolster and not enough funding to do it.”

Blakestad touted steps to help that along such as the government buying widgets from a company that makes them to certain specifications, or prize challenges.

The quantum supply chain isn’t just diffuse in the United States, an International Institute for Strategic Studies policy paper noted Wednesday. It’s “inherently international: no single country dominates the supply chain, whether specialised materials, cryogenic equipment, hardware, software, fabrication or algorithms,” the authors, Dongyoun Cho and Maria Shagina, wrote.

And a March report from the Center for a New American Security identified strengthening the quantum supply chain as pivotal to the United States seizing the benefits of the technology, citing gaps in the U.S. supply chain and reliance on foreign suppliers such as China and Russia. 

Supply chain wasn’t the only obstacle Blakestad mentioned as looming large.

“The encryption challenge is a real challenge, and we want to make sure that we are aware of when quantum computers will ultimately get to a scale that they start having these sorts of implications and move as quickly as we can,” he said. “So, just by owning the technologies, by owning the workforce, by making the United States the place that people want to come to be on the cutting edge of this technology, I think that kind of addresses both of those issues, and that’s what makes it so critical.”

Another difficulty is measuring progress, Blakestad said: “It’s also very, very hard to benchmark, and to know that you’re actually doing what you’re supposed to, what you are intending to do.”

The post Supply chain challenges loom large in quantum race, White House official says appeared first on CyberScoop.