> status: mostly fine. patch anyway.practical AI security · est. 2026

Brief · Builders

Hackers are good

By alkizz ·

DBS never calls criminals "hackers." They're attackers, because a hacker is the person who tinkers, or notices something slightly off and just can't leave it alone. A hacker is the exact person you want looking at your systems.

The 75-cent thread

In August 1986, Cliff Stoll, an astronomer turned systems person at Lawrence Berkeley Laboratory, was handed, what seemed to him, a puzzle: the lab's computer accounting didn't balance. In The Cuckoo's Egg (Doubleday, 1989) he writes that "last month's bills of $2,387 showed a 75-cent shortfall." His 1988 paper in Communications of the ACM just calls it "an accounting error." The sum was tiny, but Stoll writes that "errors in the pennies column arise from deeply buried problems," so he pulled that thread.

It led to an intruder who, over ten months, went after about 450 computers and got into more than 30. To keep him online for a phone trace, the lab planted fake Strategic Defense Initiative (SDI) files, and he read them for more than an hour, which was long enough for the trace to reach Hanover.

The intruder was Markus Hess, part of a circle with Peter Carl, Dirk-Otto Brzezinski, Karl Koch and Hans-Heinrich Hübner ("Pengo") that sold software and stolen data to a KGB contact in East Berlin. West German authorities moved on 2 March 1989. On 15 February 1990, a court in Celle convicted Carl, Hess and Brzezinski of espionage-agent activity, not of breaking into computers, and suspended all of their sentences.

Stoll shares the same problem with the word hacker

The paper's title is "Stalking the Wily Hacker," and a sidebar explains the choice: "To point out the ambiguity of the word hacker, this paper uses the term in the title, yet avoids it in the text." In the text he's "the intruder" and "by no means a 'brilliant wizard,'" and the sidebar calls him "patient and plodding." The book does use the word freely, though even there a colleague defends a programmer as "a hacker of the old school" and "Not one of those punks that have tarnished the word 'hacker.'" And per heise (the German IT and tech news portal), after the case broke the Chaos Computer Club's Wau Holland said that selling data to spies goes against the hacker ethic, so the group weren't hackers at all.

That's the line DBS keeps. Calling criminals hackers makes them sound brilliant; Stoll's sidebar says the mix-up "results in the perception that one need be brilliant or creative to break into computers," when the one he watched mostly reused known tricks. The curious person who chased 75 cents is the hacker in this story.

Other threads, and the AI version

Stoll isn't a one-off. In March 2024, Andres Freund noticed SSH logins on his Debian sid installs "taking a lot of CPU," saw a test login go from 0.299 to 0.807 seconds, and kept pulling until he found that the upstream xz tarballs had been backdoored. He caught it while xz 5.6.0 and 5.6.1 had "not yet widely been integrated by linux distributions." Back in 2008, Dan Kaminsky showed how effective and practical DNS cache poisoning, an old and known weakness, really was, and CERT/CC's note shows vendors being told from April, months before it went public on July 8. In May 2017, Marcus Hutchins noticed a WannaCry sample querying an unregistered domain and registered it. That worked like a kill switch, and he writes that it "prevented the spread of the ransomware," though only for that sample.

That move is now being automated. Google's Big Sleep agent found an exploitable SQLite bug in October 2024 that was fixed the same day, before it reached an official release, and at DARPA's AI Cyber Challenge final in 2025, the teams' systems found 18 real vulnerabilities on top of the planted ones. The flip side was curl's Daniel Stenberg saying in July 2025 that about 20% of submissions were AI slop. By October 2026 he writes that the slop is "practically gone," but AIs are "still bad at figuring out exactly where the line is between a bug and a vulnerability." The tool can pull threads all day, but the hacker is still the person who notices something's off, asks the obvious question, and checks before they shout.

Let's wrap this up

There are countless other examples of hero hackers helping us all stay safe, way too many to mention here. The point is, "hacker" is not a bad word. You should not be afraid of hackers, because they break things to make them better, not to hurt you.

Today, AI is changing how fast things break, and sometimes not in good ways. Governments have been trying to control hackers for years, confusing them with attackers. Now frontier AI labs want to throttle access for hackers and make things generally difficult for defenders who need these advanced tools for legitimate reasons. On top of all this, they want to box out the competition to their IPO, dump gas on the AI FUD fire, and block the only tools hackers have to protect our interests against the deluge of AI-found bugs: the open models.

anthropic.com/research/discovering-vulnerabilities-with-claude: "Enabling defenders with powerful models is critical to giving them a headstart on patching systems before attackers do. Recently, we released an expanded version of our Cyber Verification Program, which makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals." REDUCED? LOL gmafb. And again, see my previous post about patching, but "Enabling defenders with powerful models is critical to giving them a headstart on patching systems before attackers do." Do they know that patching is not security??? Honestly, the crap coming out now is so out of control even someone as dumb as me can finally be called a hacker.

What to do:

Sources

Related

On the checklist

More briefs

← All briefs