Re: AI slop "contributions" to IETF working groups

[Robert Moskowitz <[e-mail]>]

Some of the tests were not about crashing the plane, but having ACARS 
report about non-existant planes to force wrong evasive action.  Or not 
shut down the airport radar but to report wrong positioning of 
approaching aircraft.

Those are not the actual situations, but examples like those actually done.

But the UA had its props off so the attacker could not get it to take 
off up from the table and crash into a table across the room....

You just heard the motors spinning when they should have been off.

IMO, that was easy points.  Mavlink security is a joke.  Run it over 
UDP/DTLS.  Few do, though.  And not in the Ukraine anymore.  The 
countryside is covered with fiber optic cables and the birds are using 
the stuff to make nests.

On 2/10/26 1:34 PM, Phillip Hallam-Baker wrote:
> How is using an AI different from using fuzzing though?
>
> One of the most effective hacking tools is to simply spam the inputs 
> with garbage and see what happens. So it isn't exactly surprising that 
> when people write code in unsafe languages without null pointer and 
> array bounds checking, they can discover low hanging fruit 
> vulnerabilities faster than others.
>
> What such testing doesn't show is that the code is secure because AI 
> generated tests aren't exhaustive. Just as 'write slop, check it by 
> fuzzing' isn't a valid method for producing secure code, neither is 
> 'check with AI'.
>
>
> On Tue, Feb 10, 2026 at 11:20 AM Robert Moskowitz 
> <rgm-ietf=[e-mail]> wrote:
>
>     Last week, one of my activities was observing an Aviation Cyber Rodeo
>     with a "Capture the Flag" activity.  Two classes of participants and
>     awards.  One for college students; one for industry people. break
>     into
>     our test systems (no actual aircraft or airports used).
>
>     One industry person who is really good at finding flaws in aviation
>     stuff and advises all over the world, spent his day ONLY using AI to
>     attack.  His goal was to mimic the attackers to better understand
>     their
>     methods and how he may then develop "Purple Teams" Strategies to
>     rally
>     the defenses, as we all know the attacks can win once they try.
>
>     He won.  He penetrated every system and technology and did it faster
>     than anyone else.  And there were two really experienced industry
>     attack
>     teams there.
>
>     At one point he joked that he was ahead of me.  He had better, as
>     I was
>     not competing.  I was there as an observer and advisor to those
>     building
>     the tests that were attacked.  ;)
>
>     Scary.  That AI-guided attacks are so effective...
>
>     Really scary, as some of these systems in real world would take
>     some $6B
>     and 10 years to replace.  Thus the need for isolation.  But is it
>     really
>     isolated?
>
>     On 2/10/26 10:35 AM, Joel Halpern wrote:
>     > I presume most folks in this discussiona re aware that we are
>     far from
>     > alone in this problem?  For example, Bruce Schneier has a nice
>     summary
>     > of some of the examples and dimensions in
>     >
>     https://www.schneier.com/blog/archives/2026/02/the-ai-generated-text-arms-race.html
>     >
>     > Yours,
>     >
>     > Joel
>     >
>     > On 2/10/2026 7:05 AM, Nick Hilliard wrote:
>     >> Christian Hopps wrote on 10/02/2026 11:37:
>     >>> So anyway, while we’re (IETF) considering requiring disclosure
>     of AI
>     >>> tool use here, I think it’s worth considering what exactly
>     we’d like
>     >>> this disclosure to accomplish. Is it a filter flag (i.e., if
>     checked
>     >>> “Yes” it get’s dropped to /dev/null by a personal email
>     filter)? Does
>     >>> it help in reviewing the document knowing that AI tools were used.
>     >> IDs and formal documents are only part of the issue. Possibly a
>     >> greater problem is a contingent of people who are issuing
>     commands like:
>     >>
>     >> "ingest {URL of I-D}, identify 3 substantial problems in the text,
>     >> write a single paragraph of concise text for each problem in a
>     format
>     >> suitable for submission to an ietf mailing list"
>     >>
>     >> then cut-n-paste the output into an email.
>     >>
>     >> Nick
>     >>
>