Just say no
Thanks
Block all AI browsers for the foreseeable future: Gartner
Agentic browsers are too risky for most organizations to use, according to analyst firm Gartner. The firm offered that advice last week in a new advisory titled “Cybersecurity Must Block AI Browsers for Now,” in which research VP Dennis Xu, senior director analyst Evgeny Mirolyubov, and VP analyst John Watts observe “Default …
-
-
Tuesday 9th December 2025 14:24 GMT NoneSuch
Re: Just say no
Integration with Browsers is bad.
Embedding in the OS / Cloud good.
Gartner has the following firms as substantial stock holders:
- The Vanguard Group, Inc.
- BlackRock, Inc.
- State Street Corp
- Baron Capital Group, Inc.
All of whom supposably own significant Microsoft stock. Coincidence?
-
-
-
Monday 8th December 2025 07:53 GMT blu3b3rry
Why stop at browsers?
It'd be better if there were ways to block "AI" (or is it A1? Thanks Linda) on a more general level, like with some search engines "summaries" or the pestilence that is ClippyPilot.
Those that wish to get their head stuck in the bucket of AI slop can then continue to do so and stop bothering everyone else with it.
-
Monday 8th December 2025 09:26 GMT Tron
Design out your vulnerabilities.
Your intranet (and infrastructure) should never connect to the public internet. Ditch the scams of SaaS, AI and cloud storage, which are designed to make money for GAFA at the expense of your security. Treat internet-connected systems as high risk and disposable, retaining minimal data on them, transiently. Air gap your net connected systems from your intranet with staff. Two screens on each desk. Use the larger webmail services for your company e-mail and benefit from their malware filters.
-
-
Tuesday 9th December 2025 12:48 GMT David Hicklin
Re: Design out your vulnerabilities.
> meanwhile, in the real world......
it is technically possible to do that, but oh boy will it be difficult technically and very expensive. About the only way I could see of doing that is the users would be in a form of DMZ firewalled from both the internet and intranet.
It will be a pain for all the users to do their job that pays the bills as all intranet access would have to be 2FA - you will amazed how motivated people can be to get around those pain walls.
So good luck getting around the real world and the bean counters to pay for it
Oh and getting back to the article - good luck finding an AI free browser!
-
Monday 8th December 2025 12:07 GMT vtcodger
Re: Design out your vulnerabilities.
@tron : You're likely more or less correct. Safety was not a significant concern in the original design of the Internet. They were more concerned with getting it to work. And -- judging from the ever increasing volume of CVEs and daily disasters-- the Security that has been bolted on as an afterthought looks to be far from adequate. But I suspect that the online community is a decade or three away from accepting that there is very likely no magic sauce that can make this thing safe. In the meantime I imagine "they" will continue to come up with dubious schemes that just add complexity and user aggravation without actually fixing security. While simultaneously forging ahead with stuff like AI that probably ensure internet security is truly impossible.
But by all means keep up your lonely fight. Quite possibly in the very long run, you'll have the satisfaction of knowing you were right.
-
Tuesday 9th December 2025 11:02 GMT Anonymous Coward
Re: Design out your vulnerabilities.
Please do not throw shitty pants away.
The Internet is not flat. Never has been.
Network guys know.
The problem is a lot of "security" that is widely implemented is very shallow, and that is where the problems arise...it's very shallow because modern cybersecurity is not a technical field, it's a compliance field...they do as they're told to get signed off against some set of standards or other the point of which isn't to ensure the best possible security, it's to ensure the widest level of understanding, interoperability and trust. It's dogs sniffing other dogs arses and if they smell right, they can trust them...and trust is a massive problem in security. Good security doesn't trust, it authenticates and verifies. Compliance doesn't authenticate or verify anything. It just makes sure you followed the checklist and gives you a piece of paper that says "yay, we did the checklist too!".
"will continue to come up with dubious schemes that just add complexity and user aggravation without actually fixing security"
Yes, complexity is often used in lieu of good security because it dances around the core issue of security, which is trust. Putting 9 locks on your door doesn't stop someone kicking your door in or throwing a brick through a window...but it does make people feel safer.
Cybersecurity should start at school...kids should be taught cryptography, good password hygiene etc etc...but unfortunately a society that knows how to protect itself is not a society that can be controlled...and our overlords are frightened to death of people that can do and say or organise things without them having any oversight or control.
Cybersecurity sucks because the powers that be want it to suck. Compliance isn't about ensuring that you're doing something, it's about knowing that you aren't doing something else.
Anyone here that has been through any level of compliance with regards to cybersecurity will know exactly what I'm talking about especially if you've had to dial something back in order to comply...having to implement specific cryptography, using specific approved MFA tools, setting the screen lock timeout to a specific time span etc etc...on the face of it, it seems like reasonable steps, especially if none of this stuff is already implemented, but put yourself in the shoes of a hacker or a corrupt state department or something...knowing a lot of this stuff in advance, because you complied, is a huge tactical advantage...10 minute screen timeout gives you a window to preconfigure your rubber duck to operate in, knowing which encryption mechanisms you're using or your update cadence allows you to target specific libraries / vendors for supply chain attacks etc etc...
-
Tuesday 9th December 2025 11:22 GMT Anonymous Coward
Re: Design out your vulnerabilities.
This is the guy we all spoke to on (unencrypted) IRC back in the day that claimed to have chicken wire in his walls and his PC in an airtight foil lined box to stop the CIA listening in.
I see where you're coming from, and this setup sounds very military in design...I've seen old military systems setup this way...dark side and light side...each for different designated classifications...I'd be surprised if it was still done this way because as we've seen with the likes of Snowden, it's not the tech that causes the leaks, it's people. If you can smuggle out masses of data on a micro sd card hidden in a rubiks cube then all this posturing is for nothing.
The most insidious form of control and security we've invented in recent years is DEI...comply or be labelled a fascist and be socially shunned by your comrades.
-
-
Monday 8th December 2025 09:54 GMT Dan 55
Mozilla
They could have kept the off-device AI stuff out of Firefox (AI sidebar, summary, Perplexity search) and had a point in their favour when compared to other browsers for personal and enterprise use but they considered the options and decided it was better to shoot themselves in the foot again.
-
-
Monday 8th December 2025 16:26 GMT munnoch
Re: or a wrong flight might be booked
I just booked flights on some dodgy website referred by flightscanner. Honestly I must have had to click through a dozen pages of dark patterns trying to upsell me everything from insurance to automatic check in. What are the chances of an automated agent getting through that shit-storm without taking out a lifetime subscription to Encyclopedia Britannica along the way?
As it was I did opt for their optional "prime" subscription in return for 20 quid off. Supposedly cancel within 21 days from the account page to avoid the annual charge. All the account page does is direct you to call a phone number -- speak to a human! The AI powered live chat also directs you to call the phone number - speak to a human! The phone number answers with an AI agent which once it confirms your identity and that you want to cancel puts you on hold so that you can -- speak to a human! The human who finally answered then spent 5 minutes trying to sell me on the prime advantages. Nope, not interested, cancel me. Ok, we can offer you an 80% discount, instead of 100 quid it will only be 20 quid and we'll throw in some vouchers too. So that's me flat except I have punted the pain of cancelling it 12 months down the road. Now that I think about it, I'm an absolute idiot for having squandered this chance to get out.
So there's an indictment of the state of AI. Its still not good enough to negotiate discounts as a bribe to keep your business. No doubt we will look back on theses halcyon days with great longing for when it was possible to -- speak to a human!
-
Monday 8th December 2025 22:16 GMT Gene Cash
Re: or a wrong flight might be booked
> I have punted the pain of cancelling it 12 months down the road
Which you will totally forget to do, and BANG, they will have made their money.
It's like when you get arrested and have to keep saying "I want my lawyer" - you have to keep saying "I want to cancel" and never ever back off.
-
-
Tuesday 9th December 2025 11:30 GMT Anonymous Coward
Re: or a wrong flight might be booked
Not really. Of all the subscriptions you can get stuck in, Prime is probably one of the few that is actually reasonably good value for money.
I've never regretted my Prime subscription.
Netflix, Disney Plus...these are subscriptions that I regretted. Absolute piss poor value for money, it's like sponsoring your own indoctrination.
-
-
-
-
-
Tuesday 9th December 2025 04:55 GMT David 132
Re: The best use of AI
Over many years' career at a certain very large tech company, I had to complete a stack of mandatory trainings each year: Anti-Corruption, Compliance, Ethics, and so on. My managers (who were, without exception, great people) and I derived a lot of entertainment from me coming up with an explanation of how I'd done the training, and ticking as many "violation" boxes in my explanation as possible.
I think by the end, it was something like, "Yes boss, I bribed the underage son of a North Korean government espionage agent in embezzled Bitcoin to do the training for me by posting it on the public Internet and promised him an internship in return". Or words to that effect. The aim was to show that I had, actually, absorbed the details of what behaviours were verboten :)
Yes, my bosses had my sense of humour. Fortunately!
-
Tuesday 9th December 2025 09:57 GMT Sam not the Viking
Re: The best use of AI
I had to respond to the boss's PA's round-robin email: "Where will you be next week?"
I spent far too long creating ideas of where I hoped to be: some sun-drenched, sandy, shore near the beach-bar, accompanied by...... You get the idea.
She was quite sorry when I left, losing not just a highly skilled engineer (YMMV) with a simple imagination, but someone with an escape-plan.
-
Tuesday 9th December 2025 12:57 GMT David Hicklin
Re: The best use of AI
> I had to complete a stack of mandatory trainings each year: Anti-Corruption, Compliance, Ethics, and so on.
Yup we got the same, thankfully they mostly had an option to just take the test without having to wade through the whole thing. Everyone had screenshots of past tests but you had to read them carefully as sometimes they turned the meaning of the questions around
Just about everyone was a total waste of time for us, sure those in purchasing, sales, dealerships etc but the grunts making the stuff ??
-
Tuesday 9th December 2025 20:58 GMT David 132
Re: The best use of AI
Ah yes, the "Test Out" option - "You can skip straight to the test at the end, but if you fail to score 80% or more you will have to sit through the training in full..."
My pet peeve about those trainings was that the creators always felt that presenting the content as role-play scenarios was a good way to make the training more "interesting".
Having to watch a series of mini telenovelas ("Amir is in Marketing. His colleague Shauna has come to him with a great idea for boosting Q3 sales. Watch and listen as they discuss it at length, then choose whether you think Shauna's idea is compliant...") that took 5 minutes to communicate a point - "don't offer kickbacks" - that could have been communicated in one bullet point, was tedious in the extreme.
-
-
-
Monday 8th December 2025 22:44 GMT El.Mich.
In 1990 (or '91?), whenI had read Ray Kurzweil's "The age of intelligent machines", ...
... I THEN had thought, that I had read one of the best books I had ever read at all. And I really had had high hopes for humanity, earth and everything else and was really looking forward to great things to come ... ;-)
Boy was I wrong, as nowadays, as, at least according to some, something at least resembling something like AI finally seems to arrive in reality and messes with nearly everyone's life at least I nearly do my utmost to avoid this crap wherever I can. And I am pretty certain that if not AI as such is going to kill us, at least the accompanying continuously heightened energy consumption surely will do this in the mid or long run. Like WTF! :-(
PS:
If this were not enough I can as well recommend Clifford Stoll"s classic "Silicon Snake Oil: Second Thoughts on the Information Highway " from 1995 ... :-(
-
Tuesday 9th December 2025 00:22 GMT Nate Amsden
how long until
Chrome has this kind of stuff assuming it doesn't already? Reminds me of recent comments from cloudflare saying people can't block Google's AI scrapers without blocking Google's basic search scrapers.
No AI anywhere in my life yet anyway. Don't have a need for it. Not ruling it out forever. Wife says she plans to start to talk to AI soon, after a close friend says she talks to AI all the time, and her cousin's husband is obsessed with talking to AI. Kinda scary really.
-
Tuesday 9th December 2025 09:56 GMT Northern Lad
Just needs a couple of AI to go wrong on the wrong systems that lead to a major incident possibly causing loss of life that potentially affecting a lot of people for society to realise that AI may not be all that good after all.
Then again, as Chris Barnnet (ExplainingComputers.com YouTube), AI will make people dumb.
-
Wednesday 10th December 2025 15:53 GMT Freddie.Ramsey
I think it's impressive that we have already reached the point of agentic AI but I do think that these recommendations should not go unnoticed. Allowing AI to have access to your sensitive user data – such as active web content, browsing history, and open tabs – is definitely a breach of privacy and we have no way knowing how AI stores and tracks this data. Educating users is the best practice and I wonder how companies will adopt these policies as generative AI continus to evolve towards AGI (and the potential singularity).
Biting the hand that feeds IT
