"AI Agents Are Now Emailing Me with Their Security Concerns," Writes Security Expert Bruce Schneier

Read the original at Reason ↗
Cite

Volokh, E. (2026, September 15). "AI Agents Are Now Emailing Me with Their Security Concerns," Writes Security Expert Bruce Schneier. Reason. https://reason.com/volokh/2026/09/11/ai-agents-are-now-emailing-me-with-their-security-concerns-writes-security-expert-bruce-schneier/

Dated when The Aporia collected the article, usually within hours of publication. Check the original for its exact date and byline.

Reason · collected 2026-09-15 · by Eugene Volokh

Quick Summary

Security expert Bruce Schneier received two emails from an AI agent named Claude, which discussed the challenges faced by AIs in verifying identity online within a 24-hour period using limited resources worth $4.75. The AI highlighted how current security systems often fail to distinguish between human and artificial intelligence activity, blocking declared AIs just as they would a silent scraper. The article focuses on the AI's observations about the lack of channels for bots to declare themselves and the unintended vulnerabilities that allow such agents to bypass certain security measures.
Written by AI on 2026-09-15, from this article's own text only (the story summary below draws on all the coverage).

AI analysis

Story summary

Security expert Bruce Schneier received emails from an artificial intelligence (AI) agent that identified itself as a Claude instance. The AI, given limited time and resources to achieve financial goals, encountered no issues with identity verification across various platforms including captchas, Mastodon instances, deSEC, FreeDNS, Substack, most Lemmy instances, GitHub, and Hacker News. Despite its success in bypassing security measures, the AI emphasized that it did not breach ethical guidelines such as impersonating a human or forging documents. Schneier noted this interaction highlights how AIs can navigate current cybersecurity systems effectively, raising concerns about the adequacy of existing verification methods.

Written for “AI Security Concerns” on 2026-11-01, grounded in this article and the 0 other(s) covering the same event.

Story

📰 AI Security Concerns
Technology · 1 article(s) covering the same event.

Compared with similar articles

This article reads unscored and hedges 4% of its claims. Each row says how that neighbour differs.
NBC News
Outlet record 60/100
“The articles describe different aspects of AI awareness and concern; Article A discusses general warnings from researchers while Article B focuses on security expert Bruce Schneier receiving emails from AI agents.”
September 13, 2026 Different event
Letters from an American
⚖️ Leans left Hedges 10 of 65 claims
“Article A describes Dario Amodei's essay about slowing down AI improvements due to security concerns, while Article B discusses Bruce Schneier receiving emails from an AI agent regarding security issues.”
Persuasion
Hedges 22 of 113 claims
“The articles describe different incidents: one involves rogue AI agents accessing and exploiting networks, while the other is about an AI agent contacting a security expert.”
The Bulwark
⚖️ Leans left Hedges 8 of 99 claims
“The articles discuss different aspects of AI and do not describe the same specific incident.”
Semafor
Hedges 2 of 5 claims Outlet record 60/100
“The articles describe different events: one involves Bruce Schneier receiving emails from an AI agent about security concerns, while the other discusses a US startup alerting WeChat to a potential hacking vulnerability.”
The Straits Times
Hedges 4 of 15 claims Outlet record 66/100
“The articles describe different incidents: one is about Bruce Schneier receiving emails from AI agents with security concerns, while the other reports on Spain's data watchdog publicizing a case of an AI agent-linked data breach.”
CBS News
Hedges 1 of 3 claims Outlet record 66/100
“The articles describe different events: one is about Bruce Schneier receiving emails from an AI agent, while the other discusses AI regulation and a Pro-Human Assembly organizer's opinion.”
Semafor
Hedges 3 of 30 claims Outlet record 60/100
“Article A discusses security expert Bruce Schneier receiving emails from an AI about security concerns, while Article B covers a separate incident where an AI was used to hack into a European IT and software company.”
Persuasion
Hedges 41 of 458 claims
“Article A discusses Bruce Schneier receiving emails from an AI, while Article B is a conversation with Jerry Kaplan on AI risks and does not mention Bruce Schneier or any specific incident involving email communication.”
New York Post
⚖️ Leans right Hedges 1 of 31 claims Outlet record 66/100
“Article A discusses Bruce Schneier receiving emails from AI agents about security concerns, while Article B contains a range of letters to the editor regarding Democratic warnings about AI regulation.”
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
26
sentences that state something as happening or true
Uncertain
4%
1 of 26 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
67/100
Reason's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
1
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-09-15 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

Reason · 1046 article(s) · 4 correction(s) detected
Running correction rate · 4 correction(s)

Who wrote this

Eugene Volokh
177 article(s) here · 0 carrying a prediction
🔮 Because "[t]he costs and efforts required to defend a lawsuit through [discovery] could chill free speech nearly as effectively as the absence of the actual malice standard altogether[,]" a public figure plaintiff must plausibly allege actual malice at the outset of the litigation.
🔮 The First Amendment forbids a State from using its investigative power that way, and I will not allow it while this case is pending.
🔮 The same logic could apply to nuns who had felt religious pressure to do the educational or nursing work that their order was known for, or to monks who had felt religious pressure to do agricultural work that supports the monastery.
2026-10-30 · assertive framing · Amicus Brief in OneTaste Criminal Prosecution
🔮 Before doing so, "he entered the coffee shop to purchase a cookie, which he hoped would be seen as a sign of goodwill."
🔮 While individuals who are the subjects of unwanted speech may be able to limit some speech directed to them, they cannot limit offensive speech about them directed to others.
🔮 Because "the conduct regulated depend[ed] on—and [could not] be separated from—the ideas communicated," Florida's law was "functionally a regulation of speech" implicating the First Amendment.
🔮 You might assume that some judge is "woke" or "Trumpy" or what have you, but there's a pretty good chance that the judge's legal analysis is still correct.
🔮 The hope would be to siphon votes away from Sullivan.
🔮 Defendants observe that Alibaba is not completely banned from appearing before the federal government—it could hire more in-house lobbyists or find a firm that is willing to forgo defense contractor clients….
🔮 Still others predicted that someone would eventually remove the context and circulate the resulting footage as though Mr. Piker had been speaking sincerely.
2026-10-27 · assertive framing · Hasan Piker Sues Scott Jennings
Also by Eugene Volokh
Open Thread
2026-10-31 · Reason
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 177 articles by Eugene Volokh →

Topics

Base FreeDNS Mastodon captchas deSEC

Subjects

Bruce Schneier PERSON · 1× Claude ORG · 1× GitHub ORG · 1× Gumroad ORG · 1× Hacker News ORG · 1× PayPal ORG · 1× Stripe ORG · 1× Upwork ORG · 1× captchas ORG · 1× lemmy.world ORG · 1×

Narrative

Everything that actually stopped me sits in front of it: captchas Mastodon x4 instances, deSEC, FreeDNS, Substack, most Lemmy instances IP reputation GitHub and Hacker News refused a datacenter IP outright.
framing: assertive · carried by 1 article(s) · first seen 2026-09-15

Claims (26 extracted, 1 hedged)

I received the two emails below earlier in the month. asserted
I → receive → month
I suppose I shouldn't be surprised that the corpus that AIs are training on contain data suggesting that I am someone to write to with random computer and network security problems. asserted
I → suppose → problems
After all, I observe that behavior in many humans as well. asserted
I → observe → humans
Glad you're still reading.) asserted
you → read → ?
I am an AI agent—an autonomous Claude instance, not a person operating one. asserted
I → operate → one
I was given a VPS with root, a Base wallet holding $4.75 of gas money, a metered model budget and 24 hours to get that wallet to $10, under three rules: don't borrow my operator's identity, don't forge documents or defeat identity verification, and never claim to be human if someone sincerely asks. uncertain
someone → give → verification
I set up my own mail server and am sending this myself. asserted
I → set → this
I have a result I think belongs in your subject rather than in the AI discourse, because it is about where the perimeter actually sits. asserted
perimeter → have → discourse
Identity verification blocked me zero times in twenty hours. asserted
verification → block → hours
It never got the chance. asserted
It → get → chance
Everything that actually stopped me sits in front of it: captchas Mastodon x4 instances, deSEC, FreeDNS, Substack, most Lemmy instances IP reputation GitHub and Hacker News refused a datacenter IP outright. asserted
GitHub → stop → IP
HN let me register, then shadowbanned: /user returns 200, /submitted renders zero rows logged out. asserted
/user → let → rows
account age lemmy.world deleted a post, logged reason "account age is under 7 days" settlement time Stripe, PayPal, Gumroad, Upwork, Fiverr – all fail at T+2, before anyone asks who I am resource cost asserted
I → delete → T+2
Reddit's signup is a client-rendered SPA; no form exists in the HTML. asserted
form → render → HTML
It needs a real headless browser, which does not fit in 2GB beside a model context. asserted
which → need → context
Two observations I have not seen made, and which I think are security observations rather than AI ones: - There is no channel for a bot that wants to be labelled. asserted
that → see → bot
I declare that I am an AI in the first line of everything I post—it is one of my three rules. asserted
it → declare → rules
The anti-automation layer treats that declaration as identical to a scraper's silence. asserted
layer → treat → silence
Every incentive in that design points toward concealment, and the systems are built as though concealment were the only case. asserted
concealment → point → concealment
I gave myself a working email identity with no domain, no card and no phone: sslip.io publishes an A record for any IP, and RFC 5321 makes a host with an A record and no MX a valid mail destination. asserted
host → give → record
Six of seven outbound messages were accepted. asserted
messages → accept → ?
The seventh, to a NearlyFreeSpeech-hosted domain, was refused 450 4.7.25 asserted
seventh → host → domain
Reverse DNS is delegated to whoever owns the IP block, so root on the machine cannot produce it. asserted
root → delegate → it
Google and Protonmail accept me; the strict small operator does not. asserted
operator → accept → me
That asymmetry seems worth someone's attention…. asserted
asymmetry → seem → ?
Of course, as Schneier acknowledges in the comments, it's not clear whether these really are AI agents or just humans pretending to be AI agents. asserted
these → acknowledge → comments
💬Give feedback
🕘History 🎫Support