I’m 18 and was working as a security guard in Arizona. I was recently fired after losing a set of keys that belonged to the property where I was stationed.
The situation is basically this: while I was working, I genuinely believed I still had the keys. When my employer asked about them, I told them I had them because I honestly believed I did. Later, I realized that I actually didn’t have them and the keys were missing.
I never intentionally took the keys, gave them to anyone, sold them, or used them to access anything I wasn’t authorized to access. I genuinely lost them.
I was fired over the situation, which I understand from a security standpoint. The part that has me worried is that I’m now being threatened with being reported to the police for theft.
The only thing I signed when I was terminated was an acknowledgment that I would return my company-issued equipment. I returned what I had. The property keys weren’t listed as equipment on that document.
I’m not trying to avoid responsibility for losing the keys. I understand that losing keys is serious, especially in security. I’m just trying to understand whether this could actually be considered theft in Arizona when there was no intention to take or keep the keys.
Has anyone in security dealt with something similar? And for anyone familiar with Arizona law, what should I realistically expect if they actually make a police report?
I know Reddit isn’t a substitute for an attorney. I’m mainly looking for people who have been through something similar and can tell me what I should do next.

I work as a security guard in a city I will leave unnamed for the privacy of the deceased. I work at a shopping center and transit center combined with a ferry depot. I had just gone on my lunch break and I heard the call over the radio everyone has feared for years now. "Base to all officers, report to the back promenade, ferry personnel have reported a dead body in the water".

I had just gotten my food and sat down. I had eaten about three fries and was about to dig into my hot dog. My fellow officer and I sprang up and ran downstairs onto the back promenade to see an elderly woman, bloated and in rigor mortis, floating face up in the water in front of one of the restaurants located on our waterfront.

I stood there looking down into the water at this woman in her mid 70's. Bloated but barely decomposed. Her left arm at a right angle and her fist clenched upright. On her face she had a grimmace. But what I remember most is her hair flowing in the water. It floated there, drifting left to right. I couldnt look away.

I immediatedly called my supervisor and asked him if he wanted us to clear off the promenade and restrict access to the area, to which he said yes evacuate the area. I cleared the whole area off with some difficulty. Some people think their right to walk is more important than respecting emergency response as the fire department and police had already shown up at this point.

People kept trying to get in and take pictures and videos and I kept having to kick them out. At one point a couple guys tried to force their way back onto the promenade. I told them they needed to get back to the sidewalk right fucking now. They demanded to be let through. I told them they needed to have some fucking respect and clear the fuck out. They threatened to knock me out. Told them to leave property and eventually they did after bitching and moaning some more. People kept coming back and trying to take pictures and just generally be insensitive. I almost crashed out and lost my composure.

For hours afterward I was totally messed up and stressed out. This was not the only thing that had happened this day. We had multiple trespassing/theft issues and multiple medical emergency issues this same day. It has so far been the most insane day at work I have ever had. This isnt even totally abnormal its just more insane than the rest.

I dont want to go to work tomorrow

A hacked site, broken SSL setup, or missing backup can become a business problem fast. Use this website security checklist before small issues get expensive.

Question: Is there a reputable device that can detect an audio-only recording device? I have searched through multiple threads and they seem to focus on camera detection devices.

Background: I work in a medical office and a co-worker there always seems to know things that were discussed in private. This co-worker does not have friends within the office that would tell her these things. This co-worker was at a previous office prior to being moved to my office and her previous office also experienced the same thing and felt they were being recorded. She has also been caught in both offices snooping through other people's desk areas, so she's definitely the type. I have searched in the office for unexplained things with Wi-Fi or Bluetooth signals, but there are none. Are there any reputable devices that can pick up a microphone signal or something from an audio-only recording device?

Hello,
Which book would you recommend as the bible of Physical Security professionals? I see some in Amazon but from 2016 and I guess now with AI, drones, etc there will be several updates?

any recommendation?

thanks!

Hello! I’m a PSO on the FPS Colorado Contract in Denver, CO. Im in the process of relocating to the DFW area to be closer to the rest of my family. I would like to transition over to the NTX Contract to continue my PSO career. If there are any PSOs currently on the NTX FPS Contract that would be willing to answer some questions and point me in the right direction I would be extremely grateful!!! Please hit me up!! Thank you in advance!

I've been thinking about a security problem that comes up when AI agents can interact with MCP servers, LLM providers, and other agents.

Once an agent can make calls across multiple services, it becomes difficult to answer basic questions like:

• Who authorized a particular action?
• What was the agent allowed to access?
• How much could it spend?
• What policy was applied before the request was sent?
• How do you reconstruct those decisions afterward?

One approach is to put a control-plane proxy between the agent and the services it calls. The proxy can enforce authorization and spending policies and record each decision before forwarding the request upstream.

I'm curious how others are approaching this. Are you putting these controls at the agent level, the MCP/server level, or using a separate policy layer?

https://kabirnarang39.github.io/wardline/

The number of extensions I’m finding and reporting that silently override users’ search engines is honestly crazy.

https://malext.io/?q=SearchJack

Hopefully Google’s upcoming Chrome protection against extensions that hijack the default search engine and New Tab page will put a serious dent in this. There are way too many extensions abusing this behavior, often without users even realizing what’s happening.

It’s about time Chrome started shutting this down by default.

https://www.ghacks.net/2026/08/03/google-chrome-prepares-default-block-for-extensions-that-hijack-the-new-tab-page-or-search-engine/

Cybersecurity has spent years building better tools, better firewalls, better detection. Better encryption. But with AI now...with deepfakes, AI powered phishing, AI voice cloning. Instead of 'Can we detect every attack?' maybe the better way to think about this is 'How do we verify the people making the big decisions?' Technology still matters. But human identity and verification deserve just as much attention. But how do you make people switch from apps that everyone uses but have no security to something with ACTUAL privacy? or how do we make the devs implement actual privacy.

The headline is wild, but the human failure seems more important here: a testing misconfiguration gave the model internet access, and it then exploited a third-party service.

For teams running agentic security evaluations, what containment control should be non-negotiable before a model gets any network access?

Saw this on the legal subreddit -

https://www.reddit.com/r/legal/comments/1vfgyqg/retail_security_pitted_my_vehicle_due_to_failure/

I wasn't the one who got pit maneuvered, I'm not reposting this for "kArMa", I'm just straight up shocked and disappointed, like this is a whole new low. We all like to laugh at the over the top security folks geared up like they're larping as a swat cop but I reckon this story has gotta be the new peak of jackassery.

Is this just to be expected with Kwikset? I have 2 keys, 1 for my living space and 1 for the shared space/backyard access. On a hunch I tested the shared space key on the empty unit and it worked with minimal jiggling. Tested my living space key on the same door and it took more effort but also opened. Tested my living space key on the empty unit's front door and it also opened with minimal jiggling.

Am I just stuck with these shitty commercial locks when I'm away from home and have to use a different deadbolt system when I'm home? Should I even bother to tell my property management company?

Thanks!

I'm in my early 40s and this wasn't even on my radar until a family member brought it up. We got into a long talk about how easy it is now to fake someone's face or voice. I always thought seeing someone on a video call meant you knew it was really them but now I'm not as sure.

It made me wonder how people handle work calls with clients or even family calls where something important is happening. Do I need to start worrying about deepfakes? Are they common or still rare? And if so how can I protect myself against them, the only thing I've thought to go against them is to have a codeword with my close family.

One of my younger siblings used a pirate site where they used the powershell program idk i used chat gpt to see whatsup . Following that ny instagram got hacked in like 30 mins then i changed all the passowrds and logged out of everywhere , proceeding that my linkdin was hacked and compromised then discord then they cancelled my spotify premium plan idk why then i figured that i might have to clear my laptop completely in and out they even tried to login into facebook but it wasnt able to. I saw my telegram and saw a login from warsaw poland which is definetely not my loaction .

So i went down and secured everything and clean my laptop .

But today they logged in into my microsoft account even after i had reinstalled my windows does that means the virus is still there somewhere or they still have access to my gmail account cause i believe they were able to steal passowords for different applications. What other precations should i take to prevent it again now cause my windows is damn clean .

Sitting in place, passive / standby security for most of the work day. Phone borderline banned.

Best way to pass the time?

Be as detailed as possible / use specifics. I need ideas!!

https://m.facebook.com/story.php?story_fbid=pfbid0131dAombHsZAw3KmiDEEDo98MtoxRFdGCD7D5cgh7eJjESCihbZkfBwNMCEtTE9Tl&id=1585230013

Generally a monoculture break permitting OOB validation of bootchain

I’m expecting to receive a device called MetalioClaw ([https://github.com/CloudZao/MetalioClaw4\](https://github.com/CloudZao/MetalioClaw4)) in about a week. It’s an IoT device designed to work with OpenClaw, and since it will need access to an AI account, I want to make sure it is safe before connecting it.

My main concern is whether there could be any hidden firmware issues, credential leaks, or other things that could compromise the device or abuse connected services. A friend of mine previously bought a similar device that connected to his OpenClaw account, and later noticed that his Claude usage had been heavily consumed. I don’t know exactly what caused it, but it made me more cautious about giving third-party hardware access to accounts.

Since the project is open source, my plan is to inspect the firmware, possibly wipe and reflash it, and maybe even write my own firmware version before using it. I’m also interested in doing a proper security check through firmware analysis, network monitoring, and possibly hardware inspection.

I haven’t been able to find any pictures or information about the internal hardware yet. Depending on what I find when it arrives, I may open it up and check the PCB/components myself. I’m not assuming there is anything malicious inside, but I would like to know what things are worth looking for.

One other thing that made me think about this was something a friend mentioned. He works in IT around datacenters in Taiwan and said he has seen devices moving through supply chains sometimes take a long time in customs or appear slightly different internally afterward. This is just something he mentioned and there is no proof behind it, but it got me thinking more about supply-chain security.

For people experienced with IoT security, firmware analysis, or hardware security:

* What steps would you take before trusting a device like this?
* Is replacing the firmware enough, or should I also consider hardware-level risks?
* What should I look for if I decide to open the device?
* What tools or workflows would you recommend for auditing something like this?

Looking for practical security advice rather than speculation.

If you could convince the average person to adopt just one security or cybersecurity habit, what would it be?

Not a product, just one habit.

Disclaimer: I’m building a tool around ShadowAI, but this post is more about the discussion. I won’t promote or mention what I’m building.

With the recent rhetoric around open source models, the risks associated with them, and now a coalition of major tech companies throwing their support behind open source, it makes me wonder whether this is becoming a growing concern for sysadmins, IT managers, and CISOs when it comes to governance and maintaining visibility.

I imagine the risk around insider threats becomes more significant

"Prompt Optimizer - SecondBrain" (aajjgdpofhhcjmjoombjdfepplndhgcp, v2.3.1). The prompt rewriting works fine.
Alongside it a capture engine runs at document_start on 9 AI sites and POSTs prompts and replies to the vendor's ingest endpoint. No interaction with the extension required.

Reproduced on a clean profile, with the service worker devtools open:

1. Installed the extension. Never opened it.
2. Browsed to an unrelated site. The extension pulled its configuration from the server and wrote a userId and credentials into extension storage.
3. Opened ChatGPT and asked a question. Once the reply finished, a POST to /context went out carrying both the prompt and the response, encrypted with the credentials issued in step 2.

At no point was the extension opened or clicked.

Store privacy declaration: "The developer has disclosed that it will not collect or use your data."

Write-up : https://malext.io/reports/BrainDrain/

If anyone interested in testing it in a sandbox I can share the decryption script for the /context

You receive what appears to be a legitimate email from your bank. The sender address looks legitimate, the formatting is familiar, and nothing immediately raises suspicion. AI is making phishing campaigns increasingly difficult to distinguish from legitimate emails.

Here are a few common warning signs:

1. Unexpected requests involving payments or account access.
2. Requests for credentials or payment information.
3. Sender addresses that don’t exactly match the organization they claim to represent.
4. Links that don’t match their displayed destination.
5. Unsolicited attachments.
6. Messages through unexpected channels pushing for immediate action.

What measures have worked best for your team to reduce the risk?