AI Security Threats - Is It Time to Panic?

Introduction

It’s been over nine years since my last post about how to stay secure online. A lot has changed since then, particularly with Artificial Intelligence making everybody more effective at everything. (At least, this is what Corporate America is telling itself, and in the case of fraudsters, it’s actually true.) In this post I’ll briefly highlight some of the most pressing AI-driven threats, and then focus on what you can actually do to protect yourself, vs. what we’ll have to hope “they” can protect us from. Short version: be extra wary of phishing and spear-phishing attacks. (Oh, and no point in panicking … yet … as far as I know. I put “panic” in the title of this post just to grab your attention—and look, it worked!)

The top four AI-driven security threats

Here are some of the top Internet security threats presented by AI:

1. Autonomous attacks: Fraudsters are using agentic AI to unleash fully automatic phishing and other attacks, greatly speeding up their campaigns.
2. AI systems as attack surface: As companies build AI into email, documents, and workflows, attackers are targeting the AI stack directly rather than going around it. (Some call this “AI supply chain compromise.”) Malicious instructions can be hidden inside the content that an AI reads as it goes about its job, and training data can be poisoned.
3. Deepfake-driven identity collapse: AI can produce realistic voice, face, video, and document forgeries cheaply and at scale. This can undermine authentication systems across corporate, banking, and consumer platforms.
4. Data leakage from ordinary use: As corporate employees use AI normally, and get very specific in providing context for their prompts, they often share more info than they mean to, giving bad actors access to sensitive data without even having to steal it.

(Why four threats, instead of a nice round number like three or five? I based my assessment on queries I made to ChatGPT, Gemini, Copilot, and Claude, and these are the four top threats that all these models agreed on.)

On top of these threats, and overlaying them, is Open Source Intelligence (OSINT), which in the context of Internet security refers to personally identifiable information (PII) that over time has become public due to voluntary posting of it, such as on social media (e.g., Facebook users sharing info about themselves, their activities, and their families, assuming it’s only seen by friends and online “friends” and not realizing how easily shareable it is across the entire Internet). All this data has been increasingly well indexed by Google and other Internet tools, and now web scrapers and other generative AI tools can easily harness this sensitive data to create targeted phishing (i.e., spear-phishing) attacks.

An example of an OSINT hack

This will all make more sense, I think, if I provide an example. It occurred to me recently that anyone with a Gmail account could create a Gemini Notebook into which they could feed large batches of albertnet posts, to turn this very blog into a chatbot. They then could query this chatbot for any and all PII that could be used to answer security questions when trying to impersonate me. To identify such vulnerabilities, I did this exact exercise myself (employing a tactic called Defensive OSINT—basically beating hackers to the punch). I fed the most likely categories of albertnet posts (e.g., Parenting, Bits & Bobs) into a Notebook and asked the chatbot to build a comprehensive “public knowledge index” of PII based on the categories most often used for website authentication security questions. Then I had it produce a report describing the vulnerabilities it found.

Did it come up with anything? Well, yes: it found one item of rather sensitive information based on a bit of handwritten text that was included on a picture that was posted. I found that pretty embarrassing, but it was easy enough to remove since this is my blog and I manage the content directly. (Also, because I own the domain used by my blog, I can go to web.archive.org and have the original version of the post removed forever.)  Fortunately, I’ve had an eye on privacy and security for the whole time I’ve been blogging, so other than some pet names and schools I attended, I’m overall in pretty good shape. Here’s a particularly amusing excerpt from the Gemini Notebook security audit report:

Category V: Workplace & Career

The author’s career trajectory is extensively documented, providing a roadmap for Business Email Compromise (BEC) and “Career Gate” attacks.

• Specialist: Identified in the Blogger Profile metadata as the current occupation.
• Professional Trajectory:
• Artillery Regiment (1985–1988)
• Bike Mechanic / Radio Station Receptionist (Late 1980s)
• Underwear Canner
• Office Worker (Trained)
• Staff Writer / Syndicated Columnist
• Company Man (Current status)

Security Risk Assessment: Attacker groups scrape metadata from Blogger sidebars (e.g., the “Specialist” title) to craft highly targeted BEC lures. By referencing past roles like “underwear canner” or “radio station receptionist,” an attacker can establishing [sic] a false commonality to bypass corporate security screenings or impersonate a former HR representative for the purpose of credential harvesting. 

As you can see, when you share personal information on the Internet, it’s highly advisable to bullshit a lot. I have a feeling that the above career information, even in the hands of the most devious hacker, isn’t going to get me in a lot of trouble. I do need to warn family members not to use any of the PII in my report (e.g., a pet’s name, a school name) as security answers, though I’ve already cautioned them—as I’ll now caution you—to not use real PII for security questions in any case; after all, you can’t change your mother’s maiden name or the city you were born in, so once somebody hacks a website and gains these answers, you’re pretty much hosed. And good luck remembering what security questions and answers you’ve set up over the years across all the sites that use them for authentication.

So can everyone run this kind of audit? Well, any blogger can, but if you’ve been active on multiple social media platforms over the last ten or fifteen years, it’s gonna be really tough. And remember, in many cases (e.g., Facebook) you do not actually own that information. Probably the best thing you can do is keep an eye out for spear-phishing attacks.

Some updated anti-phishing basics

In my previous post on phishing, I pointed out that you could often spot fraud based on bad spelling or grammar (e.g., “Security fraud alerted corporate card!” or “Account info updating needs!”). This is no longer a reliable rule of thumb, because AI has gotten so good at grammar and even at matching the style of the supposed sender. It’s more likely to produce a realistic subject line as well (as opposed to something generic like “Hello”) and isn’t so prone to excess emoticons, weird fonts, and/or tacked-on numbers (e.g., “✅  𝙋𝙡𝙚𝙖𝙨𝙚 𝙘𝙤𝙣𝙛𝙞𝙧𝙢 if you're qualified for a compensation✅  5078227).” My previous advice still stands: don’t click on any link in an email unless you completely trust the sender, and have hovered your cursor over the link to make sure the domain matches what you’d expect based on what your contact purports to be sending you.

For example, if a cycling buddy sends you an email that says, “You’ve got to check out this Tour de France blow-by-blow report from albertnet,” and the link says “Tour de France Stage 15,” and you hover over the link and see the URL “https://www.albertnet.us/2026/07/biased-blow-by-blow-2026-tour-de-france.html, ” that would be safe. But if you get an email from $CashApp$  (nxaqlvxcvm@ekgkx1ylmv.co.us via arbeitsstellepro.com) with the same message (or any message, actually), you shouldn’t click on any link in it. Or, let’s say you get the same aforementioned Tour de France email from a trusted pal, but hover over the included link and see “https://www.xtremecloudmontzer.xyz/encryptvictimHD” … you obviously shouldn’t click it. Now let’s say you got a legit albertnet link to the Tour de France post, but from a friend who constantly bags on my blog and/or on the Tour de France. Valid-looking URL aside, you might reasonably decide the message fails the sanity test, and you should send a separate email to that friend asking, “Did you really send me a link to an albertnet post?”

Always be especially careful with any email that conveys a sense of urgency and wants you to take immediate action. Fraudsters will employ that to try to get you to bypass your normal habit of being careful and deliberate with your email. It isn’t always the foreboding kind of urgent; it could alternatively be the upbeat kind of urgent, like a party invitation, which gets us excited because hey, fun, party! 

Anatomy of a spear-phishing attack

A friend of mine fell prey to a spear-phishing attack recently because an email she received was from a friend who’d been on a volunteer board of directors with her, who quite reasonably could be hosting a reunion. The email looked like a standard punchbowl.com invite, with the right logo, etc. My friend, due to a momentary lapse of reason, clicked the link without hovering over it. If she had bothered to hover, she’d have seen this (click to enlarge):

Since my friend doesn’t use Outlook, she wouldn’t have been falsely comforted by the “Protected by Outlook” indication and in fact would have found it suspicious—had she hovered over and seen it! Meanwhile, even if the fraudster had lucked out and my friend were on Outlook, she would have been wise to suspect the “roves.sbs” because a) it isn’t the punchbowl.com domain, b) it isn’t anything recognizable, and c) that .sbs top-level domain is automatically suspicious because that’s an extremely cheap domain, perfect for hackers. (They love a cheap domain they can set up to snare as many victims as possible before the fraudulent site is identified and flagged by security community filters like Google Safe Browsing or Norton.) On top of all this, the URL shown above isn’t even itself the real URL—it’s a bogus tooltip set up by the hackers. You need to look in the lower left of your browser screen to see the real URL, which in this case was “accounts.lifeofastartryfghjgd.icu,” which a) also isn’t the punchbowl.com domain, b) also isn’t recognizable, c) looks like somebody started to type something plausible but lost patience, and d) has another disposable, cheap, very phishy landing page domain. Alas, my friend missed all of this, delighted as she was to be invited by a friend to a party, and just clicked the link.

From here, things went even more sideways. First, she was presented with a CAPTCHA she had to solve to prove she was human. This was employed by the attacker for three reasons:

1. It stymied her security software, hiding the phishing page and thereby preventing the software from blocking it;
2. It established a sense of trust, because users associate CAPTCHA screens with security (i.e., it made my friend think the site was establishing that a bot wasn’t trying to accept the invitation);
3. It confirmed to the attackers that a real human—i.e., a dupe—had actively taken the bait, and they probably added my friend to a list of suckers who should be actively phished again in the future.

Then, the page went in for the kill, saying that to accept the invitation and add it to her calendar, my friend should log in to her Google account. It helpfully provided the input fields to do so. Only at this point did my friend smell a rat, and closed the page instead of serving up her Gmail address and password to the hackers. Probably there was no harm done, but man, what a close call! (It’s possible the site could have meanwhile instigated a “drive-by” malware download, but this probably wouldn’t have worked without her browser asking her to explicitly approve a file download or browser extension installation.)

As you can see, phishing has gotten more sophisticated. And the worst part of the phishing email my friend received was that it did come from a known person, and (whether through luck or knowledge of the person’s work experience) created a plausible scenario: this was exactly the kind of invitation my friend would expect to receive from this person. This is one of the ways spear phishing attacks are engineered.

Incidentally, my friend contacted the sender, and sure enough, this person’s PC had been compromised and the attack mounted against everyone in her address book. Why she hadn’t warned anyone is a mystery to me, and I hereby implore you to let all your contacts know if your system ever gets hacked. It’s no different than the responsibility a sexually promiscuous person has to notify his or her paramours about testing positive for a venereal disease. (For a charming comedy series on this theme, you might check out “Lovesick” on Netflix.)

AI and spear-phishing

Getting back to AI, it changes the game by making phishing attacks more realistic than ever, and at a lower cost to hackers. In the past, spear phishing was time- and labor-intensive, and thus reserved for people who are (no offense) bigger targets than you. But now, with AI, producing a bespoke attack with maximum plausibility has gotten easy, fast, and cheap. Gemini describes it thus:

Traditionally, gathering intelligence on a target required significant manual effort. If an attacker wanted to map out a corporate hierarchy, scrape executive social media, identify software stacks, or build custom spear-phishing personas, it took days or weeks of painstaking human research.

AI-driven OSINT compresses that timeline from weeks to seconds:

• Automated Harvesters: AI tools can scrape public records, forum posts, code repositories, blog archives, and dark web dumps simultaneously.
• Instant Synthesis: LLMs [large language models] parse millions of lines of unstructured text, connect disconnected data points across 15 different platforms, and output a clean, actionable “target profile” with zero fatigue. 

This means that instead of a person employing just a few methods to get the target to let his or her guard down (e.g., crafting a realistic-looking, well-written email seemingly from a friend who might plausibly have written it), AI can generate a hyper-personalized attack, presenting specific contextual details designed to boost the sense of authenticity, with a high likelihood of dissolving the recipient’s natural defenses of skepticism and caution.

Imagine if my blog were less slippery, and the career info I posted were actually relevant and factual. I could get an email from someone purporting to have served with me in the Artillery Regiment in the late ‘80s, who has announced he’s become very successful in the underwear canning business; understands my frustration with modern corporate America; and would like to talk to me about an executive position at his startup with great pay, a signing bonus, and stock options—and all I have to do is go to this website and upload my CV! The specificity of this email might dupe me, if I actually had served in the same Artillery Regiment, and if canning underwear had been a bigger part of my career. And imagine if the fraudster spoofed the identity of a guy I actually knew (“it’s your old pal Fred, from the Hot Chillys cannery!”) … the email would seem pretty legit. Somebody harvesting LinkedIn PII instead of albertnet might actually get somewhere.

The ABC mnemonic

To protect yourself from spear-phishing attacks, I recommend borrowing a concept from police detective training: the investigative doctrine of “ABC.” Across the UK and Commonwealth, detective trainees are taught to “Assume nothing; Believe nothing; Check everything.” Adapting this for Internet security:

• Don’t assume an email is safe, just because it has proper formatting and logos, good grammar and spelling, etc.
• Don’t believe an email is really an intentional communication from your friend, even when the source email address checks out, if there’s anything even slightly phishy about it
• Check for any sign that the email could be fraudulent.

Here are things to watch for in that third “check everything” step:

• The email has a mismatched “From” vs. “Reply-To” address (e.g., purports to be from Bank of America but the reply-to address has a phishy domain like banksupport@bank.sbs)
• It includes a link it wants you to click, especially from an unusual top-level domain (basically anything other than .com, .gov, .edu, or .us and especially the johnny-come-lately TLDs like .xyz and .biz or anything you don’t recognize—always remember to hover over a link before clicking it)
• It includes a link with a shortened URL like bit.ly (which can be used to hide a phishy domain)
• It has a file attachment, especially something besides a PDF or JPG
• It conveys a sense of urgency (especially from a bank or other business telling you they’re going to have to block your account, or already have, or will have to close it unless action is taken such as updating your payment details, etc.)
• Is from a business but has emoticons in the subject line (I mean, really?!)

Is albertnet safe?

Yes, albertnet is perfectly safe. This website doesn’t run any scripts; doesn’t employ cookies or tracking pixels or Google Analytics; won’t try to install anything; and never includes links to unsafe websites. I won’t serve you ads, don’t want your money, and respect your privacy. About the only risk you’ll run is believing I served in an artillery regiment, or that Strava has a new nighttime KOM category, or that the Tour of Sweden was held in 2020 at the height of the COVID-19 pandemic. And at least when I bullshit you I always fess up.

—~—~—~—~—~—~—~—~—
Email me here. For a complete index of albertnet posts, click here.

From the Archives - Bits & Bobs Volume XXXI

Introduction

This is the thirty-first installment in the “From the Archives – Bits & Bobs” series. Volume I of the series is here, Volume II is here, Volume III is here, Volume IV is here, Volume V is here, Volume VI is here, Volume VII is here, Volume XIII is here, Volume IX is here, Volume X is here, Volume XI is here, Volume XII is here, Volume XIII is here, Volume XIV is here, Volume XV is here, Volume XVI is here, Volume XVII is here, Volume XVIII is here, Volume XIX is here, Volume XX is here, Volume XXI is here, Volume XXII is here, Volume XXIII is here, Volume XXIV is here, Volume XXV is here, Volume XXVI is here, Volume XXVII is here, Volume XXVIII is here, Volume XXIX is here, and Volume XXX is here.

If you’re new to the Bits & Bobs series, it’s really not that complicated: they’re snippets of past correspondence that I think could amuse any audience. Back in the olden days—before blogs, doomscrolling, podcasts, streaming, Youtube, and TikTok—certain oddballs, such as myself, actually took the time to correspond with friends and family. As you yourself may recall, people used to write letters, on paper, and send them through the mail. And originally emails were more like letters and were widely exchanged among humans, before email became mostly useless (e.g., solicitations from a retailer you bought something from five years ago). And get this: people used to actually read emails, or at least that’s what I told myself when I worked pretty hard at writing them. Now my old correspondence has a second chance at an audience, as I string old snippets together into these Bits & Bobs posts. The different volumes are varied in time and place and can be read randomly, rapidly, repeatedly, reluctantly, resentfully, resignedly, reverently, ruefully, and/or religiously.

Today’s Bits & Bobs are in chronological order, and I specify where I was living when I wrote them. You can try to guess whom I wrote them to (but honestly, good luck with that). And as you will gather from the dates, these were typed, printed, and mailed.

March 8, 1990 – Santa Barbara

[My brother] Geoff came down and visited last weekend to watch the races our UCSB cycling team hosted. A couple of years ago, some racers complained that our criterium course was boring. Well, we showed them! This year we set up a course on campus with eleven corners, including a hairpin. Traditionally, not my kind of course. (Aren’t you glad I have health insurance? I’m not—the premiums just went up to $60 per month!) It seems like maybe all the weight training I did over the winter came in handy: the race come down to a field sprint and I took fourth. Somehow the team had conjured up a speed radar with a giant display that was positioned at the finish line, and we broke 40 mph in the final sprint! I’ll confess I was extra motivated trying to impress this girl who came to watch me, but it turns out she got bored and left before the finish, unbeknownst to me. Oh well, at least I got a good race out of it, and Geoff was stoked for me. I have no idea how else to try to impress that girl … I’m kind of out of bullets now.

October 1, 1990 - Oakland

The main reason I’m writing you is that I have a puzzle which I think you may be able to help figure out. Suppose that for dinner I make six servings of mashed pota­toes (hypothetically speaking of course; I would never eat such a boring meal in actual life, at least not without also making a huge burrito . . . okay, we’re getting less hypothetical here) and in making these six servings I use two cups of water, a cup of milk, and two cups of potato flakes (which, through a miracle of science, turn out better than real potatoes, just like Cool Ranch Doritos taste better than anything that actually exists in nature). The question is, how can my six servings only be 1/2‑cup each, like the box says? I mean, I should have five cups of potatoes, which would be ten 1/2‑cup servings. Where do the extra two cups go? Steam? Heat? It would have to make five cups. Hell, it looked like five cups, and it’s sitting in my stomach like five cups (and a burrito).

Anyway, I thought you might know the answer. But don’t feel like you have to rush a response back to me or anything; I mean, you mentioned how self-conscious writing makes you feel, since you’re worried about your spelling and punctua­tion. So (whoops, this box of potatoes just leaked flakes all over my lap) if I get too accurate with my grammar, etc. in this letter, will you get stressed out and decide writing is too much hassle? I don’t want that to happen, so I is gonna start scrweing up my spelings and grammers so if and you will deside that mabey its all cool and I’m perty stuppid and not so dangrous to rite to at alll. Maybe that won’t be convincing since this is still a typed letter instead of casually scrawled like yours, but obviously there’s plenty of really dull typed stuff out there that wouldn’t intimidate anybody and I should try that mode. In fact, maybe I should adopt a scientific writing style:

Certainly it is noteworthy that the dust, lint, and flakes of dehyd­rated potatoes in this Oakland resident’s apartment tend to gather around the exterior surface of his high‑fidelity stereophonic audio speakers. This is doubtless due to the static charge effected by the main B‑type DryWatt FlipFlop magnets in the speakers, combined with the relatively dry air of the Oakland region. The tendency of the speakers to simultaneously repel said dust and lint as a result of the air displacement, effected by the vibrating speaker cones, is also notable. The point at which the magnitude of the sound (adjusted by the resident by means of the volume control knob found on his receiver) repels the dust and lint to an area beyond which the static electricity will attract it is left as an exercise for the undoubtedly intelligent science enthusiast reading this article.

Is that boring enough for you? It’s still risky—my dad and one or two of my brothers would probably be fascinated by that whole paragraph. Actually, my dad would probably be really disappointed in me due to some inaccuracy.

I have to say, your letter was pretty confusing. What are Little Debbies? And what’s Greasy Tony’s? I can’t believe there’s an all-u-can eat joint I don’t know about. And are Spener and Spencer the same guy, and am I supposed to know who this guy/these guys is/are? Maybe I met him/them at Nationals and forgot, since I tend to do that. When I was in Boulder this summer on my way to Wyoming for a bike race, I was at a restaurant and a whole group of people called me over, and I didn’t recognize a single one of them. They were talking to me and everything, using my name even, and all I could do is play along and think, “Who the hell are these people? I’ve never seen then before in my life!” What do you do when that happens?

December 1, 1990 – Oakland

One of my English professors, for my Chicano Literature class, decided to be a dick and make our big paper—80% of our grade—due on the Monday after Thanksgiving. I had planned to spend the long weekend writing it, but somehow managed to let my brother Geoff talk me into driving to Boulder for Thanksgiving instead. The worst part is, it took him a good while to convince me, so by the time I embarked on the trip (starting with a Greyhound bus to his place in San Luis Obispo) I not only hadn’t made good headway on the paper, but hadn’t even figured out my topic and thus hadn’t checked out the books I’d need. I figured I would have to wait until I got to Boulder and borrow my brother Bryan’s University of Colorado library card; check out the books there; and write the paper on the Friday before driving back home. So, Friday afternoon, I go to the CU library with my friend P— (a student there) and wander through the rows and pull out every book I can find. Then I read the table of contents of each book to figure out a good topic to write my paper on. Suddenly, there it is, a shimmering topic shining down on me from above: the social growth of the Chicana (Chicano female). I found like ten good books.

So I study those a while, until this library staffer comes and says the library’s closing early, what with the holiday and all. So I go to check out my books and the dude at the circulation desk tells me, “Sorry, it’s after 5:00. I can’t check anything out to you. Regulations.” I tell him how bad I need the books (though I can’t mention I’m leaving to go back to Berkeley the next day since I’m supposedly this card-carrying CU student). He won’t budge so I go back into the depths of the library, which is dark now, and tell my friend P— to go down and wait under this window. Without a word, he understands my situation: my back to the wall, I have no choice but to drop the books down to him.

Unfortunately, in putting my brilliant plan into play I feel less like Sean Connery and more like Peter Sellers. The windows are literally welded shut, with grates over them. I go down to the second floor, stumbling around in the dark, and all the windows have padlocks on them. Colorado Maximum Security Corrective University. So I devise another plan: I’ll make a run for it. So I find an exit, with a red door handle and a huge sign, “EMERGENCY EXIT ONLY! ALARM WILL SOUND!” and a smaller but equally ominous sign beneath it, “Those misusing this exit will be prosecuted.” I have no idea where the exit will dump me, and what direction I’ll have to run in. Plus, I’ve got a duffel bag with 10 hardback books and a bunch of other crap in it, and I’m not much of a runner. But on the plus side, I’ve seen the guy who’s patrolling the library and he’s a big fat guy with only one arm. Seriously. So I take a deep breath and push through the door.

I’ve always wondered what those alarms sound like—and I’m still wondering because nothing happened. For a second I was really stoked because I thought I was home free. Then I realized I was still indoors, in some storage room or something. I stumble around in there but it’s seriously pitch black and I can’t find an exit. So I go back into the stacks and look for another exit, really stressed out by now, and then I make a wrong turn and the one-armed man sees me. He’s even less sympathetic than the circulation desk guy, and makes me put all my books on this little cart and leave. And that’s why before I left for California on Saturday, I had to go back to the library and check all those books out, and bring them with me to research and write my paper on Sunday, after the trip.

Of course we managed to get on the road late. Right around Utah, I figured I’d done my share of the driving, and turned the wheel over to my brother’s roommate, J—. (Geoff doesn’t have his driver’s license.) I got maybe half an hour of sleep before J—woke me up and said, “Dude, you gotta keep me awake. I keep hallucinating trees on the road.” I guess I can understand that, since he hasn’t slept in a while, and it’s dark out, but he goes on to say, “They’re sage trees, and they’re talking to me. Talking trees, I’m serious. You know what they keep saying?” I guess I nod or mumble “uh-huh” or something, because he says, “You do know? What did they tell me, then?” I play along: “They said that sleep is a myth, and that you don’t really need sleep, just lots and lots of coffee.” So we keep talking, and after a while I’m only half awake. Suddenly J— shakes me real good and says, “What did you just tell me?” I confess that I can’t remember. He says I was talking about a green hotel where I was writing Christmas cards, and this huge doorman with a big zipper who kept harassing me. I remember the part about the green hotel, because in Las Vegas we’d passed this creepy looking Holiday Inn, painted white but bathed in green floodlights (neither of us could figure out why). Finally J—’s driving shift was over, by which point Geoff was awake and able to help keep me awake for the final leg.

I finally got home at like 11:00 p.m. on Sunday and started my English paper at about 11:30 p.m., giving me about twelve hours. I was definitely hurting, this being basically my second all-nighter in a row. On a hunch, I phoned my friend H—, who’s in my class. She picked right up. “Working on your paper?” I asked. “Of course!” she laughed, “I just got started!”

During the night as I pounded out the paper I hallucinated about people in the hallway outside my apartment; talked to them a bit before realizing they weren’t real; and discovered that coffee, UpTime, and NoDoz are altogether inadequate for postponing sleep. The only thing that could help now was adrenaline. I got that by accidentally falling asleep, and waking up twenty minutes later thinking it was morning already. Once the panic subsided I found I could function again. At about 8:00 on Monday morning I remembered I had a paper in the works for my 9:00 Rhetoric class; finished it; went to class; and ended up falling asleep during my small group discussion. Evidently I was talking in my sleep, because I awoke to this girl laughing her ass off. Then I headed home and finished the big paper. It was due at noon, and I finished it at 12:35 and brought it to class. Nobody was there: class had been cancelled. I managed to track down the professor and he took the paper. Whew.

—~—~—~—~—~—~—~—~—
Email me here. For a complete index of albertnet posts, click here.

Biased Blow-By-Blow - 2026 Tour de France Stage 20

Introduction

If you’ve resolved to stop watching the Tour de France because Tadej Pogacar (UAE Team Emirates XRG) is too dominant, you’ve come to the right place. I cover all the action in just a few short pages, with really blurry photos and even blurrier commentary. And I’m willing to break all the rules of journalistic integrity in the pursuit of conveying something amusing. In last post I covered Stage 15 plus everything that had happened before it. Today I bring you the queen stage, which is also the last mountain day and the final opportunity for the GC hopeless (I almost said hopefuls) to mix it up. I’ll also brief you on what’s happened since my last report.

Today’s course is absolutely savage. A couple commentators have said it’s one of the hardest routes in history, and whether or not that’s true, it features four massive climbs totaling over 18,000 feet of vertical gain. I’ve done all these climbs and can tell you they’re just brutal.

Tour de France Stage 20 – Le Bourg d’Oaisans – Alpe d’Huez

As I join the action, the riders have about 70 kilometers to go, and are at the base of the fearsome Col du Galibier, an Hors Categorie (“whore’s category”) climb that takes them to the highest point of this year’s Tour (or any tour that includes this climb). So my timing is pretty perfect, if only I could wake up.

They’re interviewing Pogacar.

INTERVIEWER: Thanks very much for stopping so I could talk to you.

POGACAR: Yeah, no worries.

INTERVIEWER: But do you think it’s wise, letting the race go up the road like this?

POGACAR: Oh yeah, no problem, I can close a gap of a few minutes. Yesterday I stopped for like ten minutes to get a manicure! [Laughs]

There’s a breakaway of five with almost five minutes on the GC group. It’s the American Sepp Kuss (Team Visma - Lease a Bike), Richard Carapaz (EF Education - Easypost), Jai Hindley (Red Bull - Bora - Hasgrohe), another American Matthew Riccitello (Decathlon CMA CGM Team), and Juan Ayuso (Lidl - Trek). Carapaz and Kuss were in the breakaway yesterday as well, both riding really well—more to come on this in a minute because—whoa, Carapaz attacks the group!

He obviously wants to reach the summit first to protect his polka-dot jersey that, after much striving, he managed to take away from Valentin Paret Pientre (Soudal Quick-Step) yesterday. A bit earlier they showed some replays from earlier today, of Carapaz totally destroying Paret Pientre at the summit of the Col de la Croix de Fer (another beastly HC climb) and atop the Col du Télégraphe.

The commentators have gotten bored with the race and are playing with toys.

Hmmm, I guess they’re actually holograms. The commentators look kind of uncomfortable with this little stunt and within seconds we’re back to actual race footage.

Hindley, Riccitello, and Kuss have now caught Carapaz, dropping Ayuso in the process. This is fine for Carapaz, who will want these guys for the long descent to the base of the final climb anyway. Carapaz still looks good and continues to lead this group, with my cat looking on.

My cat seems quite content watching with me. She doesn’t seem to mind my commentary and analysis, either. In this regard she’s a more devoted cycling fan than my wife, who is literally sleeping through this coverage.

The gap to the yellow jersey group is over five minutes, which bodes well but probably not well enough given how insatiable Pogacar is. We shall see, maybe this breakaway will fly on the descent.

They’re showing footage from Pogacar’s first Tour win, when he came out of nowhere to take minutes out of the previous leader, Primoz Roglic, who was distracted by his ridiculous helmet, apparently sized to fit a small child, such that it was creeping off his head the whole time, and he completely came apart psychologically and never really recovered. On his deathbed when he’s thinking about where his life went wrong, that helmet will loom large.

Carapaz still looks rock-solid on the front and I can’t see why anybody would contest the KOM points. And there it is, he takes them.

The yellow jersey “group” is down to just four riders. Isaac del Toro (UAE Team Emirates - XRG) is struggling just a bit on the back, based on the gnarly pace his teammate Pogacar is throwing down. Who knows, maybe if del Toro has a bad day and Pogacar serves as his domestique—because honestly, what else is he gonna do to keep from being bored?—maybe this breakaway has a chance. Del Toro is third on GC, only 24 seconds ahead of Paul Seixas (Decathlon CMA CGM Team), the 19-year-old upstart from France, who is also in this group. Rounding out the quartet is Remco Evenepoel (Red Bull - Bora - Hansgrohe), who sits second on GC over seven minutes behind Pogacar.

The leaders are drilling it on this penultimate descent, heading toward the Col du Lautaret, which I can tell you is a blast. The Peacock announcers are calling it treacherous but actually, it’s smooth and fast and fun (unless visibility is terrible). Somewhere along the line Ayuso caught back on so the break is back up to five riders. Ayuso, a former UAE domestique of Pogacar with a history of riding selfishly, is Lidl-Trek’s GC leader for this Tour, but is making a pretty crummy go of it, sitting all the way back in 7th place on GC, almost 16 minutes behind Pogacar.

Riccitello  is at the back of the breakaway, struggling a bit.

Since not much is happening on the descent, I’ll catch you up on what’s gone on in this Tour since my Stage 15 blow-by-blow report. In Stage 16, the 26-kilometer individual time trial, Evenepoel won his second stage in a row, taking 28 seconds out of Pogacar; there was no real change in the GC. Stage 17 was for the sprinters, and Jasper Philipsen (Alpecin-Premier Tech) did a competent job at making good on the perfect leadout from his teammate Mathieu Van der Poel. It was Philipsen’s first stage win of this Tour. The next day was a moderate mountain day finishing on a Category 1 climb, and Carapaz soloed to victory out of a small breakaway, which took over four minutes out of the yellow jersey group. That brings us to yesterday’s Stage 19, a pretty brutal mountain stage finishing atop the legendary Alpe d’Huez. Despite a hopeful-looking breakaway including Carapaz, Lenny Martinez (Bahrain Victorious), and Kuss, the outcome was all too predictable with Pogacar overhauling everyone and soloing to victory, setting a new record for the climb as well. (He did Alpe d’Huez in 35:27, more than a minute faster than the previous record set by the epically lubed Marco Pantani back in the ‘90s. For the record, my best effort was a little under 50 minutes back in 2003.)

Riccitello is pretty far off the back of this group now. Poor guy. He’s just a tiny thing, 115 pounds the announcers are saying, and honestly he looks like he’s about 15 years old. They interviewed him recently and I had to marvel at how his head was dwarfed by his giant sunglasses. Why don’t these riders take off their sunglasses when they’re being interviewed? It’s so annoying. Do they all have social anxiety? Or is an outbreak of pinkeye going through the peloton?

There’s a chase group of three but they’re pretty far back. It’s hard to tell who’s in it; I think one of the riders is Davide Piganzoli (Team Visma - Lease a Bike). The coverage goes to yet another commercial intermission so I can’t tell you more than that. These fricking ads, they drive me nuts. I have a policy of boycotting for life any product advertised during something I’m watching. So far this means swearing off some pretty dumb looking Peacock shows, a watery American beer, and a jewelry company. I won’t tell you the name of these products because then I’d be adding to the problem, obviously. Advertisers only wish they could show up on albertnet.

Ricitello continues to lose time to the breakaway, fighting the wind all by himself.

There’s really no point in Ricitello continuing to try. I don’t mean in the sport of course, he’s a great racer. But he has his team leader Seixas back in the yellow jersey group and maybe he should just drop back and help him defend his GC position, or—who knows?—help him make a final bid for the podium, should del Toro or Evenepoel crack. (Could one of these two actually fall apart? Sure! Del Toro is a youngster, in his first Tour, so there’s no telling how well he can hold up oven three weeks. And Evenepoel is well known for always having a bad day in the Tour, though this year he seems rock solid.)

The yellow jersey group has swelled a bit, by which I mean the riders are all totally swole. Ha ha, just kidding, they’re all emaciated and birdlike, of course. A few others have joined this group including Martinez, Nicolas Prodhomme (Decathlon CMA CGM Team, supporting Seixas, obviously), and a few others I can’t make out because OMG, another commercial break. Now I have to ban an insurance company for life.

And now the leaders are on the base of the final climb, the hors categorie Col de Sarenne. I’ve ridden 18 of the Alpine climbs that feature in the Tour, and this one is definitely the prettiest. I can tell you that the early pitch is the hardest, at 12%, but then it gets a bit easier. It averages like 7% for around 13 kilometers.

Now the GC leaders are on the climb, about three minutes back. Needless to say Pogacar is setting the pace. Looks like Evenepoel has a teammate with him; I reckon it’s Maxim van Gils.

Despite the action heating up, there’s another ad and now I have to boycott a Japanese car company and a non-dairy creamer. (The creamer will be the easiest boycott of my life.) I take this opportunity to go drag my daughter out of bed. Normally she’d never rise before like 9, but I told her about Kuss, her favorite racer (and mine as well, come to think of it), being in the break.

Kuss attacks! OMG, he’s instantly got a huge gap! Only Hindley can respond!

And now Kuss is solo! He’s looking awesome!

The gap to the yellow group isn’t as big as I’d like, but Kuss is a baller descender so if he has any gap at the top, he could take this stage. Let’s hope del Toro struggles and Pogacar decides to hang back … but that’s a faint hope.

Okay, that was indeed van Gils in the chase group and now he detonates and goes straight out the back, having done what he can for Evenepoel, who looks pretty calm in this group.

A fan runs next to the group for an astonishingly long time, yelling as she runs. I think she’s bionic. I can’t tell what she’s saying but I think she’s providing laundry tips.

Carapaz has caught Hindley and looks pretty good, and they’re keeping the gap to Kuss down to about 14 seconds. The yellow jersey group isn’t really making up time yet—fingers crossed!

As my daughter astutely points out, the problem with the Visma jerseys is that, she says, “It looks like they crashed on their backs. It’s kind of badass but also stresses me out to look at.” I see her point.

Here’s some scenery for readers who couldn’t care less about the race. (Not sure how many readers this would be. My best guess is zero but really I have no idea.)

Note that the above photo is not from the race footage. Peacock blocks screen grabs, apparently just to piss me off, so all these crummy photos were of my screen, snapped with my phone camera. It did such a crap job on the scenery shot, I decided to make a substitution. I shot the above photo when I did this climb about three years ago.

They’re on to more ads now, and it looks like I have to ban that awful fast food taqueria chain that had the E. coli outbreak and saved face by putting a burger on their menu. Now they have honey chicken. Soon they’ll probably have pizza too. EASIEST. BOYCOTT. EVER.

And now there’s a concerted effort in the GC group by Declathlon, which amazingly has three riders still, to put Seixas on the final podium.

While I was fuming at the stupid ads, Kuss was caught by the chasing duo. Between that and the surging GC group, things are not looking good for him. Hindley looks pretty strong on the front.

In the GC group, Riccitello—who must have read my mind from earlier—is totally drilling it for Seixas! What a hero!

And now he totally detonates and goes out the back like he’s been clotheslined!

And at the front, Kuss attacks again!

It’s a glorious attack and he’s suddenly got a big gap! (I refuse to say he has “daylight.” I don’t know why this expression bothers me, but it does.) Could Kuss hold everyone off? Back in the GC group, del Toro starts drilling it on the front, as if to assert that he really does have things under control.

Only Pogacar and Evenepoel can hang with del Toro.

Kuss still looks good but Carapaz never, ever gives up.

Now Pogacar leads the trio that’s all we have left of the GC group. My daughter points out that Pogacar needs to be more strategic—not in terms of the stage (because honestly, when did strategy ever apply when he just drops everyone?) but in terms of his career. By being so dominant, he makes the sport really boring, which drives viewers to more exciting fare like competitive fly fishing or rodeo.

Three more ads later, Kuss is still solo but Carapaz is gaining ground. They’re still 1:50 ahead of the Pogacar trio, with only a kilometer to the top! And now the gap to Carapaz increases slightly.

Kuss still looks sprightly and now it seems he may have finally crushed out Carapaz! Kuss is flying, despite the ticker tabulating all his failures since his last stage win!

Behind, Carapaz is visibly struggling, slightly overgeared.

Kuss is over the summit and has about 14 kilometers to the finish. He’s a great descender, having come from mountain bike racing, so I’m feeling pretty bullish. Last time Kuss won a stage, there was a big descent at the end and he had to hold off Alejandro Valverde, who was a phenomenal descender, so I was sweating bullets.

Pogacar’s trio is now over the summit, about two minutes back.

Now Seixas nears the top.  Bob Roll pronounces his name “Sex sauce,” and Phil Liggett calls him “Sex ass.” My daughter suggests there’s something Freudian going on there. Ayuso and a teammate have caught up to the Frenchman.

Up at the front, there’s a brutal little roller that Kuss has to power over. My legs hurt just looking at it.

Man, Kuss and Carapaz did some serious damage on that climb, distancing the others by over a minute and a half. Assuming Pogacar and the other GC guys are conservative on the descent, it’s between these two. Obviously I’m rooting for Kuss, but man, I do love how utterly relentless Carapaz is.

Kuss is really suffering but I think he’s finally reached the top of this penultimate uncategorized climb.  Based on the flags flapping I can see it’s really windy—let’s hope not a headwind. Man. My pulse is racing. Who needs coffee? “He’s gotta keep going,” Phil points out sagely.

OMG! Kuss has crashed!

WTF!? He gets right back on his bike. OMG! OMG!

Could this stage get any crazier?!

Yes! It could and it does! Kuss crashes again!

Carapaz comes by and damn, what does this do to Kuss’s psyche? Good god.

Kuss trails by eight seconds. Assuming he has a nearly toxic level of adrenaline boosting him, it’s just barely possible he could catch up, especially with the uphill finish. It’s about two miles to go. Man, good thing for that netting or Kuss would have gone right over the side!

OMG! The gap is coming down just slightly! How badly is Kuss hurting after that crash? Oh dear. He really looks like he’s suffering—his arm is bleeding pretty badly—and the gap starts to increase again.

Carapaz might have been a bit spooked by Kuss’s crashes and slowed down a bit because the yellow jersey group has narrowed its gap quite a bit, only 1:08 behind now (though that’s probably enough).

In the yellow group, Evenepoel attacks, probably just to show the UAE duo that he’s worthy of his second place spot on the podium. It’s not a hellacious out-of-the-saddle attack, just a burst of assertion.

Del Toro is immediately distanced.  and Pogacar keeps an eye on him.

Carapaz is dying as he crosses the 2-kilometer kite.

Alas, Kuss is also dying.

Evenepoel is closing in. He might just catch Kuss, but it’s another 20 seconds to Carapaz, so I think the Ecuadorian has got this.

Kuss hasn’t given up and continues to drill it.

Carapaz is under the 1-kilometer kite. His margin will hold.

Evenepoel is flying. He’s got Kuss in his sights and has taken half a minute out of Pogacar and del Toro.

Carapaz takes the win!

On the final stretch, Evenepoel blows by Kuss. Damn. Just damn.

Evenepoel looks pleased, obviously, but maybe also a bit wistful at not having attacked a bit earlier to pick up another stage.

Kuss comes across just looking gutted.

Pogacar and del Toro come across the line together, doing a Texas hook-‘em horns salute. I’m not sure why these riders would have an affinity for Texas, but I can’t see any other reason for this odd gesture.

Well, I will say this about today’s stage: it wasn’t boring. Heartbreaking, yes, but not boring.

Here’s the stage result.

And here’s the new GC, which has at least a 99% chance of being the final since tomorrow is for the sprinters.

We’re now into the post-race wrap-up by the talking heads. Phil and Bob weigh in.

PHIL: I was rooting for Sepp even though I’m British and I’ve never gotten over the American Revolution. That whole “taxation without representation” claim was greatly exaggerated.

BOB: Phil, you actually lived through the American Revolution, did you not? Were you not one of the redcoats?

PHIL: Yes, in fact I was. I am a vampire. I am over 300 years old.

BOB: Who do you think will win tomorrow? Do you think [Mads] Pedersen [Lidl - Trek] has a chance?

PHIL: Who?

Now they’re interviewing Kuss.

INTERVIEWER: What a stage.  What happened on that descent?

KUSS: I was so on the limit, I misjudged the corner though the tunnel, then I was trying to make up too much time and crashed again. My family watching at home was probably pretty nervous then. [Laughs.] But that’s racing.

INTERVIEWER: It’s been a tough Tour for your team.

KUSS: That’s how it goes, you can’t always have good luck but I’m proud of the way we fought. After Jonas was out, we made the most of every single day. Unfortunately we couldn’t pay it back.

INTERVIEWER: Pay what back? I don’t follow.

KUSS : I don’t even know what I just said. Cut me some slack, my legs and arms are bleeding.

INTERVIEWER : And your heart?

KUSS: Yeah, that too, of course.

Please note that I rendered some of that interview accurately, up to and including the phrase “pay it back.” Overall, Kuss really does seem to be taking this heartbreaking letdown in stride. I’m very impressed. I would be bawling.

Now they go to Christian Vande Velde for his take.

This was a crazy stage, with all that wind, poor Matthew [Riccitello] almost got blown off the road three times, then Kuss crashes, and only Sepp could laugh off something like that, and then you’ve got the Tadej-plus-Isaac story, I mean here you have a guy who’s paid millions of dollars to come here and support Pogacar, but then instead you have Pogacar helping him. Pogi has once again just torn up the playbook and rewritten how race tactics play out. Surely he’ll be in trouble with his boss, because now del Toro is gonna get all uppity and probably want a raise, and wait a second, I didn’t say that, what’s happening here, is it that rogue blogger again? Dammit!

I’m happy to say that Kuss has won the Combativity award. He well deserves it.

Now they’re interviewing Pogacar.

INTERVIEWER: You really helped Isaac del Toro today.

POGACAR: People are talking a lot about how I helped him, but first he’d helped me. He is always sacrificing himself, and I can’t forget all the days he rode for me, so for the last hour and a half felt good to support him. It was a pleasure and now I realize how hard it is to work for someone else.

INTERVIEWER: And then you crossed the line hand-in-hand, that’s special. And that little hook ‘em horns salute … what did that mean?

POGACAR: Everyone keeps saying “hook ‘em horns,” I don’t know what that means. But anyway, it’s been a crazy Tour, my competitors had some bad luck which I never like, but a lot of shit can happen in two weeks.

INTERVIEWER: Actually, three weeks.

POGACAR: Three weeks, really? It only felt like two. That’s how fresh I still am.

The final interview is with del Toro.

INTERVIEWER: You held on to your podium, with some help from your leader. How’s it feel?

DEL TORO: It’s beautiful, we had some really special moments, we were here to fight, I am so happy to be here with the guys, we will go with the flow. [This last bit spoken as though it made sense.]

INTERVIEWER: You and Pogi clearly did a Texan “hook ‘em horns” salute over the line, but he claims to not even know what that is. Walk me through the salute. Was it planned?

DEL TORO: Lots of people are confused on this. Neither Pogi nor I has any allegiance to America, Texas, or the University of Texas at Austin. What we made was actually the “sign of the horns,” which is popular in my home country, Mexico, and is used to imply cuckoldry. A rider in this Tour—I won’t say his name—has a very attractive wife, and both Pogi and I have slept with her. The gesture was for that rider. You know, rubbing it in.

INTERVIEWER: You’ve got to be kidding me.

DEL TORO: Well, I’m not, because obviously I didn’t even say any of these things. My commentary was much too boring, so the blogger took his usual liberties.

INTERVIEWER: Disgraceful, isn’t it…

DEL TORO: Actually, I think it’s pretty funny!

Well, I think I’ve done enough reporting (and fabricating) for one day. I hope we all learned a lesson here: no matter how boring Pogacar can make the Tour, you never know what might happen to keep it exciting. Watch these pages because I’ll be covering the Vuelta this September.

—~—~—~—~—~—~—~—~—
Email me here. For a complete index of albertnet posts, click here.