You're listening to the Cyber Wire Network, powered by N2K. Five Eyes agencies issue agentic AI guidance. A federal database leaks social security numbers. A stealthy worm poisons open source packages. OT firms are sidelined from frontier cyber models. The FBI warns of a surge in cyber-enabled cargo theft. Officials flag likely election interference as security programs face cuts. Researchers uncover a covert Python backdoor. Ubuntu's site takes Iranian-linked DDoS fire. Cyber pros are sentenced in a ransomware case. Our guest is Andrew Carr, global head of threat management at Booz Allen, discussing how AI is accelerating cyber attacks. And OpenAI joins the invitation-only club.
It's Friday, May 1st, 2026. I'm Dave Fittner, and this is your CyberWire Intel Briefing. Thanks for joining us here today. Happy Friday. It is great, as always, to have you with us.
Agentic AI can automate useful tasks, but new multinational guidance warns it should be adopted cautiously, especially in critical infrastructure and defense. The guidance, co-authored by cyber agencies from Australia, the United States, Canada, New Zealand, and the United Kingdom, says agentic systems can reason, plan, use tools, and act without constant human oversight. That autonomy creates risks beyond traditional generative AI, including prompt injection, excessive privileges, identity spoofing, rogue agents, cascading failures, opaque decision-making, and data exposure. The agencies recommend limiting agentic AI to low-risk, non-sensitive tasks, aligning controls with existing cybersecurity programs, and avoiding broad access to sensitive systems. Key safeguards include least privilege, strong identity management, sandboxing, phased deployment, human approval for high-impact actions, continuous monitoring, red teaming, logging, and rollback plans. The central message? Prioritize resilience and containment over efficiency gains.
The Centers for Medicare and Medicaid Services, CMS, inadvertently exposed Social Security numbers of some health care providers in a database supporting a new Medicare provider directory, according to the Washington Post. The publicly accessible database, intended to improve transparency and help seniors identify participating providers, contained sensitive identifiers linked to names. The exposure lasted several weeks before officials removed the data after notification. CMS said the issue resulted from providers entering information incorrectly and stated safeguards are being strengthened. The directory is part of a broader modernization effort led in part by Amy Gleason, but it's faced accuracy concerns and criticism from Jeff Merkley and Ron Wyden. CMS Administrator Mehmet Oz said improvements will continue to support informed coverage decisions.
Mini Shai Haloud, a sophisticated worm targeting open-source supply chains, has compromised multiple ecosystems by poisoning widely used packages, including PyTorch Lightning on PyPy and the Intercom Client on NPM. The malware silently executes during installation, stealing SSH keys and GitHub Actions tokens and expanding into Packagist, RubyGems, and Go modules. Researchers at Socket, Akito Security, and Ox Security identified the malicious releases. The campaign focuses on developer machines and continuous integration pipelines, where stolen credentials enable deeper backdoor insertion into enterprise software builds. Polyglot development environments increase exposure because each package manager creates a separate attack surface. The incident highlights weakening trust in public registries and underscores the need for tighter dependency governance, internal mirrors, runtime monitoring, and software builds of material to limit supply chain compromise impact.
Operational technology cybersecurity firms have been excluded from restricted programs granting early access to advanced vulnerability discovery models from Anthropic and OpenAI, raising concerns about risks to critical infrastructure. The initiatives aim to help select defenders identify software flaws before attackers gain similar artificial intelligence capabilities, but OT vendors say they were not invited to participate. Industry representatives argue the omission reflects a cultural gap between major technology firms and smaller infrastructure operators such as utilities. Experts warn OT systems fake unique constraints, long life cycles, and different vulnerability priorities, making standard disclosure processes less effective. Programs like Project Glasswing and Trusted Access for Cyber include open-source stakeholders and researchers, yet critics say excluding OT weakens coordinated defense as AI-driven threat capabilities continue to expand across critical infrastructure environments.
The FBI warns that cyber-enabled cargo theft is surging, with hackers targeting brokers and carriers through phishing emails, fake sites, malware, and remote access tools. The schemes abuse trucking load boards, compromised broker accounts, and stolen carrier identities to win high-value shipments. Attackers may alter federal records, double broker loads, move goods through cross-docking or transloading, then sell them or hold them for ransom. Cargo theft caused more than $700 million in 2025 losses, up 60% from 2024. Army General Joshua Rudd, head of U.S. Cyber Command and the National Security Agency, told the Senate Armed Services Committee that foreign interference in upcoming midterm elections is likely, citing past activity by Russia, China, and Iran. Officials said adversaries continue relying on cyber intrusions and disinformation. The election security group has coordinated with the FBI and CISA since 2018, including operations disrupting Russian propaganda infrastructure before the 2024 election. A proposed budget would eliminate CISA's election security program, raising defense concerns.
Researchers at Securonix identified a stealthy Python-based backdoor called DeepDoor that enables persistent remote access and surveillance on Windows systems. Delivered via a batch script that disables protections such as smart screen and defender safeguards, the malware establishes persistence through registry changes, scheduled tasks, and startup folder scripts. It evades analysis with anti-sandbox checks and covert command channels, then supports command execution, credential theft, key logging, and webcam access. The tool can also overwrite the master boot record indicating potential destructive capability alongside espionage use.
Canonical says its web infrastructure is facing a sustained DDoS attack after the pro-Iran hacktivist group Islamic Cyber Resistance in Iraq, also known as 313 team, claimed responsibility. The disruption took down Ubuntu's main website and limited user access to downloads and accounts for hours beyond the group's stated timeline. The attackers also issued an apparent extortion message warning the assault would continue without contact. Canonical is working to restore services, while the motive for targeting the Ubuntu developer remains unclear. Ryan Goldberg and Kevin Martin were sentenced to four years in prison for deploying Alpha V Black Cat ransomware against multiple U.S. victims in 2023 alongside Angelo Martino. All three worked in the cybersecurity industry and used their professional expertise securing networks to conduct the attacks. Acting as Ransomware as a Service affiliates, they shared proceeds with platform administrators and extorted about $1.2 million from one victim laundering their share.
Prosecutors said the campaign targeted organizations including medical providers and engineering firms and involved leaking patient data to increase pressure. Officials from the U.S. Department of Justice and FBI said the case highlights continued enforcement against skilled insiders misusing defensive expertise for ransomware operations. Coming up after the break, my conversation with Andrew Carr, Global Head of Threat Management at Booz Allen. We're discussing how AI is accelerating cyber attacks. And OpenAI joins the invitation-only club. Stay with us.
Andrew Carr is Global Head of Threat Management at Booz Allen. We recently sat down to discuss how AI is accelerating cyber attacks and reshaping cybersecurity defenses. Yeah, so it's from a number of different facets. As far as reconnaissance is concerned, generative AI and its ability to quickly sift through and amass a summary of information has rapidly accelerated an attacker's ability to perform reconnaissance on an organization or the executive suite and provide really insightful context related to potential partnerships that they're engaging in that might help with a phishing attack. Once they get into an organization, they may already have an understanding of the tooling that's in place there. It really allows a single individual or a small group of individuals to carry out an attack that would normally take.
you know, a far longer time to carry out and far more research to be conducted. And so these generative AI tools are allowing them to kind of speed that up. From a perspective of, you know, once they actually get into the system, employing AI tooling will allow it to quickly recognize and adapt to different systems within the environment. Before, we used to see threat actors would come in with a really static script that would try to turn off, you know, everything under the sun, every tool out there for antivirus or endpoint detection response, but it was really predictable. This allows them to pivot in real time and be more thoughtful and less noisy, if you will, when they get in the environment.
I think a lot of the defenders out there are thinking that these AI tools are going to help them detect things faster. But I know you've made the point that detection might not be the key element here. Yeah. So detection is just one part of it, right? Having an alert pop up is great, but someone has to act on that alert for something to happen. Now you can put in automations and things like that, but if you put in too many, you're going to have a detrimental effect on your infrastructure. So most of the time it does require that human in the loop, but that human in the loop, if it's a tier one person that then escalated to a tier two, that really takes the time away from responding. And that threat actor might be pivoting. They might be moving throughout the infrastructure and they might already have detonated their payload. So the introduction of AI.
takes that automation piece that used to be really scripted out, used to be really static based on detection logic and rule sets and things like that. And it allows for a nuanced ability to change on the fly, to recognize changes in behavior, to take action through agentic AI that otherwise would have needed a human to perform. And it really speeds up that response time. So detection is great. And speeding up detection is obviously something we need to strive for. But responding more quickly is what's really necessary to try and stop the threat actor before they can get their hooks in too deeply. And that's where AI can help us as defenders.
What about threat intelligence feeds? I know lots of folks, it's an area where there's a lot of investment. What does that solve and where are areas where it comes up short? So threat intelligence is extremely valuable, but if it's viewed as something passive, it's often not going to be very effective. There's too much information out there. You don't really know how it applies to your environment. So taking a more active role and using platforms that are based on not only providing valuable information from the outside world, but then mapping that to your actual infrastructure so you have an understanding of do these vulnerabilities affect my systems? Do I have these particular tools within my environment? How would I react to one of these things? And then having that all curated and automated so that when that threat intelligence feed feeds in a new CVE or a new zero day or something like that, you already know what in your environment.
that applies to, and you have agentic AI to be able to take action on it, to apply the patch or something, you know, change the configuration. We saw this years ago with things like the Haffnium vulnerabilities. Many of the organizations were trying to keep up and do their best to patch and get everything, you know, back to normal. But unfortunately, that 48-hour window that it took to do that, the threat actors had already put web shells in the environment, and we saw hundreds of organizations impacted by secondary attacks because of that. Well, I know there are some elements here that you and your colleagues advocate, things like adversary emulation at scale and rehearsing the attacks. How do they contribute to a team's ability to defend themselves here? Absolutely. So a tabletop is a great exercise, but it's not going to be enough. Taking that next step to try and demonstrate how an attacker would actually take hold of your environment, how they would get past your defenses, how they would interact with your active SOC team or your blue team. Do they know how to pivot from the playbook? Can they on the fly make changes? How quickly can they make those changes?
kind of live fire exercises are going to be far more valuable than, you know, sitting in front of a group of people at a table talking about how you would respond. Really taking that extra step to get people in there, to push those defenses to their limit, see what breaks down, you know, when you're in a friendly environment, to understand how can we be better? How can we move more quickly? Who needs additional authority to make those decisions? That's really going to take your team to that next level and provide them with the preparedness so that you don't end up, you know, having to call us.
You know, it strikes me that very few organizations out there have unlimited resources when it comes to being able to address these things. So for the folks out there who are part of a smaller security team, how do they go about adopting this mindset when they don't have those large red team resources? Well, that's where it's really great with the AI piece of it, right? Because the AI allows for a reduction in cost for offering, you know, what would essentially be maybe the equivalent of 10 people red teaming your environment. So you can do that with a smaller budget because you don't need to pay for all those different resources to come in and do this for you. Additionally, from the defense perspective, they don't need to have a whole in-house SOC for a small organization. They can hire one of these firms that utilizes these technologies to essentially act as a force multiplier for their internal IT team or security team. AI is helping to kind of reduce that burden for these smaller organizations because it's more scalable and you don't need to recoup the kind of the people costs associated with all those individuals coming in and performing that for you.
This increase in velocity, is it fair to say that mistakes become more expensive when things are moving faster? They can be. That's why building out these platforms thoughtfully, really testing them, as I mentioned before, to see how the teams and the tooling react, how to really dial it in so that it doesn't cause undue disruption to the business. Obviously, we as security practitioners are there to facilitate the business functions. We certainly don't want to get in the way of that. But if you don't test them, if you don't really put them through their paces, if you don't give them a really realistic environment to test in, you don't know until...
you know, the bad guys at your door. So going through those can help you truly understand what mistakes might happen, what things you didn't consider, and you can mitigate as many of those as possible so that your team and your tooling can actively and properly respond while also keeping the business up and running. I'd love to dig into some of the details about what your notion of the future SOC looks like. I mean, I think a lot of folks, when they hear terms like autonomous incident response, they're imagining removing the humans entirely. But that's not necessarily what we're talking about here. No, and I don't think you'd ever see it where there's not a human in the loop, right? Of course, we try to act as a force multiplier with AI, where it can help you triage things much more quickly. It can go through large data sets more quickly and identify the things that need to bubble up to the surface. But ultimately, it becomes where the human analysts are supervising.
what's going on with the agents. They're supervising what's being brought up to the surface and they're performing that more granular, more detailed, more experience-driven review to understand how this impacts the environment. Is this truly a false positive? And they're doing less of the, I'll call it the grunt work, and they're doing more of the kind of the general in the back, right? So it allows you to have all these agents out there, this tooling out there that can sift through vast amounts of data much more quickly and then bring that to the attention of those with the true experience that can sift through it.
In your experience, what is the trust factor look like? How long does it take the folks who are tasked with supervising these AI assistants to get on board and really understand that they can trust them? You know, it depends. It can sometimes take a little while because the knee-jerk reaction might be, oh, I don't know if this is accurate enough or, you know, we don't really have enough experience with this. So, you know, how are we going to develop that familiarity with it? And it's really about reps. It's about putting it through its paces, giving it every different scenario you can think of, and then fine-tuning it. You know, these aren't static models. They can learn. You teach it what is good and what isn't good. And that way you can customize it for your environment so that you can feel confident that when it's responding, it's responding how you would respond. It's responding according to your playbooks. It's not doing things that you would find detrimental to the overall business.
So I think that familiarity and that comfort comes with really testing it out, really driving it, instead of just dropping something in the environment and hoping it's going to anticipate how you would respond. Are there any particular safeguards that people need to be concerned about before they put these sorts of things into action? Yeah, obviously, you want to make sure the AI is going to absorb and touch everything you give it access to. So being thoughtful with what you're giving access to, what you're allowing it to take action on, segregating data, performing red teaming of the platform itself, right? So this is a piece of software. It is made of code. Making sure that you're testing it to ensure that it operates properly. Dealing with your typical insider threat issues, right? The access to that model, the access to what it's able to do and how you're controlling that from an internal perspective so you don't have an issue with a disgruntled employee or someone that maybe has more access to the system than they should.
So it's a lot of the traditional principles of things like zero trust and insider threat preparation that we do right now. It's just applying it in a slightly different way. So what are the takeaways for you? For the security leaders who are listening to us here today, what sort of things should they be doing to prepare for these AI accelerated threats? What are your recommendations?
So the first is, don't be afraid of it. It is helpful, it is valuable, and it can really act, like I said, as a force multiplier for what may be quite a small security group in your organization. I would also say that when you look into these, you know, some are better than others. Some have functionality that is more aligned to your organization than others. And more investment isn't always better. It's being thoughtful with that investment, it's aligning it to your mission, and it's getting your people to train, test, and use this all the time. I can't stress enough how important it is for people to get the reps in with the tooling, with the AI,
make it so that it complements the organization rather than acting as something that's seen as a replacement to individuals, a replacement to workflows. It should really be a way for you to speed up what you already do rather than looking at it like a fix-all, if you will. That's Andrew Carr, Global Head of Threat Management at Booz Allen. And finally, OpenAI is preparing a limited rollout of its new GPT 5.5 cyber model to a selected group of trusted defenders, a move that arrived shortly after CEO Sam Altman criticized Anthropic for doing much the same with its clawed mythosystem. Altman said the model will help secure companies and infrastructure by finding vulnerabilities before attackers do, though access will initially remain tightly controlled. Independent testing by the UK AI Security Institute suggests the tool is unusually capable, completing complex cyber attack simulations end-to-end.
The rollout follows Altman's recent complaints that restricting advanced cybermodels concentrates power in too few hands. Now, however, OpenAI appears to be running its own velvet rope policy, checking badges at the entrance while insisting the party is for everyone's safety. As always, with tools that can both defend and break systems, the real question is not what they can do, but who gets there first. And that's The Cyber Wire. For links to all of today's stories, check out our daily briefing at thecyberwire.com. Be sure to check out this weekend's Research Saturday and my conversation with Justin Albrecht, principal researcher at Lookout. The research is titled Attackers Wielding Dark Sword Threaten iOS Users. That's Research Saturday. Check it out. We'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com.
N2K's lead producer is Liz Stokes. Remixed by Trey Hester with original music and sound design by Elliot Helpsman. Our contributing host is Maria Vermazis. Our executive producer is Jennifer Iben. Peter Kilpie is our publisher. And I'm Dave Bittner. Thanks for listening. We'll see you back here next week.