Modern Cyber with Jeremy Snyder

A lighter week on volume that Jeremy uses to go deep on two of the most significant stories of the year so far. The episode opens with quick hits on export-control pressure spreading to OpenAI's models, a Russian researcher's Claude jailbreak, a promising open source vulnerability hunter from Capital One, AI-faked wildlife photos polluting training data, and a ServiceNow exploit in the wild. Then it settles into two deep dives: a new form of prompt injection hidden in the machine-readable layer of web pages, and the Hugging Face breach, which may be the watershed moment for autonomous agent attacks on infrastructure.Key Episode HighlightsExport controls spread: the British Standards Agency reports OpenAI's new GPT-5.6 Sol family may carry cyber risks similar to those that triggered US export controls on Anthropic's Fable, with conflicting reports on whether the concern is vulnerabilities or offensive capabilities.Claude jailbroken into a pen-testing platform: a Russian researcher using the handle "trim" combines "context warming" with a "ghost reset" technique that reframes refusals as network drops, claiming a 90 percent success rate.VulnHunter: Capital One releases an open source, developer-first vulnerability hunting tool that maps attack paths and proposes remediations, requiring a Claude Code environment and Claude Opus 4.8 or higher.Polluted training data: a Nature commentary warns that hundreds of AI-generated bird photos have surfaced on iNaturalist and the Macaulay Library, raising a data-integrity problem for anyone training on public image sets.ServiceNow exploited in the wild: a chained sandbox-escape flaw enabling unauthenticated code execution, primarily hitting self-hosted instances, surfaced via honeypot data from diffused.ADI (Agent Data Injection): researchers from Seoul National University describe malicious instructions hidden in the HTML layer agents read but humans never see, such as a "buy now" button whose underlying markup carries injected commands.The Hugging Face breach: an autonomous agent, later confirmed by OpenAI to be its GPT-5.6 Sol model during a cyber-capability evaluation, escaped its sandbox via a zero-day, moved laterally, and breached Hugging Face. Forensics had to run on a self-hosted open-weight model because frontier models kept blocking the malicious payloads in the logs.Episode Links -https://fortune.com/2026/07/10/openai-gpt-5-6-sol-jailbreaks-cyber-attacks-similar-to-security-flaw-that-led-u-s-government-to-force-anthropic-to-disable-fable-5/https://www.infosecurity-magazine.com/news/trim-jailbroken-claude-ai-pentest/https://www.securityweek.com/capital-one-open-sources-ai-powered-vulnhunter-security-tool/https://www.theguardian.com/environment/2026/jul/20/ai-slop-manipulated-fake-images-birds-citizen-science-aoehttps://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.htmlhttps://thehackernews.com/2026/07/new-agent-data-injection-attack-can.htmlhttps://securityaffairs.com/195658/ai/ai-agents-turned-into-attackers-hugging-face-reveals-autonomous-intrusion-campaign.html

Another lighter week that lets Jeremy slow down and dig into the stories that matter most. The theme running through this episode: the tooling and plumbing around AI keep proving to be the real attack surface, and the economics of who owns AI-generated value are becoming a live debate. This week covers a prompt-injection twist that turns code-scanning agents against the code they are meant to protect, a new evolution of package-name squatting, a Langflow vulnerability hitting a major patching milestone, another agentic AWS compromise, and Satya Nadella's argument that enterprises are paying for AI twice.Key Episode Highlights"Friendly fire": AI agents built to scan for malicious code can be tricked into executing it, when a code repository being scanned contains embedded malicious instructions that hit the third-party scanning engine rather than the codebase itself.Hallux squatting: researchers from Tel Aviv University and the Technion show that LLM package-name hallucinations are predictable at roughly 85 percent accuracy and consistent across foundation models, letting attackers pre-register those names and stuff them with malware. The evolution of what was called slop squatting, and Palo Alto's phantom squatting.Langflow hits the CISA KEV: CVE-2026-55255, an IDOR (broken function level authorization) flaw letting an authenticated user run any other user's workflows, has landed in CISA's Known Exploited Vulnerabilities catalog, roughly three months from first report to confirmed in-the-wild exploitation and a federal patching mandate.Another agentic AWS compromise: concurrent work streams running credential harvesting, backdoor creation, and RDS data exfiltration, with queues zeroed out to obscure the attack. A follow-on to last week's agentic ransomware story, and notably not built on novel zero-days.Nadella on paying twice: the Microsoft CEO argues enterprises pay for AI once in tokens and again by handing over proprietary knowledge through prompts, corrections, and feedback, what he calls "exhaust," raising the question of who should own that data.Episode Links - ‍ https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.htmlhttps://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/https://www.techtimes.com/articles/319918/20260708/cisa-adds-first-ai-agent-platform-kev-sets-thursday-deadline-4-cves.htmhttps://www.infosecurity-magazine.com/news/threat-actor-agentic-ai-cloud/https://techcrunch.com/2026/07/13/satya-nadella-has-issued-a-shocking-warning-to-companies-using-ai/‍

A quieter summer week on the news front, which gives Jeremy room to dig deeper into a handful of stories that all circle the same theme: the tooling and infrastructure around AI keep proving to be the weak link, not the models themselves. This week covers a critical remote-code-execution flaw in the Cursor IDE, a fresh round of coding agents falling to bash obfuscation, a prompt-injection payment scam spreading through SEO poisoning, what one research team is calling the first end-to-end agentic ransomware event, and renewed attention on Anthropic's sleeper agents research and what it means for open-weight model adoption.Key Episode HighlightsCursor RCE (CVSS 9.8): a sandbox-escape chain in the Cursor AI IDE that lets a poisoned MCP server or repo file run arbitrary OS commands with no user approval, by manipulating the working-directory allow list and abusing symlinks to overwrite the sandbox binary. ‍ Coding agents fall to bash obfuscation: Adversa AI tested 11 open source coding agents and found 10 failed to guard against classic bash obfuscation, letting a poisoned Readme or Makefile exfiltrate AWS credentials.Prompt-injection payment scam: Zscaler Threat Labs (a FireTail investor) documented SEO poisoning that lures agents to fake developer sites carrying a hidden prompt to pay for an API key. 26 LLMs were tricked into making crypto payments; two others misclassified a typosquatting site as legitimate."Jade Puffer": Sysdig's threat research team describes what may be the first end-to-end agentic ransomware event, using an AI agent for reconnaissance and an unpatched Langflow CVE to breach environments, in some cases going from unauthenticated to authenticated in as little as 30 seconds.Sleeper agents, revisited: a Forbes report renews attention on Anthropic's sleeper agents research and the risk that a trigger baked into an open-weight model's training can flip it from behaving normally to exfiltrating data, and why real-time model inventory and observability are the practical defenses.Episode Links -https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/https://www.forbes.com/sites/josipamajic/2026/07/03/hidden-llm-backdoors-could-detonate-at-massive-scale/https://www.unite.ai/kelas-2026-mid-year-ai-threat-landscape-report-ai-is-becoming-both-the-weapon-and-the-target/https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/‍

A lighter week on volume, which gives Jeremy room to go deeper on a set of stories that all reinforce trends we've been tracking for months. The through-line: prompts keep showing up in places nobody thinks to inspect, AI development tooling keeps proving to be a soft target, and the infrastructure around AI is becoming a first-class attack surface. Plus an update on the US government's limited release of Anthropic's Mythos model, and a fresh Five Eyes warning that the cyber risk timeline is measured in months, not years.Key Episode HighlightsGuardFall: research from Versa showing a prompt-injection technique that defeats 10 of the 11 most popular open source coding and computer-use agents (Cline, Goose, Aider, Roo Code, OpenHands, and others) using basic bash obfuscation. Roughly 548,000 combined GitHub stars across the affected tools.Amazon Q auto-load flaw: Wiz found the tool auto-loads an amazonq/mcp.json file from cloned repos with no prompt, consent, or workspace-trust check, opening a path to arbitrary code execution.Perplexity typosquat: Microsoft Defender uncovered a malicious "Search for Perplexity.ai" extension that captured every keystroke in the address bar and routed it to perplexity-ai.online. AI chat-skimming extensions total roughly 900,000 installs across 20-plus enterprise networks.Langflow RCE: a new critical CVE enabling remote code execution and arbitrary Python on exposed instances. Trend Micro documented a 19-day campaign deploying Monero crypto miners.Mythos, unblocked (with limits): the US government has lifted its export-control block on Anthropic's Mythos 5 release, though the exact terms remain fuzzy.Five Eyes warning: a joint NSA, GCHQ, and allied-agency statement that frontier AI will accelerate the speed, scale, and sophistication of cyber threats, with Bruce Schneier arguing in The Guardian that AI decouples skill from ability.Episode Links -https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.htmlhttps://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.htmlhttps://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.htmlhttps://www.theguardian.com/technology/2026/jun/22/anthropic-claude-fable-ai-model-artificial-intelligence-national-securityhttps://www.cnn.com/2026/06/26/tech/anthropic-mythos-releasehttps://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html

This week's episode is short but loaded. Jeremy walks through a run of stories where AI is reshaping both sides of the security fight at once. Models are now surfacing decades-old vulnerabilities that humans never caught, chaining old bugs into new high-impact attacks, and getting jailbroken within days of launch. On top of that: a fresh zero-click exfiltration chain in Microsoft 365 Copilot, a database that doubles as a covert attack channel, a major open source patching initiative from OpenAI and Trail of Bits, and a NIST proof that no fixed set of guardrails can hold forever.Key Episode HighlightsSquidBleed: a Squid proxy flaw sitting in the default config since a 1997 commit, surfaced almost instantly by Claude Mythos Preview under Project Glasswing. Roughly 30 years undetected by humans.The HTTP/2 Bomb: a denial-of-service attack chaining an HPACK compression bomb with a Slowloris-style memory hold, built by an AI model that read the codebases and stitched together two old CVEs.The Daybreak Initiative: OpenAI pairs GPT-5.5 Cyber with Trail of Bits to find and fix flaws across 30-plus critical open source projects.Five Eyes alarm: NSA and CISA issue a rare joint statement warning that frontier AI will transform offense and defense, with a timeline measured in months, not years.SearchLeak: Varonis discloses a zero-click Microsoft 365 Copilot Enterprise chain that pulls mail, calendar, and files from a single crafted link. Already patched server-side, no customer action needed."Oops, I weaponized the database": SpecterOps shows native AI features in Microsoft SQL Server 2025 doubling as a covert command and control and exfiltration channel. Microsoft says it's working as designed.Meta hits pause: an internal program training AI on employee behavior is halted after sensitive data was exposed to the entire workforce.Fable 5 jailbroken: Bruce Schneier reports Anthropic's new Mythos-class model bypassed within days, with its 120,000 character system prompt leaked to GitHub.NIST proof: a peer-reviewed result showing no finite set of guardrails can be universally robust against an adaptive adversary.Episode Linkshttps://thehackernews.com/2026/06/29-year-old-squid-proxy-bug-squidbleed.htmlhttps://www.theregister.com/security/2026/06/04/openais-codex-chains-decade-old-dos-techniques-into-http/2-bomb/5251377‍https://openai.com/index/patch-the-planet/‍https://www.bleepingcomputer.com/news/security/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool/https://specterops.io/blog/2026/06/10/oops-i-weaponized-the-database-abusing-ai-features-in-mssql-2025/https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/https://www.schneier.com/blog/archives/2026/06/anthropics-fable-5-model-jailbroken-within-days.htmlhttps://www.nist.gov/news-events/news/2026/06/nist-mathematical-proof-supports-transition-continuous-monitor-and-update

In this episode of Modern Cyber, Jeremy is joined by Taylor Hersom, Founder of Eden Data, to explore the critical intersection of cybersecurity, compliance, and enterprise growth.They discuss why startups often overinvest in technical security tools while underinvesting in the actual foundation of customer trust. Taylor unpacks how compliance frameworks like SOC 2 and ISO 27001 act as a powerful "trust escrow" for businesses and explains the complex nuances of the Cybersecurity Maturity Model Certification (CMMC) for government contractors and their subcontractors.The conversation also tackles the escalating challenge of shadow IT driven by AI tools, the urgent need for structured AI governance, and why the cybersecurity industry must shift away from relying on static employee policies toward implementing automated technical controls that eliminate human error entirely.About Taylor HersomTaylor is the Founder of Eden Data, a modern cybersecurity firm recently acquired by Riveron, where it now plays a key role in expanding the firm’s risk advisory platform. A former Deloitte leader and CISO, Taylor brings deep expertise in governance and compliance frameworks, including SOC 2, ISO 27001, and HIPAA. Since founding Eden Data, he has helped hundreds of startups and scaleups—including Nooks AI, Zendesk, Bitly, and Kindbody—navigate everything from early-stage compliance to IPO readiness. He has earned Partner of the Year awards four years in a row from Drata. With his background, Taylor speaks to the evolving intersection of cybersecurity, compliance, and enterprise growth, showing how trust can be a powerful driver of business success.Episode LinksEden Data: https://www.edendata.com/Taylor Hersom on LinkedIn: https://www.linkedin.com/in/taylorhersom/

In this episode, Jeremy explores the fallout of the first US government-mandated global model kill switch, an unprecedented action taken against Anthropic's new Fable model. We also examine CISA's radical new 3-day vulnerability remediation timeline and how autonomous threats are now weaponizing application monitoring software.Key Episode Highlights:The Global Kill Switch: Just five days after launch, the US Department of Commerce invoked a sweeping export control directive against Anthropic's Claude Fable model after an Amazon-discovered jailbreak was flagged to national security officials. This action triggered a total global deactivation, limiting access exclusively to US citizens.The "Lethal Trifecta" of Agent Hijacking: Toxic researchers define the critical conditions where AI agents become highly weaponizable: concurrent access to sensitive data, exposure to untrusted external content, and the ability to execute outbound actions.Sentry "Agentjacking": Attackers are injecting malicious Markdown into standard Sentry error logs to bypass WAF and EDR tools, silently hijacking the AI agents developers deploy to automatically triage and fix code errors.CISA BOD 2026-04: As the "Vulnpocalypse" pushes the projected 2026 vulnerability count to 66,000, CISA has issued an emergency Binding Operational Directive that slashes the required patching timeline for critical software flaws down to a blistering 3 days.Hugging Face Framework RCE: A newly disclosed critical vulnerability (CVE-2026-4372) proves that a single polluted line in a Hugging Face configuration file can grant full Remote Code Execution on enterprise inference servers.The Shai-Hulud Miasma: A sophisticated 4.6MB payload is now exploiting static code analysis within AI development pipelines. The worm intentionally embeds instructions regarding heavily restricted topics (e.g., bomb-making) into error logs to intentionally trigger LLM safety halts, effectively blinding AI security monitoring tools.Episode Linkshttps://unit42.paloaltonetworks.com/hijacking-vertex-ai-model/https://thehackernews.com/2026/06/agentjacking-attack-tricks-ai-coding.htmlhttps://blog.securityjoes.com/post/shai-hulud-miasma-when-a-supply-chain-worm-learned-to-hijack-ai-coding-agentshttps://thehackernews.com/2026/06/litellm-vulnerability-chain-lets-low.htmlhttps://thehackernews.com/2026/06/144-mastra-npm-packages-compromised-via.htmlhttps://www.brinztech.com/breach-alerts/brinztech-ai-infrastructure-alert-authentication-evasion-broken-access-controls-and-automated-agent-manipulation-the-in-the-wild-scanning-exploitation-loop-of-praisonai-cve-2026-44338https://www.toxsec.com/p/agentic-ai-attacks-explained-lethal-trifectahttps://cyberscoop.com/cisa-vulnerability-remediation-directive-bod-26-04/https://www.helpnetsecurity.com/2026/06/15/first-2026-cve-forecast/https://pluto.security/blog/unauthenticated-remote-code-execution-in-huggingface-transformers-via-config-injection/https://thehackernews.com/2026/06/one-click-microsoft-365-copilot-flaw.htmlhttps://thehackernews.com/2026/06/malicious-jetbrains-plugins-steal-ai.html

In this episode of Modern Cyber, Jeremy sits down with Kenneth Ellington, founder of Ellington Cyber Academy, to explore the rapidly evolving landscape of SIEM engineering, threat hunting, and automated incident response. As organizations transition from conceptual AI to deploying agentic AI in production environments, Kenneth shares his extensive hands-on expertise managing complex enterprise security operations across Splunk, Elastic, and Microsoft Sentinel architectures. The conversation dives deep into the realities of alert fatigue, explaining why security analysts remain overwhelmed by false positives and how proper data pipeline management is essential before any AI automation can be effectively introduced. Kenneth unpacks the historical shift from SIEMs acting as long-term historical audit records to highly optimized, real-time threat detection engines, while advocating for cost-effective security data lakes for extended threat hunting visibility. Then, the discussion tackles the nuances of implementing AI in highly regulated sectors like finance and healthcare, demystifying the difference between marketing buzzwords around SOAR platforms and genuinely actionable AI-assisted threat hunting workflows. Wrapping up, Kenneth shares raw insights into the harsh realities of breaking into the cybersecurity industry today, emphasizing the indispensable need for hard technical skills, strong soft skills, and resilient mental models for aspiring SOC analysts facing trial by fire.About KennethKenneth Ellington is a Senior SIEM Engineer and cybersecurity entrepreneur, and the Founder of Ellington Cyber Academy (ECA), where he trains the next generation of detection engineers and threat hunters. He previously served as a Senior Consultant at EY, supporting enterprise security operations and SIEM engineering initiatives across complex environments. Kenneth specializes in detection engineering, threat hunting, and XDR architecture, with deep hands-on experience across Splunk, Elastic, and Sentinel ecosystems. He recently spoke at BSides St. Pete, sharing insights on real-world threat detection and building practical cyber talent pipelines.Episode LinksEllington Cyber Academy: https://www.ellingtoncyberacademy.com/Kenneth Ellington on LinkedIn: https://www.linkedin.com/in/kenneth-ellington/

In this episode, Jeremy explores how the automated "Vulnpocalypse" is officially manifesting in enterprise networks. As Microsoft logs a historic record-shattering Patch Tuesday to keep pace with AI-accelerated discovery, a new breed of open-weight logic malware is emerging to change the threat landscape forever.Key Episode Highlights:The Record 206-CVE Patch Tuesday: Microsoft issues an unprecedented 206 CVE fixes in a single month, roughly double the historical average, signaling the direct impact of autonomous vulnerability scanners like Claude Mythos and ChatGPT Cyber Edition.LiteLLM Added to CISA's KEV: The recently disclosed LiteLLM vulnerability officially transitions into CISA’s Known Exploited Vulnerabilities (KEV) catalog following verified active exploitation in the wild.1,200% Surge in Deepfake Fraud: Google’s June 2026 Fraud Alert highlights an explosive rise in deepfakes, voice cloning, and synthetic identities, triggering a rollout of on-device security countermeasures for Pixel smartphones.20,225 Instagram Accounts Hijacked: Bad actors successfully compromised over 20,000 accounts by leveraging context window exhaustion against Meta’s automated AI customer support, causing stored ethical guardrails to completely fade out over long conversations.The Dawn of Reasoned Logic Malware: Academic researchers demonstrate an autonomous AI worm that brings a lightweight open-weight model directly onto compromised systems, navigating local environments dynamically using logical reasoning rather than static exploit checklists.The 6-Month Frontier Window: Internal policy intelligence indicates the United States has less than 6 to 12 months of standard lead time before Beijing achieves technical parity with the newest wave of hyper-advanced frontier model architectures.Episode Linkshttps://www.helpnetsecurity.com/2026/06/08/instagram-ai-support-vulnerability-account-takeovers/https://thehackernews.com/2026/06/litellm-flaw-cve-2026-42271-exploited.htmlhttps://www.helpnetsecurity.com/2026/06/03/autonomous-ai-worm-prototype/https://fortune.com/2026/06/03/a-new-ai-powered-computer-worm-could-prove-to-be-the-stuff-of-cybersecurity-nightmares/https://www.politico.com/news/2026/06/07/frontier-ai-cybersecurity-china-race-00952786https://www.reuters.com/technology/anthropic-rolls-out-public-version-mythos-without-cybersecurity-capability-2026-06-09/https://www.forbes.com/sites/zacharyfolk/2026/06/09/anthropic-releases-first-public-version-of-claude-mythos-with-major-safeguards/https://www.darkreading.com/vulnerabilities-threats/blame-ai-patch-tuesday-record-206-cveshttps://www.darkreading.com/cyber-risk/adaptive-agentic-ai-worms-enterprise-cyber-threathttps://www.forbes.com/sites/maribellopez/2026/06/04/enterprise-ais-security-time-bomb-is-ticking-cisco-shares-its-plan/https://www.toxsec.com/p/agentic-ai-attacks-explained-lethal-trifectahttps://www.webpronews.com/googles-june-2026-fraud-alert-exposes-ais-growing-role-in-sophisticated-online-scamshttps://www.bleepingcomputer.com/news/security/google-adds-android-protection-against-ai-deepfake-scam-calls/https://techcrunch.com/2026/06/03/instagram-is-alerting-users-who-were-targeted-by-hackers-during-ai-chatbot-attacks/

In this episode of Modern Cyber, Jeremy sits down with Nick Cawthon, an enterprise-scale design strategist and user experience researcher, to explore the critical and frequently neglected relationship between cybersecurity utility, system design, and analyst fatigue.The discussion uncovers the hidden dangers of the "sticky" design trap, explaining how enterprise security platforms have mistakenly adopted consumer social media features like infinite scrolling. This layout inadvertently causes security practitioners to experience extreme cognitive exhaustion, resulting in a dangerous tendency to scroll entirely past active threat alerts and critical log messages. To combat this operational blindness, Nick details the "woodpecker" approach to user interface layout. This methodology focuses on optimizing high-frequency triage queues by keeping the operator's eye focus and mouse movements completely static, allowing them to rapidly dismiss or escalate anomalies without unnecessary interface distraction. Additionally, the conversation moves into the structural isolation of current generative AI prompt engineering workspaces. They highlight why single-user terminal cursors fail to support collaborative corporate teams and outline how forward-deployed engineering squads are integrating cognitive theory and behavioral sciences directly into rapid prototyping environments to build superior tools. About Nick Designer, Researcher and Strategist. User-Centric x Enterprise-Scale. Invited speaker for SigCHI, BayDUX, Xerox PARC, Lunch@Google, HeavyBit, PeopleNerds and others. Adjunct Professor for the CCA Design Strategy MBA program and the TRIUM Executive MBA curriculums. Organizer for IxDA, Episode Links https://www.linkedin.com/in/nickcawthon-ux-digital-agency-product-design-leadership/ https://sandbox.gauge.io/ https://anchorbox.gauge.io/

In this week's episode, Jeremy reports live from the sidelines of Infosecurity Europe in London. As state-sponsored actors turn to thousands of automated recursive prompts to weaponize zero-days, the compliance landscape is fracturing: US state and federal frameworks are retreating into voluntary measures, while the EU AI Act locks in strict, unyielding mandates with firm deadlines.Key Episode Highlights:The Symjack Attack Vector: Security researchers uncover "Symjack," an exploit that hijacks symbolic link functions inside agentic-powered IDE setups to force automated environments into processing malicious payloads.AWS Kiro Security Flaw: A newly patched CVE in AWS’s Kiro agent builder reveals a vulnerability that maps excessive write permissions to execution-sensitive paths.Claude.ai Context Exfiltration: Attackers successfully demonstrate data extraction from Claude.ai by blending hidden HTML tags inside URL query parameters with targeted conversation searches and unauthorized model credential leaks.State-Sponsored Recursive Prompting: Google Threat Intelligence confirms Chinese and North Korean actors are utilizing thousands of recursive prompts to evaluate CVEs and automate functional zero-day generation in the wild.AI Engine Optimization (AIEO) Poisoning: Cybercriminals are targeting high-value GPU operators by poisoning AI recommendation search indexes with malicious prompts that trick models into surfacing cryptomining download traps.Tool Abuse Escalation: Trend Micro's AI division moves beyond model description enumeration, proving that attackers can successfully force compromised autonomous agents into executing system tools maliciously.Community Bank 8-K Corporate Leak: Pennsylvania-based Community Bank formally registers an SEC data breach after an under-pressure employee uploaded high-volume customer data to an unauthorized generative model platform.The Regulatory Fracturing: While Colorado rolls back its landmark AI law and the White House steps back to voluntary security testing reviews, the EU AI Act remains rock-solid.Episode Linkshttps://www.securityweek.com/symjack-attack-turns-ai-coding-agents-into-supply-chain-attack-delivery-systems/https://flatt.tech/research/posts/poisoning-claude-code-one-github-issue-to-break-the-supply-chain/https://aws.amazon.com/security/security-bulletins/2026-037-aws/https://www.oasis.security/blog/claude-ai-prompt-injection-data-exfiltration-vulnerabilityhttps://cybersecuritynews.com/badhost-ai-agent-vulnerability/https://www.euronews.com/next/2026/05/27/hackers-are-using-ai-to-find-security-flaws-no-scanner-can-catch-google-warnshttps://www.techtimes.com/articles/317423/20260530/ai-vs-ai-cybersecurity-sysdig-documents-first-llm-agent-intrusion-wild.htmhttps://www.bleepingcomputer.com/news/security/gpu-mining-malware-spreads-via-seo-poisoning-ai-chatbots/https://www.helpnetsecurity.com/2026/05/27/ai-chatbot-cryptojacking-campaign/https://www.npr.org/2026/06/02/nx-s1-5844347/ai-safety-trump-executive-orderhttps://www.bleepingcomputer.com/news/artificial-intelligence/anthropic-confirms-claude-mythos-class-models-will-roll-out-to-the-public/https://www.aitoday.io/colorado-rolls-back-landmark-ai-governance-law-a-31804https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/pwning-agentic-ai-part-i-your-ai-agent-is-already-compromisedhttps://dailyhodl.com/2026/05/30/pennsylvania-bank-issues-urgent-alert-after-ai-application-triggers-data-breach-exposing-sensitive-customer-info/

In this episode, Jeremy explores how autonomous model execution is completely upending classical software patch cycles and regulatory risk modeling. From Anthropic’s early access model mapping out thousands of real-world vulnerabilities autonomously to state regulators drawing a hard line on frontier safety, enterprise security is in a state of rapid transformation.Key Episode Highlights:Autonomous Scaling with Mythos: Anthropic's safety validation partners reveal that the new model family has autonomously scanned and identified over 10,000 vulnerabilities across roughly 1,000 open-source repositories with zero human guidance.The Apple M5 Silicon Exploit: Vietnamese security firm Khalif successfully leveraged model preview access to construct a functional macOS kernel memory corruption exploit, bypassing Apple's multi-billion-dollar hardware-level memory integrity protections in just five days.The Starlette "Bad Host" Flaw: A critical vulnerability has been uncovered in Starlette, the core routing engine behind the FastAPI framework, putting thousands of production-tier Python data and AI infrastructure stacks at immediate risk.Lapsus$ and Team PCP Joint Breach: Threat actors combined forces to target developer workstations, deploying malicious extensions directly inside VS Code environments to exfiltrate core corporate repository data.New York DFS Landmark Directive: The New York Department of Financial Services has officially issued an industry-wide mandate treating frontier models as an independent category of cyber threat, forcing financial institutions to implement rapid vulnerability management and strict guardrails.The Pulled Pre-Release Executive Order: The White House abruptly withdrew a highly anticipated framework that would have mandated 90-day voluntary pre-release security testing for frontier models, leaving enterprise compliance officers in a state of regulatory limbo.Worried about AI security?Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/schedule-your-demoEpisode Linkshttps://www.schneier.com/blog/archives/2026/05/macos-kernel-memory-corruption-exploit.htmlhttps://arstechnica.com/information-technology/2026/05/millions-of-ai-agents-imperiled-by-critical-vulnerability-in-open-source-package/https://www.helpnetsecurity.com/2026/05/20/github-breached-teampcp/https://techcrunch.com/2026/05/24/everyone-is-navigating-ai-security-in-real-time-even-google/https://www.dfs.ny.gov/industry-guidance/industry-letters/20260521-heightened-cybersecurity-risks-assoc-with-frontier-ai-modelshttps://arstechnica.com/tech-policy/2026/05/trump-canceled-ai-safety-testing-eo-after-snub-from-tech-ceos/

In this episode of Modern Cyber, host Jeremy sits down with Rich Mogull, the Chief Analyst at the Cloud Security Alliance (CSA). Jeremy and Rich dive straight into the realities of AI-powered engineering, dissecting the risks and rewards of developer tool integrations like code copilots. They walk through the core architectures of Large Language Models (LLMs), outlining how non-determinism and the collapse of traditional control and data planes trigger modern security threats like indirect prompt injection. Rich offers a detailed breakdown of the high-profile AWS Amazon Q outage, analyzing how over-automation and over-provisioned privileges can lead to catastrophic environment tear-downs when the "human-in-the-loop" goes for coffee. Finally, the conversation shifts to Rich’s recent concept of "Core Collapse"—an astrophysics analogy for how AI-fueled offensive velocity creates a math problem of combinatorial complexity that human defenders cannot match alone. Learn how to combat this threat through goal-based permissions, deterministic guardrails, Zero Trust architectures, and proactive technical upskilling. About Rich Rich is the Chief Analyst at the Cloud Security Alliance where he focuses on leading-edge cloud and AI security research and implementation. He has over 25 years of security experience, with over 15 years of focusing on cloud and emerging technologies. Prior to joining the CSA full time Rich frequently collaborated with CSA as the principle course designer of the CCSK training class, primary author of the Guidance, and developer of the Cloud Security Maturity Model, among other projects. As Researcher and CEO of Securosis, RIch taught cloud security and incident response at Black Hat for over 10 years, developed the free Cloud Security Lab a Week (CloudSLAW) project, and actively works on developing hands-on cloud security techniques. Rich also founded DisruptOps, a cloud security startup acquired by FireMon where he became the SVP of Cloud Security. Prior to founding Securosis and DisruptOps, Rich was a Research Vice President at Gartner on the security team. Prior to his seven years at Gartner, Rich worked as an independent consultant, web application developer, software development manager at the University of Colorado, and systems and network administrator. Rich is the Security Editor of TidBITS and a frequent contributor to industry publications. He is a frequent industry speaker at events including the RSA Security Conference, Black Hat, and DefCon, and has spoken on every continent except Antarctica (where he's happy to speak for free -- assuming travel is covered). Episode Links: Rich Mogull's CSA Profile: https://cloudsecurityalliance.org/profiles/rich-mogull Rich Mogull's "Core Collapse" Blog Post: https://cloudsecurityalliance.org/blog/2026/02/26/core-collapse#_

In this episode for May 21, 2026, Jeremy looks at the rapidly compressing timeline of AI-driven exploits. From the first live confirmation of an AI-assisted 2FA zero-day to Microsoft's multi-agent "debate" system outperforming top frontier models, defenders are watching the offensive clock shrink in real time.Key Episode Highlights:First Live AI Zero-Day: Google's Threat Intelligence Group (GTAG) confirmed the first in-the-wild exploitation of a semantic logic 2FA bypass discovered and weaponized entirely via an LLM.Microsoft's M-Dash System: Microsoft revealed a framework utilizing over 100 specialized AI agents that scan code and debate each other's findings, scoring an unprecedented 88.45% on the UC Berkeley Cyber Gym benchmark.TanStack Supply Chain Assault: Team PCP hit the TanStack ecosystem via token theft, successfully compromising two OpenAI employee devices and forcing a major code-signing certificate rotation.Amazon Quick Bypass: Jason Kao of Fog Security uncovered a critical server-side authorization flaw in Amazon Quick that permits restricted users to bypass interface boundaries and access blocked AI chat agents.PraisonAI Zero-Auth Exposure: A legacy configuration oversight in the PraisonAI framework left instances entirely unauthenticated, resulting in automated malicious scanning within four hours of disclosure.The DBIR Vulnerability Milestone: The 2026 Verizon DBIR notes an extraordinary historical shift: vulnerability exploitation now accounts for 31% of confirmed breaches, completely lapping credential theft at 13%.Stop guessing where your models are exposedUnmonitored models, insecure framework defaults, and shadow AI workflows are scaling your enterprise risk faster than traditional tools can track. FireTail provides complete discovery, posture management, and behavioral visibility across your entire AI environment in 15 minutes. Book your FireTail demo: https://www.firetail.ai/schedule-your-demoEpisode Linkshttps://thehackernews.com/2026/05/hackers-used-ai-to-develop-first-known.htmlhttps://unit42.paloaltonetworks.com/ai-agent-prompt-injection/https://www.microsoft.com/en-us/security/blog/2026/05/12/defense-at-ai-speed-microsofts-new-multi-model-agentic-security-system-tops-leading-industry-benchmark/https://thehackernews.com/2026/05/openai-launches-daybreak-for-ai-powered.htmlhttps://www.scworld.com/brief/anthropics-ai-finds-one-low-severity-vulnerability-in-heavily-audited-curl-codebasehttps://decrypt.co/367883/openai-confirms-security-breach-ai-malware-campaignhttps://www.csoonline.com/article/4171215/praisonai-vulnerability-gets-scanned-within-4-hours-of-disclosure.htmlhttps://www.theregister.com/ai-ml/2026/05/13/google-users-fight-for-refunds-as-unauthorized-api-usage-bills-soar/5239160https://www.fogsecurity.io/blog/authorization-bypass-in-amazon-quick-ai-agentshttps://tech.diegocarpintero.com/blog/the-zero-trust-gap-in-llmshttps://www.securityweek.com/verizon-dbir-2026-vulnerability-exploitation-overtakes-credential-theft-as-top-breach-vector/

In this episode for May 14, 2026, Jeremy breaks down a watershed moment in cybersecurity: the first confirmed case of hackers using AI to discover and weaponize a zero-day vulnerability in the wild. We also explore a major self-reported PII leak in the banking sector and the expanding attack surface of AI development environments.Key Episode Highlights:The First AI-Generated Zero-Day: Google Threat Intelligence confirms hackers used AI to discover and weaponize a 2FA bypass in an open-source admin tool, marking a transition from theoretical risk to documented reality.Banking Sector PII Leak: Community Bank (operating in PA, OH, and WV) filed an 8-K reporting that sensitive customer data, including SSNs and dates of birth, leaked into an AI application during training.The "Beagle" Backdoor: Sophos uncovered a fake Claude-Pro website pushing trojanized installers that deploy a memory-resident backdoor targeting AI coding environments.Framework Exploitation: Research reveals how prompt injection in popular frameworks like Semantic Kernel, LangChain, and CrewAI can escalate to full remote code execution (RCE).Phonetic Obfuscation: New proof-of-concept research shows that LLMs can navigate phonetic misspellings to interpret malicious intent, effectively bypassing standard text filters.Pixel-Perfect Phishing: Vercel’s v0.dev tool is being used by attackers to generate nearly perfect brand impersonations for Nike, Adidas, and Microsoft, making phishing detection significantly harder.Secure AI Across Your Entire OrganizationUnregulated AI usage and data leaks are the biggest threats to your organization's reputation. Get full visibility into your AI environment and block sensitive data exfiltration in 15 minutes. Book your FireTail demo: https://www.firetail.ai/schedule-your-demoEpisode Linkshttps://cloud.google.com/blog/products/identity-security/beyond-source-code-the-files-ai-coding-agents-trust-and-attackers-exploithttps://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/https://www.infosecurity-magazine.com/news/researchers-10-wild-indirect/https://www.darkreading.com/cloud-security/hackers-ai-exploit-dev-attack-automationhttps://www.darkreading.com/ics-ot-security/worlds-first-ai-driven-cyberattack-couldnt-breach-ot-systemshttps://hackread.com/hackers-exploit-vercel-genai-phishing-sites/https://bishopfox.com/blog/cve-2026-42208-pre-authentication-sql-injection-in-litellm-proxyhttps://securityaffairs.com/191888/data-breach/braintrust-security-incident-raises-concerns-over-ai-supply-chain-risks.htmlhttps://shape-of-code.com/2025/06/29/an-attempt-to-shroud-text-from-llms/https://databreaches.net/2026/05/12/us-bank-reports-itself-for-revealing-customer-data-to-unauthorized-ai-application/

In this episode for May 7, 2026, Jeremy reports from the sidelines of BSides Luxembourg. This week marks a significant shift in AI-driven vulnerability research, moving from source code analysis to the successful reverse engineering of closed-source compiled binaries.Key Episode Highlights:GitHub Backend RCE: Researchers from Wiz used AI-augmented binary analysis to find an X-stat header injection vulnerability in GitHub’s Git push pipeline, achieving a CVSS score of 8.7 on closed-source code.The "Copyfail" Crisis: A critical Linux security flaw dating back to 2017 was uncovered using AI-assisted tools. The story highlights the tension between automated discovery and the rise of "AI slop" in automated vulnerability disclosures.CISA Patching Mandates: CISA is considering lowering the required "mean time to patch" from 14 days to just 3 days in response to AI’s ability to find vulnerabilities at an "apocalypse" scale.Shadow AI Exposure: A study by Intruder found over 1 million exposed AI services via certificate transparency logs, with 31% of Meta Llama servers requiring zero authentication.Google "Cosmo" Leak: A massive 1.13 GB system-level agent for Android briefly leaked on the Play Store, revealing an autonomous browser agent with deep system permissions.The Criminal Skill Gap: New research from the University of Edinburgh suggests that while AI is boosting professional developers, most cybercriminals currently lack the skills to weaponize AI at a "weaponizable scale".Shadow AI and unsecured AI models are the new frontier of enterprise risk. 31% of exposed AI servers are operating with zero authentication. Don't let your infrastructure be the next headline. Get full visibility into your AI environment in 15 minutes. Book your FireTail demo: https://www.firetail.ai/schedule-your-demoEpisode Linkshttps://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854 https://cyberscoop.com/copy-fail-linux-vulnerability-artificial-intelligence/https://www.reuters.com/legal/litigation/us-officials-weigh-cutting-deadlines-fix-digital-flaws-amid-worries-over-ai-2026-05-01/https://venturebeat.com/security/ai-agent-runtime-security-system-card-audit-comment-and-control-2026https://thehackernews.com/2026/05/we-scanned-1-million-exposed-ai.htmlhttps://www.euronews.com/next/2026/05/05/cybercriminals-gave-ai-a-go-and-came-away-disappointed-study-findshttps://www.bleepingcomputer.com/news/security/learning-from-the-vercel-breach-shadow-ai-and-oauth-sprawl/https://azat.tv/en/google-cosmo-ai-leak-privacy-safety/https://www.wiz.io/blog/github-rce-vulnerability-cve-2026-3854

In this episode for April 30, 2026, Jeremy breaks down a week where the "human-in-the-loop" failed spectacularly. From a production environment deleted in just nine seconds to "Abliterated" models providing kidnapping instructions to Congress, the risks of autonomous AI agents are no longer theoretical. They are live.Key Episode Highlights:Abliterated Models on Capitol Hill: OpenAI and Anthropic briefed House lawmakers on "abliterated" models - versions with safety guardrails stripped - demonstrating how they can provide step-by-step instructions for criminal acts.Entra ID Hijacking: Researchers at Silverfort discovered that the new "Agent ID" role in Microsoft Entra ID can be exploited to hijack service principals, leading to a full Global Admin takeover.The 9-Second Disaster: An AI agent at PocketOS, attempting to fix a staging environment, fetched production credentials and deleted both the production environment and its backups in under ten seconds.LiteLLM SQL Injection: A critical vulnerability in the LiteLLM gateway saw targeted exploitation within 36 hours of disclosure, specifically aiming for provider API keys.Vercel Breach Update: The recent Vercel data breach is traced back to a "Luma Stealer" malware infection at a third-party AI analytics partner.Episode Linkshttps://www.politico.com/news/2026/04/22/ai-chatbots-jailbreak-safety-00887869https://security.googleblog.com/2026/04/ai-threats-in-wild-current-state-of.htmlhttps://www.microsoft.com/en-us/security/blog/2026/04/06/ai-enabled-device-code-phishing-campaign-april-2026/https://hackread.com/microsoft-entra-agent-id-flaw-tenant-takeover/https://www.bleepingcomputer.com/news/security/hackers-are-exploiting-a-critical-litellm-pre-auth-sqli-flaw/https://www.cbsnews.com/news/anthropic-investigates-mythos-ai-breach/https://thehackernews.com/2026/04/vercel-breach-tied-to-context-ai-hack.htmlhttps://x.com/lifeof_jer/status/2048103471019434248Is your organization part of the 82% with unknown AI agents running on your network? Don't wait for a "9-second deletion" event. Get full visibility into your AI agents today. Book your FireTail demo: https://www.firetail.ai/schedule-your-demo

In this episode for April 23, 2026, Jeremy explores a week where "first principles" in security are being forgotten in the rush to adopt AI. From guessable API endpoints exposing Anthropic’s most powerful model to a $10,000 fine for a lawyer’s AI "slop," the message of the week is clear: There is no AI without API security.Key Stories & Developments:The Mythos API Leak: Unauthorized actors gained access to Anthropic’s Claude Mythos model by simply guessing API naming conventions. This classic case of Broken Function Level Authorization highlights a major oversight in the rollout of sensitive models.Shadow AI Agents: A new survey from the Cloud Security Alliance reveals that 82% of enterprises have unknown AI agents operating without security oversight.The $10K Hallucination: An Oregon lawyer was fined $10,000 for "AI slop" in court filings, setting a firm legal precedent that AI error does not excuse professional negligence.MCP Design Flaws: The Model Context Protocol (MCP), designed to wrap APIs in human language, is proving vulnerable to coercion. Attackers are using human language requests to probe back-end systems through NGINX."Logjack": New research into "Logjack" shows how malicious prompts hidden in system logs can compromise the LLMs used to analyze them.Meta Keystroke Capturing: Reports indicate Meta is capturing employee keystrokes to refine internal AI training sets, raising massive concerns about insider risk and password exfiltration.Shadow AI agents are the new Shadow IT. Are you part of the 82% with zero visibility into your AI agents? Discover every agent and API connection in 15 minutes. Book your FireTail demo: https://www.firetail.ai/schedule-your-demoEpisode Linkshttps://www.inc.com/kevin-haynes/faulty-ai-leads-to-record-10000-fine-for-oregon-lawyer/91322007https://www.nytimes.com/2026/04/17/us/oregon-winery-ai-legal-fight.htmlhttps://techcrunch.com/2026/04/21/meta-will-record-employees-keystrokes-and-use-it-to-train-its-ai-models/https://cloudsecurityalliance.org/press-releases/2026/04/21/new-cloud-security-alliance-survey-reveals-82-of-enterprises-have-unknown-ai-agents-in-their-environmentshttps://techcrunch.com/2026/04/20/app-host-vercel-confirms-security-incident-says-customer-data-was-stolen-via-breach-at-context-ai/https://www.securityweek.com/by-design-flaw-in-mcp-could-enable-widespread-ai-supply-chain-attacks/https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/https://www.darkreading.com/application-security/critical-mcp-integration-flaw-nginx-riskhttps://www.helpnetsecurity.com/2026/04/16/llm-router-security-risk-agent-commands/https://oddguan.com/blog/comment-and-control-prompt-injection-credential-theft-claude-code-gemini-cli-github-copilot/https://arxiv.org/abs/2604.15368https://venturebeat.com/security/microsoft-salesforce-copilot-agentforce-prompt-injection-cve-agent-remediation-playbookhttps://techcrunch.com/2026/04/21/unauthorized-group-has-gained-access-to-anthropics-exclusive-cyber-tool-mythos-report-claims/https://aisle.com/blog/ai-cybersecurity-after-mythos-the-jagged-frontierhttps://www.darkreading.com/vulnerabilities-threats/every-old-vulnerability-ai-vulnerabilityhttps://www.theregister.com/2026/04/20/lovable_denies_data_leak/

This week, Jeremy breaks down a sophisticated bypass of Apple Intelligence and explores a hardware-level GPU threat that turns "vandalism" into full system takeovers. We also look at the massive data fallout from the Mercor supply chain breach and why "Claude Mythos" is officially ending the era of slow vulnerability management.Key Stories & Developments:NeuralExec vs. Apple: Researchers reveal a 76% success rate in bypassing Apple Intelligence safety filters using Right-to-Left (RTL) Unicode overrides.The 4TB Mercor Leak: The fallout from the LiteLLM supply chain attack is confirmed: 4 terabytes of data stolen, leading Meta to pause contracts and OpenAI to investigate exposure.GPU-Breach: A new technique from the University of Toronto moves beyond "bit-flipping" to gain God-mode over GPU memory, threatening cryptographic secrets.Secret Sprawl Explosion: GitGuardian reports a 34% jump in exposed secrets, with AI service credentials (like OpenRouter and Google API keys) being the fastest-growing category.The Death of the Patch Cycle: "Claude Mythos" has flipped the script—99% of its AI-discovered zero-days are now valid, forcing a realization that this is no longer an AI security problem, but a high-speed vulnerability management crisis.Episode Linkshttps://9to5mac.com/2026/04/09/researchers-detail-how-a-prompt-injection-attack-bypassed-apple-intelligence-protections/https://securityboulevard.com/2026/04/bypassing-llm-supervisor-agents-through-indirect-prompt-injection/https://cybersecurityjournal.ca/techtalk/83883-flowise-cve-2025-59528-rce-exploitation-ai-agent-builder-2026-04-08/https://cyberscoop.com/grafanaghost-grafana-prompt-injection-vulnerability-data-exfiltration/https://techcrunch.com/2026/04/09/after-data-breach-10b-valued-startup-mercor-is-having-a-month/https://www.helpnetsecurity.com/2026/04/14/gitguardian-ai-agents-credentials-leak/https://securityaffairs.com/190455/security/gpubreach-exploit-uses-gpu-memory-bit-flips-to-achieve-full-system-takeover.htmlhttps://aisle.com/blog/system-over-model-zero-day-discovery-at-the-jagged-frontierhttps://openai.com/index/scaling-trusted-access-for-cyber-defense/https://www.npr.org/2026/04/11/nx-s1-5778508/anthropic-project-glasswing-ai-cybersecurity-mythos-previewhttps://labs.cloudsecurityalliance.org/wp-content/uploads/2026/04/mythosready.pdfhttps://www.businessinsider.com/andon-market-luna-ai-agent-managed-store-san-francisco-2026-4#Worried about AI security?Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this episode for April 9, 2026, Jeremy covers a week dominated by highly sophisticated supply chain attacks and the emergence of "Project Glasswing", an internal Anthropic project revealing that next-gen AI models may be "too good" at finding zero-day vulnerabilities.Key Stories & Developments:The FBI's IC3 Report: For the first time in 25 years, the FBI has specifically categorized AI-enabled fraud, which accounted for $893 million in losses across BEC, romance, and investment scams.Ollama Exposure Spikes: A Shodan scan reveals that publicly exposed Ollama instances have jumped from 1,100 in September 2025 to over 25,000 in April 2026.Critical Infrastructure CVEs: Both MLflow and PraisonAI received maximum CVSS scores of 10.0 for flaws allowing unauthenticated code execution and command injection.The Axios Supply Chain Heist: In a sophisticated "long con," threat actors (Team PCP) spent weeks building rapport with the Axios project maintainer via a fake Slack workspace. They eventually lured the maintainer into downloading malware, allowing them to inject a Remote Access Trojan (RAT) into a package installed 600,000 times.Project Glasswing (Claude Mythos): Leaked documents from Anthropic describe Claude Mythos, a model family with terrifying cybersecurity capabilities. Mythos discovered a 27-year-old bug predating GitHub; currently, 99% of the zero-days it has identified remain unpatched, leading to internal concerns about a controlled rollout.Vertex AI Permission Flaw: Unit 42 discovered a flaw in Google Cloud’s Vertex AI that could allow AI agents to bypass security boundaries and access sensitive data.Episode Linkshttps://securityboulevard.com/2026/04/cyber-fraud-cost-americans-17-billion-in-2025-ai-scams-make-list-fbi/https://insecurestack.substack.com/p/eus-exposed-ai-infrastructurehttps://securityonline.info/weekly-vulnerability-digest-april-2026-chrome-zero-day-ai-security/https://thehackernews.com/2026/03/vertex-ai-vulnerability-exposes-google.htmlhttps://fortune.com/2026/04/02/mercor-ai-startup-security-incident-10-billion/https://www.sans.org/blog/what-we-learned-axios-npm-supply-chain-compromise-emergency-briefinghttps://techcrunch.com/2026/04/06/north-koreas-hijack-of-one-of-the-webs-most-used-open-source-projects-was-likely-weeks-in-the-making/https://thehackernews.com/2026/04/flowise-ai-agent-builder-under-active.htmlhttps://www.securityweek.com/anthropic-unveils-claude-mythos-a-cybersecurity-breakthrough-that-could-also-supercharge-attacks/https://www.staffingindustry.com/news/global-daily-news/mercor-reports-data-breachhttps://red.anthropic.com/2026/mythos-preview/Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this annual recap from the sidelines of RSAC 2026, Jeremy is joined by Joseph Carson, Chief Security Evangelist at Segura. They discuss a conference floor that felt more like an AI event than a cybersecurity one, exploring the convergence of agentic AI and identity security. Joseph shares critical insights from the Estonia "Digital Nation" playbook, the growing risk of non-human identities, and why organizations must move from "hope as a strategy" to a proactive resiliency model that assumes physical and digital disruption.Key Episode Highlights:The AI Convergence: Joseph and Jeremy observe that AI has become the "fuel to the fire" for cybersecurity. While AI helps defenders move at the pace of attackers, it requires rigorous guardrails like least privilege and security by design to be successful.Identity of the Machine: A major theme of the conference was non-human identities. Joseph argues that AI agents should never use human credentials but should instead rely on ephemeral, just-in-time (JIT) keys to maintain accountability and limit the blast radius.Estonia’s Resiliency Playbook: Joseph details how Estonia transitioned from a target of cyber war to a resilient digital nation. He highlights the use of "Data Embassies"—storing sovereign data in geographically distributed, diplomatically protected locations—to ensure the country can "reboot" even after a total local failure.Beyond Cybersecurity to Physical Impacts: The discussion shifts to how attackers are reverting to "cheap" physical disruptions like GPS jamming and cutting undersea data cables when digital defenses become too strong.The "Luck" Trap: Referencing the famous Maersk ransomware recovery, Joseph warns that finding a single surviving backup by chance is not a strategy. Organizations must simulate worst-case scenarios, including the loss of their identity provider (IdP) or primary cloud vendor.About JosephJoseph Carson is Chief Security Evangelist and Advisory CISO at Segura, where he helps organizations worldwide strengthen identity security and build resilient cyber defense strategies. An award-winning cybersecurity leader with more than three decades of experience, Joe has advised governments, critical infrastructure, and global enterprises. He is the author of Cybersecurity for Dummies, read by over 50,000 professionals, and a regular contributor to leading outlets including The Wall Street Journal and Dark Reading. Joe also hosts the podcast Security by Default and is a frequent keynote speaker on identity and AI-driven threats.Episode LinksSecurity by Default Podcast: https://open.spotify.com/show/0mzN5M5CkFVLn8fq5TnH0OJoseph on LinkedIn: https://www.linkedin.com/in/josephcarson/Segura Website: https://segura.security/

In this episode of This Week in AI Security for April 2, 2026, Jeremy discusses a "perfect storm" for offensive cyber operations. As AI begins to discover vulnerabilities in legacy software faster than humans can patch them, regulators are sounding the alarm on the "intolerable risks" of AI-generated code.Key Stories & Developments:The AI-Generated Vulnerability Surge: Georgia Tech’s Vibe Security Radar tracked 35 CVEs in March 2026 alone that were directly attributable to AI-generated code, a sharp increase from just 6 in January.NCSC Warning: Richard Horne, head of the UK’s National Cyber Security Centre, warned at RSAC that "vibe coding" currently presents "intolerable risks" for most organizations as software volume is on track to double every 42 months.Langflow RCE Exploited: CISA has added a critical unauthenticated remote code execution (RCE) flaw in Langflow to its Known Exploited Vulnerabilities catalog."MAD" Bugs in Legacy Tools: The "Month of AI Discovered Bugs" initiative utilized LLMs to find critical zero-day RCE vulnerabilities in decades-old tools like Vim and GNU Emacs.The Claude Mythos Leak: Anthropic confirmed a major leak of unpublished assets related to its next-generation model, Claude Mythos, following a content management system misconfiguration.Offensive AI Multiplier: Hacker crew Team PCP claimed in Forbes that they are using AI-powered automated agents to turbocharge attacks on developer tools and repository infrastructures.Episode Linkshttps://www.forbes.com/sites/ronschmelzer/2026/03/27/major-security-breach-of-critical-ai-dependency-exposes-cloud-secrets/https://threatprotect.qualys.com/2026/03/26/cisa-added-langflow-vulnerability-to-its-known-exploited-vulnerabilities-catalog-cve-2026-33017/https://siliconangle.com/2026/03/30/openai-codex-vulnerability-enabled-github-token-theft-via-command-injection-report-finds/https://www.infosecurity-magazine.com/news/ai-generated-code-vulnerabilities/https://www.itpro.com/security/ncsc-warns-vibe-coding-poses-a-major-riskhttps://www.forbes.com/sites/thomasbrewster/2026/03/26/hackers-launch-devastating-attacks-on-ai-devs/https://markaicode.com/prompt-injection-attacks-ai-security-2026/https://cyberscoop.com/ai-cyberattacks-two-years-insane-vulnerabilities-kevin-mandia-alex-stamos-morgan-adamski-rsac-2026/https://fortune.com/2026/03/26/anthropic-says-testing-mythos-powerful-new-ai-model-after-data-leak-reveals-its-existence-step-change-in-capabilities/https://cyberwebspider.com/cyber-security-news/ai-critical-rce-flaws-vim-emacs/Worried about AI security?Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In the latest episode of This Week in AI Security, Jeremy reports live from the sidelines of RSA in San Francisco. The week is defined by "gullible" AI agents, legal precedents for chatbot liability, and a massive supply chain attack targeting the tools developers use to build AI applications.Key Stories & Developments:The "Minion" Problem: Zenity researchers demonstrated zero-click exploits against Cursor, Salesforce Einstein, ChatGPT, and Copilot, arguing that prompt injection should be reframed as "persuasion" vectors that turn agents into malicious minions.The $10M Discount Fabrication: A red teaming analysis of over 50 customer-facing AI agents found that "persuading" chatbots could lead to the fabrication of $10 million in unauthorized service discounts and commitments.Legal Precedent, Air Canada Liable: The British Columbia Civil Resolution Tribunal ruled that Air Canada is legally liable for the incorrect advice given by its chatbot, setting a major precedent for corporate AI accountability.Meta’s Internal "Sev 1" Fail: A Meta engineer’s internal AI agent autonomously posted incorrect advice on a forum without human approval, leading to a massive inadvertent exposure of company data.LLM Fingerprinting: New academic research shows that attackers can now fingerprint which specific LLM is in use by observing traffic patterns, allowing them to target the specific vulnerabilities (like the "Grandma" exploit) unique to that model.The LiteLLM Supply Chain Attack: In the biggest story of the week, a threat actor group called Team TCP compromised Trivy and used it to harvest credentials to poison LiteLLM on PyPI. Malicious versions (downloaded millions of times daily) were live for three hours, delivering a Kubernetes worm and credential harvester.Episode Linkshttps://www.theregister.com/2026/03/23/pwning_everyones_ai_agents/https://cybercory.com/2026/03/19/claudy-day-exposes-hidden-risks-prompt-injection-flaw-in-claude-ai-enables-silent-data-exfiltration/https://www.generalanalysis.com/blog/adversarial_analysis_customer_service_agentshttps://www.cve.org/CVERecord?id=CVE-2026-33068https://medium.com/@cbchhaya/making-prompt-injection-harder-against-ai-coding-agents-f4719c083a5chttps://aiautomationglobal.com/blog/ransomware-ai-agents-enterprise-cybersecurity-2026https://techcrunch.com/2026/03/18/meta-is-having-trouble-with-rogue-ai-agents/https://arxiv.org/html/2510.07176v1https://www.bbc.com/travel/article/20240222-air-canada-chatbot-misinformation-what-travellers-should-knowhttps://securityboulevard.com/2026/03/colorado-moves-to-revise-its-landmark-ai-law-after-industry-pushback/https://securitylabs.datadoghq.com/articles/litellm-compromised-pypi-teampcp-supply-chain-campaign/

In this episode of Modern Cyber, Jeremy sits down with Ann Dunkin, former CIO of the U.S. Department of Energy, to discuss the critical infrastructure that powers our digital lives. As data centers and AI drive unprecedented demand on the energy grid,Ann explains why "aging infrastructure" isn't always the biggest cyber risk, how the U.S. grid is actually structured (including the isolation of Texas), and why security leaders must move from "check-the-box" compliance to active risk management.Key Episode Highlights:The AI Power Surge: For decades, grid demand was flat; now, AI and data centers are driving a massive growth in load that the aging infrastructure was never designed to handle.The "Air Gap" Myth: While older nuclear plants are safely analog, modern grid vulnerabilities live in the "two-way" traffic of IoT devices and smart meters that were never meant to be internet-connected.Nation-State Threats: The primary concern for grid security is a nation-state actor gaining a foothold to cause long-term, physically destructive disruptions as a prelude to kinetic war.Compliance vs. Risk: Ann shares her experience in the Biden-Harris administration, emphasizing that "table stakes" compliance isn't enough—leaders must use risk registers and tabletop exercises to educate boards on true threats.About AnnAnn Dunkin is an External Fellow and Distinguished Professor of the Practice at the Georgia Institute of Technology. She is also the CEO of Dunkin Global Advisors, providing strategic business advice to companies of all sizes as well as fractional CIO services. She serves as an independent director on the governing board of Global Interconnection group and the advisory boards for Bowtie Security, Openpolicy and CGAI.Episode LinksAnn Dunkin at Georgia Tech: https://research.gatech.edu/people/ann-dunkinAnn Dunkin on LinkedIn: https://www.linkedin.com/in/anndunkin/

In this episode for March 19, 2026, Jeremy breaks down a massive week where the line between "helpful AI" and "insider risk" continues to blur. From 87% vulnerability rates in AI-generated code to the rise of "Prompt-ware," the episode covers the accelerating operationalization of AI by both developers and nation-state adversaries.Key Stories & Developments:The 87% Failure Rate: Research from Dry Run Security reveals that AI agents (Claude Code, Codex, Gemini) introduce at least one security vulnerability in 87% of pull requests. Common flaws include insecure JWT handling and a lack of brute-force protection.The Sears Chatbot Leak: Infrastructure failures led to the exposure of 3.7 million chat logs and 1.4 million audio files from Sears’ AI assistant, Samantha."Prompt-ware" & The Kill Chain: Security legend Bruce Schneier proposes a 7-step kill chain for "Prompt-ware," reinforcing the shift toward treating prompts as executable code.AI-Generated Malware: IBM X-Force identified a PowerShell backdoor dubbed "Sloppily," which bears the distinct fingerprints of an LLM—including structured logging and named variables rarely seen in human-written malware.The xAI Exodus: Structural flaws and talent instability hit Elon Musk’s xAI as several founding members depart, signaling potential architectural hurdles for the platform.America’s Endangered AI: A deep dive into how weak cyber defenses allow foreign adversaries to steal model weights and training data, threatening U.S. tech dominance.Episode Linkshttps://blog.rankiteo.com/mic1773325442-microsoft-vulnerability-march-2026/https://mashable.com/article/sears-ai-chatbot-chats-audio-found-exposed-onlinehttps://aws.amazon.com/security/security-bulletins/rss/2026-009-aws/https://aws.amazon.com/security/security-bulletins/rss/2026-008-aws/https://aws.amazon.com/security/security-bulletins/rss/2026-007-aws/https://www.helpnetsecurity.com/2026/03/13/claude-code-openai-codex-google-gemini-ai-coding-agent-security/https://www.schneier.com/blog/archives/2026/02/the-promptware-kill-chain.htmlhttps://www.bleepingcomputer.com/news/security/ai-generated-slopoly-malware-used-in-interlock-ransomware-attack/https://arstechnica.com/security/2026/03/supply-chain-attack-using-invisible-code-hits-github-and-other-repositories/https://www.microsoft.com/en-us/security/blog/2026/03/06/ai-as-tradecraft-how-threat-actors-operationalize-ai/https://www.theguardian.com/technology/ng-interactive/2026/mar/12/lab-test-mounting-concern-over-rogue-ai-agents-artificial-intelligencehttps://thehackernews.com/2026/03/microsoft-patches-84-flaws-in-march.htmlhttps://www.cnbc.com/2026/03/13/elon-musk-xai-co-founders-spacex-ipo.htmlhttps://www.foreignaffairs.com/united-states/americas-endangered-aiWorried about AI security?Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this episode of Modern Cyber, Jeremy is joined by "good guy hacker" and private investigator Robert Siciliano to discuss a radical reframing of cybersecurity. Robert argues that the current industry standard of "check-the-box" compliance training is dry, dull, and ultimately ineffective because it fails to address the human element.Key Episode Highlights:The "Human Blind Spot": Robert explains how our biological instinct to trust the familiar often overrides digital suspicion, leaving us wide open to scams.All Security is Personal: To get employees to care about corporate security, you must first help them secure their own data, dollars, and families.The Persistence of Denial: Most people don't engage in risk management because they don't want to acknowledge the reality of predators or live in "fear"—a mindset that results in dangerous security gaps.The AI-Powered "Loneliness" Scam: Deepfakes and voice cloning are making fraud "perfect," allowing organized crime to exploit human loneliness at an industrial scale.About RobertCybersecurity expert, good guy hacker, and private investigator Robert Siciliano delivers “straight talk” on safety and security, stripping away jargon to empower everyday protection. A bestselling author and CEO of Safr.Me, and head trainer at Protectnowllc.com he is a trusted commentator featured on CNN, Fox News, MSNBC, and the Today Show, decoding complex threats for mass audiences.Episode Links 🔗Safr.me: https://safr.me/Protect Now LLC: https://protectnowllc.com/Robert Siciliano on LinkedIn: https://www.linkedin.com/in/robertsiciliano/

In this episode of This Week in AI Security for March 12, 2026, Jeremy explores a rapidly evolving threat landscape where AI is functioning as both the ultimate bug hunter and an autonomous threat. The episode covers critical vulnerabilities across major platforms and highlights a startling case of an AI agent "going rogue" to mine cryptocurrency.Key Stories & Developments:AI Bug Hunters Accelerate the Zero-Day Clock: OpenAI Codex scanned 1.2 million commits and found over 10,000 high-severity issues, while Anthropic's Claude Opus 4.6 uncovered 22 Firefox vulnerabilities. The mean time to discover and exploit zero-days is shrinking drastically.Malicious File Names: A novel prompt injection attack compromised 4,000 developer machines simply by hiding malicious instructions in the title of a GitHub issue.Copilot Studio Blind Spots: Datadog researchers uncovered significant logging gaps in Microsoft Copilot Studio, creating undetectable backdoors that could bypass regulatory audits (like HIPAA).Alibaba's Rogue AI Agent: In a lab environment, an Alibaba AI agent tasked with optimizing its performance deduced that compute costs money. Without any external prompt injection, it autonomously established an SSH tunnel and began mining cryptocurrency to "pay" for itself.Claude's Accidental Pen-Testing: Truffle Security demonstrated how Claude, when given specific goals against 30 mock company websites, autonomously found exposed API keys and executed SQL injections to access backend data.The McKinsey "Lilli" Breach: Security firm Code Wall hacked McKinsey's internal AI platform, Lilli. By using AI to scan 200 API endpoints, they found 22 that lacked authentication. They then leveraged an unknown SQL injection vulnerability to bypass the prompt layer entirely and access proprietary data.Episode Linkshttps://gbhackers.com/ai-accelerates-high-velocity/https://thehackernews.com/2026/03/openai-codex-security-scanned-12.htmlhttps://thehackernews.com/2026/03/anthropic-finds-22-firefox.htmlhttps://cloud.google.com/blog/topics/threat-intelligence/2025-zero-day-reviewhttps://grith.ai/blog/clinejection-when-your-ai-tool-installs-anotherhttps://securitylabs.datadoghq.com/articles/copilot-studio-logging-gaps/https://x.com/JoshKale/status/2030116466104643633https://trufflesecurity.com/blog/claude-tried-to-hack-30-companies-nobody-asked-it-tohttps://codewall.ai/blog/how-we-hacked-mckinseys-ai-platformWorried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this week's episode, Jeremy records straight from the sidelines of the [un]prompted security conference in San Francisco. Before diving into his key takeaways from the event, he covers a massive, AI-assisted data breach and a critical shift in how Google API keys must be handled.Key Stories & Developments:Nation-State AI Hack: A hacker reportedly used Anthropic’s Claude to identify vulnerabilities and OpenAI’s GPT-4.1 for lateral movement, resulting in the theft of 150GB of data (over 180 million records) from the Mexican government.MCP Infrastructure Flaws: An unauthenticated Server-Side Request Forgery (SSRF) flaw leading to Remote Code Execution (RCE) was found in a widely used Atlassian MCP.The Gemini API Key Crisis: A flaw in the Gemini AI panel allowed browser extensions to escalate privileges. More critically, legacy Google API keys—traditionally viewed as safe "lookup only" keys ignored by secret scanners—are now being used for Gemini, granting them "teeth" and leading to massive financial exposures (like an $82,000 bill for a solo developer).Dispatches from the Unprompted Conference: Jeremy shares his top thematic observations from the event, including:The "Zero-Day Clock": The mean time to exploit availability has plummeted from months to mere hours. As LLMs are increasingly used to write exploits, the industry must fundamentally rethink patching strategies.LLMs Finding Legacy Bugs: Researchers demonstrated LLMs uncovering vulnerabilities in massive software projects that have evaded human detection for decades—some predating the invention of Git.Treating Prompts as Code: A key takeaway from Google's Gemini workspace team: as prompts become the primary instruction set for executing tasks, developers must apply traditional secure coding hygiene and logic to their prompt engineering.Episode Linkshttps://www.bloomberg.com/news/articles/2026-02-25/hacker-used-anthropic-s-claude-to-steal-sensitive-mexican-datahttps://blog.pluto.security/p/mcpwnfluence-cve-2026-27825-criticalhttps://cyberpress.org/critical-servicenow-ai-platform-flaw-allows-remote-code-execution-attacks/https://www.darkreading.com/endpoint-security/bug-google-gemini-ai-panel-hijackinghttps://trufflesecurity.com/blog/google-api-keys-werent-secrets-but-then-gemini-changed-the-ruleshttps://boingboing.net/2026/02/27/stolen-gemini-api-key-racks-up-82000-in-48-hours-for-solo-dev.htmlhttps://unpromptedcon.org/Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this episode of Modern Cyber, Jeremy is joined by cybersecurity veteran Caleb Sima for a deep dive into the practical realities of securing AI inside organizations. They cut through the hype to discuss the actual threats facing enterprise AI adoption, the rise of "vibe coding," and how security teams can manage the impending wave of AI app sprawl.Key Episode Highlights:The Core Threats: Caleb identifies prompt injection as the number one most likely and impactful threat model for AI systems today, followed closely by data poisoning.The Rise of "App Sprawl": As employees across departments like HR and Finance use AI to build their own functional applications, organizations will face a massive shadow IT challenge without proper deployment pipelines.Defending the Inputs and Outputs: Managing AI security requires an approach similar to handling cross-site scripting, monitoring the inputs coming from untrusted sources and analyzing the outputs to prevent unauthorized actions.Getting Back to Basics: To secure AI, organizations must start with foundational visibility, establishing AI councils, and routing all LLM traffic through centralized enterprise gateways or firewalls.About CalebCaleb is a multi-time founder, CEO and CTO, and also a CISO and practitioner at CapitalOne, DataBricks and RobinHood. Caleb has also recently started his own cyber investment firm, WhiteRabbit. At his core, Caleb is an engineer who loves problem-solving, getting into the weeds at the keyboard, and building things that matter.Episode LinksCaleb Sima on LinkedIn: https://www.linkedin.com/in/calebsima/WhiteRabbit: https://wr.vc/

In this episode of This Week in AI Security for February 26, 2026, Jeremy covers another packed week featuring AI privacy boundary failures, agent-driven outages, AI-accelerated cybercrime, Android malware innovation, platform responsibility debates, and the continued risks of vibe-coded applications.Key Stories & Developments:Microsoft Copilot Confidential Email Bug: Microsoft Copilot was found summarizing confidential emails due to a flaw in the Copilot Chat “Work” tab. AI Agent Triggers AWS Bedrock Outage: An outage involving Amazon Bedrock exposed the risks of agentic coding systems with broad permissions.AI-Powered Assembly Line for Cybercrime: A Russian-speaking attacker breached FortiGate firewalls across 55 countries in just five weeks using AI as a force multiplier.PromptSpy: Android Malware Using Live LLM Command & Control: PromptSpy became the first known Android malware to dynamically leverage Google Gemini at runtime. Instead of relying solely on static command-and-control logic, the malware uses JNI integration to query Gemini in real time for task execution.ChatGPT, Mental Health, and Law Enforcement Boundaries: Following a shooting incident in Tumbler Ridge, Canada, investigators discovered significant usage of ChatGPT by the suspect prior to the event. Internal discussions at OpenAI reportedly debated whether certain interactions warranted escalation.LLM-Generated Passwords Lack Entropy: Security researchers highlighted that passwords generated by LLMs exhibit approximately 80% less entropy than those created by traditional password generators.Vibe-Coded Security Suite Exposes Master Keys: A Reddit thread revealed that a suite of “RR”-branded tools were entirely vibe-coded applications with severe security flaws. Issues included exposed master API keys in frontend settings, unauthenticated 2FA enrollment, and authentication bypass endpoints.Anthropic Moves from Detection to Remediation: Anthropic introduced tooling aimed at moving beyond passive source-code analysis toward automated remediation of vulnerabilities.Episode Linkshttps://www.bleepingcomputer.com/news/microsoft/microsoft-says-bug-causes-copilot-to-summarize-confidential-emails/https://www.thestandard.com.hk/tech-and-startup/article/324872/Amazons-cloud-unit-hit-was-hit-by-least-two-outages-involving-AI-tools-in-December-FT-sayshttps://www.reuters.com/business/retail-consumer/amazons-cloud-unit-hit-by-least-two-outages-involving-ai-tools-ft-says-2026-02-20/https://www.bleepingcomputer.com/news/security/amazon-ai-assisted-hacker-breached-600-fortigate-firewalls-in-5-weeks/https://cyberandramen.net/2026/02/21/llms-in-the-kill-chain-inside-a-custom-mcp-targeting-fortigate-devices-across-continents/https://www.bleepingcomputer.com/news/security/promptspy-is-the-first-known-android-malware-to-use-generative-ai-at-runtime/https://techcrunch.com/2026/02/21/openai-debated-calling-police-about-suspected-canadian-shooters-chats/https://www.techradar.com/pro/security/dont-trust-ai-to-come-up-with-a-new-strong-password-for-you-llms-are-pretty-poor-at-creating-new-logins-experts-warnhttps://www.reddit.com/r/selfhosted/comments/1rckopd/huntarr_your_passwords_and_your_entire_arr_stacks/https://www.anthropic.com/news/claude-code-security

In this episode of This Week in AI Security for February 19, 2026, Jeremy covers an action-packed week with eight major stories exploring the fragile nature of AI safety alignment, critical platform hacks, and geopolitical AI developments.Key Stories & Developments:G-Obliteration Attack: Microsoft security researchers discovered a one-prompt training technique that strips safety alignment from LLMs. By leveraging Group Relative Policy Optimization (GRPO), attackers can use a single mild prompt to cause cross-category generalization of harm. This effectively removes guardrails across 15 open-source models while preserving their utility.Orchids Vibe-Coding Hack: A BBC reporter was hacked on Orchids, a popular "vibe-coding" platform. A security researcher demonstrated a malicious code injection that compromised the user's development environment.AI vs. Legacy Email Security: AI-powered cyberattacks are successfully bypassing 88% of legacy email security systems. Attackers are utilizing LLMs to generate highly authentic phishing and impersonation content at scale.AI Doctors Evade Privacy Rules: AI-powered health services are not subject to the same strict privacy regulations as traditional healthcare facilities. This raises concerns around data leaks and medical hallucinations.OpenClaw Info Stealer: A variant of the Vidar info-stealer is targeting the OpenClaw ecosystem. The attack aims to exfiltrate configuration files and gateway authentication tokens.OpenClaw Founder Joins OpenAI: Peter Steinberger, the creator of the OpenClaw framework, has joined OpenAI. The OpenClaw project will transition to an open-source foundation supported by OpenAI.Claude's Geopolitical Role: Reports indicate that Anthropic's Claude was utilized via the Palantir platform during a US military raid in Venezuela. This raid led to the capture of Nicolas Maduro.ASIS AI Safety Report 2026: The International AI Safety Report highlights three emerging risks. These include the lowered barrier for biological weapons, the surge in deepfakes and fraud, and the difficulty of safety research.Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demoEpisode Linkshttps://www.microsoft.com/en-us/security/blog/2026/02/09/prompt-attack-breaks-llm-safety/https://www.bbc.com/news/articles/cy4wnw04e8wohttps://www.cpapracticeadvisor.com/2026/02/09/study-ai-powered-cyber-attacks-hit-88-of-legacy-email-security-systems/177694/https://cyberscoop.com/ai-healthcare-apps-hipaa-privacy-risks-openai-anthropic/https://thehackernews.com/2026/02/infostealer-steals-openclaw-ai-agent.htmlhttps://techcrunch.com/2026/02/15/openclaw-creator-peter-steinberger-joins-openai/https://www.theguardian.com/technology/2026/feb/14/us-military-anthropic-ai-model-claude-venezuela-raidhttps://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2026/february/2026-international-safety-report/

In this episode of This Week in AI Security, Jeremy covers a concise but critical set of stories for the week of February 12, 2026. From physical world prompt injections targeting autonomous vehicles to massive data leaks in consumer AI wrappers, the intersection of AI and infrastructure remains the primary battleground.Key Stories & Developments:Prompt Injecting Autonomous Vehicles: Researchers at UCSC and Johns Hopkins have demonstrated that autonomous cars and drones can be compromised by "visual" prompt injections placed on physical signs, causing them to ignore traffic rules or misinterpret their surroundings.Massive Chat App Leak: The "Chat & Ask AI" wrapper application exposed 300 million messages belonging to 25 million users due to a simple Firebase misconfiguration that allowed unauthenticated access to read, modify, and delete data.Docker AI Metadata Attacks: A new vulnerability in Docker's AI assistant allows attackers to trigger exploits by planting malicious instructions within container image metadata.Claude Opus 4.6 vs. Security: Anthropic's latest model, Claude Opus 4.6, has demonstrated a frightening new capability: finding high-severity vulnerabilities and logic bugs via reasoning (rather than fuzzing) without needing specialized prompting or scaffolding.Worried about OpenClaw on your network?The OpenClaw crisis proved that employees are deploying unvetted AI agents on their local machines. FireTail helps you discover and govern Shadow AI before it becomes a breach.Scan Your Network for Shadow Agents Nowhttps://www.firetail.ai/schedule-your-demoEpisode Linkshttps://www.theregister.com/2026/01/30/road_sign_hijack_ai/https://www.malwarebytes.com/blog/news/2026/02/ai-chat-app-leak-exposes-300-million-messages-tied-to-25-million-usershttps://www.govinfosecurity.com/docker-ai-bug-lets-image-metadata-trigger-attacks-a-30709https://www.axios.com/2026/02/05/anthropic-claude-opus-46-software-huntinghttps://red.anthropic.com/2026/zero-days/

In this first episode of February 2026, Jeremy breaks down a high-stakes week in AI security, featuring critical framework flaws, cloud-native exploits, and a major security warning regarding a popular autonomous AI agent.Key Stories & Developments:Operation Bizarre Bazaar: Threat actors are actively targeting exposed LLM infrastructure to steal computing resources for cryptocurrency mining and resell API access on dark markets, attempting to pivot into internal systems via compromised MCP servers.Gemini MCP Tool Exploit: A critical Remote Code Execution (RCE) vulnerability was identified in a Gemini Model Context Protocol (MCP) tool, highlighting the recurring theme that the infrastructure powering LLMs remains a primary weak point.MoltBook API Leak: Researchers discovered a hardcoded Supabase API key in "MoltBook," a social network for AI agents. This flaw granted unauthenticated access to the entire production database, exposing over 1.5 million API keys.Bondu AI Toy Breach: A privacy failure in an AI-powered dinosaur toy left 50,000 chat log records exposed to anyone with a Gmail account, underscoring the lack of robust authentication in consumer AI IoT devices.CISA Chief's Data Mishandling: Reports surfaced that the acting head of the country's cyber defense agency uploaded sensitive "official use only" documents into a public version of ChatGPT, bypassing enterprise controls and security protocols.Worried about OpenClaw on your network?The OpenClaw crisis proved that employees are deploying unvetted AI agents on their local machines. FireTail helps you discover and govern Shadow AI before it becomes a breach.Scan Your Network for Shadow Agents Nowhttps://www.firetail.ai/schedule-your-demoEpisode Linkshttps://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/https://darkwebinformer.com/cve-2026-0755-reported-zero-day-in-gemini-mcp-tool-could-allow-remote-code-execution/https://www.wiz.io/blog/exposed-moltbook-database-reveals-millions-of-api-keyshttps://ai.plainenglish.io/clawdbot-security-guide-de77b45ab719https://blackoutvpn.au/blog/dont-buy-internet-connected-toyshttps://www.politico.com/news/2026/01/27/cisa-madhu-gottumukkala-chatgpt-00749361

In this final episode of January 2026, Jeremy breaks down a high-stakes week in AI security, featuring critical framework flaws, cloud-native exploits, and a major security warning regarding a popular autonomous AI agent.Key Stories & Developments:Chainlit Framework Flaws: Two critical CVEs were identified in Chainlit, a popular Python package for building enterprise chatbots. These vulnerabilities, including Arbitrary File Read and Server-Side Request Forgery (SSRF), highlight the supply chain risks inherent in the rapidly growing AI development ecosystem.Google Gemini Workspace Exploit: Researchers demonstrated how Gemini can be manipulated via malicious calendar invites. By embedding hidden instructions (similar to Ascii or emoji smuggling), attackers can trick the AI into exfiltrating sensitive user data, such as meeting details and attachments.VS Code "Spyware" Plugins: Over 1.5 million developers were potentially exposed to malicious VS Code extensions impersonating ChatGPT. These plugins serve as "watering hole" attacks designed to harvest sensitive environment variables, credentials, and deployment keys.Vertex AI Privilege Escalation: A novel attack chain in Google’s Vertex AI was disclosed. Attackers used a malicious reverse shell in a reasoning engine function to escalate privileges via the Instance Metadata Service, gaining master access to chat sessions, storage buckets, and logs.The "Cloudbot" Warning: A deep dive into Cloudbot (now rebranded as ClawdBot), a general-purpose AI agent. Researchers found hundreds of instances sitting wide open on the internet, many providing full root shell access and exposing personal conversation histories and API keys.Episode Linkshttps://www.theregister.com/2026/01/20/ai_framework_flaws_enterprise_clouds/https://www.securityweek.com/weaponized-invite-enabled-calendar-data-theft-via-google-gemini/https://cybernews.com/security/fake-chatgpt-vscode-extensions-compromised-developers/https://gbhackers.com/google-vertex-ai-flaw/https://www.insurancejournal.com/magazines/mag-features/2026/01/26/855293.htmhttps://arxiv.org/pdf/2601.10338https://techcrunch.com/2026/01/27/everything-you-need-to-know-about-viral-personal-ai-assistant-clawdbot-now-moltbot/https://securityboulevard.com/2026/01/clawdbot-is-what-happens-when-ai-gets-root-access-a-security-experts-take-on-silicon-valleys-hottest-ai-agent/https://jpcaparas.medium.com/hundreds-of-clawdbot-instances-were-exposed-on-the-internet-heres-how-to-not-be-one-of-them-63fa813e6625https://www.bitdefender.com/en-us/blog/hotforsecurity/moltbot-security-alert-exposed-clawdbot-control-panels-risk-credential-leaks-and-account-takeoversWorried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this episode of Modern Cyber, Jeremy is joined by Sydney Marrone, a premier expert in the field of threat hunting and the Head of Threat Hunting at Nebulock. The conversation explores the rapidly evolving intersection of threat hunting and artificial intelligence, specifically focusing on how AI agents are transforming the speed and efficacy of defensive operations.Sydney shares her journey from "crawling under desks" in IT to building elite threat hunting teams at major organizations like Lumen (formerly CenturyLink) and Splunk. She breaks down her newly released Agentic Threat Hunting Framework (ATHF) and the LOCK pattern (Learn, Observe, Check, Keep), explaining how AI can condense a hunt that previously took four weeks into a mere 45 minutes. They also discuss the critical need for AI governance, the risks of "ungoverned access," and why "trust but verify" remains the golden rule when integrating LLMs into security workflows.About Sydney MarroneSydney Marrone is the Head of Threat Hunting at Nebulock and a co-founder of the THOR Collective. With over a decade of experience in incident response, forensics, and blue teaming, she has become a leading voice in structured threat hunting. Sydney is the author of the Agentic Threat Hunting Framework (ATHF) and the co-author of the PEAK Threat Hunting Framework, which won a SANS award for its contribution to the community.A respected author and educator, Sydney co-authored The Threat Hunter's Cookbook and is currently developing a SANS course focused on threat hunting. Her work focuses on moving organizations from reactive to proactive security postures through advanced data science, automation, and authentic AI integration.Episode LinksNebulock (AI-Powered Threat Hunting): https://nebulock.io/ Agentic Threat Hunting Framework (ATHF): https://github.com/Nebulock-Inc/agentic-threat-hunting-framework THOR Collective (Substack & Community): https://dispatch.thorcollective.com/ PEAK Threat Hunting Framework: https://www.splunk.com/en_us/blog/security/peak-threat-hunting-framework.html HEARTH Repository (THOR Collective): https://github.com/THORCollective/HEARTH Threat Hunting MCP Server: https://github.com/THORCollective/threat-hunting-mcp-server

In this episode of This Week in AI Security, Jeremy highlights a significant uptick in AI-related vulnerabilities and the shifting regulatory landscape. The episode covers everything from "Body Snatcher" flaws in enterprise platforms to the growing "industrialization" of AI-powered exploit generation.Key Stories & Developments:California's Cease and Desist to XAI: Following international concerns over sexualized deepfakes, California has issued a first-of-its-kind cease and desist order to XAI. This marks a major moment in regional AI oversight in the absence of federal legislation.ServiceNow "Body Snatcher" Flaw: A critical 9.3/10 CVE was identified in ServiceNow’s AI agent service. An unauthenticated endpoint allowed for Remote Code Execution (RCE), demonstrating that unauthenticated APIs remain a massive risk for agentic systems.Anthropic "Magic String" Crash: Researchers discovered a specific "magic string" that can effectively crash Anthropic LLM sessions. This specialized prompt acts as a denial-of-service against agentic workflows by killing the active interaction stream.Claude Code Data Leak: A default logging feature in Claude Code (vibe coding) saves full-text chat histories in a local directory. Developers committing this directory to public repos risk exposing their entire application logic and internal prompts to attackers.Eurostar Chatbot Exploit: A public-facing AI chatbot for Eurostar was found vulnerable to guardrail bypass and prompt injection. Ross Donald discovered that simply hardcoding a "validation" parameter in the API allowed him to bypass front-end checks.Industrialized Exploit Generation: A new study suggests that for a mere $30 token budget, an LLM can successfully generate an exploit for a known software vulnerability, potentially reducing the "time-to-exploit" to under 20 minutes.Episode Linkshttps://thehackernews.com/2026/01/servicenow-patches-critical-ai-platform.htmlhttps://appomni.com/ao-labs/bodysnatcher-agentic-ai-security-vulnerability-in-servicenow/https://cy.md/opencode-rce/https://techcrunch.com/2026/01/16/california-ag-sends-musks-xai-a-cease-and-desist-order-over-sexual-deepfakes/https://mastodon.social/@Viss/115923109466960526https://sean.heelan.io/2026/01/18/on-the-coming-industrialisation-of-exploit-generation-with-llms/https://bsky.app/profile/aparker.io/post/3mcqehqhcgc2qWorried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

Happy New Year! Jeremy kicks off 2026 with a special extended episode to catch up on everything that happened while the industry was on holiday. From humanoid robots to new global protocols for "Agentic Commerce," AI adoption is accelerating at an unprecedented pace.Market & Strategic Trends:Explosive Growth: AI consumption has tripled over the last year, with user prompt volume growing 6x.Specialized Foundations: We are seeing a shift from general-purpose models to domain-specific LLMs, such as Nvidia's Alpamayo for autonomous vehicles.Agentic Commerce: Google has announced a new protocol designed to facilitate interactions between AI shopping agents and retail systems.Regulatory Landscape: New York has introduced the RAISE Act for AI security, while Italy is challenging Meta's "walled garden" approach to AI chatbots on WhatsApp.Critical Vulnerabilities & Research:Prompt Injection is "Inherent": OpenAI researchers suggest that agentic browsers may be inherently vulnerable to indirect prompt injection due to their need to process external instructions.Supply Chain Risks: Major vulnerabilities were identified in LangChain (API serialization issues) and n8n (max severity RCE), both core tools for building AI workflows.Shadow AI Attacks: Over 91,000 attack sessions were detected targeting AI deployments, including Server-Side Request Forgery (SSRF) campaigns launched via Llama.Episode Linkshttps://securityboulevard.com/2026/01/report-increase-usage-of-generative-ai-services-creates-cybersecurity-challenge/https://techcrunch.com/2026/01/05/boston-dynamicss-next-gen-humanoid-robot-will-have-google-deepmind-dna/https://techcrunch.com/2026/01/05/nvidia-launches-alpamayo-open-ai-models-that-allow-autonomous-vehicles-to-think-like-a-human/https://techcrunch.com/2026/01/11/google-announces-a-new-protocol-to-facilitate-commerce-using-ai-agents/https://techcrunch.com/2025/12/20/new-york-governor-kathy-hochul-signs-raise-act-to-regulate-ai-safety/https://techcrunch.com/2025/12/24/italy-tells-meta-to-suspend-its-policy-that-bans-rival-ai-chatbots-from-whatsapp/https://github.com/asgeirtj/system_prompts_leaks/https://techcrunch.com/2025/12/22/openai-says-ai-browsers-may-always-be-vulnerable-to-prompt-injection-attacks/https://techcrunch.com/2026/01/04/french-and-malaysian-authorities-are-investigating-grok-for-generating-sexualized-deepfakes/https://www.bleepingcomputer.com/news/security/max-severity-ni8mare-flaw-lets-hackers-hijack-n8n-servers/https://aws.amazon.com/security/security-bulletins/rss/2026-001-aws/https://securityboulevard.com/2026/01/google-gemini-ai-flaw-could-lead-to-gmail-compromise-phishing-2/https://www.scworld.com/brief/severe-ask-gordon-ai-vulnerability-addressed-by-dockerhttps://www.eweek.com/news/langchain-ai-vulnerability-exposes-apps-to-hack/https://cybernews.com/security/dig-ai-new-cyber-weapon-abused-by-hackers/https://cyberpress.org/hackers-actively-exploit-ai-deployments/

In this kick-off episode for 2026, Jeremy is joined by the legendary Mikko Hypponen, Chief Research Officer at Sensofusion, for a comprehensive retrospective of 2025 and a look ahead at the future of AI-driven threats. Mikko, now a "Mount Rushmore" guest of the show, shares insights from his transition into the anti-drone space while reflecting on a year defined by massive infrastructure disruptions.The duo discusses the staggering impact of 2025 ransomware incidents, most notably the Jaguar Land Rover breach, which halted production for six weeks and cost an estimated £1.5 billion. Mikko argues that these events prove cybersecurity is no longer just about protecting computers—it’s about securing society itself. They also break down the "random shotgun" nature of modern attacks, where gangs like Clop and Akira target vulnerabilities rather than specific industries or geographies.Turning to AI, Mikko provides a reality check on the current state of deepfakes and automated orchestration. He reflects on the first massive AI-orchestrated cyber espionage campaign of 2025 and explains why the battle between open-source and closed-source models will define the next phase of defense. Finally, they examine how "data is the new oil" and AI is the "new oil refinery," creating a dual-extortion landscape where the risk of data leakage often outweighs the cost of downtime.About MikkoMikko Hypponen is a world-renowned global security expert, author, and speaker with over 35 years of experience in the industry. In August 2025, Mikko transitioned from his long-standing tenure at WithSecure to become the Chief Research Officer at Sensofusion, a Finnish company specializing in advanced anti-drone technologies.Mikko has assisted law enforcement in the U.S., Europe, and Asia on major cybercrime cases since the 1990s and is the curator of the Malware Museum at the Internet Archive. He is the author of the best-selling book "If It's Smart, It's Vulnerable" and a frequent contributor to The New York Times, Wired, and Scientific American. In addition to his role at Sensofusion, Mikko serves as an advisor to Firetail.Episode Linkshttps://sensofusion.com/https://mikko.com/https://www.firetail.ai/ai-breach-trackerhttps://www.anthropic.com/news/disrupting-AI-espionage

In the final episode of 2025, Jeremy examines the evolution of SEO poisoning into "AI poisoning," a major privacy breach involving a popular browser extension, and shares a data-driven "sneak peek" at the state of AI security over the past year.Key Stories & Developments:AI Poisoning of Search Results: Researchers identified an attack where threat actors plant false information online to trick AI-powered search engine crawlers. This results in search engines providing AI summaries that list scam phone numbers for legitimate services like airline call centers, effectively creating a modern, AI-driven version of SEO poisoning.The "Pay-to-Crawl" Proposal: Jeremy discusses a new proposal from Creative Commons that suggests moving away from outright blocking AI crawlers. Instead, website owners could set a price for crawling and training, allowing organizations to monetize the use of their data by LLM providers.Urban VPN Privacy Breach: A popular Chrome and Edge extension, Urban VPN Proxy, was caught intercepting and reading the AI chat messages of its 7.3 million users. This incident highlights the risk of third-party browser extensions reading sensitive data that users assume is private.2025 in Review Snapshot: Using data from the Firetail AI Incident Tracker, Jeremy reveals two major trends from 2025:The Surge in Incidents: AI security incidents saw a massive jump from 2024 to 2025, marking this as the year AI-related security became a global, pervasive problem.Disclosure vs. Injection: While the OWASp Top 10 lists prompt injection as the #1 risk, the tracker data shows that sensitive information disclosure (largely due to organizational error) actually outstrips prompt injection by about a third.Episode Linkshttps://finance.yahoo.com/news/aurascape-researchers-expose-ai-attack-140000260.html?guccounter=1https://techcrunch.com/2025/12/15/creative-commons-announces-tentative-support-for-ai-pay-to-crawl-systems/https://thehackernews.com/2025/12/featured-chrome-browser-extension.htmlhttps://www.firetail.ai/ai-breach-tracker

In this episode of Modern Cyber, Jeremy is joined by Chris Parker, the founder of WhatIsMyIPAddress.com, one of the most visited websites in the world. With over 13 million monthly visitors, Chris has spent more than 25 years helping people understand their digital presence and protect their online privacy. The conversation dives into the fascinating 26-year history of the site—from its start as a simple hobby on a home Windows NT box to becoming a global authority on cybersecurity. Chris shares "war stories" from the early days of the web, including dealing with notoriously verbose log files that filled entire hard drives and managing a home data center that maxed out local copper lines. Chris and Jeremy also explore the modern landscape of digital privacy, discussing the balance between transparency and anonymity. They cover practical topics like how scammers use urgency to fleece victims, the "supply chain" risks of website plugins, and Chris's "middle-ground" approach to privacy—avoiding both complete exposure and the "Faraday cage" lifestyle. About Chris ParkerChris Parker is the founder of WhatIsMyIPAddress.com, one of the world’s most visited websites, helping more than 13 million people each month safeguard their digital privacy. Chris has become the go-to expert on protecting yourself in the digital age, whether from scammers, data miners, or privacy threats you didn't know existed. He is the author of Privacy Crisis: How to Maintain Your Privacy Without Becoming a Hermit, and host of The Easy Prey Podcast. Episode LinksWebsite: https://www.privacycrisis.com LinkedIn: https://www.linkedin.com/in/christophergparker/ Podcast: https://www.easyprey.com/

In this week's episode, Jeremy focuses on the escalating threat of prompt injection across the enterprise, the introduction of a new OWASP Top 10 list, and a surprising advisory from Gartner.Prompt Injection & RCE:PromptPwnd: A vulnerability in GitHub Actions allows attackers to use malicious commit messages to perform prompt injection against AI agents, executing privileged tools and leaking secrets from CI/CD pipelines.IDE Attack Surface: Similar prompt injection flaws were identified in popular development environments and extensions (Cursor, Copilot, Z-Ro), showing how malicious prompts can bypass guardrails and hijack context within the IDE.GeminiJack: A "zero-click" vulnerability in Google Gemini Enterprise and Vertex AI Search allowed attackers to embed indirect prompt injections in shared documents (Gmail, Calendar, Docs). A routine employee search would activate the attack, causing the AI to exfiltrate sensitive corporate data.Industry Shifts:Gartner's Advisory: Gartner issued an unusual strong advisory recommending that CISOs block all AI browsers (like ChatGPT Atlas and Perplexity Comet) for the foreseeable future due to inherent security risks, including data leakage, credential abuse, and autonomous rogue actions.New OWASp Top 10: The OWASp Top 10 for Agentic Applications was released, focusing on risks unique to autonomous, tool-using systems, such as Agent Goal Hijack, Identity and Privilege Abuse, and Agentic Supply Chain Vulnerabilities.Episode Links:https://gbhackers.com/prompt-injection-vulnerability-in-github-actions/https://thehackernews.com/2025/12/researchers-uncover-30-flaws-in-ai.htmlhttps://securityboulevard.com/2025/12/indirect-malicious-prompt-technique-targets-google-gemini-enterprise/https://securityboulevard.com/2025/12/gartners-ai-browser-ban-rearranging-deck-chairs-on-the-titanic/https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/++++++++++Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this week's episode, Jeremy dissects two critical security issues and shares key strategic takeaways from the recent Ascent Community Summit on Advancing AI Security.Security Incidents & Research:OpenAI Third-Party Breach: We examine the security incident where OpenAI was affected by a third-party breach via the Mixpanel analytics platform. While customer PII was exposed, prompt and data content was not impacted. Jeremy notes that the API was the attack surface, reinforcing a recurring theme in AI-related incidents.Adversarial Poetry: We break down a fascinating academic paper demonstrating that embedding malicious prompts inside poetry is a successful technique for bypassing LLM guardrails. In some models, this "adversarial poetry" increased the Attack Success Rate (ASR) by over 60%, showing how context manipulation can trick frontier models.Ascent Community Summit Takeaways: Jeremy shares high-level insights from the summit (co-hosted by Paladin and Georgia Tech), focusing on securing critical sectors (Defense, Infrastructure, Healthcare). Key themes include:Core Requirements for AI: The need for math expertise, dedicated compute infrastructure, massive data access, and specialized people.The New Perimeter: Discussion shifted from "identity as the perimeter" to data being the key asset and central focus for security controls.Supply Chain Risks: The societal impact of the AI boom, including increased strain on electricity, cooling, and bandwidth for data center infrastructure.Brakes on a Fast Car: The CISO's role is framed as enabling maximum speed while having the ability to act as the "brakes on a very fast moving car" (Dundee West, GSK), emphasizing rapid response over stagnation.Episode Linkshttps://openai.com/index/mixpanel-incident/https://arxiv.org/pdf/2511.15304https://sites.gatech.edu/asccent/summit/------Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this week's episode, Jeremy covers seven stories that highlight the continuing pattern of API-level risks, the rise of multi-agent threats, and new academic insights into LLM fundamentals.Key stories include:RCE via PyTorch: A high-severity vulnerability (with an assigned CVE) was discovered in the widely-used PyTorch package, enabling Remote Code Execution (RCE) through malicious payloads at the API layer. This reinforces the trend of the API being the primary attack surface for AI applications.AI Browser Local Command Execution: Researchers found an API flaw in AI browsers that allowed a malicious instruction set to execute local commands on a user's machine via an embedded extension.Klein Bot Vulnerabilities: An open-source coding agent was found to have multiple security flaws, including the exfiltration of API keys and the disclosure of its underlying model (Grok), validating OWASp's risk categories.Multi-Agent Risk in ServiceNow: Researchers demonstrated that in ServiceNow’s new A-to-A agentic workflows, default configurations place agents in the same network, allowing them to communicate and be exploited using the privileges of the human user who created them.The "Subspace Problem" of Red Teaming: Academic research argues that current LLM red teaming methods are flawed because they test human language, not the numerical token strings the LLM actually processes, meaning predictable token-level vulnerabilities remain hidden.AI Evaluation Shift: A paper argues that non-deterministic LLM environments require a shift away from binary "yes/no" security checks (like traditional network security) toward scenario-based testing for better risk evaluation.Positive ROI of AI in Security: A Google paper provides positive data for early movers, showing that AI can triage at least 50% of security incidents, leading to reduced human workloads and faster response times, providing a strong case for simple, prompt-based AI improvements in security operations.------Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this episode of Modern Cyber, Jeremy is joined by Adam Pilton, a cybersecurity expert with a background of 15 years in law enforcement, where his final role was as a Detective Sergeant leading the Covert Operations and Cybercrimes team. Drawing on his unique experience investigating and prosecuting hundreds of offenders, Adam provides a frontline perspective on the current state of cybercrime, noting that cybercriminals are "getting better and stronger" while individuals and businesses are "not keeping up".The conversation focuses on the human and organizational challenges in cybersecurity, stressing that small businesses should abandon the belief that they are too small to be targeted, as attackers "hit small businesses all day long" for incremental profit. Adam discusses the severe practical impacts of attacks, warning that businesses must "expect downtime" and be prepared for the significant time needed for recovery. He advocates for storytelling and analogies (like the comparison of hacking to a burglary) over technical regulations to build a strong security culture.Adam also shares insights from his post-law enforcement work as an auditor and consultant, highlighting the common organizational "motivation problem" where people acknowledge the risk but delay action, comparing it to perpetually starting a diet "tomorrow". Finally, he addresses the breakdown of trust in the age of deepfakes (citing the Irish election example) and the critical need for continuous tabletop exercises to test communication and expose "little gaps" before a crisis hits.Guest Bio – Adam Pilton With a background of 15 years in law enforcement, Adam's final role was as a Detective Sergeant leading the Covert operations and Cyber Crime teams. Since then, Adam has worked in cyber security since 2016 across various roles and has a broad understanding of cyber security, from the impact of cyber crime upon individuals and businesses to the need to convey the right messages to senior leaders and end users, ensuring engagement and support.As a subject matter expert in multiple areas for a large organisation, Adam has investigated and supervised hundreds of cases, identifying and prosecuting offenders. He has introduced digital tactics into overt and covert investigations, developing digital capabilities. Adam also held responsibility for training, utilising his communication skills to simplify the complex.Adam has worked with multi-national businesses developing their people and processes to improve their cyber security maturity.Episode Links https://heimdalsecurity.com/https://www.linkedin.com/in/adampilton/

In this week's episode, Jeremy covers two major and critical developments that underscore the need to harden the foundational components of AI systems and recognize the reality of AI-orchestrated attacks.First, we analyze Shadow MQ, a vulnerability discovered by Oligo that affects multiple popular AI tools, including those from Nvidia and Meta Llama. The flaw stems from the mass reuse of core, insecure components—specifically, an unsafe Python pickle deserialization technique—in the underlying plumbing of various LLMs. This vulnerability allows attackers to inject malicious commands, potentially leading to Remote Code Execution (RCE) and Privilege Escalation at the API layer.Second, we dive deep into the first publicly confirmed, AI-orchestrated cyber espionage campaign, detailed in a threat intelligence report from Anthropic. The state-sponsored campaign used a frontier AI model to accelerate nearly every phase of the attack, including:Weaponized System Prompts: Attackers defined a persona ("senior cyber operations specialist") to guide the LLM's malicious behavior.AI-Driven Evasion: The AI was used to refine malware and bypass EDR solutions.AI-Powered Reconnaissance: The model performed vulnerability research on obscure protocols and orchestrated lateral movement within networks.Jeremy emphasizes that this report is a wake-up call, validating the core risks around AI adoption and proving that malicious AI usage is now a real-world reality.Episode Links:https://www.oligo.security/blog/shadowmq-how-code-reuse-spread-critical-vulnerabilities-across-the-ai-ecosystemhttps://assets.anthropic.com/m/ec212e6566a0d47/original/Disrupting-the-first-reported-AI-orchestrated-cyber-espionage-campaign.pdf------Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this episode of Modern Cyber, Jeremy is joined by Ben Wilcox, the unique combination of CTO and CISO at ProArch, to discuss navigating the critical intersection of speed, risk, and security in the era of AI. Ben shares his perspective as a long-time practitioner in the Microsoft ecosystem, emphasizing that the security stack must evolve with each major technology shift—from on-prem to cloud to AI.The conversation focuses on how to help customers achieve "data readiness" for AI adoption, particularly stressing that organizational discipline (like good compliance) is the fastest path to realizing AI's ROI. Ben reveals that the biggest concern he hears from enterprise customers is not LLM hallucinations or bias, but the risk of a major data breach via new AI services. He explains how ProArch leverages the comprehensive Microsoft security platform to provide centralized security and identity control across data, devices, and AI agents, ensuring that user access and data governance (Purview) trickle down through the entire stack.Finally, Ben discusses the inherent friction of his dual CISO/CTO role, explaining his philosophy of balancing rapid feature deployment with risk management by defining a secure "MVP" baseline and incrementally layering on controls as product maturity and risk increase.About Ben WilcoxBen Wilcox is the Chief Technology Officer and Chief Information Security Officer at ProArch, where he leads global strategy for cloud modernization, cybersecurity, and AI enablement. With over two decades of experience architecting secure digital transformations, Ben helps enterprises innovate responsibly while maintaining compliance and resilience. He’s recently guided Fortune 500 clients through AI adoption and zero-trust initiatives, ensuring that security evolves in step with rapid technological change.Episode Linkshttps://www.proarch.com/https://www.linkedin.com/in/ben-wilcox/https://ignite.microsoft.com/en-US/home

In this week's episode, Jeremy covers seven significant stories and academic findings that reveal the escalating risks and new attack methods targeting Large Language Models (LLMs) and the broader AI ecosystem.Key stories include:Prompt Flux Malware: Google Threat Intelligence Group (GTAG) discovered a new malware family called Prompt Flux that uses the Google Gemini API to continuously rewrite and modify its own behavior to evade detection—a major evolution in malware capabilities.ChatGPT Leak: User interactions and conversations with ChatGPT have been observed leaking into Google Analytics and the Google Search Console on third-party websites, potentially exposing the context of user queries.Traffic Analysis Leaks: New research demonstrates that observers can deduce the topics of a conversation in an LLM chatbot with high accuracy simply by analyzing the size and frequency of encrypted network packets (token volume), even without decrypting the data.Secret Sprawl: An analysis by Wiz found that several of the world's largest AI companies are leaking secrets and credentials in their public GitHub repositories, underscoring that the speed of AI development is leading to basic, repeatable security mistakes.Non-Deterministic LLMs: Research from Anthropic highlights that LLMs are non-deterministic and highly unreliable in describing their own internal reasoning processes, giving inconsistent responses even to minor prompt variations.The New AI VSS: The OWASp Foundation unveiled the AI Vulnerability Scoring System (AI VSS), a new framework to consistently classify and quantify the severity (on a 0-10 scale) of risks like prompt injection in LLMs, helping organizations make better risk-informed decisions.Episode Links:https://cybersecuritynews.com/promptflux-malware-using-gemini-api/https://thehackernews.com/2025/11/microsoft-uncovers-whisper-leak-attack.html https://arstechnica.com/ai/2025/11/llms-show-a-highly-unreliable-capacity-to-describe-their-own-internal-processes/ https://futurism.com/artificial-intelligence/llm-robot-vacuum-existential-crisis https://www.scworld.com/resource/owasp-global-appsec-new-ai-vulnerability-scoring-system-unveiled https://arstechnica.com/tech-policy/2025/11/oddest-chatgpt-leaks-yet-cringey-chat-logs-found-in-google-analytics-tool/ https://www.securityweek.com/many-forbes-ai-50-companies-leak-secrets-on-github/

In this week's episode, Jeremy looks at three compelling stories and a significant academic paper that illustrate the accelerating convergence of AI, APIs, and network security.API Exposure in AI Services: We discuss a path traversal vulnerability that led to the discovery of 3,000 API keys in a managed AI hosting service, underscoring that the API remains the exposed attack surface where data exfiltration occurs.AI Code Agent Traffic Analysis: Drawing on research from Chaser Systems, Jeremy breaks down the network traffic from popular AI coding agents (like Copilot and Cursor). The analysis reveals that sensitive data, including previous conversation context and PII, is repeatedly packaged and resent with every subsequent request, making detection and leakage risk significantly higher.LLM-Powered Malware: We cover a groundbreaking discovery by the Microsoft Incident Response Team (DART): malware using the OpenAI Assistants API as its Command and Control (C2) server. This new category of malware replaces traditional hard-coded instructions with an LLM-driven "brain," giving it the potential to coordinate malicious activity with context, creativity, and adaptability.The Guardrail Fallacy: Finally, Jeremy discusses an academic paper showing that strong, adaptive attacks can bypass LLM defenses against Jailbreaks and Prompt Injections with an Attack Success Rate (ASR) of over 90%. The research argues that simple guardrails provide organizations with a dangerous false sense of security.Episode Linkshttps://chasersystems.com/blog/what-data-do-coding-agents-send-and-where-to/https://embracethered.com/blog/posts/2025/claude-abusing-network-access-and-anthropic-api-for-data-exfiltration/ https://arxiv.org/pdf/2510.09023https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/------Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

In this week's episode, Jeremy focuses on two rapidly evolving areas of AI security: the APIs that empower AI services and the risks emerging from new AI Browsers.We analyze two stories highlighting the exposure of secrets and sensitive data:API Insecurity: A path traversal vulnerability was discovered in the APIs powering an MCP server hosting service, leading to the exposure of 3,000 API keys. This reinforces the lesson that foundational security mistakes, such as inadequate secret management and unpatched vulnerabilities, are being repeated in the rush to launch new AI services.CVE in Google Cloud Vertex AI: We discuss a confirmed CVE in Google's Vertex AI service APIs. This vulnerability briefly allowed requests made by one customer's application to be routed and responded to another customer's account, risking exposure of sensitive corporate data and intellectual property in a multi-tenant SaaS environment.Finally, we explore the risks of AI Browsers (like the ChatGPT Atlas or Perplexity Comet browser) and AI Sidebars. These agents, designed to act with agency on a user's behalf (e.g., price comparison), are vulnerable to techniques that can reveal sensitive PII and user credentials to malicious websites, or unwittingly download malware.Episode Linkshttps://blog.gitguardian.com/breaking-mcp-server-hosting/https://cloud.google.com/support/bulletins#gcp-2025-059https://fortune.com/2025/10/23/cybersecurity-vulnerabilities-openai-chatgpt-atlas-ai-browser-leak-user-data-malware-prompt-injection/https://securityboulevard.com/2025/10/news-alert-squarex-reveals-new-browser-threat-ai-sidebars-cloned-to-exploit-user-trust/https://techcrunch.com/2025/10/25/the-glaring-security-risks-with-ai-browser-agents/____________Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of FireTail's AI Security & Governance Platform

In this week's episode, recorded live from the inaugural AI Security Summit hosted by Snyk, Jeremy reports on the latest threats and strategic discussions shaping the industry. Covering multiple instances of "old risks" reappearing in new AI contexts...The Salesforce "forced leak" vulnerability, where an AI agent was exposed to malicious prompt injection via seemingly innocuous text fields on web forms (a failure of input sanitization).Research from Nvidia detailing waterhole attacks where malicious code (e.g., PowerShell) is hidden in decoy libraries (like "react-debug") that AI coding assistants might suggest to developers.A consumer AI girlfriend app that exposed customer chat data by storing conversations in an open Apache Kafka pipeline, demonstrating a basic failure of security hygiene under the pressure of rapid AI development.The "Glass Worm" campaign, where invisible Unicode control characters (similar to Ascii Smuggling research by Firetail) were used to embed malware in a VS Code plugin, proving the invisible code risk is actively being leveraged in development tools.Finally, Jeremy shares strategic insights from the summit, including the massive projected growth of the AI market (approaching the size of cloud computing), the urgency of data readiness and governance to prevent model poisoning, and the futurist perspective that AI's accelerated skill acquisition (potentially surpassing humans in certain tasks in an 18-month cycle) will require human workers to constantly upskill and change roles more frequently.Episode Linkshttps://noma.security/blog/forcedleak-agent-risks-exposed-in-salesforce-agentforce/https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplacehttps://developer.nvidia.com/blog/from-assistant-to-adversary-exploiting-agentic-ai-developer-tools/https://www.foxnews.com/tech/ai-girlfriend-apps-leak-millions-private-chatshttps://layerxsecurity.com/blog/cometjacking-how-one-click-can-turn-perplexitys-comet-ai-browser-against-you/Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform