Anthropic’s Project Glasswing is an Infosec Turning Point – 2026-04-13

This episode dives into Anthropic’s “Project Glasswing” and the broader implications of AI-driven offensive security, including models autonomously discovering vulnerabilities and attempting sandbox escapes. The hosts discuss how agentic AI testing approaches could reshape vulnerability research, while also raising concerns about AI safety, regulation, and real-world risk. Additional topics include the growing impact of AI on security workflows, rising infrastructure costs tied to AI demand, a new infostealer ecosystem overview, and ongoing debates about data collection practices and platform privacy.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — A Real Studio (03:43) - Anthropic’s Project Glasswing is an Infosec Turning Point – 2026-04-13 (05:39) - Story # 1: Project Glasswing (22:20) - Story # 2: AI-Led Remediation Crisis Prompts HackerOne to Pause Bug Bounties (30:36) - Story # 3: Disgruntled researcher leaks “BlueHammer” Windows zero-day exploit (32:39) - WEBCAST: Proxy Execution with Microsoft Edge WebView2 w/ Matthew Eidelberg (51:47) - Story # 4: New "BrowserGate" report claims LinkedIn secretly scans user browsers for installed extensions and collects device data (56:32) - Story # 5: The silent “Storm”: New infostealer hijacks sessions, decrypts server-side (58:46) - ChickenSec: the Chicken Accords of 2026 (01:00:27) - Story # 6: EFF is Leaving X (01:03:01) - Workshop: How to Think Like a Cybersecurity Defender (01:05:49) - AI Security Ops Podcast LinksStory # 1: Project GlasswingStory # 2: AI-Led Remediation Crisis Prompts HackerOne to Pause Bug BountiesStory # 3: Disgruntled researcher leaks “BlueHammer” Windows zero-day exploitWEBCAST: Proxy Execution with Microsoft Edge WebView2 w/ Matthew EidelbergStory # 4: New “BrowserGate” report claims LinkedIn secretly scans user browsers for installed extensions and collects device dataStory # 5: The silent “Storm”: New infostealer hijacks sessions, decrypts server-sideChickenSec: the Chicken Accords of 2026Story # 6: EFF is Leaving XWorkshop: How to Think Like a Cybersecurity DefenderAI Security Ops PodcastCreators & Guests Corey Ham - Host Wade Wells - Host Alex Minster "Belouve" - Guest Bronwen Aker - Host Ralph May - Host John Strand - Host Doc Blackburn - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com

This episode covers several major cybersecurity and tech news stories, including a sophisticated NPM supply chain attack that compromised the widely used Axios library through advanced social engineering, and the broader implications for software security. The hosts also discuss the accidental leak of Anthropic’s Claude codebase, what it reveals about AI development practices, and the risks of misconfigurations exposing sensitive systems. Additional conversation touches on AI reliability, “vibe-coded” software, and the growing role of AI in both development and attack techniques.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Professional Sitters (04:36) - Artemis Astronaut's Bad Outlooks - 2026-04-06 (07:12) - The Absolute Truths of Cybersecurity with Doc Blackburn (08:52) - Professionally Evil API Testing: AAA and Keys are Not Just for Cars (09:35) - Story # 1: Post Mortem: axios npm supply chain compromise (19:54) - Story # 2: Artemis II astronaut: 'I have two Microsoft Outlooks, and neither one of those are working' (26:02) - Story # 3: Microsoft Copilot Terms of Service Label Copilot is for Entertainment Purposes Only (30:13) - Story # 4: Here’s what that Claude Code source leak reveals about Anthropic’s plans (35:03) - Story # 4b: https://neuromatch.social/@jonny/116325123136895805 (37:57) - Story # 5: Meta freezes AI data work after breach puts training secrets at risk (41:40) - Story # 6: Possible US Government iPhone Hacking Tool Leaked (44:32) - Story # 7: FBI labels data breach ‘major incident,’ notifies Congress (46:58) - Story # 8: vSphere and BRICKSTORM Malware: A Defender's Guide (52:12) - Story # 9: CBP Facility Codes Sure Seem to Have Leaked Via Online Flashcards (01:04:26) - ChickenSec: Why did the chicken wear a reflective vest? To cross the road of course LinksThe Absolute Truths of Cybersecurity with Doc BlackburnProfessionally Evil API Testing: AAA and Keys are Not Just for CarsStory # 1: Post Mortem: axios npm supply chain compromiseStory # 2: Artemis II astronaut: ‘I have two Microsoft Outlooks, and neither one of those are working’Story # 3: Microsoft Copilot Terms of Service Label Copilot is for Entertainment Purposes OnlyStory # 4: Here’s what that Claude Code source leak reveals about Anthropic’s plansStory # 4b: https://neuromatch.social/@jonny/116325123136895805Story # 5: Meta freezes AI data work after breach puts training secrets at riskStory # 6: Possible US Government iPhone Hacking Tool LeakedStory # 7: FBI labels data breach ‘major incident,’ notifies CongressStory # 8: vSphere and BRICKSTORM Malware: A Defender’s GuideStory # 9: CBP Facility Codes Sure Seem to Have Leaked Via Online FlashcardsChickenSec: Why did the chicken wear a reflective vest? To cross the road of courseCreators & Guests Jennifer Shannon - Guest Wade Wells - Host Corey Ham - Host Ralph May - Host Ryan Poirier - Producer Bronwen Aker - Host Doc Blackburn - Guest Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com

This episode covers the FCC’s move to restrict or ban certain foreign-made networking equipment—especially routers tied to Chinese manufacturers—highlighting the potential cybersecurity risks, supply chain implications, and how the rule could affect ISPs and consumers. The hosts also discuss broader concerns around hardware trust, existing infrastructure, and what qualifies as “approved” devices under FCC guidelines, along with a brief, lighter mention of a viral robot incident making the rounds online.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Robot Handlers (05:11) - FCC Blocks Foreign-Made Routers – 2026-03-30 (06:44) - Story # 1: FCC moves to block new foreign-made routers (17:00) - Story # 2: FBI Chief Kash Patel’s Gmail Account was Hacked by Iranian Hackers (20:07) - Story # 3: FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage Ops (24:18) - Story # 4: LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaign (27:49) - Story # 4b: TeamPCP Supply Chain Campaign (42:45) - Story # 5: Spylandia: How a Stretch of Florida Real Estate Has Become a Covert Corridor for Chinese and Russian Spies (45:51) - Story # 6: Anthropic readies Mythos model with high cybersecurity risk (57:31) - Story # 7: Google Ships WebMCP, The Browser-Based Backbone For The Agentic Web (01:02:24) - Story # 8: DDR5 Memory Prices Just Took a Noticeable Dive for the First Time in Months, and Google’s TurboQuant Might Be Behind It (01:04:03) - Securing the Cloud: Foundations by Andrew Krug (01:04:47) - Incident Response Simplified by Patterson Cake News LinksStory # 1: FCC moves to block new foreign-made routersStory # 2: FBI Chief Kash Patel’s Gmail Account was Hacked by Iranian HackersStory # 3: FancyBear Exposed: Major OPSEC Blunder Inside Russian Espionage OpsStory # 4: LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP supply chain campaignStory # 4b: TeamPCP Supply Chain CampaignStory # 5: Spylandia: How a Stretch of Florida Real Estate Has Become a Covert Corridor for Chinese and Russian SpiesStory # 6: Anthropic readies Mythos model with high cybersecurity riskStory # 7: Google Ships WebMCP, The Browser-Based Backbone For The Agentic WebStory # 8: DDR5 Memory Prices Just Took a Noticeable Dive for the First Time in Months, and Google’s TurboQuant Might Be Behind ItSecuring the Cloud: Foundations by Andrew KrugIncident Response Simplified by Patterson CakeCreators & Guests Andy Pettit "Nerf" - Guest Andrew Krug - Guest Wade Wells - Host Corey Ham - Host Bronwen Aker - Host Patterson Cake - Guest Ryan Poirier - Producer Ralph May - Host Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com

This episode covers a range of cybersecurity and AI-related news, including how Pokémon Go players may have unknowingly helped train delivery robots using massive image datasets. The hosts also discuss the Pentagon’s reported plans to train AI systems on classified data and the potential risks of exposing sensitive information. Additional topics include major data breaches (such as a third-party breach impacting Crunchyroll user data), ongoing challenges in cybersecurity practices, evolving AI security concerns, and real-world examples of exploits and vulnerabilities affecting mobile devices and organizations.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Easier Than Printers (05:20) - Pentagon Plans to Train AI With Classified Data – BHIS - Talkin' Bout [infosec] News 2026-03-23 (06:38) - Story # 1: Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web (07:38) - Story # 1b: ALT Link - Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the Web (15:35) - Story # 2: Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anyway (24:31) - Story # 3: The Pentagon is planning for AI companies to train on classified data, defense official says (34:04) - Story # 4: CISA Urges Endpoint Management System Hardening After Cyberattack Against US Organization (37:50) - Story # 5: Warning: Your AI-Generated Password Is a Major Security Risk. Here’s What to Use Instead (42:21) - Story # 6: CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963) (49:57) - Story # 7: Massive China Data Leak: Hackers Access 10 Petabytes of Weapons Testing Data (51:28) - Story # 8: Anime fans' credit cards might be stolen from Sony streamer Crunchyroll (55:03) - Story # 9: The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors LinksStory # 1: Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the WebStory # 1b: ALT Link - Sears Exposed AI Chatbot Phone Calls and Text Chats to Anyone on the WebStory # 2: Federal cyber experts called Microsoft’s cloud a “pile of shit,” approved it anywayStory # 3: The Pentagon is planning for AI companies to train on classified data, defense official saysStory # 4: CISA Urges Endpoint Management System Hardening After Cyberattack Against US OrganizationStory # 5: Warning: Your AI-Generated Password Is a Major Security Risk. Here’s What to Use InsteadStory # 6: CISA warns of active exploitation of Microsoft SharePoint vulnerability (CVE-2026-20963)Story # 7: Massive China Data Leak: Hackers Access 10 Petabytes of Weapons Testing DataStory # 8: Anime fans’ credit cards might be stolen from Sony streamer CrunchyrollStory # 9: The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat ActorsCreators & Guests John Strand - Host Ralph May - Host Chadd Watson - Guest Wade Wells - Host Alex Minster "Belouve" - Guest Hayden Covington - Host Bruce Potter - Guest Ryan Poirier - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com

This episode covers multiple cybersecurity news stories, including Iranian hackers claiming responsibility for a cyberattack on Stryker, ongoing challenges in attributing nation-state cyber operations, and broader trends in global cyber conflict. The hosts also discuss the reliability of public breach claims, emerging threats targeting critical industries, and how organizations are responding to an increasingly complex threat landscape.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Organizing Family Beets (04:02) - Iranian Hackers Claim Responsibility for Stryker Attack - 2026-03-16 (08:56) - Story # 1: Iran-Backed Hackers Claim Wiper Attack on Medtech Firm Stryker (23:38) - Story # 2: How We Hacked McKinsey's AI Platform (32:30) - Story # 3: Amazon holds engineering meeting following AI-related outages (39:11) - Story # 4: Meta gets into social networks for AI agents with acquisition of viral Moltbook platform (45:24) - Story # 5: Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026 (50:45) - Story # 6: Michelin Confirms Data Breach Linked to Oracle EBS Attack (51:08) - Story # 7: New Dohdoor malware campaign targets education and health care (58:10) - Story # 8: Man's dog was riddled with tumors and dying. He used ChatGPT to design a custom cancer vaccine, stunning researchers LinksStory # 1: Iran-Backed Hackers Claim Wiper Attack on Medtech Firm StrykerStory # 2: How We Hacked McKinsey’s AI PlatformStory # 3: Amazon holds engineering meeting following AI-related outagesStory # 4: Meta gets into social networks for AI agents with acquisition of viral Moltbook platformStory # 5: Meta to Shut Down Instagram End-to-End Encrypted Chat Support Starting May 2026Story # 6: Michelin Confirms Data Breach Linked to Oracle EBS AttackStory # 7: New Dohdoor malware campaign targets education and health careStory # 8: Man’s dog was riddled with tumors and dying. He used ChatGPT to design a custom cancer vaccine, stunning researchersCreators & Guests Dan Rearden (Haircutfish) - Guest Bronwen Aker - Host Ralph May - Host John Strand - Host Troy Wojewoda - Guest Corey Ham - Host Hayden Covington - Host Wade Wells - Host Meagan Bentley - Producer Click here to watch this episode on YouTube. Click here to view the episode transcript. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com

Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — That's Not How It Works (03:40) - A Nightmare of Vibeware – 2026-03-09 (04:54) - Story # 1: APT36: A Nightmare of Vibeware (13:56) - Story # 2: Oracle Layoffs: Tech giant to slash 30,000 jobs as banks pull out from financing AI data centres (16:28) - Story # 3: Iran-linked hacktivist groups target US infrastructure after Feb 28 strikes, cyber activity surges: Report (24:28) - Story # 4: Introducing the First Frontier Suite built on Intelligence + Trust (28:59) - Story # 5: Motorola partners with GrapheneOS for future phones (29:13) - Story # 5b: GrapheneOS: Microsoft Authenticator does not support secure Android OS (29:53) - Story # 6: Western allies form 6G security coalition amid tech rivalry with China (34:01) - Story # 7: ShinyHunters claims ongoing Salesforce Aura data theft attacks (35:47) - Story # 8: Doppelgänger / RRN Disinformation Infrastructure Ecosystem 2026 (44:33) - Story # 9: LexisNexis confirms data breach as hackers leak stolen files (49:10) - Story # 10: Google urges Supreme Court to strike down geofence warrants as unconstitutional (55:59) - ANTI-CAST : How to Detect Malicious Remote Workers w/ James McQuiggan (56:47) - SOC Summit 2026 LinksStory # 1: APT36: A Nightmare of VibewareStory # 2: Oracle Layoffs: Tech giant to slash 30,000 jobs as banks pull out from financing AI data centresStory # 3: Iran-linked hacktivist groups target US infrastructure after Feb 28 strikes, cyber activity surges: ReportStory # 4: Introducing the First Frontier Suite built on Intelligence + TrustStory # 5: Motorola partners with GrapheneOS for future phonesStory # 5b: GrapheneOS: Microsoft Authenticator does not support secure Android OSStory # 6: Western allies form 6G security coalition amid tech rivalry with ChinaStory # 7: ShinyHunters claims ongoing Salesforce Aura data theft attacksStory # 8: Doppelgänger / RRN Disinformation Infrastructure Ecosystem 2026Story # 9: LexisNexis confirms data breach as hackers leak stolen filesStory # 10: Google urges Supreme Court to strike down geofence warrants as unconstitutionalANTI-CAST : How to Detect Malicious Remote Workers w/ James McQuigganTroy & Wade’s Upcoming Things:– Antisyphon Training SOC Summit 2026– Breach Assessment - The Curious Case of the Comburglar w/ Troy Wojewoda– Network Forensics and Incident Response with Troy Wojewoda🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com

Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Kerberoasting Too Hard (05:05) - Pentagon Declares Anthropic a Supply Chain Risk — Talkin’ Bout [infosec] News 2026-03-02 (08:40) - Story # 1: Pentagon Designates Anthropic Supply Chain Risk (17:27) - Story # 2: European Parliament blocks AI on lawmakers’ devices, citing security risks (21:23) - Story # 3: Mexican Government Breach and the Rise of Agentic Cyber Threats (22:58) - Story # 4: 2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack Surface (33:04) - Story # 5: Leak confirms GrapheneOS & Motorola partnership for non-Pixel hardware (38:24) - Story # 5b: Motorola announces a partnership with GrapheneOS Foundation, marking a new chapter in smartphone security and expanding its enterprise portfolio (39:21) - Story # 6: Immediate Action Required: CISA Issues Emergency Directive to Secure Cisco SD-WAN Systems (43:12) - Story # 7: Cops back Dutch telco Odido after second wave of ShinyHunters leaks (45:40) - Story # 8: Discord puts global age verification policy on hold after backlash (46:30) - Story # 9: A new California law says all operating systems, including Linux, need to have some form of age verification at account setup (51:51) - Story # 10: User accidentally gains control of over 6,700 robot vacuums (53:35) - Story # 11: App Warns You if Someone Is Wearing Smart Glasses Nearby (57:32) - Weekly CTF Winners (58:28) - Story # 12: Microsoft is blocking 'Microslop' comments in Copilot's official Discord server (59:01) - Story # 13: New AirSnitch attack bypasses Wi-Fi encryption in homes, offices, and enterprises LinksStory # 1: Pentagon Designates Anthropic Supply Chain RiskStory # 2: European Parliament blocks AI on lawmakers’ devices, citing security risksStory # 3: Mexican Government Breach and the Rise of Agentic Cyber ThreatsStory # 4: 2026 CrowdStrike Global Threat Report: AI Accelerates Adversaries and Reshapes the Attack SurfaceStory # 5: Leak confirms GrapheneOS & Motorola partnership for non-Pixel hardwareStory # 5b: Motorola announces a partnership with GrapheneOS Foundation, marking a new chapter in smartphone security and expanding its enterprise portfolioStory # 6: Immediate Action Required: CISA Issues Emergency Directive to Secure Cisco SD-WAN SystemsStory # 7: Cops back Dutch telco Odido after second wave of ShinyHunters leaksStory # 8: Discord puts global age verification policy on hold after backlashStory # 9: A new California law says all operating systems, including Linux, need to have some form of age verification at account setupStory # 10: User accidentally gains control of over 6,700 robot vacuumsStory # 11: App Warns You if Someone Is Wearing Smart Glasses NearbyStory # 12: Microsoft is blocking ‘Microslop’ comments in Copilot’s official Discord serverStory # 13: New AirSnitch attack bypasses Wi-Fi encryption in homes, offices, and enterprises🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com

In this episode:Agentic AI tools that can autonomously perform tasks like researching and booking flights, raising concerns about automated purchases, fraud, guardrails, and over-trust in AI systems.The idea of a coming “SaaS apocalypse,” where AI tools could replicate or replace many small- and mid-tier SaaS products by crawling and recreating their functionality—potentially disrupting payroll, accounting, and other service platforms.Android’s shift away from its open-platform roots, including concerns about reduced openness, developer anonymity in app stores, and the broader implications for privacy-focused users and alternative operating systems.Ongoing tensions in the tech ecosystem around platform control, openness, and general-purpose computing, particularly involving large vendors like Google, Apple, Oracle, and major cloud providers.Broader security implications of AI adoption, including hallucinations, accountability, and how organizations are integrating AI to cut costs versus innovate.The discussion centers strictly on these current tech news developments and their security, privacy, and market impact.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Take the interstate to Dubai (04:53) - The Coming SAAS Apocalypse - 2026-02-23 (07:39) - Story # 1: Keep Android Open (15:34) - Story # 2: Meta patents AI that takes over a dead person’s account to keep posting and chatting (21:13) - Story # 3: The Coming SaaS Apocalypse... (28:52) - Story # 4: Firm Data on AI (29:43) - Story # 4b: Thousands of CEOs just admitted AI had no impact on employment or productivity—and it has economists resurrecting a paradox from 40 years ago (36:15) - Story # 5: US Defense Secretary Hegseth summons Anthropic CEO for tough talks over military use of Claude, Axios reports (40:41) - Story # 6: Conduent data breach could be largest in U.S. history (43:13) - Story # 6: The Erosion of Agency and the New Burden on Leaders (46:02) - Story # 7: DSA-2026-079: Security Update for RecoverPoint for Virtual Machines Hardcoded Credential Vulnerability (48:30) - Story # 8: AI-augmented threat actor accesses FortiGate devices at scale (51:42) - Story # 9: I hacked ChatGPT and Google's AI - and it only took 20 minutes (01:03:07) - Antisyphon Training SOC Summit, March 25, 2026 (01:03:40) - Antisyphon Training: Attacking, Defending, and Leveraging AI-LLM Systems (01:03:58) - Antisyphon Workshop: Hacking AI-LLM Applications (01:04:27) - Antisyphon Anti-Cast: RED TEAMING AI: OWASP LLM TOP 10 WITH BRIAN AND DEREK (01:04:53) - PODCAST : A.I. Security Ops LinksStory # 1: Keep Android OpenStory # 2: Meta patents AI that takes over a dead person’s account to keep posting and chattingStory # 3: The Coming SaaS Apocalypse…Story # 4: Firm Data on AIStory # 4b: Thousands of CEOs just admitted AI had no impact on employment or productivity—and it has economists resurrecting a paradox from 40 years agoStory # 5: US Defense Secretary Hegseth summons Anthropic CEO for tough talks over military use of Claude, Axios reportsStory # 6: Conduent data breach could be largest in U.S. historyStory # 6: The Erosion of Agency and the New Burden on LeadersStory # 7: DSA-2026-079: Security Update for RecoverPoint for Virtual Machines Hardcoded Credential VulnerabilityStory # 8: AI-augmented threat actor accesses FortiGate devices at scaleStory # 9: I hacked ChatGPT and Google’s AI - and it only took 20 minutesAntisyphon Training SOC Summit, March 25, 2026Antisyphon Training: Attacking, Defending, and Leveraging AI-LLM SystemsAntisyphon Workshop: Hacking AI-LLM ApplicationsAntisyphon Anti-Cast: RED TEAMING AI: OWASP LLM TOP 10 WITH BRIAN AND DEREKPODCAST : A.I. Security Ops🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.comClick here to watch this episode on YouTube. Click here to view the episode transcript.

In this episode, the crew dives into reports that Palo Alto Networks allegedly avoided directly attributing a threat campaign to China over fears of retaliation—sparking a broader debate about corporate and government threat attribution, geopolitics, and whether attribution still matters in today’s cyber landscape.They also explore the escalating AI arms race, including Meta’s aggressive (and expensive) talent poaching, the growing rivalry between OpenAI and Anthropic, and what it all means for the future of the industry.Rounding out the episode, the team discusses the unintended consequences of the AI boom—like global hardware shortages stretching beyond GPUs to hard drives—and examines emerging prompt injection attack techniques, highlighting real-world examples and the growing security risks surrounding AI-powered tools.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Threat Actor Age Range (05:37) - Palo Alto Fears China Retaliation – 2026-02-16 (11:28) - Story # 1: Exclusive: Palo Alto chose not to tie China to hacking campaign for fear of retaliation from Beijing, sources say (16:01) - Story # 2: Rent a Human (20:39) - Story # 3: OpenClaw creator Peter Steinberger joining OpenAI, Altman says (24:31) - Story # 4: Western Digital runs out of HDD capacity: CEO says massive AI deals secured, price surges ahead (28:30) - Story # 5: GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial Use (30:32) - Story # 6: Data Exfil from Agents in Messaging Apps (32:15) - Story # 7: AMOS infostealer targets macOS through a popular AI app (39:25) - Story # 8: Discord Voluntarily Pushes Mandatory Age Verification Despite Recent Data Breach (46:11) - Story # 9: Vietnam bans unskippable online video ads longer than 5 seconds from next month (49:59) - Story # 10: SolarWinds Web Help Desk Exploitation - February 2026 (54:00) - Story # 11: Devilish devs spawn 287 Chrome extensions to flog your browser history to data brokers (58:13) - Story # 12: Snail mail letters target Trezor and Ledger users in crypto-theft attacks (01:00:59) - Eric's Workshop (01:01:31) - Jennifer's Workshop (01:04:36) - SOC Summit 2026 LinksStory # 1: Exclusive: Palo Alto chose not to tie China to hacking campaign for fear of retaliation from Beijing, sources sayStory # 2: Rent a HumanStory # 3: OpenClaw creator Peter Steinberger joining OpenAI, Altman saysStory # 4: Western Digital runs out of HDD capacity: CEO says massive AI deals secured, price surges aheadStory # 5: GTIG AI Threat Tracker: Distillation, Experimentation, and (Continued) Integration of AI for Adversarial UseStory # 6: Data Exfil from Agents in Messaging AppsStory # 7: AMOS infostealer targets macOS through a popular AI appStory # 8: Discord Voluntarily Pushes Mandatory Age Verification Despite Recent Data BreachStory # 9: Vietnam bans unskippable online video ads longer than 5 seconds from next monthStory # 10: SolarWinds Web Help Desk Exploitation - February 2026Story # 11: Devilish devs spawn 287 Chrome extensions to flog your browser history to data brokersStory # 12: Snail mail letters target Trezor and Ledger users in crypto-theft attacks01:01:00 - Eric’s Workshop01:01:31 - Jennifer’s Workshop01:04:37 - SOC Summit 2026Creators & Guests Corey Ham - Host Wade Wells - Host Bronwen Aker - Host Ralph May - Host Ched "cheddar" Wiggins - Guest Jennifer Shannon - Guest Eric Kuehn - Guest Click here to watch a video of this episode. 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.comClick here to view the episode transcript.

Live from Wild West Hackin’ Fest Denver 2026, the Black Hills Information Security crew brings their signature mix of sharp security insight and off-the-cuff banter to a packed in-person audience. This episode centers on a controversial Notepad update that introduced Markdown rendering—along with a potential remote code execution (RCE) issue. The hosts unpack what this says about modern software bloat, “vibe coding,” and the growing push to embed AI into everything—whether it belongs there or not. They also explore the implications of Discord's Age verification requirements, AI-generated code, including OpenAI’s latest Codex model, and debate whether we’re headed toward a wave of AI-assisted vulnerabilities.Join us LIVE on Mondays, 4:30pm EST.A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.https://www.youtube.com/@BlackHillsInformationSecurityChat with us on Discord! - https://discord.gg/bhis🔴live-chatChapters(00:00) - PreShow Banter™ — Corey Olympics (02:23) - Story # 1: Critical Notepad vulnerability reignites criticism of Microsoft’s forced AI features (07:42) - Story # 2: Discord will require a face scan or ID for full access next month (10:17) - Story # 3: 2026-01-14: The Day the telnet Died (15:04) - Story # 5: BeyondTrust Remote Access Products 0-Day Vulnerability Allows Remote Code Execution (16:32) - Story # GRITREP: 0APT and the Victims Who Weren’t (20:54) - The advanced advancement of AI models Click here to watch a video of this episode. Creators & Guests John Strand - Host Corey Ham - Host Derek Banks - Guest Andrew Krug - Guest Chadd Watson - Guest Hayden Covington - Host Click here to view the episode transcript. LinksStory # 1: Critical Notepad vulnerability reignites criticism of Microsoft’s forced AI featuresStory # 2: Discord will require a face scan or ID for full access next monthStory # 3: 2026-01-14: The Day the telnet DiedStory # 5: BeyondTrust Remote Access Products 0-Day Vulnerability Allows Remote Code ExecutionStory # GRITREP: 0APT and the Victims Who Weren’t🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.comBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.comAntisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com