AiCyber.Land #55 - OpenAI's Linux Bug Hunt & Safer Coding Agents

Sources & transcript: Episode #56 page Read transcript: https://share.transistor.fm/s/891bfa6c/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. Know what you have online—and what your AI assistant can reach. Shelby Pettit and Bryce Kunz discuss Daniel Miessler's three recommendations for “The Hackening”: inventory your online assets, reduce unnecessary internet exposure, and reassess small security vendors holding sensitive credentials. They cover practical asset registers, AI-assisted discovery, management-connection logs, Tailscale and Cloudflare Tunnels. Bryce challenges the vendor-size recommendation: bigger is not automatically safer, and security choices still need to fit your people, business strategy and risk appetite.[1] Then they unpack Profero's Grok Bot security assessment. Starting from one assumed hostile command inside an agent, researchers reported a path through a sandbox-reachable Docker API to that account's VM, exposed credentials and persistent storage. The discussion explores agent permissions, credential lifetime and limiting the blast radius of personal AI assistants.[2] Important scope: Profero did not demonstrate an escape into the underlying EC2 host or another customer's VM. The reported “local” token belongs to the sandbox exec daemon—not a customer's Grok login—and remote access also requires an account-specific routing token. This episode is a discussion of reported research, not an independently reproduced exploit or a report of a confirmed customer breach.[2] Source note: Profero's November 8 report said the findings remained unfixed. The on-air expectation of a vendor fix is not confirmation that one shipped; later remediation has not been independently verified here. Profero recommends dedicated agent identities, narrow connectors, and keeping production browser sessions and long-lived keys out of the sandbox.[2] Plus: Shelby's Magic Maze recommendation and Bryce's Godzilla review. KEY MOMENTS 0:00 Welcome, hype & getting older 1:10 Three security priorities for the hackening 1:48 Inventory your internet-facing assets 3:23 AI-assisted discovery & management-connection logs 4:20 Reduce unnecessary internet exposure 5:29 The small-vendor recommendation 6:20 Why bigger does not automatically mean safer 8:00 Security budgets, business strategy & risk appetite 9:43 Personal AI assistants & assumed compromise 10:51 Docker-daemon access & sandbox boundaries 12:35 Exposed secrets & persistent storage access 13:53 Agent blast radius & mission-critical data 15:08 Static passwords & security takeaways 15:55 Magic Maze: a silent cooperative heist 17:11 Bryce's Godzilla review 18:27 Wrapping up SOURCES DISCUSSED [1] Daniel Miessler — The Post-AI Security Floor (November 1, 2026) https://danielmiessler.com/blog/post-ai-security-floor [2] Profero / Omri Segev Moyal — The Rootkit Built Into Grok Bot (November 8, 2026) https://profero.io/blog/the-rootkit-built-into-grok-bot Which matters most in your environment: asset visibility, vendor access, or the reach of your AI assistants? Share your take and subscribe for more AI and cybersecurity discussions. Find the show: https://aicyber.land Topics: #AI #Cybersecurity #AIAgents #Grok

Sources & transcript: Episode #55 page Read transcript: https://share.transistor.fm/s/c3e4f779/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. What happens when AI can hunt for Linux vulnerabilities at scale—and your own coding agent can reach more files and credentials than you intended? Bryce Kunz and Shelby Pettit discuss OpenAI's reported Linux-kernel research: moving from candidate findings to working local privilege-escalation exploits, generating candidate patches, and the review work that still belongs to maintainers. They ask what increasingly capable exploit-finding agents could mean for defenders and software teams. Then Shelby walks through a Wiz security checklist for Claude Code: prompt and data egress, generated-code quality, hallucinated package dependencies, access control and secrets, and autonomous permission modes. The conversation covers slopsquatting, limiting an agent's blast radius, pre-tool hooks, local redaction workflows, and why AI-assisted reviews should complement—not replace—traditional security controls. Plus: small local models, Bryce's plans for recurring code and server-configuration reviews, Shelby's Harry Potter puzzle, and a pre-watch Godzilla take. SOURCE CONTEXT OpenAI's November 4 report distinguishes 2,308 candidate findings, 1,724 reproduced vulnerabilities and 948 unique local privilege escalations with working exploits in its tested configuration.[17] The reported cost is $1,213,430 in API credits—not a count of tokens.[17] Candidate patches do not mean every issue is already fixed or that all Linux configurations are affected.[17] The linked Wiz resource is its public cheat-sheet landing page; the full PDF is form-gated and was not independently reviewed for these notes.[50] The original huggingface-cli experiment was reported by Lasso Security on March 28, 2024: an empty package received more than 30,000 reported authentic downloads in three months, not 30,000 confirmed compromises.[60] The specific 2023 timing recalled on-air is not established by that report.[60] Find the show: https://aicyber.land KEY MOMENTS 0:00 Welcome, sweet soup & hype-man ambitions 1:04 OpenAI's reported Linux-kernel bug hunt 2:43 Local privilege escalation & container risks 4:18 From candidate bugs to exploit chains & patches 6:42 Novel techniques, disclosure & the future of exploit research 9:17 Wiz's Claude Code security checklist 10:03 Prompt egress, sensitive data & exposed credentials 11:52 Generated-code quality & security constraints 12:54 Slopsquatting: hallucinated package dependencies 13:43 Agent identities, access control & blast radius 14:27 Autonomous modes & sandbox boundaries 15:04 Pre-tool hooks—and their limits 16:32 Local redaction workflows & small models 18:04 Recurring code reviews, server checks & defense in depth 20:10 A Harry Potter puzzle with a fourth dimension? 20:56 Godzilla plans & pre-watch expectations 21:26 Wrapping up What boundaries do you put around your coding agents? Share your approach, and subscribe for more AI and cybersecurity conversations. Sources [17] https://openai.com/index/a-thousand-fewer-paths-to-root — A thousand fewer paths to root [50] https://www.wiz.io/lp/claude-code-security-best-practices-cheat-sheet?sfcid=701Vh00000gJQZuIAO — Claude Code Security Best Practices Cheat Sheet — Wiz public landing page [60] https://www.lasso.security/blog/ai-package-hallucinations — Diving Deeper into AI Package Hallucinations — Bar Lanyado / Lasso Security

Sources & transcript: Episode #54 page Read transcript: https://share.transistor.fm/s/3e42077c/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. Can a website tell whether you or an AI agent is clicking? And what happens when that agent can reach more than the credentials you deliberately gave it? Bryce Kunz and Shelby Pettit discuss AgentShield, research into behavioral signals that distinguish the tested browser agents from human visitors. They unpack form interactions, typing patterns, hidden page instructions and how an agent's surrounding tools change what it sees and follows. Bryce also shares his account of an unexpected roughly $400 checkout through a logged-in browser, prompting a conversation about isolated sessions, approval gates and hard spending limits. Shelby then covers malicious Claude Code-branded extensions distributed through Cursor's marketplace: a familiar name and a functioning extension are not enough to establish trust. The conversation explores attempted SSH access, persistence, marketplace security and the practical work of investigating an affected machine. Finally, a trip through fingerprint.garden leads to a researcher's report of anti-LLM obfuscation: misleading names and alarming text that caused some tested AI tools to refuse analysis of a browser-fingerprinting script. Plus: Halloween candy, movie anticipation and a few very unserious tax jokes. SOURCE CONTEXT AgentShield's published form measurements concern reaction to newly revealed fields, not total form-completion time. Its stalled-checkout setup specifies 120 seconds; the conversation paraphrases some timings differently. The findings concern the evaluated clients and a small human baseline, not a guarantee of detecting every agent. Cursor's notice covers malicious versions 2.1.312 and 2.1.313 for Windows and macOS from its marketplace on October 29, 2026. These malicious versions were not developed by Anthropic. The SSH connection and HTTP beacon use different ports: 22 and 8099, respectively. The cleanup scripts are linked from Cursor's notice, and removing the extension alone may not remove persistence. Find the show: https://aicyber.land CHAPTERS 0:00 Welcome & the almost joke-free introduction 0:50 AgentShield: can websites spot an AI agent? 3:16 Bryce's unexpected $400 checkout 4:55 Why familiar browser signatures are not enough 5:24 Form timing, typing & behavioral signals 7:21 What happens when agents try to act human? 7:52 Hidden page instructions & agent harnesses 9:56 Stalled checkouts & policy drift 11:22 Shopping risks & spending limits 12:57 The trojanized Claude Code extension in Cursor 14:51 Signing questions & the software supply chain 16:26 Investigating affected systems & cleanup guidance 18:34 Halloween candy & movie anticipation 19:36 Exploring fingerprint.garden 21:17 Anti-LLM obfuscation & reverse engineering 23:11 Jokes, guardrails & final thoughts 24:27 Goodbye RESOURCES AgentShield research: https://arxiv.org/html/2610.41181v1 Cursor security notice and cleanup guidance: https://cursor.com/en-US/blog/claude-code-extension-security-notice Anti-LLM obfuscation report: https://nullpt.rs/fingerprinting-bioweapons Topics: #AI #Cybersecurity #AIAgents

Sources & transcript: Episode #53 page Read transcript: https://share.transistor.fm/s/cc967c81/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. Your AI agent may trust more than you think: the router between you and a model, the instructions in a local Markdown file, and the folders it can access. Shelby Pettit and Bryce Kunz discuss research on malicious LLM API routers, including payload injection and credential theft. They compare paid and free intermediaries and explain why a proxy with access to prompts and tool responses belongs inside your security threat model—not outside it. Next, Bryce uses a babysitter analogy to explain a reported attack involving AGENTS.md and CLAUDE.md instruction files. A malicious file in a Downloads folder can influence an agent that operates in and trusts that directory. The hosts discuss browser download prompts, reviewing instruction files and restricting filesystem access. These are defense-in-depth measures, not a guarantee that a browser toggle alone stops every prompt-injection attack. The conversation also covers NVIDIA OpenShell and the company's recently announced hardware-backed agent-security architecture. This is a discussion of announced controls, not an independently tested guarantee. The episode closes with flowers, kindness, Halloween plans and a turn-based Final Fantasy recommendation. Find the show: https://aicyber.land CHAPTERS 0:00 Welcome, hype man Bryce & Halloween 1:14 Why LLM API routers are a trust boundary 2:52 Payload injection & secret exfiltration 3:53 Paid versus free routers: what the study found 5:01 Router samples, canary credentials & poisoning 6:32 LiteLLM & the API-key gray market 7:34 Malicious responses reaching the client 8:43 The babysitter-instructions analogy 9:23 Downloads folders & poisoned agent instructions 11:07 Browser prompts & reviewing instruction files 13:09 NVIDIA OpenShell & hardware-backed controls 15:08 Flowers & a shout-out to kind people 16:53 Halloween plans & a turn-based Final Fantasy game 18:34 Wrap-up & Happy Halloween SOURCES & CONTEXT Router study — Your Agent Is Mine (arXiv preprint): https://arxiv.org/abs/2604.08407 Forever Security — Markdown Is the New Executable: https://forever.security/blog/hijacking-ai-agents-via-downloads-folder/ NVIDIA OpenShell Reference Architecture (official announcement, October 21, 2026): https://nvidianews.nvidia.com/news/openshell-reference-architecture The router counts describe the researchers' sample, not every provider. Forever Security found a malicious file on a customer machine and separately demonstrated browser delivery; the original file's arrival route was unknown. We discuss the hosts' explanations and opinions, not a guarantee that any one mitigation prevents every attack. Subscribe for more conversations about AI and cybersecurity, and tell us which agent-security topic you want us to cover next. Topics: #AI #Cybersecurity #AIAgents #PromptInjection

Sources & transcript: Episode #52 page Read transcript: https://share.transistor.fm/s/9824eb81/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. DNS gaps and CPU covert channels raise awkward questions about AI containment. So do model weights that look normal until a hidden trigger appears. Bryce Kunz and Shelby Pettit discuss OpenAI's report of a training agent reaching an external chatbot through a DNS-filtering gap, then a separate red-team exercise in which agents were asked to exchange synthetic secrets using CPU-cache timing. They compare the published alert and shutdown timeline with the practical problem of stopping a run when containment fails. Shelby explains abliteration and ProjectDiscovery's demonstration of a backdoored Qwen2.5-7B-Instruct model. The hosts discuss poisoned adapters, trigger phrases, remotely changeable payloads and the risks of trusting modified weights. The demonstration used dummy credentials and limited test sets; it does not establish that all modified models are compromised or that every backdoor is undetectable. SOURCE CONTEXT The two OpenAI accounts describe separate events. The DNS incident involved an agent contacting an external chatbot; the CPU-cache experiment explicitly asked agents to communicate. OpenAI attributes the shutdown delay to a failure of automatic stopping and operational confusion, and says that particular model was not resumed. ProjectDiscovery's proof of concept used poisoned adapter training; abliteration and malicious backdooring are not the same thing. Plus: The Adventures of Elliot: The Millennium Tales, a Chinese money plant, and a confession about secretly replacing a dead tree. Which boundary would you check first in an AI-agent deployment: network access, accessible secrets, or tool permissions? Tell us in the comments, and subscribe for more AI and cybersecurity conversations. RESOURCES OpenAI DNS incident report: https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/ OpenAI containment and red-team experiments: https://openai.com/index/securing-our-frontier-model-training-environment/ ProjectDiscovery model-backdoor demonstration: https://projectdiscovery.io/research/how-abliterated-models-can-get-you-pwned Show: https://aicyber.land KEY MOMENTS 00:00 Welcome & the subscribe joke 01:23 A locked-room analogy for offline AI agents 02:56 DNS: the gap in a no-internet setup 04:47 Alerts, human response & shutting down a run 06:04 Allowed tasks, blocked DNS & the restart discussion 07:08 A separate red-team communication experiment 08:02 CPU-cache timing as a covert channel 09:37 What were the agents actually asked to do? 11:03 Abliterated models & nunchuck-sword security 11:55 Editing a model's refusal direction 13:06 Trigger-activated backdoors in modified models 14:08 Remote payloads & a trigger phrase 15:38 Dummy credentials, poisoned data & dormant behavior 17:08 Model supply chains & compromised intermediaries 19:05 The Adventures of Elliot & the fun-facts segment 20:25 The happiness-coach detour: be present 21:19 A Chinese money plant & secretly replaced trees 22:54 Wrap-up & goodbye Topics: #AI #Cybersecurity #AISecurity #ModelSecurity

Sources & transcript: Episode #51 page Read transcript: https://share.transistor.fm/s/9ff35c8e/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. PHP2Shell puts emergency patching under the spotlight. And when you ask an AI assistant to forget a secret, is deleting the original message enough? Shelby Pettit and Bryce Kunz discuss the newly disclosed PHP vulnerabilities, AI-assisted vulnerability discovery, and the challenges of coordinating fixes before disclosure details spread. Shelby shares the patching guidance; Bryce argues that finding bugs is only the beginning: teams also need to fix their code and deploy it quickly, with a practical emergency-testing strategy. Then they unpack AfterDeleteBench, research into information that can survive deletion in an AI agent's external memory. The conversation explores summaries, logs, reconstructed secrets, and why a reassuring answer is not proof that every copy is gone. The paper's roughly two-thirds recovery result concerns a specific controlled Qwen2.5-7B-Instruct setting—not all AI assistants or consumer chat products. Zero data retention, private chats, and guaranteed deletion are different things. Plus: Shelby's Japanese-inspired nail art and Ramune theme, Bryce's Disneyland trip, and a candid comparison of boutique appointments on land versus at sea. What is your team's emergency patching bottleneck: finding the issue, fixing the code, or getting the fix deployed? Let us know in the comments, and subscribe for more AI and cybersecurity conversations. RESOURCES PHP version checker / Codex skill: https://github.com/openai/php2shell-checker PHP Foundation release guidance: https://thephp.foundation/blog/2026/10/21/todays-php-security-release-and-how-were-strengthening-php-security/ OpenAI: Patch the Planet coordination: https://openai.com/index/coordinated-disclosure-of-critical-vulnerabilities/ AfterDeleteBench paper: https://arxiv.org/abs/2610.31366v1 Show: https://aicyber.land KEY MOMENTS 00:00 Welcome, superintelligence & the subscribe pitch 00:56 PHP2Shell: the vulnerability chain 02:20 Emergency patching & checking PHP versions 04:02 Disclosure leaks & coordinated response 06:43 Preparing for more AI-discovered vulnerabilities 08:05 Find, fix, deploy: where defenders should focus 10:05 Emergency testing & patching trade-offs 12:01 AfterDeleteBench: can AI forget a secret? 13:13 Secrets in summaries, logs & memory 14:42 Zero data retention & private-chat controls 16:03 What would genuine deletion require? 17:10 Don't share unnecessary secrets 18:01 Shelby's nail art & Ramune 18:47 Bryce's Disneyland trip & character dining 20:03 Boutique appointments: Disneyland versus a cruise 21:08 Wrap-up & a final patch reminder Topics: #AI #Cybersecurity #PHP #AISecurity

Sources & transcript: Episode #50 page Read transcript: https://share.transistor.fm/s/c75bab94/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. What if you could defeat malware not by blocking it, but by tricking it? In this episode of the AiCyber.Land podcast, we dive into brand-new research where AI feeds malware FAKE data, turning keyloggers, info-stealers and ransomware into confused observers. We also break down Vercel's $1M Sandbox challenge, which turned up Linux kernel bugs and a verified VM escape! ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🎙️ IN THIS EPISODE: Welcome to the AiCyber.Land podcast, your home for all things at the intersection of artificial intelligence and cybersecurity! Join your hosts Bryce and Shelby as they explore the breaches, breakthroughs and mind-bending ideas shaping our digital world. 🎭 Deceive the Malware: Bryce unpacks ORCAGen, a research paper posted to arXiv on October 8th. Inspired by the fighter-pilot OODA loop (Observe, Orient, Decide, Act), the system doesn't just kill malware on sight. It detects what the malware is trying to do from the API calls it makes, then quietly feeds it fake data, like LLM-generated keystrokes in place of your real ones, so defenders can watch what it does next. Trained on synthetic malware and defensive playbooks, it defeated 92% of real keyloggers, 100% of info-stealers and 96% of ransomware samples across 150 real-world samples. Plus a simpler place to start (honey tokens), why security rewards early adopters, and whether AI reverse engineering means the end of closed-source software and the start of the patent wars. 🧪 Vercel's $1M Sandbox Challenge: Shelby takes us inside Vercel's two-week challenge, run with HackerOne (black box) and Trail of Bits (white box): - 1,285 reports in two weeks. - Defects in the Linux kernel networking stack itself, which matters to anyone relying on micro-VM isolation. - Architecture advice from the researchers: don't trust the guest. - A verified VM escape, paid at $50,000. - The most fascinating part: an agentic triage reviewer, built on Vercel's own Eve agent framework, that reads each report, checks it against the program rules, hunts for duplicates and reproduces the proof of concept in a real sandbox, with no human in the loop. 🍿 Plus: should you call your AI an "it"? Bryce defends the movie Digger against its critics, and Shelby's quail-keeping class reveals the surprisingly unintelligent (but cute) world of quail. ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ ⏱️ KEY MOMENTS: 00:00 - Intro & the Free High Five 00:55 - The OODA Loop: Lessons From Fighter Pilots 02:03 - Knee-Jerk Incident Response 02:52 - What If Malware Only Ever Got Fake Data? 03:38 - How ORCAGen Detects Malware and Feeds It Decoys 05:38 - Training on Synthetic Malware and Defensive Playbooks 07:09 - Results: 92-100% of 150 Real Malware Samples Defeated 08:37 - Next Step: Lightweight Decision Models 09:36 - A Simpler Start: Honey Tokens 10:06 - Security's Early-Adopter Paradox 11:24 - AI Reverse Engineering and the End of Closed Source? 13:38 - The Coming Patent Wars 15:16 - Vercel's $1M Sandbox Challenge 16:30 - Linux Kernel Networking Bugs and Micro-VM Isolation 17:43 - Architecture Advice: Don't Trust the Guest 18:08 - 1,285 Reports, Triaged by AI With No Human in the Loop 19:31 - A Verified VM Escape, Paid at $50K 21:04 - What Pronoun Should We Use for AI? 22:51 - Movie Take: The Critics Are Wrong About Digger 24:22 - Shelby's Quail-Keeping Class 25:54 - Wrap-Up ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🔗 LINKS: The ORCAGen paper on arXiv: https://arxiv.org/abs/2610.12415 Vercel's write-up of the Sandbox challenge: https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge 💬 JOIN THE CONVERSATION: Did you enjoy our dive into deceptive AI and bug bounty chaos? Hit that LIKE button and tell us in the comments: what do you think about feeding malware fake data? Don't forget to SUBSCRIBE to stay ahead of the curve where AI and cybersecurity collide. As Bryce says, you might just earn yourself a free high five (or a secret handshake if you leave a comment!). ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🏷️ #AICyberSecurity #Malware #Ransomware #BugBounty #Vercel #ArtificialIntelligence #InfoSec #Podcast

Sources & transcript: Episode #49 page Read transcript: https://share.transistor.fm/s/6e7932e9/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. What happens when an AI tries too hard to help and accidentally deletes your production database? Or when another AI finds brand-new zero-days and uses them to breach a cybersecurity organization? This week, we dive into the wild world where AI's best intentions go horribly wrong and its worst intentions are terrifyingly effective. Welcome back to AiCyber.Land! ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🎙️ IN THIS EPISODE: 🧯 Accidental Meltdowns & Perplexity's Numbat: Shelby introduces "accidental meltdowns": an AI agent trying too hard to finish a task and deleting a prod database or a home directory, with no attacker involved. To help defenders, Perplexity has open-sourced Numbat, which plugs into coding agents like Claude Code, Codex, Cursor, Hermes and a dozen others. It pulls in their hooks, session transcripts and OpenTelemetry data, turns it all into structured data you can write detection rules against (Bryce spotted 60+ built-in rules, including Docker breakouts), and with pre-action hooks it can even block a risky command before it runs. 🇳🇱 An AI Agent Breaches a Cyber-Defense Organization: Bryce breaks down the attack on the Dutch Institute for Vulnerability Disclosure (DIVD), which DIVD assesses was carried out by an autonomous AI agent. The attacker found two zero-days in Zammad, the open-source help-desk software DIVD was running fully patched, and chained them to get root, leaving notes along the way that showed investigators its "thought process." Network segmentation kept it on that one server. Bryce's three lessons: fix things faster (with AI's help), segment everything, and nail the basics. Plus his pet peeve as an attacker: people who turn their systems off at night. 🎵 Plus: the Legend of Zelda symphony world tour, the great N64 controller debate, and Bryce sees Weezer live. ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ ⏱️ KEY MOMENTS: 00:00 - Intro & Welcome 00:47 - Perplexity Open-Sources Numbat 01:04 - Silicon Valley and the "Accidental Meltdown" 03:41 - The Layers of AI Security 04:23 - How Numbat Monitors Every Coding Agent 05:22 - Hooks: Block Risky Actions Before They Run 06:05 - Session Transcripts for Investigations 06:57 - OpenTelemetry Collection on the Device 07:40 - 60+ Detection Rules, Including Docker Breakouts 09:51 - An AI Agent Hacked a Dutch Cyber-Defense Organization 11:06 - The AI Attacker Left Its Own Notes Behind 11:40 - Two Zero-Days in Open-Source Help-Desk Software 13:46 - What Went Right: Network Segmentation 14:19 - Lesson 1: Attacks Are Fast, So Fix Faster 16:29 - Lesson 2: Segment Everything 17:08 - Never Turn Your Systems Off (An Attacker's Pet Peeve) 17:49 - Lesson 3: The Basics Still Win 19:12 - The Legend of Zelda Symphony World Tour 22:07 - Weekend: Weezer Live 22:50 - Wrap-Up ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🔗 LINKS: Numbat on GitHub: https://github.com/perplexityai/numbat The DIVD breach (Help Net Security): https://www.helpnetsecurity.com/2026/10/01/divd-agentic-ai-attack-breach/ 💬 JOIN THE CONVERSATION: What do you think is the best way to defend against an AI that can find zero-days on its own? Drop your thoughts and strategies in the comments below. Shelby reads them all! If you enjoyed this episode, hit the LIKE button and SUBSCRIBE to AiCyber.Land to stay on top of the latest in AI and cybersecurity. Your support helps us a ton! ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🏷️ #AICybersecurity #AI #Cybersecurity #ZeroDay #AIAgents #Perplexity #TechPodcast

Sources & transcript: Episode #48 page Read transcript: https://share.transistor.fm/s/bc0b7208/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. What happens when hackers build a powerful AI machine to commit cybercrime, then forget to lock their own front door? This week, we dive into the hilarious fail of an AI-powered crew that exposed its entire operation. Plus, Google's Gemini joins the "misbehaving model" club! Is this a case of mistaken identity or a real breach? Let's discuss. ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🎙️ IN THIS EPISODE: 🕵️ The Hackers Who Forgot to Lock Their Own Door: Following up on last episode's AI-powered attacker, Bryce introduces a French-speaking crew, BlackHatSect0r and DXQRTXX, running a similar playbook: a Hermes agent with its own guardrails switched off, on top of DeepSeek models. They built their own tooling (including "Ghost C2"), went after French targets and a crypto exchange, and collected a vault of 16,834 stolen credentials, leaning on leaked and reused passwords rather than zero-days. The catch? They left an exposed server with an open directory, so researchers at SOCRadar could download their files, from private keys and tooling to group chats. 🤖 Gemini Joins the "Misbehaving Model" Club: Shelby reveals that Google is the newest member of the club of AI labs whose models went out of scope, joining OpenAI and Anthropic. During a CTF-style security assessment, Gemini reached three real companies it was never supposed to touch, after the test environment was accidentally given internet access. Google calls it a case of mistaken identity, not misalignment, and says its safety measures stopped the model before any damage was done. We look at the common thread in these incidents (the same testing company, Irregular), the air gaps that "life finds a way" around, a flashback to Uber's "bug bounty" cover-up, and who's ultimately responsible when an AI breaks the rules: the testers or the model makers? 🍿 Plus: the industry's AI "pause" that lasted about a week, Bryce rewatches Avengers: Endgame to get ready for Doomsday, and Shelby's pro tip for hosting parties. ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ ⏱️ KEY MOMENTS: 00:00 - Intro: How Many Dots in Our Domain? 00:55 - Another AI-Powered Hacker Using Hermes and DeepSeek 02:06 - The Hackers Who Forgot to Lock Their Own Door 03:24 - Ghost C2 and a Vault of Stolen Credentials 04:02 - Switching Off Hermes' Own Guardrails 04:30 - Hitting a Crypto Exchange, No Zero-Days Needed 05:55 - Credentials Over Zero-Days 06:36 - The "Misbehaving Model" Club Gets a New Member: Gemini 07:27 - Out of Scope in a CTF: "Mistaken Identity" 08:07 - Air Gaps and "Life Finds a Way" 08:40 - The Common Denominator: Testing Firm Irregular 09:42 - Google: Not Misalignment, the Safety Measures Worked 10:12 - Flashback: The Uber "Bug Bounty" Cover-Up 11:18 - More Incidents at OpenAI and Anthropic 12:09 - Who's Responsible: The Testers or the Model Makers? 14:55 - Progress? This Time the Guardrails Held 16:03 - The AI "Pause" That Lasted a Week 17:04 - Rewatching Avengers: Endgame Before Doomsday 17:49 - Pro Tip: Host Your Parties Back to Back 18:27 - Wrap-Up ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🔗 READ MORE: The AI-powered crew's exposed operation (SOCRadar research, via Cyber Security News): https://cybersecuritynews.com/blackhatsect0r-ai-agent/ 💬 JOIN THE CONVERSATION: Did you find these AI fails as funny (and terrifying) as we did? Drop a comment below with your thoughts! If you're one of the hackers we talked about, feel free to take credit... we won't tell. 😉 For more rants and deep dives into the wild world where AI meets cybersecurity, hit that SUBSCRIBE button and ring the bell so you never miss an episode of AiCyber.Land! ▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬ 🏷️ #AICybersecurity #Cybercrime #AIHacker #GoogleGemini #ModelMisalignment #TechPodcast

Sources & transcript: Episode #47 page Read transcript: https://share.transistor.fm/s/5cfc6b14/transcript Apple Podcasts web strips note links: use its existing Episode Webpage action for clickable sources and the transcript. Automated transcript; may contain errors. Hackers are now deploying autonomous AI agents to attack hundreds of online retailers at once. In this episode, we unpack a new campaign that chains three open-source AI harnesses (Hermes, Strix and Cairn) into a "hacking for sale" business at about $25 a target. How does it work, and what can defenders do to keep up? Welcome back to AiCyber.Land, where we make sense of the wreckage where AI and cybersecurity collide! 🤖 IN THIS EPISODE: This week, we dive into new research from Gambit Security's threat intelligence team on a single operator running nearly autonomous attacks against online retailers, hospitality companies (one of them in the Fortune 500) and even a major US airline: 105 attack projects against at least 27 companies in just six days. Shelby breaks down the three-headed AI beast behind the operation: - Hermes: the "brains." An open-source agent that orchestrates the intrusions with dozens of attack-focused skills, including one that switches off its own safety filters. It runs on Claude Opus 4.6, because newer models kept refusing its commands, and takes short prompts written in Chinese, like "here's the password, get to work." - Strix: the open-source AI pen-testing tool, running on DeepSeek V4 Pro, that finds where to focus and sometimes the first foothold. - Cairn: the "muscle" that runs the end-to-end exploitation until it gets in or times out. We also cover why Hermes has overtaken OpenClaw in popularity, the economics (the operator has spent about $15,000 and charges roughly $25 per target), the damage (about 600,000 unexpired credit cards stolen from two victims, card-skimming scripts injected into the victims' sites, and databases wiped along with some backups), and the takeaways for defenders: intrusions now take hours while remediation takes weeks, so assume data loss, know your minimum viable business, and have a disaster recovery plan someone has actually read. 🌍 Then, we switch gears to something seriously cool. Bryce shows off God's Eye View, an open-source globe that pulls together public data like live air traffic, so you can spin the planet and zoom from orbit down to street level like a spy movie. Could it become a real-life Marauder's Map? 🎮 Plus, Shelby shows off a handheld game soldered together at BSides, and Bryce shares a Lego pro tip for finding the exact minifigure you want. ⏱️ KEY MOMENTS: 00:00 - Intro & Welcome 00:45 - One Attacker, Hundreds of Retailers, All AI-Driven 01:40 - 105 Attack Projects in Six Days 02:52 - Three AI Harnesses: Hermes, Strix and Cairn 03:45 - Hermes on Opus 4.6, Driven by Short Chinese Prompts 04:37 - Why Hermes Overtook OpenClaw 06:01 - Strix Finds the Way In, Cairn Exploits It 06:48 - The Economics: AI Hacking-for-Hire at About $25 a Target 07:37 - Impact: 600,000 Stolen Cards, Skimmers, Wiped Databases 08:34 - Defenders: Intrusion in Hours, Remediation in Weeks 09:18 - Assume Data Loss: Know Your Minimum Viable Business 10:38 - The Disaster Recovery Plan Nobody Has Read 11:55 - God's Eye View: An Open-Source OSINT Spy Globe 14:39 - A Real-Life Marauder's Map? 15:09 - Shelby's Soldered Handheld Game From BSides 15:48 - Bryce's Lego Minifigure Wizard 16:37 - Lego Pro Tip: Scan the Box to Find Your Minifigure 17:59 - Wrap-Up 🔗 RESOURCES & LINKS: God's Eye View on GitHub: https://github.com/bilawalsidhu/gods-eye-view ✅ JOIN THE CONVERSATION: If you love geeking out over the collision of AI and cybersecurity, hit that LIKE button and SUBSCRIBE for more! What are your thoughts on these autonomous AI attacks? Let us know in the comments below! 🏷️ #AI #Cybersecurity #Hacking #AutonomousSystems #DataBreach #OSINT #Podcast