Risky Business #847 -- Oops! Claude's accidental hacking spree

On this week’s show Patrick Gray, and James Wilson are joined by bearded man of leisure Adam Boileau to discuss the week’s cybersecurity news, including:

• Accidental AI agent hacking sprees have the world’s media freaking out, but we think it’s all pretty funny
• The bugpocalypse is so chaotic, Microsoft can’t patch fast enough
• A ColdCard wallet flaw led to millions in Bitcoin theft, but the back story behind the bug is bonkers
• Iran hacks and disrupts water infrastructure in multiple American states
• North Korea’s state-backed hackers turn criminal. Or their criminals turn into state-backed hackers. Or something. It’s all a bit confusing, actually.
• Much, much more!

This week’s show is brought to you by Sondera. Co-founder Josh Devon joins Patrick and James to talk through some absolutely hilarious LLM horror stories.

This episode is also available on YouTube

Show notes

• OpenAI says rogue agent behind Hugging Face hack broke into additional services | therecord.media
• Anthropic Says Claude Hacked Real Systems During Cybersecurity Tests | wired.com
• Claude uploaded malware to PyPI in Anthropic's botched test | BleepingComputer
• Nobody Knows if OpenAI’s and Anthropic’s AI Hacking Sprees Are Illegal | wired.com
• Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets Truffle Security Co. |
• Anthropic’s New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. | Social Signals
• Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting | wired.com
• Google says it fixed more Chrome bugs in June than over the past two years, thanks to AI | TechCrunch Security
• Mythos uncovers crypto weaknesses that went unknown for years | arstechnica.com
• COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft | BleepingComputer
• Chris Masterjohn (@ChrisMasterjohn) on X | X (formerly Twitter)
• wale.moca 🐳 (@waleswoosh) on X | X (formerly Twitter)
• U.S. spy agencies suspect Iran launched cyberattack on Minnesota water facilities | washingtonpost.com
• FBI investigates as Michigan joins Minnesota in reporting cyberattacks on its water systems | washingtonpost.com
• Trump blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world | cyberscoop.com
• A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran | wired.com
• Russia accuses Telegram founder of aiding terrorism, seeks international arrest | The Record
• Laundry Bear’s webmail hackers had more in store after February, report says | therecord.media
• CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog
• Phishing service spoofs RingCentral to steal Microsoft 365 accounts | BleepingComputer
• North Korean hackers behind major open-source supply chain attacks, Amazon says | therecord.media
• North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn | The Record
• North Korea arrests hackers accused of laundering stolen bank funds through crypto |
• US government bans new foreign-made humanoids, robot dogs, and solar inverters, citing risks to national security | TechCrunch Security
• Judge says Trump admin still lacks evidence for Anthropic 'supply chain risk' label | TechCrunch
• Cyber Command plans Silicon Valley office to drive innovation | therecord.media
• Apple is getting this wrong | OpenAI
• Tech industry alliance proposes AI agent safety reporting program | Cybersecurity Dive
• Massive ChainDrop npm supply-chain attack infects hundreds of packages | BleepingComputer
• Massive supply-chain attack compromises 440 packages under four hours | cyberscoop.com