Risky Business #857 -- AI FUD intensifies
Show notes
On this week’s show Patrick Gray and James Wilson are joined by special guest co-host Alex Stamos to talk through the week’s cybersecurity news, including:
- Everyone’s still panicking about “misbehaving” AI models that are pretty much just doing what they’re being told to do
- Americans are giving AI agents unfettered access to their bank accounts. What could go wrong?
- Last week’s PHP meteor seems to have missed Earth
- This week’s Brotli HTTP/2 critical flaw is this week’s meteor
- The private key is always 4. This time it’s TLS bugs in GoAhead
- Much, much more!
This week’s show is brought to you by Truffle Security. Co-founder and CEO Dylan Ayrey joins James Wilson to chat about scanning GitHub repos and finding more than half a million unique credentials that were never revoked. As Dylan explains, the problem of exposed keys exists everywhere and is only getting worse.
This episode is also available on YouTube
Show notes
- OpenAI AI agents demonstrate VM escapes and secret cross-sandbox communication
- OpenAi agents disabled safety monitoring, one lied about it
- solst/ICE of Astarte (@IceSolst) on X
- What I learned from cheating clankers
- Unvetted AI agents are accessing US bank accounts
- Hiding Capabilities in AI Models
- AI is finding bugs faster. Let the market find the fixes
- AI Guardrails Aren’t Stopping Criminal Hackers
- Andromeda October 2026 Security Incident
- Developer platform Railway urges ‘all users’ to revoke secret keys after cyberattack
- Exclusive: bipartisan bill would develop federal guidance for distillation attacks, convene industry on defensive cyber
- Hackers got a four-day head start on the PHP2Shell vulnerabilities
- Critical HTTP2Shell flaw in Brotli triggers emergency patches
- Senators say targeted ads are a security risk. Ad groups say the critics are off base
- Alleged Israeli spy company heavily targeted Starlink users, sources say
- LiteLLM release pipeline hacked to distribute info-stealer malware
- CISA warns attackers are chaining Plex flaws in active Plex2Shell attacks
- Abandoned Popcorn Time app exposed millions of devices to RCE attacks
- Chrome adds Gemini-powered scam detection and ClickFix warnings
- Microsoft Teams is getting context-aware phishing detection
- China-nexus actor linked to attack on ConnectWise cloud backup
- University of New Mexico hospital diverts ambulances after cyberattack
- solst/ICE of Astarte (@IceSolst) on X
- GitHub Repos Exposed 543,699 Credentials. Nobody Revoked Them