Three Buddy Problem·Oct 12, 2026·1h 5m

Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI

Download audio Show notes Apple Podcasts Spotify

Show notes

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems.

Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Katie Moussouris.

Timestamps:
0:00 Intros at Offensive AI Con
1:00 OpenAI's DNS tunneling incident and slow monitoring
4:36 Treating AI like malware in a sandbox
9:01 The business model is the misalignment
13:37 Log4j, SBOMs and an NTSB for AI
18:00 Trading liability protection for honest disclosure
22:13 Accountability and "once you become aware"
26:18 The Australia notification timeline
28:19 A blank-check administration and the Anthropic phaseout
34:35 Powerful models in the right hands
38:42 Kill switch bills and regulatory capture
42:36 EU fines as a tariff on American tech
48:03 Reasons for optimism
54:13 Bring back "information security"
1:01:57 Katie's last word

Links:

← Previous

NCSC's Ollie Whitehouse: 'The Biggest Correction of Technical Debt Ever'

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems. Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Katie Moussouris . Timestamps: 0:00 Intros at Offensive AI Con 1:00 OpenAI's DNS tunneling incident and slow monitoring 4:36 Treating AI like malware in a sandbox 9:01 The business model is the misalignment 13:37 Log4j, SBOMs and an NTSB for AI 18:00 Trading liability protection for honest disclosure 22:13 Accountability and "once you become aware" 26:18 The Australia notification timeline 28:19 A blank-check administration and the Anthropic phaseout 34:35 Powerful models in the right hands 38:42 Kill switch bills and regulatory capture 42:36 EU fines as a tariff on American tech 48:03 Reasons for optimism 54:13 Bring back "information security" 1:01:57 Katie's last word Links: Transcript Katie Moussouris on Twitter Katie Moussouris | LinkedIn Luta Security | Bespoke Bug Bounty OpenAI Agent Breached Australian Data Portal in Newly Disclosed Hack CSRB Review: Log4j CSRB Report on Microsoft Online Exchange Incident EU Cyber Resilience Act: 24-Hour Reporting Duties Patching Faster Has Never Been the Answer The Real Story on AI Security Live From LABScon Katie Moussouris | LABScon DHS Disbands Cyber Safety Review Board The Chaos (and Cost) of the Lapsus$ Hacking Carnage Katie Moussouris on the Anthropic Export-Control Mess Fable 5 Export Controls Harm US Cyber Defense Offensive AI Conference TLPBLACK