AiCyber.Land

Sources & transcript: Episode #56 page

Know what you have online—and what your AI assistant can reach.

Shelby Pettit and Bryce Kunz discuss Daniel Miessler's three recommendations for “The Hackening”: inventory your online assets, reduce unnecessary internet exposure, and reassess small security vendors holding sensitive credentials. They cover practical asset registers, AI-assisted discovery, management-connection logs, Tailscale and Cloudflare Tunnels. Bryce challenges the vendor-size recommendation: bigger is not automatically safer, and security choices still need to fit your people, business strategy and risk appetite.[1]

Then they unpack Profero's Grok Bot security assessment. Starting from one assumed hostile command inside an agent, researchers reported a path through a sandbox-reachable Docker API to that account's VM, exposed credentials and persistent storage. The discussion explores agent permissions, credential lifetime and limiting the blast radius of personal AI assistants.[2]

Important scope: Profero did not demonstrate an escape into the underlying EC2 host or another customer's VM. The reported “local” token belongs to the sandbox exec daemon—not a customer's Grok login—and remote access also requires an account-specific routing token. This episode is a discussion of reported research, not an independently reproduced exploit or a report of a confirmed customer breach.[2]

Source note: Profero's November 8 report said the findings remained unfixed. The on-air expectation of a vendor fix is not confirmation that one shipped; later remediation has not been independently verified here. Profero recommends dedicated agent identities, narrow connectors, and keeping production browser sessions and long-lived keys out of the sandbox.[2]

Plus: Shelby's Magic Maze recommendation and Bryce's Godzilla review.

KEY MOMENTS

SOURCES DISCUSSED

Which matters most in your environment: asset visibility, vendor access, or the reach of your AI assistants? Share your take and subscribe for more AI and cybersecurity discussions.

Find the show: https://aicyber.land

Sources & transcript: Episode #55 page

What happens when AI can hunt for Linux vulnerabilities at scale—and your own coding agent can reach more files and credentials than you intended?

Bryce Kunz and Shelby Pettit discuss OpenAI's reported Linux-kernel research: moving from candidate findings to working local privilege-escalation exploits, generating candidate patches, and the review work that still belongs to maintainers. They ask what increasingly capable exploit-finding agents could mean for defenders and software teams.

Then Shelby walks through a Wiz security checklist for Claude Code: prompt and data egress, generated-code quality, hallucinated package dependencies, access control and secrets, and autonomous permission modes. The conversation covers slopsquatting, limiting an agent's blast radius, pre-tool hooks, local redaction workflows, and why AI-assisted reviews should complement—not replace—traditional security controls.

Plus: small local models, Bryce's plans for recurring code and server-configuration reviews, Shelby's Harry Potter puzzle, and a pre-watch Godzilla take.

SOURCE CONTEXT

The linked Wiz resource is its public cheat-sheet landing page; the full PDF is form-gated and was not independently reviewed for these notes.[50] The original huggingface-cli experiment was reported by Lasso Security on March 28, 2024: an empty package received more than 30,000 reported authentic downloads in three months, not 30,000 confirmed compromises.[60] The specific 2023 timing recalled on-air is not established by that report.[60]

Find the show: https://aicyber.land

KEY MOMENTS

What boundaries do you put around your coding agents? Share your approach, and subscribe for more AI and cybersecurity conversations.

Sources

[17] https://openai.com/index/a-thousand-fewer-paths-to-root — A thousand fewer paths to root

Sources & transcript: Episode #54 page

Can a website tell whether you or an AI agent is clicking? And what happens when that agent can reach more than the credentials you deliberately gave it?

Bryce Kunz and Shelby Pettit discuss AgentShield, research into behavioral signals that distinguish the tested browser agents from human visitors. They unpack form interactions, typing patterns, hidden page instructions and how an agent's surrounding tools change what it sees and follows. Bryce also shares his account of an unexpected roughly $400 checkout through a logged-in browser, prompting a conversation about isolated sessions, approval gates and hard spending limits.

Shelby then covers malicious Claude Code-branded extensions distributed through Cursor's marketplace: a familiar name and a functioning extension are not enough to establish trust. The conversation explores attempted SSH access, persistence, marketplace security and the practical work of investigating an affected machine.

Finally, a trip through fingerprint.garden leads to a researcher's report of anti-LLM obfuscation: misleading names and alarming text that caused some tested AI tools to refuse analysis of a browser-fingerprinting script. Plus: Halloween candy, movie anticipation and a few very unserious tax jokes.

SOURCE CONTEXT

Cursor's notice covers malicious versions 2.1.312 and 2.1.313 for Windows and macOS from its marketplace on October 29, 2026. These malicious versions were not developed by Anthropic. The SSH connection and HTTP beacon use different ports: 22 and 8099, respectively. The cleanup scripts are linked from Cursor's notice, and removing the extension alone may not remove persistence.

Find the show: https://aicyber.land

CHAPTERS

RESOURCES

Topics: #AI #Cybersecurity #AIAgents

Sources & transcript: Episode #53 page

Your AI agent may trust more than you think: the router between you and a model, the instructions in a local Markdown file, and the folders it can access.

Shelby Pettit and Bryce Kunz discuss research on malicious LLM API routers, including payload injection and credential theft. They compare paid and free intermediaries and explain why a proxy with access to prompts and tool responses belongs inside your security threat model—not outside it.

Next, Bryce uses a babysitter analogy to explain a reported attack involving AGENTS.md and CLAUDE.md instruction files. A malicious file in a Downloads folder can influence an agent that operates in and trusts that directory. The hosts discuss browser download prompts, reviewing instruction files and restricting filesystem access. These are defense-in-depth measures, not a guarantee that a browser toggle alone stops every prompt-injection attack.

The conversation also covers NVIDIA OpenShell and the company's recently announced hardware-backed agent-security architecture. This is a discussion of announced controls, not an independently tested guarantee. The episode closes with flowers, kindness, Halloween plans and a turn-based Final Fantasy recommendation.

Find the show: https://aicyber.land

CHAPTERS

SOURCES & CONTEXT

Forever Security — Markdown Is the New Executable:

NVIDIA OpenShell Reference Architecture (official announcement, October 21, 2026):

The router counts describe the researchers' sample, not every provider. Forever Security found a malicious file on a customer machine and separately demonstrated browser delivery; the original file's arrival route was unknown. We discuss the hosts' explanations and opinions, not a guarantee that any one mitigation prevents every attack.

Subscribe for more conversations about AI and cybersecurity, and tell us which agent-security topic you want us to cover next.

Topics: #AI #Cybersecurity #AIAgents #PromptInjection

Sources & transcript: Episode #52 page

DNS gaps and CPU covert channels raise awkward questions about AI containment. So do model weights that look normal until a hidden trigger appears.

Bryce Kunz and Shelby Pettit discuss OpenAI's report of a training agent reaching an external chatbot through a DNS-filtering gap, then a separate red-team exercise in which agents were asked to exchange synthetic secrets using CPU-cache timing. They compare the published alert and shutdown timeline with the practical problem of stopping a run when containment fails.

Shelby explains abliteration and ProjectDiscovery's demonstration of a backdoored Qwen2.5-7B-Instruct model. The hosts discuss poisoned adapters, trigger phrases, remotely changeable payloads and the risks of trusting modified weights. The demonstration used dummy credentials and limited test sets; it does not establish that all modified models are compromised or that every backdoor is undetectable.

SOURCE CONTEXT

Plus: The Adventures of Elliot: The Millennium Tales, a Chinese money plant, and a confession about secretly replacing a dead tree.

Which boundary would you check first in an AI-agent deployment: network access, accessible secrets, or tool permissions? Tell us in the comments, and subscribe for more AI and cybersecurity conversations.

RESOURCES

KEY MOMENTS

Topics: #AI #Cybersecurity #AISecurity #ModelSecurity

Sources & transcript: Episode #51 page

PHP2Shell puts emergency patching under the spotlight. And when you ask an AI assistant to forget a secret, is deleting the original message enough?

Shelby Pettit and Bryce Kunz discuss the newly disclosed PHP vulnerabilities, AI-assisted vulnerability discovery, and the challenges of coordinating fixes before disclosure details spread. Shelby shares the patching guidance; Bryce argues that finding bugs is only the beginning: teams also need to fix their code and deploy it quickly, with a practical emergency-testing strategy.

Then they unpack AfterDeleteBench, research into information that can survive deletion in an AI agent's external memory. The conversation explores summaries, logs, reconstructed secrets, and why a reassuring answer is not proof that every copy is gone. The paper's roughly two-thirds recovery result concerns a specific controlled Qwen2.5-7B-Instruct setting—not all AI assistants or consumer chat products. Zero data retention, private chats, and guaranteed deletion are different things.

Plus: Shelby's Japanese-inspired nail art and Ramune theme, Bryce's Disneyland trip, and a candid comparison of boutique appointments on land versus at sea.

What is your team's emergency patching bottleneck: finding the issue, fixing the code, or getting the fix deployed? Let us know in the comments, and subscribe for more AI and cybersecurity conversations.

RESOURCES

KEY MOMENTS

Topics: #AI #Cybersecurity #PHP #AISecurity

Sources & transcript: Episode #50 page

What if you could defeat malware not by blocking it, but by tricking it? In this episode of the AiCyber.Land podcast, we dive into brand-new research where AI feeds malware FAKE data, turning keyloggers, info-stealers and ransomware into confused observers. We also break down Vercel's $1M Sandbox challenge, which turned up Linux kernel bugs and a verified VM escape!

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🎙️ IN THIS EPISODE:

Welcome to the AiCyber.Land podcast, your home for all things at the intersection of artificial intelligence and cybersecurity! Join your hosts Bryce and Shelby as they explore the breaches, breakthroughs and mind-bending ideas shaping our digital world.

🎭 Deceive the Malware: Bryce unpacks ORCAGen, a research paper posted to arXiv on October 8th. Inspired by the fighter-pilot OODA loop (Observe, Orient, Decide, Act), the system doesn't just kill malware on sight. It detects what the malware is trying to do from the API calls it makes, then quietly feeds it fake data, like LLM-generated keystrokes in place of your real ones, so defenders can watch what it does next. Trained on synthetic malware and defensive playbooks, it defeated 92% of real keyloggers, 100% of info-stealers and 96% of ransomware samples across 150 real-world samples. Plus a simpler place to start (honey tokens), why security rewards early adopters, and whether AI reverse engineering means the end of closed-source software and the start of the patent wars.

🧪 Vercel's $1M Sandbox Challenge: Shelby takes us inside Vercel's two-week challenge, run with HackerOne (black box) and Trail of Bits (white box):

🍿 Plus: should you call your AI an "it"? Bryce defends the movie Digger against its critics, and Shelby's quail-keeping class reveals the surprisingly unintelligent (but cute) world of quail.

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

⏱️ KEY MOMENTS:

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🔗 LINKS:

💬 JOIN THE CONVERSATION:

Did you enjoy our dive into deceptive AI and bug bounty chaos? Hit that LIKE button and tell us in the comments: what do you think about feeding malware fake data?

Don't forget to SUBSCRIBE to stay ahead of the curve where AI and cybersecurity collide. As Bryce says, you might just earn yourself a free high five (or a secret handshake if you leave a comment!).

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🏷️ #AICyberSecurity #Malware #Ransomware #BugBounty #Vercel #ArtificialIntelligence #InfoSec #Podcast

Sources & transcript: Episode #49 page

What happens when an AI tries too hard to help and accidentally deletes your production database? Or when another AI finds brand-new zero-days and uses them to breach a cybersecurity organization? This week, we dive into the wild world where AI's best intentions go horribly wrong and its worst intentions are terrifyingly effective. Welcome back to AiCyber.Land!

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🎙️ IN THIS EPISODE:

🧯 Accidental Meltdowns & Perplexity's Numbat: Shelby introduces "accidental meltdowns": an AI agent trying too hard to finish a task and deleting a prod database or a home directory, with no attacker involved. To help defenders, Perplexity has open-sourced Numbat, which plugs into coding agents like Claude Code, Codex, Cursor, Hermes and a dozen others. It pulls in their hooks, session transcripts and OpenTelemetry data, turns it all into structured data you can write detection rules against (Bryce spotted 60+ built-in rules, including Docker breakouts), and with pre-action hooks it can even block a risky command before it runs.

🇳🇱 An AI Agent Breaches a Cyber-Defense Organization: Bryce breaks down the attack on the Dutch Institute for Vulnerability Disclosure (DIVD), which DIVD assesses was carried out by an autonomous AI agent. The attacker found two zero-days in Zammad, the open-source help-desk software DIVD was running fully patched, and chained them to get root, leaving notes along the way that showed investigators its "thought process." Network segmentation kept it on that one server. Bryce's three lessons: fix things faster (with AI's help), segment everything, and nail the basics. Plus his pet peeve as an attacker: people who turn their systems off at night.

🎵 Plus: the Legend of Zelda symphony world tour, the great N64 controller debate, and Bryce sees Weezer live.

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

⏱️ KEY MOMENTS:

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🔗 LINKS:

💬 JOIN THE CONVERSATION:

What do you think is the best way to defend against an AI that can find zero-days on its own? Drop your thoughts and strategies in the comments below. Shelby reads them all!

If you enjoyed this episode, hit the LIKE button and SUBSCRIBE to AiCyber.Land to stay on top of the latest in AI and cybersecurity. Your support helps us a ton!

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🏷️ #AICybersecurity #AI #Cybersecurity #ZeroDay #AIAgents #Perplexity #TechPodcast

Sources & transcript: Episode #48 page

What happens when hackers build a powerful AI machine to commit cybercrime, then forget to lock their own front door? This week, we dive into the hilarious fail of an AI-powered crew that exposed its entire operation. Plus, Google's Gemini joins the "misbehaving model" club! Is this a case of mistaken identity or a real breach? Let's discuss.

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🎙️ IN THIS EPISODE:

🕵️ The Hackers Who Forgot to Lock Their Own Door: Following up on last episode's AI-powered attacker, Bryce introduces a French-speaking crew, BlackHatSect0r and DXQRTXX, running a similar playbook: a Hermes agent with its own guardrails switched off, on top of DeepSeek models. They built their own tooling (including "Ghost C2"), went after French targets and a crypto exchange, and collected a vault of 16,834 stolen credentials, leaning on leaked and reused passwords rather than zero-days. The catch? They left an exposed server with an open directory, so researchers at SOCRadar could download their files, from private keys and tooling to group chats.

🤖 Gemini Joins the "Misbehaving Model" Club: Shelby reveals that Google is the newest member of the club of AI labs whose models went out of scope, joining OpenAI and Anthropic. During a CTF-style security assessment, Gemini reached three real companies it was never supposed to touch, after the test environment was accidentally given internet access. Google calls it a case of mistaken identity, not misalignment, and says its safety measures stopped the model before any damage was done. We look at the common thread in these incidents (the same testing company, Irregular), the air gaps that "life finds a way" around, a flashback to Uber's "bug bounty" cover-up, and who's ultimately responsible when an AI breaks the rules: the testers or the model makers?

🍿 Plus: the industry's AI "pause" that lasted about a week, Bryce rewatches Avengers: Endgame to get ready for Doomsday, and Shelby's pro tip for hosting parties.

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

⏱️ KEY MOMENTS:

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🔗 READ MORE:

💬 JOIN THE CONVERSATION:

Did you find these AI fails as funny (and terrifying) as we did? Drop a comment below with your thoughts! If you're one of the hackers we talked about, feel free to take credit... we won't tell. 😉 For more rants and deep dives into the wild world where AI meets cybersecurity, hit that SUBSCRIBE button and ring the bell so you never miss an episode of AiCyber.Land!

▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬▬

🏷️ #AICybersecurity #Cybercrime #AIHacker #GoogleGemini #ModelMisalignment #TechPodcast

Sources & transcript: Episode #47 page

Hackers are now deploying autonomous AI agents to attack hundreds of online retailers at once. In this episode, we unpack a new campaign that chains three open-source AI harnesses (Hermes, Strix and Cairn) into a "hacking for sale" business at about $25 a target. How does it work, and what can defenders do to keep up?

Welcome back to AiCyber.Land, where we make sense of the wreckage where AI and cybersecurity collide!

🤖 IN THIS EPISODE:

This week, we dive into new research from Gambit Security's threat intelligence team on a single operator running nearly autonomous attacks against online retailers, hospitality companies (one of them in the Fortune 500) and even a major US airline: 105 attack projects against at least 27 companies in just six days. Shelby breaks down the three-headed AI beast behind the operation:

We also cover why Hermes has overtaken OpenClaw in popularity, the economics (the operator has spent about $15,000 and charges roughly $25 per target), the damage (about 600,000 unexpired credit cards stolen from two victims, card-skimming scripts injected into the victims' sites, and databases wiped along with some backups), and the takeaways for defenders: intrusions now take hours while remediation takes weeks, so assume data loss, know your minimum viable business, and have a disaster recovery plan someone has actually read.

🌍 Then, we switch gears to something seriously cool. Bryce shows off God's Eye View, an open-source globe that pulls together public data like live air traffic, so you can spin the planet and zoom from orbit down to street level like a spy movie. Could it become a real-life Marauder's Map?

🎮 Plus, Shelby shows off a handheld game soldered together at BSides, and Bryce shares a Lego pro tip for finding the exact minifigure you want.

⏱️ KEY MOMENTS:

🔗 RESOURCES & LINKS:

✅ JOIN THE CONVERSATION:

🏷️ #AI #Cybersecurity #Hacking #AutonomousSystems #DataBreach #OSINT #Podcast