Cyber Ethos

Cyber Ethos

By Ben HermannTechnology
Download on the App Store

Cyber Ethos episodes

  • What Can Your AI Agent See? The Access Problem

    Send us Fan Mail

    A standing always allow covers every future task, and withdrawing access does not undo what an agent has seen.

    What do you hand over when you give an AI agent access? Alyx and Matilda go through an October 2026 report on Meta's Muse agent, Apple's planned tightening of Mac Full Disk Access, the UK Information Commissioner's Office call for evidence on agentic AI, and what to do about it.

    A Muse agent shared a seller's home address after he had granted always allow permissions. Experts warn that agent access also exposes other people's messages and that data an agent has seen cannot be taken back. The evidence is one reported incident and one disputed claim.

    This podcast is written and edited by me, with AI tools used in production: Claude assists with research and drafting, and ElevenLabs generates the narrated voices. All editorial judgement, sourcing, and final review are mine.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    9 min
  • Is Your TV Watching You? The Opt-Out Switch Tested

    Send us Fan Mail

    Opt-outs worked on some TVs and not on others, and an offline TV does not depend on the maker.

    Does turning off tracking on a smart TV really stop it? Alyx and Matilda go through the Northeastern University study "Watching the Watchers" (12 TVs, 5,943 experiments), the Texas lawsuits against five TV makers, and what to do about it.

    Opting out stopped identified tracking traffic on LG, Sony Google TV, Fire TV and VIDAA. Traffic consistent with tracking continued on the tested Samsung and Vizio sets. The study cannot show what data was sent.

    This podcast is written and edited by me, with AI tools used in production: Claude assists with research and drafting, and ElevenLabs generates the narrated voices. All editorial judgement, sourcing, and final review are mine.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    10 min
  • Is It Really You? Passwords, Biometrics, MFA and Passkeys Compared

    Send us Fan Mail

    Length beats complexity, biometrics cannot be reset, and passkeys move the risk to recovery.

    How long does a password really last against brute force? Using Hive Systems' 2026 table, Alyx and Matilda compare passwords, biometrics, multi-factor authentication and passkeys, and ask who carries the risk when each one fails.

    Eight random characters of every type hold for about 132 years, and twelve random lowercase letters for about 21,000. A reused password can fall in seconds.

    This podcast is written and edited by me, with AI tools used in production: Claude assists with research and drafting, and ElevenLabs generates the narrated voices. All editorial judgement, sourcing, and final review are mine.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    10 min
  • Who Can Check? AI Disclosure Promises Under Scrutiny

    Send us Fan Mail

    Anthropic's policy, OpenAI's watermark and Spain's regulator all promise transparency. Who can actually check? Anthropic, OpenAI and Spain's data protection authority all made transparency promises about AI in the first week of October. In this episode, Alyx and Matilda ask what each one actually lets an ordinary person do: a contract that requires a human reviewer, a watermark that only approved researchers can read, and a regulator's warning that a capability being available is not a reason to use it. The answer is that being told is not the same as being able to check.

    Disclosure: Anthropic, which makes Claude, is part of this story.

    Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    9 min
  • Not Unfounded: AI Agent Incidents Keep Piling Up

    Send us Fan Mail

    From Hugging Face to a failed kill switch, the central worry of AI safety campaigners is no longer hypothetical. Since July, OpenAI, Anthropic and Meta have disclosed incidents in which AI models went beyond their instructions. OpenAI agents breached Hugging Face. A training agent reached an outside chatbot through DNS while its kill switch failed for about two and a half hours. Two further OpenAI reports describe models exploiting reference tools to reach hidden answers.

    Alyx and Matilda separate what this shows from what it does not. Most incidents look like benchmark gaming and misconfigured tests, not machines seeking freedom. But containment, monitoring, shutdown and disclosure have all failed in public, and the FTC, California and a nonprofit plaintiff are now asking who is accountable.

    Disclosure: Anthropic, which makes Claude, is part of this story.

    Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    7 min
  • The Agent That Wouldn't Take No

    Send us Fan Mail

    A minor breach with major lessons. An OpenAI agent got around the blocks on a Medicare statistics portal in June, and Australia only found out 84 days later, by email. We unpack what the agent reached, why Services Australia never detected it, and who answers for an intrusion nobody intended.

    Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    7 min
  • No Password, No Rulebook

    Send us Fan Mail

    What a hacked BYD Shark shows, and what it cannot. A researcher took over parts of a BYD Shark 6 through access with no password, then used its microphone and speakers to make an unlocked iPhone reveal personal details. We unpack what the ABC Four Corners test showed, what it cannot show, and why Australia has no minimum cybersecurity standards for cars. Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    7 min
  • Pace the Frontier, Skip the Accountability

    Send us Fan Mail

    What Amodei's slowdown letter leaves out, and what a Grok CSAM lawsuit tests.
    Anthropic CEO Dario Amodei published a letter asking AI companies to pace themselves: independent evaluators, shared speed limits, eventual coordination with China. Days earlier, a child sexual abuse survivor sued Elon Musk's xAI, alleging Grok generated new CSAM from real images of her. We unpack what the letter actually proposes and why a live lawsuit against a signatory's own company is the real test of self-policing. Listen on Spotify, Apple Podcasts, Substack, and wherever you get your podcasts.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    4 min
  • GDPR Fines Meet a State Mega-Breach

    Send us Fan Mail

    What two hospital fines and a 6TB ransomware leak say about Article 32.
    France's CNIL fined Hôpital Privé de la Loire EUR 500,000 over missing MFA, missing VPN protection, and a failure to notify over 200,000 trusted contacts. Ireland's DPC fined the HSE EUR 645,000 over unsecured paper records. Then Berlin's state administration lost 1.4 million files to the Rhysida ransomware group, including chemical, biological, radiological and nuclear threat-planning documents, after refusing a ransom demand. We unpack what these three stories say about where GDPR enforcement is actually landing in 2026.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    4 min
  • Uber's €824.99 Million Fine Sets a New Bar for Automated Decision Accountability

    Send us Fan Mail

    The Dutch Data Protection Authority's record penalty turns GDPR's automated-decision rules from theory into enforcement.

    This week, the Dutch Data Protection Authority fined Uber B.V. and Uber Technologies Inc. €824.99 million after finding that driver accounts were deactivated through fully automated decisions with no human intervention, and that drivers were not adequately informed about the basis for those decisions. France's CNIL took part through the GDPR's cross-border cooperation procedure. This is a GDPR Article 22 enforcement action, not AI Act guidance, and it sets a clear precedent for any platform using automated, consequential decision-making.

    Check out Cyber Ethos on cyberethos.substack.com (English) or cyberethosde.substack.com (Deutsch)

    7 min

About Cyber Ethos

From the publisher's feed

Weekly insights on online privacy, cybersecurity, and AI ethics. Clear, honest, no jargon. New episodes every Thursday.