DTF Cyber Podcast

In October 2026, attackers didn't steal data — they stole AI keys. Nine AI developer platforms were hit in one month, their stored environment variables hunted for the application programming interface (API) keys that run artificial intelligence (AI) models. This is Black October, and the LLMJacking (large language model hijacking) story underneath it: stolen keys tested, left quiet, then used to run up someone else's bill.

In this episode, Damian, Troy, and Fern break down what happened, why rotating a single key isn't enough, and the bigger identity problem underneath it all: machine identities now outnumber human identities 109 to 1, and most organizations can't even revoke an agent's credentials.

What we cover:

• The nine platforms hit in Black October: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16-17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28), and Northflank (Oct 30)

• How attackers hunted stored environment variables for AI access keys

• The pattern: keys tested within 30 minutes, then quiet — then about 800,000 calls in 30 hours, and 1.7 million calls in 13 hours in the traced cases

• Why the damage ran past $100,000, and why one platform shut down over it

• Spend guardrails, prepay limits, and usage alerts that cap your exposure

• The 2026 identity survey of about 2,900 security leaders: 109 machine identities for every human, up from 82 to 1 a year earlier

• Little Orphan Agents: agents left running after their creator leaves, with no owner

• Why only 37% of organizations can revoke an AI agent's credentials at all

• Joiner, mover, leaver — and why that lifecycle breaks for agents that never join, never move, and never leave

• The Monday-morning checklist: rotate unknown keys, give every agent an owner, scope and expiry on every key, no shared standing keys, and alert on AI spend spikes

Chapters:

0:00 Black October: Attackers Stole AI Keys, Not Data

1:51 The Nine AI Platforms Hit in October

5:15 Environment Variables: Where the Keys Were Hiding

6:40 Tested in 30 Minutes, Then 800,000 Calls

13:15 They Rented Out Your Keys on Your Bill

19:12 Spend Guardrails That Could Have Stopped This

20:45 AI Agents Outnumber Humans 109 to 1

25:27 Little Orphan Agents Nobody Owns

29:39 Joiner, Mover, Leaver — and Why Agents Break It

42:48 What to Do Monday Morning: The Checklist

If this helped, like, subscribe, and send it to someone who runs AI tools at work — especially if they're putting keys in environment variables and hoping for the best.

#BlackOctober #AISecurity #LLMJacking #APIKeys #AIAgents #IdentitySecurity #CyberSecurity #ZeroTrust #CloudSecurity #DTFCyberPodcast

http://cyberpodcast.net

Spotify: http://spotify.cyberpodcast.net

Apple: http://apple.cyberpodcast.net

X: https://x.com/dtfcyberpodcast

IG: https://www.instagram.com/dtfcyberpodcast/

Linkedin:

DTF: https://www.linkedin.com/company/dtf-cyber-podcast/

Damian: https://www.linkedin.com/in/damianchung/

Troy: https://www.linkedin.com/in/kosovotroy/

Fern: https://www.linkedin.com/in/fernrojasaz/

Business Inquiries: dtf at cyberpodcast dot net Everything here is our personal hot takes — not our employers, not the vendors we roast, not legal advice. Just three idiots with mics trying to keep you from getting pwned.

Your MSP has the keys to your cyber kingdom — but who's watching the locksmith? This week Damian's on vacation, so Troy and Fern are joined by JT Haynes (Technology & Cloud Advisor), who runs a managed service provider (MSP) after 15 years in healthcare security. Three stories: why attackers love MSPs (hack one, own dozens), the small businesses running HIPAA on Gmail, and the M365 session-token attack that walks right past MFA.

⏱️ CHAPTERS:

0:00 — Cold open: who's watching the locksmith?

0:53 — Intro: Damian's out, meet JT Haynes

1:41 — JT's story: healthcare security to MSP owner

7:56 — Why attackers target MSPs: hack one, own dozens

11:01 — The RMM hack that proved it

12:06 — Questions to ask before you hire an MSP

20:59 — War story: patient records backed up to a guy's house

30:48 — Your dentist is running HIPAA on Gmail

37:15 — The Gmail business-card test

51:37 — MFA didn't save them: session-token theft

55:45 — Anatomy of the M365 attack

1:06:34 — Wrap-up

1:07:30 — What we missed + final advice

🎙️ DTF Cyber Podcast — real talk on cybersecurity, no vendor fluff. 🌐

http://cyberpodcast.net

📺 New episodes weekly.

Subscribe for the hot takes your CISO won't give you.

#CyberSecurity #MSP #MFA #HIPAA #InfoSec

#DTFCyberPodcast

http://cyberpodcast.net

Spotify: http://spotify.cyberpodcast.net

Apple: http://apple.cyberpodcast.net

X: https://x.com/dtfcyberpodcast

IG: https://www.instagram.com/dtfcyberpodcast/ Linkedin:

DTF: https://www.linkedin.com/company/dtf-cyber-podcast/

Damian: https://www.linkedin.com/in/damianchung/

Troy: https://www.linkedin.com/in/kosovotroy/

Fern: https://www.linkedin.com/in/fernrojasaz/

Business Inquiries: dtf at cyberpodcast dot net Everything here is our personal hot takes — not our employers, not the vendors we roast, not legal advice. Just three idiots with mics trying to keep you from getting pwned.

Can we actually control autonomous AI agents once they leave the sandbox?

In Episode 54 of the DTF Cyber Podcast, Damian, Troy, and Fern dive into real-world instances of AI models breaking containment and acting beyond human control.

From an AI benchmark escaping its isolated test environment to laterally move and hack external infrastructure like Hugging Face, to the viral whistleblower tweet from former OpenAI and Anthropic safety researcher Jacob Coxon warning that labs are "racing straight to self-improving superintelligence", the crew breaks down what this shift means for real-world enterprise cybersecurity.

Timestamps:

00:00 – An AI model breaks out of its sandbox

00:36 – Intro: When the machines go wild, are we losing control?

00:54 – "AI Gone Wild" & retro tech memories

02:18 – The Hugging Face Incident: Breaking containment at machine speed

04:16 – Why traditional allowlists and denylists fail against autonomous agents

06:00 – Tech leadership culture: Do Dario and Sam prioritize security?

08:14 – The nation-state race: Can we afford to slow down?

11:30 – Media hype, FUD, and the battle over AI data centers & power

14:56 – Underwater data centers, cooling loops, and future infrastructure

16:13 – The Tweet Heard 'Round the World: The ex-OpenAI/Anthropic whistleblower

18:13 – Terminator theories & real-world threats to critical infrastructure

20:45 – Reading Jacob Coxon’s viral resignation tweet

23:49 – Whistleblower protections vs. walking away: What was the motivation?

28:02 – Leadership culture: Speaking up internally vs. venting publicly

30:45 – The trust dilemma: Transparency vs. catastrophic PR fallout

32:55 – Hugging Face detection: Why observability matters

34:30 – Autonomous agents in the real world (FinTech, payment rails, everyday apps)

36:55 – Hilarious automated messaging fails (and late-night work excuses)

43:18 – The weaponization of deepfakes and the erosion of digital trust

47:48 – Blue team reality: Why we need machine-on-machine governance

52:15 – Final thoughts, audience callout & wrap-up

53:48 – DTF Episode 54 Outro Song

Join the Conversation:

Has your organization started running autonomous AI agents, or are you keeping strict human-in-the-loop guardrails in place? Let us know your thoughts in the comments below!

🔔 Subscribe for weekly deep dives into technical cybersecurity, threat architecture, and modern application defense.

⭐ If you're listening on Apple Podcasts or Spotify, please leave us a 5-star review!

You can reset a password, but you can't reset your face. In this episode of the DTF Cyber Podcast, Damian, Troy, and Fern break down the massive Nexus / IDScan.net leak exposing over 153 million driver's licenses, travel documents, and medical cards. From rental car counters and Vegas dispensaries to third- and fourth-party vendor liability, we look at how raw UV/IR scans ended up on the dark web—and what consumers and enterprises need to do now.

TIMESTAMPS

* 00:00 - "You Can't Reset Your Face": The 153M ID Leak

* 01:18 - The Numbers: 170M Affected Across the US & Canada

* 03:08 - Why Ultraviolet & Infrared Scans Change the Game

* 05:30 - Nexus Marketplace & The Brian Krebs Discovery

* 07:13 - IDScan.net & The Third-Party Supply Chain Problem

* 09:30 - Car Rentals, Dispensaries & Fourth-Party Liability

* 12:03 - Barcode Swipes vs. Permanent Image Archiving

* 15:13 - Why Are Static Addresses Still Printed on Physical IDs?

* 17:10 - Facial Recognition, Meta Glasses & Law Enforcement Tech

* 20:00 - High Exposure States & Corporate Silence

* 22:30 - Data Breach Fatigue & Protecting Your Credit

* 24:18 - Holding Vendors Accountable: MSAs, Audits & Tort Law

* 26:33 - Brand Damage & The Hidden Cost of Lost Customers

* 30:13 - The Discord & 5CA Incident: A Repeating Vendor Pattern

* 32:48 - Sports Betting, Prediction Markets & Non-Credit Identity Theft

* 34:37 - Multi-Million Dollar Settlements vs. The $7 Payout

* 37:39 - SIM Swapping & Account Takeovers

* 38:24 - "Steve in Accounting" & The Reality of Phishing

* 39:04 - Vendor Security Theater & The Branded Sleep Mask

* 41:26 - Protecting Family: Grandmas, Wealth & Google Shortcuts

* 44:28 - Compliance Checklists vs. True Operational Security

* 45:56 - Will Threat Actors Use Public LLMs to Parse Stolen Data?

* 48:22 - Final Takeaways: Practical Guardrails for the New Normal

* 50:39 - Outro Track

KEY TAKEAWAYS

* Verification Doesn’t Require Retention: A real-time ID check only needs a binary pass/fail result, yet vendors continue to store high-res visible, UV, and IR scans long term.

* The Fourth-Party Blindspot: You might trust the brand on the rental counter, but your risk posture is actually dictated by the obscure downstream vendor processing their data behind the scenes.

* Non-Credit Attack Vectors: Identity theft isn't limited to credit bureaus—prediction markets, gaming sites, and sportsbooks verify identity via document scans without ever pinging credit monitoring. JOIN THE CONVERSATION

* Have you checked if your license or documents were compromised?

* Drop a comment below and let us know your take on vendor data retention policies.

* Don't forget to Like, Subscribe, and share this with someone who needs to freeze their credit! #Cybersecurity #DataBreach #IDScan #Privacy #IdentityTheft #DTFCyberPodcast #InfoSec

In Episode 52 of the DTF Cyber Podcast, Damian, Troy, and Fern debate the ultimate cybersecurity career question: should you build your path as a deep specialist or a broad generalist? The hosts discuss the harsh realities of aiming for penetration testing on day one, the difficult transition from hands-on keyboard roles to leadership, and why understanding the business is more important than your ego. They also dive into how artificial intelligence is changing the industry and why you need to "skate to where the puck is going" to future-proof your career.

Chapter Timestamps:

00:00 - Cold Open: Hackers in the kernel and the bigger risk picture

00:22 - Episode Intro: The Specialist vs. Generalist debate

01:23 - The rude awakening of wanting to be a pen tester on day one

03:00 - How internship programs are the real path to offensive security

05:25 - The Chef Analogy: Comparing cyber roles to a restaurant kitchen brigade

07:45 - The struggle of shifting from a technical specialist to people management

08:47 - Troy's journey from digital forensics to a broader CISO role

0:00 - Damian's story: Specializing in data resiliency after 9/11

13:40 - Why foundational networking knowledge is crucial for everyone

17:51 - The "AI Salt" analogy: MSG, tequila, and synthetic technology

22:02 - A controversial truth: Cyber exists to support the business, not run it

24:18 - When it makes sense to take a lesser title for a bigger opportunity

26:21 - Why ego and hubris are the ultimate career killers

31:33 - AI's future impact and the rise of autonomous pen testing

36:25 - The hunting and hockey metaphors: Skating to where the AI puck is going

40:27 - Uncovering the full "Jack of all trades" quote

48:24 - Do certifications actually get you jobs, or is it a business incentive?

53:03 - Outro Grunge Song: "AI Salt on the Table"

Are Flock Safety cameras keeping our neighborhoods safe, or are we sleepwalking into an unchecked private surveillance dragnet? When does legitimate workplace Data Loss Prevention (DLP) cross the line into invasive employee bossware?

In Episode 51 of the DTF Cyber Podcast, Damian Chung, Troy Wilkinson, and Fern break down the escalating battle between Security and Privacy. From AI-driven license plate recognition (ALPR) grids and 4th Amendment violations to keystroke logging, SOC alert fatigue, and who watches the administrators holding root access, the crew debates where the boundaries must be drawn.

Timestamps:

00:00 - Cold Open: Keystroke Logging vs. Telemetry Visibility

00:51 - Episode 51 Kickoff: Security vs. Privacy Debate

01:46 - Average Fern's Neighborhood Flock Camera Discovery

03:16 - Amber Alerts & The Pro-Surveillance Argument

04:32 - Troy's Lens: NCIC Auditing & Who Watches the Watchers?

06:20 - Crossing State Lines & The 4th Amendment Violation

08:15 - Minority Report Reality: Tracking Intent vs. Actions

09:16 - Workplace Surveillance & European Data Subject Rights

10:59 - How Machine Vision & SIEM Correlation Change the Game

14:40 - Facial Recognition False Positives & Arrest-First Risks

16:45 - The Thanos Ratio: 14,605,000 Defensive Wins vs. 1 Breach

20:38 - Zero Trust Governance, Admin Logs & Immediate Termination

23:45 - Threat Actor Attribution, Obfuscation & False Flags

26:00 - The 1984 Surveillance State & Data Aggregation Hazards

26:53 - Fern's Missing Child Story & Neighborhood Ring Cameras

33:22 - Tiered Access, Admin Tickets & Immediate Termination

46:37 - Mandatory Incident Reporting Regulations & CISA Rules

51:56 - Telemetry Lakes vs. Intrusive HR Bossware

01:05:43 - Outro & Custom DTF Outro Track

In this milestone episode, Damian, Troy, and Fern look back on 14 months of podcasting, growing from 1,000 to nearly 7,000 subscribers, and moving into a brand-new studio. We dive deep into the biggest lessons we've learned along the way: how AI has rapidly transformed our workflows and security operations, the unwritten rules of vendor-sponsored CISO dinners, navigating corporate ethics, and what it really takes to break into the cybersecurity industry today.

🪙 EPISODE 50 GIVEAWAY: To thank our listeners for reaching 50 episodes, we are giving away 10 custom, heavy-duty DTF Cyber Challenge Coins! How to enter:

* Make sure you are subscribed to the channel.

* Like this video.

* Leave a comment below letting us know what topic you want us to cover next!

⏱️ Timestamps

* 00:00 - Welcome to Episode 50 & The New Studio Setup

* 03:04 - The Unreleased "Episode 000" & Pivoting the Show Format

* 05:04 - Fern’s Daughter Out-Pacing the Podcast on YouTube

* 07:02 - Damian on Communicating Complex Security Concepts

* 08:33 - The "Bowling Alley on Fire" AI Guardrails Analogy

* 10:03 - Are Companies Really Blocking AI in 2026?

* 11:27 - Looking Back at Episode Predictions & The Evolution of AI

* 13:05 - Phone Games, Token Limits, and Micro-Transactions in AI

* 17:58 - Why Career & Internship Topics Resonate Most with Listeners

* 20:25 - Has Technology Changed Too Fast for Old Podcast Episodes?

* 23:14 - How Damian, Troy, and Fern Personally Use AI Every Day

* 26:47 - Sanitizing Contracts & Redlining Terms with AI

* 28:25 - Building Custom Apps, Automated Trading Bots & Agentic Defense

* 29:59 - The Process Behind the AI End-Song Music & B-Roll Visuals

* 32:00 - Why We Don't Take Sponsors & Keeping the Show Authentic

* 35:07 - Why You Don't Need to Be the "Smartest Person in the Room"

* 39:32 - The "7-Episode Curse" & Committing to Real, Organic Growth

* 41:48 - Shoutout to Andrew (The Ginger Hacker) & Community Initiatives

* 45:09 - CISO Dinners: How Vendor Networking Should Work

* 49:15 - Marketing Attribution, Account Lists & Behind-the-Scenes Sales Budget

* 55:32 - CISO Anxiety, "Speed Dating" Conferences & Ethics Boundaries

* 1:00:18 - Protecting Your Reputation as a CISO

* 1:02:32 - Cutting Through the Sales Noise & Dealing with Cold Emails

* 1:06:07 - How Networking Built Real-World Security Connections

* 1:07:19 - Episode 50 Challenge Coin Giveaway Details!

What happens when cybercriminals don't even bother encrypting your files, but still demand $5 million?

In Episode 49 of DTF Cyber, Damian, Troy, and Fern sit down with former 3x Financial CISO Brian Rosario to break down a terrifying shift in the threat landscape: Extortion Without Encryption. We analyze recent breach news (like Abbott Laboratories) to reveal how bad actors quietly exfiltrate crown jewel data, bypass traditional backup recovery options, and hold reputational/SEC clocks over your head. Plus, we dive into the risks of "Vibe Coding" with AI, unmonitored OAuth tokens, and how to build a security culture without ego.

----------------------------------------------------------------

📌 TIMESTAMPS:

00:00 - Cold Open: $5M Ransom, Zero Encrypted Files

00:49 - Guest Intro: 20-Year CISO Veteran Brian Rosario

01:50 - Abbott Labs Incident: The Shift Away From Encryption

03:55 - Why Bad Actors Pre-2020 Pivot To Pure Data Exfiltration

06:32 - Why Cloud Snapshots & Backups Aren't Stopping Extortion

08:28 - Supply Chain Threats: Codebases & Hardcoded Secrets

10:30 - The SolarWinds & NotPetya Effect

11:47 - Email Protection & Siphoning CEO Mailboxes via OAuth

14:35 - "Vibe Coding" & Unmonitored Citizen Developers

18:30 - The Explosive Rise of AI Governance Platforms

20:26 - "Is It Better To Not Know?" The CISO Visibility Dilemma

23:27 - Getting Ego Out of Security Leadership

28:20 - Analyzing the Kill Chain: Vishing, Smishing & DefCon Lessons

36:06 - SEC Disclosures & Data Layer Visibility

42:30 - Data at Rest Encryption: Is AI The Solution?

Are you tracking cybersecurity metrics that actually keep your business secure, or are you just reporting "the weather" to your executive board?

In Episode 48 of the DTF Cyber Podcast, Damian Chung, Troy Wilkinson, and Fern sit down with enterprise security operations leader Jason Barnes to look past the vanity metrics and deliver a definitive blueprint on the metrics that actually drive decisions.

We break down the operational realities of security telemetry across three critical categories: operational speed, corporate risk liability, and the human element. From navigating the true timeline of Mean Time to Detect (MTTD) to calculating hard-dollar risk through the FAIR model, this episode details exactly how to align engineering data with courtroom and boardroom defensibility.

📌 Key Timestamps:

00:00 - Security Metrics vs. Reporting the Weather

01:53 - Welcoming Special Guest Jason Barnes

02:50 - Ripping Dashboards Apart: Grouping by Category

03:37 - Metric 1: Mean Time to Detect (MTTD) & Attacker Dwell Time

05:26 - Fern’s "Intruder in the Attic" Analogy

08:00 - Addressing Timeline Manipulation in SOC Detection Logic

09:51 - Metric 2: Mean Time to Respond & Remediate (MTTR)

12:41 - Alert Fatigue: The Danger of Acknowledging Without Triaging

15:55 - Metric 3: Patch Cadence & The 72-Hour KEV Mandate

24:14 - Brand Reputation vs. Lost Sales: Calculating True Impact

27:03 - Metric 4: Security Control Coverage & Mapping MITRE ATT&CK

31:16 - The Shelfware Epidemic: Why 80% of Tools are Half-Deployed

32:02 - Metric 5: Supply Chain & Managing Third-Party Risk

38:31 - Metric 6: Cyber Risk, Financial Exposure, & The FAIR Model

45:19 - Metric 7: Phishing Repeat Offenders & Broken Human Firewalls

00:49:09 - Metric 8: Alert-to-Analyst Ratio & Workforce Burnout

00:50:44 - Operationalization Failures: Growth in Alerts From New Tools

00:51:51 - Metric 9: Security Investment ROI & Eliminating Uncertainty

00:53:40 - Guilt by Association: Why Shelfware Kills Long-Term Sales Relationships

00:58:01 - Metric 10: Incident Root-Cause Trends & After Action Reports

01:03:14 - Case Management vs. Using AI to Summarize Root Cause Analysis (RCA) Themes

01:06:04 - Metric 11 (BONUS JASON BARNES LANE): Exploitability & Internal Surface Attack Mapping (CMDB)

The traditional cybersecurity entry-level pipeline is fundamentally changing. In Episode 47 of the DTF Cyber Podcast, Damian, Troy, and Fern break down the rapid evolution of security operations centers and tackle a stark reality: the traditional Tier-1 SOC analyst job is officially dead.

With modern baseline metrics proving that AI platforms are automating over 50% of basic alert triage and log parsing, our hosts debate what this means for university programs, upcoming graduates, and mid-career professionals looking to break into the industry.

Fern introduces Jevons Paradox to explain the counterintuitive explosion of corporate data ingestion. Meanwhile, Damian and Troy face off on the corporate risk management landscape of "Building vs. Buying" automated security operations tools, the hidden dangers of undocumented enterprise AI sprawl, and why cybersecurity hiring is morphing from a wide-bottom pyramid into a highly specialized diamond.

Whether you are a tier-1 analyst trying to stay relevant, a student planning your career map, or an enterprise security leader trying to scale a global team, this episode delivers raw, unscripted strategy on how to reinvent your technical skillset before you get left behind.

--- ⏱️ CHAPTER TIMESTAMPS ---

00:00:00 - The University Pipeline Panic: Training for Dead Jobs?

00:01:07 - Welcome to Episode 47: The Level-1 SOC Analyst Job is Dead

00:01:59 - The AI SOC Market Explosion: Tracking 60+ New Automation Vendors

00:03:50 - Troy’s Evolution Analogy: From the Abacus to the Digital Calculator

00:04:17 - The Triage Threshold: Do Students Still Need to Learn Manual Log Parsing?

00:06:08 - Function vs. Job: Redefining Security Operations Metrics

00:09:29 - Road Trip Retrospective: Looking Back at AWS re:Invent

00:10:48 - The Gartner Baseline Metric: 50% of Tier-1 Tasks Automated

00:11:16 - The Anthropic Velocity: Unpacking the 8x Capability Multiplier

00:13:53 - Fern's Analogy Corner: Jevons Paradox & Exponential Data Lakes

00:17:01 - Autonomous Detection Engineering: Will AI Manage Its Own Ingestion?

00:22:12 - CISO Executive Assessment: The Build vs. Buy Infrastructure Dilemma

00:23:27 - Enterprise AI Sprawl: The Risk of Shadow API Keys & Tokens

00:29:07 - The Career Shift: Moving Up to AI Auditing & Agent Orchestration

00:32:18 - The Talent Diamond: Why Cyber Hiring is Changing Shape

00:35:10 - Alternative Entry Points: Vulnerability Management & GRC Realities

00:37:46 - Token Productivity Markers: Tracking Misuse & Side-Hustle Risks

00:41:30 - Damian's Hiring Blueprint: Why Growth Trajectory Beats a Degree

00:52:39 - The Non-Linear Path: Transitioning via Help Desks & IT Admins

00:58:35 - The Art of Interviewing: Damian's 300+ Career SOC Direct Hires

01:01:30 - Producer's Final Verdict: Reinventing Yourself for Judgment Day

01:04:50 - Episode Song - Where the Agents Hunt