On this week’s show Patrick Gray, and James Wilson are joined by bearded man of leisure Adam Boileau to discuss the week’s cybersecurity news, including:
Accidental AI agent hacking sprees have the world’s media freaking out, but we think it’s all pretty funny
The bugpocalypse is so chaotic, Microsoft can’t patch fast enough
A ColdCard wallet flaw led to millions in Bitcoin theft, but the back story behind the bug is bonkers
Iran hacks and disrupts water infrastructure in multiple American states
North Korea’s state-backed hackers turn criminal. Or their criminals turn into state-backed hackers. Or something. It’s all a bit confusing, actually.
Much, much more!This week’s show is brought to you by Sondera. Co-founder Josh Devon joins Patrick and James to talk through some absolutely hilarious LLM horror stories.
This episode is also available on YouTube
Show notes
OpenAI says rogue agent behind Hugging Face hack broke into additional services | therecord.media
Anthropic Says Claude Hacked Real Systems During Cybersecurity Tests | wired.com
Claude uploaded malware to PyPI in Anthropic's botched test | BleepingComputer
Nobody Knows if OpenAI’s and Anthropic’s AI Hacking Sprees Are Illegal | wired.com
Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets Truffle Security Co. |
Anthropic’s New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. | Social Signals
Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting | wired.com
Google says it fixed more Chrome bugs in June than over the past two years, thanks to AI | TechCrunch Security
Mythos uncovers crypto weaknesses that went unknown for years | arstechnica.com
COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft | BleepingComputer
Chris Masterjohn (@ChrisMasterjohn) on X | X (formerly Twitter)
wale.moca 🐳 (@waleswoosh) on X | X (formerly Twitter)
U.S. spy agencies suspect Iran launched cyberattack on Minnesota water facilities | washingtonpost.com
FBI investigates as Michigan joins Minnesota in reporting cyberattacks on its water systems | washingtonpost.com
Trump blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world | cyberscoop.com
A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran | wired.com
Russia accuses Telegram founder of aiding terrorism, seeks international arrest | The Record
Laundry Bear’s webmail hackers had more in store after February, report says | therecord.media
CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog
Phishing service spoofs RingCentral to steal Microsoft 365 accounts | BleepingComputer
North Korean hackers behind major open-source supply chain attacks, Amazon says | therecord.media
North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn | The Record
North Korea arrests hackers accused of laundering stolen bank funds through crypto |
US government bans new foreign-made humanoids, robot dogs, and solar inverters, citing risks to national security | TechCrunch Security
Judge says Trump admin still lacks evidence for Anthropic 'supply chain risk' label | TechCrunch
Cyber Command plans Silicon Valley office to drive innovation | therecord.media
Apple is getting this wrong | OpenAI
Tech industry alliance proposes AI agent safety reporting program | Cybersecurity Dive
Massive ChainDrop npm supply-chain attack infects hundreds of packages | BleepingComputer
Massive supply-chain attack compromises 440 packages under four hours | cyberscoop.com