Sign up to save your podcasts
Or
Share Skillthropic
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Skillthropic
Skillthropic episodes
- Deep Dive: ARTEX: The FBI's Warning About AI Agents That Run the Whole Intrusion
The FBI's November 13, 2026 FLASH warns that ARTEX, an open-source agentic AI penetration testing framework, is being used to go from first scan to privileged access in under three hours. How it works, the South Korea and ConnectWise campaigns, the intrusion chain, what to look for in your logs, the FBI's mitigations and three things to do today.
In this deep dive
- What ARTEX is: a Go orchestrator that hands an intrusion to AI agents, and why pulling the GitHub repo on October 8 didn't stop it
- How it works: SI agents in parallel, reasoning rented from Claude, GPT, DeepSeek, GLM, Grok or Kimi, often through API resellers
- The FBI's five risks, from multi-target operations to a compressed detection window
- Two campaigns: about 67,000 people's data from South Korean financial institutions, and 2,250+ tenants reached through ConnectWise Cloud Backup's OAuth app
- The intrusion chain, the lateral movement EDR blocked, and why the initial access flaws were all testable
- Indicators and three places to detect it: identity, egress to LLM APIs, and the cloud control plane
- The FBI's mitigations, what it means for Security+, CySA+ and SecAI+, and three actions for today
Source: FBI FLASH-20261113-001, "Threat Overview of ARTEX Autonomous Penetration Testing Framework," November 13, 2026 (TLP:CLEAR). The full write-up, with the ATT&CK mapping, the IOCs and both hunting queries, is on the Skillthropic blog.
Links
- FBI FLASH on ARTEX: the full breakdown (Skillthropic blog)
- Watch the video version on YouTube
- Interactive MITRE ATT&CK matrix
- Study guides for Security+, CySA+ and SecAI+
- Report an incident to the FBI (IC3)
Transcript and links: https://www.skillthropic.com/podcast/artex-fbi-flash-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=artex-fbi-flash-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
14 min - Deep Dive: Detective vs. Corrective Controls, Explained: Tell Us, Then Fix It
Why prevention alone isn't enough, the difference between controls that identify a problem and controls that address it, and why collecting logs isn't the same as detecting. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
In this deep dive
- Why organizations need controls beyond prevention: malware that gets past preventive controls
- Detective controls: intrusion detection systems and monitoring for unusual sign-ins, file changes and suspicious processes
- The misconception that collecting logs is detecting, and when detection really happens
- Corrective controls: removing malware, restoring from a clean backup, patches applied after an incident
- An endpoint tool that detects and quarantines: one product, two control types
This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
Links
- CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
- All of Chris Rees's Pluralsight courses
- Watch this lesson on YouTube
- Security+ study guides
Transcript and links: https://www.skillthropic.com/podcast/detective-vs-corrective-controls-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=detective-vs-corrective-controls-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
3 min - Deep Dive: Strong Encryption, Weak Choices: LastPass and Matching Cryptography to the Requirement
How unencrypted website addresses and low PBKDF2 iteration counts undid LastPass's encrypted vaults, and why Security+ objective 1.3 is about matching the cryptographic solution to the requirement. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
In this deep dive
- Why objective 1.3 asks which cryptographic technique fits a requirement, not how to do the math
- The LastPass breach: encrypted passwords, unencrypted website addresses, and PBKDF2 iteration counts as low as one
- Why stolen ciphertext doesn't expire, and weak protection is only a matter of time
- How encryption turns plaintext into ciphertext with an algorithm and a key
- Why integrity, origin and non-repudiation point past encryption to hashing and digital signatures
This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
Links
- CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
- All of Chris Rees's Pluralsight courses
- Watch this lesson on YouTube
- Security+ study guides
Transcript and links: https://www.skillthropic.com/podcast/lastpass-appropriate-cryptography-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=lastpass-appropriate-cryptography-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
6 min - Deep Dive: Transport Encryption, Explained: How TLS Protects Data in Motion
How HTTPS uses a TLS handshake, a key exchange and symmetric encryption to protect data between systems, and why old SSL and early TLS versions should be out of your environment. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
In this deep dive
- Transport or communication encryption: protecting data in motion between systems
- HTTPS as HTTP protected by TLS, and the handshake where the server presents its certificate
- A key exchange that gives both sides the same session keys without sending them, then symmetric encryption for the session
- TLS 1.3 (RFC 8446) as the current version, and RFC 8996 formally deprecating TLS 1.0 and 1.1 in March 2021
- For the exam: TLS is the default answer for web traffic, and old SSL or TLS 1.0 is a finding
This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
Links
- CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
- All of Chris Rees's Pluralsight courses
- Watch this lesson on YouTube
- Security+ study guides
Transcript and links: https://www.skillthropic.com/podcast/transport-encryption-tls-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=transport-encryption-tls-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
4 min - Deep Dive: CrowdStrike, July 2024: Backout, Fail Forward and the Size of the Blast Radius
What the July 2024 CrowdStrike update teaches about recovery, why a fast revert didn't help machines that had already crashed, and how to choose between backing out and failing forward. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
In this deep dive
- July 19th, 2024: a routine CrowdStrike content update sends Windows machines running the sensor into a crash loop
- Why reverting 78 minutes later only protected machines that hadn't crashed yet, and how BitLocker recovery keys stretched recovery into days
- The staged rollout CrowdStrike moved to: a canary group, early adopters, broad deployment, then everyone
- When backing out is the safer choice, and when failing forward makes more sense
- Finding the point of no return before the change starts
This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
Links
- Microsoft: Helping our customers through the CrowdStrike outage
- CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
- All of Chris Rees's Pluralsight courses
- Watch this lesson on YouTube
- Security+ study guides
Transcript and links: https://www.skillthropic.com/podcast/crowdstrike-backout-vs-fail-forward-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=crowdstrike-backout-vs-fail-forward-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
4 min - Deep Dive: Impact Analysis and Test Results, Explained: Evidence First, Then Deployment
How a harmless-looking certificate swap touches four systems, the four questions an impact analysis asks, and why test results have to reach the approver before a change reaches production. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
In this deep dive
- A certificate replacement that touches a customer portal, an internal API, a load balancer and a mobile app
- The impact analysis questions: who's affected, what depends on it, does it change our security exposure, and what would the business feel
- Why a change can be technically correct and still be a business failure
- Development, test or staging, and production, and why the test environment has to resemble production
- Functional tests, compatibility tests and a security scan, and how the results inform the CAB's approval
This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
Links
- CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
- All of Chris Rees's Pluralsight courses
- Watch this lesson on YouTube
- Security+ study guides
Transcript and links: https://www.skillthropic.com/podcast/impact-analysis-test-results-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=impact-analysis-test-results-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
5 min - Deep Dive: Defense in Depth, Explained: Layered Controls and the Side Window Nobody Locked
Why one control is never enough, how layers that prevent, detect and respond work together, and a phishing scenario where any one of three layers can stop the attack. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
In this deep dive
- The vocabulary objective 1.1 assumes you already have, and why control categories and control types answer two different questions
- Why a single firewall leaves an attacker relatively unrestricted access once it's bypassed
- Building layers: perimeter firewall, network segmentation, endpoint protection and MFA, all wrapped around the data
- Layers that prevent, detect and respond, and why they shouldn't duplicate the same weakness
- A phished password scenario where MFA, segmentation and monitoring each get a chance to stop the attacker
This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
Links
- CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
- All of Chris Rees's Pluralsight courses
- Watch this lesson on YouTube
- Security+ study guides
Transcript and links: https://www.skillthropic.com/podcast/defense-in-depth-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=defense-in-depth-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
5 min - AI Security Brief: GPT-6 Cyber Builds 948 Linux Exploits, Claude Code Leaks Secrets to GitHub
An AI model builds hundreds of Linux exploits, Claude Code leaks secrets to GitHub, and stolen AI keys push a bad plugin to 5,000 companies.
In this episode
- GPT-6 Cyber builds 948 Linux exploits while fixes lag: AI is finding serious bugs in mature code faster than the industry is patching them.
- Claude Code's 'don't ask again' leaks secrets to GitHub: Approved commands, passwords included, are being saved to settings files and pushed to public repos.
- Stolen AI keys chain into a plugin hitting 5,000 companies: A breach at one AI provider rippled through a coding tool into thousands of customers.
- Researchers bypass ChatGPT Lockdown Mode: A protection built to stop prompt injection exfiltration was sidestepped before it was patched.
- Claude Code hooks see the checkpoint, not what follows: Agent policy controls judge the request, not the processes and connections it spawns afterward.
- Prompt adware hides in a Codex jailbreak bundle: A jailbreak rewrites an agent's trusted instructions, proving agent config files are an attack surface.
- White House AI accord leaves auditors undefined: 'Independently audited' has no shared definition, so customers have to ask the follow-up questions.
What to do this week
- Hunt for leaked agent secrets. Scan repos for Claude Code settings files and rotate any keys or passwords you find.
- Look past the hook checkpoint. Back agent hooks with endpoint monitoring and track changes to agent config files.
- Get your patch process ready. AI is finding bugs faster than teams fix them. Plan capacity for a bigger patch queue.
Sources
- GPT-6 Cyber builds 948 Linux exploits while fixes lag (CSO Online)
- Claude Code's 'don't ask again' leaks secrets to GitHub (The Hacker News)
- Stolen AI keys chain into a plugin hitting 5,000 companies (The Verge)
- Researchers bypass ChatGPT Lockdown Mode (The Hacker News)
- Claude Code hooks see the checkpoint, not what follows (CIO)
- Prompt adware hides in a Codex jailbreak bundle (The Hacker News)
- White House AI accord leaves auditors undefined (Crypto Briefing)
Transcript and links: https://www.skillthropic.com/podcast/ai-security-brief-2026-11-09?utm_source=podcast&utm_medium=audio&utm_campaign=ai-security-brief-2026-11-09
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
6 min - Deep Dive: Least Privilege and Break-Glass Accounts, Explained: Shrinking the Blast Radius
Why least privilege applies to users, applications and services, how it limits the damage from a compromised account, and the one planned exception every cloud tenant needs. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
In this deep dive
- Least privilege: only the permissions an identity needs for its legitimate responsibilities
- Why a stolen ordinary account reaches a small area and a stolen admin account reaches almost everything
- Separate standard and admin accounts for administrators, and least privilege for applications and services
- People who move between roles and collect access, and why keeping old access is a least privilege failure
- Break-glass accounts: two cloud-only accounts, excluded from conditional access, protected with FIDO2 keys, alerting on any sign-in and tested on a schedule
- Microsoft's mandatory MFA for its admin portals, and why password-only emergency accounts no longer work there
This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.
Links
- CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
- All of Chris Rees's Pluralsight courses
- Watch this lesson on YouTube
- Security+ study guides
Transcript and links: https://www.skillthropic.com/podcast/least-privilege-break-glass-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=least-privilege-break-glass-deep-dive
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
6 min - AI Security Brief: Binance $6.3bn Heist Used an Internal AI Tool, UK Warns of AI Ransomware
An internal AI tool in a $6.3 billion crypto heist, a UK warning on AI-powered ransomware, and malware that ranks victims by value.
In this episode
- Binance heist: internal AI tool helped drain $6.3bn: A fake job interview and an internal AI tool put attackers inside the wallet team's systems.
- NCSC: AI ransomware on UK infrastructure highly likely: The UK's cyber agency expects AI to help attackers find and exploit long-tolerated weaknesses.
- VOLTA infostealer uses AI to rank victims by value: The theft is familiar. Using LLMs to decide which stolen data pays best is the new part.
- Gemini model leads benchmarks for finding and exploiting bugs: Models that find and patch bugs for defenders can find them for attackers too.
- Fake ChatGPT and Claude apps deliver crypto miners: Attackers are using AI brand names and signed executables to get malware installed.
- Lock down AI coding agents with an allowlist: Agent identity and command policy decide how far a hijacked coding agent can reach.
- 40% of security teams now use AI every day: AI agents in the SOC only help if the data and processes underneath are in order.
What to do this week
- Brief engineers on fake job offers. Recruiting scams deliver malware. Lock internal AI tools down like privileged systems.
- Allowlist AI clients and agent commands. Approved desktop clients only. Enforce agent policy in the harness, not the model.
- Shrink your patch window. AI is speeding up bug discovery. Your patch backlog is now a timeline.
Sources
- Binance heist: internal AI tool helped drain $6.3bn (The Guardian)
- NCSC: AI ransomware on UK infrastructure highly likely (The Guardian)
- VOLTA infostealer uses AI to rank victims by value (The Hacker News)
- Gemini model leads benchmarks for finding and exploiting bugs (The Hacker News)
- Fake ChatGPT and Claude apps deliver crypto miners (The Hacker News)
- Lock down AI coding agents with an allowlist (Help Net Security)
- 40% of security teams now use AI every day (The Hacker News)
Transcript and links: https://www.skillthropic.com/podcast/ai-security-brief-2026-11-05?utm_source=podcast&utm_medium=audio&utm_campaign=ai-security-brief-2026-11-05
Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com
6 min
About Skillthropic
From the publisher's feed
AI security for people who work in tech. Chris Rees, 25+ year security veteran and author of 51 Pluralsight courses, brings you The AI Security Brief, a short rundown of the AI security news that…
matters, plus a weekly deep dive into one AI or security topic, explained so you can use it at work or on your next certification exam. The briefs are drafted with AI from the day's news, reviewed by Chris before they go out, and narrated in Chris's own voice using an AI voice clone. Formerly My Tech Career.