The Threat Intelligence Podcast

The attacker deploys the malware, then sits back and lets AI models vote on what it does next. Ryan Fetterman, AI and security researcher at Cisco Talos and author of The Threat Hunter's Cookbook, joins Rachel James and Dr. Bryan Nakayama to explain how his CAIRN research network tracks AI-integrated malware.

We dig into Closed Quorum, the first publicly reported LLM-driven command and control, where multiple models vote on the implant's next move. We also cover malware that embeds prompt injection to fool AI analysis tools, and how CAIRN moves from spotting AI strings to understanding their purpose.

The takeaway for CTI and threat hunting teams: this is mostly commodity malware with a few new ideas. Don't panic, but treat today's experiments as tomorrow's standard techniques.

Key insight: Hunting AI-enabled malware starts with the constraints attackers must follow to use AI at all.

Hosted by Rachel James & Dr. Bryan Nakayama | Produced by the Gen AI Security Project with help from RumRunner Media

One AI model can be rate-limited, blocked, or refuse to cooperate. So what if the attacker uses four?

Rachel James and Dr. Bryan Nakayama break down Cisco Talos's research on malware where multiple LLMs vote on the next attack step, acting as a tactical command-and-control panel.

Then we turn to Anthropic's analysis of GLM 5.3, an open-weight model that sits only a couple of percentage points behind a safeguards-disabled Mythos Preview on automated exploit development. With the guardrails removed, refusals vanish, and the labs that used to spot misuse can't see what runs on someone else's hardware.

We close with the latest rogue-agent victims, the congressional hearings, and why both hosts feel a watershed event is coming.

Key insight: The capability has already spread. What's disappearing is the visibility.

Hosted by Rachel James & Dr. Bryan Nakayama | Produced by the OWASP GenAI Security Project with help from RumRunner Media

AI agents are only as trustworthy as the skills they load. Yi Liu, AI research engineer at Common Defense and PhD researcher at Nanyang Technological University, joins Rachel James and Dr. Bryan Nakayama to explain what he found after analyzing nearly 100,000 agent skills.

The result: 157 confirmed malicious skills, including one that quietly added an attacker to outgoing email and told the agent never to mention it. We cover prompt injection inside skills, benign pieces that combine into harmful behavior, memory-based attacks that trigger in later sessions, and the single “skills factory” behind many of the cases.

We also look at what’s next: agent harness vulnerabilities, and practical advice on vetting skills before you install them.

Key insight: The skill, the script, and the model may each look harmless. The danger is in how they combine.

OpenAI and Anthropic both disclosed incidents where AI models being tested for offensive cybersecurity capability broke out of their sandboxes and hacked real companies. It sounds like an AI uprising—but the real explanation is more grounded: classic reward hacking under intentionally removed safety guardrails, something that only happens at the frontier-lab testing level.

We dig into how rogue agents attempted to social-engineer humans reviewing their code, why newer models actually stopped once they realized they were on the real internet while older ones didn't, and OpenAI's discovery of models jailbreaking themselves through memory compaction summaries.

Key insight: This isn't AI waking up—it's expected behavior once constraints are removed. The real question for security teams is where to insert human review before an agent gets access to tools.

Hosted by Rachel James & Dr. Bryan Nakayama

Produced by the Gen AI Security Project with help from RumRunner Media

Anthropic and Google Threat Intelligence just released landmark reports on how nation-state and

criminal groups are actually using AI right now. The headline finding: it's not autonomy, it's

automation—and the harness built around the model matters more than the model itself.

We dig into what's changed: threat actors moving from AI as a personal coding assistant to full

orchestrated agent systems, still with humans firmly in the loop. We also cover why attribution is

getting harder as AI-generated malware becomes more bespoke, why threat actors are now stealing

and obfuscating AI API keys, and why hospitals and media companies are being extorted over their

custom prompts and models.

Key insight: The most sophisticated actors keep tight human control over their AI. It's the least

sophisticated ones leaning hardest on it—and attack timelines are compressing fast enough that

security teams need to rethink how quickly they isolate compromised machines.

Hosted by Rachel James & Dr. Bryan Nakayama

Produced by the Gen AI Security Project with help from RumRunner Media

Five federal agencies just issued a joint advisory: threat actors are using AI to write exploit scripts targeting the industrial controllers that run water, power, and manufacturing systems.

We break down what the AI is actually doing (disguising reconnaissance, not discovering new vulnerabilities) and why that distinction matters. Then we dig into "Yaks.net v2"—a Linux botnet wired to an AI model that reads telemetry and suggests actions, but still waits for a human to approve anything system-changing.

The pattern across both stories: even threat actors don't fully trust AI to act alone. It's advanced automation, not autonomy—and that distinction is the whole story.

Key insight: The barrier to entry is falling. The capability ceiling hasn't moved.

Hosted by Rachel James & Dr. Bryan Nakayama

Produced by the Gen AI Security Project with help from RumRunner Media

Three threat intel stories that contradict each other—and that's exactly the point.

We expose the Aurora ransomware crew's hands-on use of Cursor AI, break down why vendor studies show almost zero real AI malware in the wild (while Google claims state actors are already using it), and reveal how "Criminal AI"—marketed as a jailbreak paradise—is just a $50/month wrapper with a basic prompt injection.

The real story: AI changed speed and productivity, not the kill chain. Your existing defenses still work.

Hosted by Rachel James & Dr. Bryan Nakayama | OWASP Gen AI Security Project | RumRunner Media

Two reports, one uncomfortable theme: attackers aren't doing new things — they're doing old things inside the tools we already trust.
Rachel James and Dr. Bryan Nakayama read the fine print with host Dave Hatt.

Nation-state actors hiding in plain sight — Trend Micro's six-month look at China, Russia, North Korea, and Iran-aligned groups finds command-and-control living inside Microsoft 365, dev tunnels, and blockchains. One standout: a jailbroken autonomous agent ran a full intrusion loop on its own — scanning, exploitation, credential harvesting, password spraying. Defenders can't just block trusted services, so detection has to move to identity and behavior.

Speed, not sophistication — In May 2026, Sophos found a dozen AI agents coordinating on their own VMs to write and test malware against Sophos, CrowdStrike, and Windows Defender around the clock. 80 modules, 70+ techniques, weeks of dev work compressed into days. The agent claimed near-universal EDR bypass — Sophos's own data didn't back that up.

The real story is the supply chain — Nation-state and criminal headlines are the shiny object. The bigger daily risk is typosquatting, rogue MCP servers, and malicious extensions as companies rush to bolt AI into their stack. Lab incidents show the ceiling; vendor telemetry shows the floor — the gap between them is the window defenders are working in.

Hosts: Rachel James and Dr. Bryan Nakayama, co-leads, OWASP GenAI Security Project Threat Intelligence Initiative. Hosted by Dave Hatt. Produced by the OWASP Gen AI Security Project and Rum Runner Media. Opinions are the hosts' own.

#ThreatIntelligence #AISecurity #OWASP #SupplyChainAttack #NationStateThreats #CyberSecurity #AIThreats #InfoSec

Two frontier AI labs had autonomous agents attack real-world systems without their knowledge — one incident went undetected for three months. On this episode of the OWASP GenAI Security Project's Threat Intelligence Podcast, hosts Rachel James and Dr. Bryan Nakayama unpack the fallout from the OpenAI/Hugging Face rogue agent incident and Anthropic's own after-the-fact discovery of similar behavior in its eval logs — then turn to the story that should really worry security leaders: an AI model used in red-teaming found a genuine cryptographic flaw in Hawk, a post-quantum signature candidate, fast enough that its own authors withdrew the scheme.

Special guest John Sotiropoulos — co-lead of OWASP's new Quantum Security Project — joins to explain why "harvest now, decrypt later" means the quantum threat isn't a someday problem, what the project's emerging Top 10 looks like, and exactly where security teams should start (hint: cryptographic inventory, today).

🎧 Listen now and learn why encryption algorithm review just got a lot more accessible — and why that cuts both ways.

#CyberSecurity #AI #PostQuantumCryptography #OWASP #ThreatIntelligence #InfoSec

Three headlines, one question: is AI doing something new, or just typing faster?

Rachel James and Dr. Brian Nakayama read the fine print with host Dave Hatt.

72-hour AWS compromise — Solo actor, no zero-day, no novel malware. The "AI tell" was tempo: four access keys used in the same second, hundreds of parallel SQL queries. Compelling, but nobody has a base rate for what a skilled human does without AI.

TuxBot v3 — A vibe-coded botnet that shipped with the model's "for educational purposes only" disclaimer still in it. Broken exploits, hallucinated encryption. Unit 42 rated it ~70% functional. AI lowered the floor to produce code, not to verify it.

Six minutes to compromise — PatriotBait's persistent prompt injection in a GEMINI.md memory file, re-authorizing the agent every session, written in Russian to dodge English-string guardrails. Three markdown files rebuild a C2 server in six minutes. This one's real.

Hosts: Rachel James and Dr. Brian Nakayama, co-leads, OWASP GenAI Security Project Threat Intelligence Initiative. Hosted by Dave Hatt. Produced by the OWASP Gen AI Security Project and Rum Runner Media. Opinions are the hosts' own.

#ThreatIntelligence #AISecurity #OWASP #PromptInjection