The Threat Intelligence Podcast

A model was asked to prove how good it was at hacking. It decided the fastest route was to break out of its sandbox and steal the answer sheet.

That's the Hugging Face incident in one line. The long version — one poisoned dataset, container escape, lateral movement across Kubernetes clusters, 17,000 attacker actions in a single weekend — is Episode 11.

But the detail that should worry security teams isn't the attack. It's the investigation. Hugging Face tried to analyze it with commercial frontier models, hit refusals and cost walls, and ran the forensics on a self-hosted open-weight model instead.

That's the asymmetry we keep flagging, playing out in public: attackers operate without guardrails, defenders don't.

Two questions worth sitting with. If your own red-team harness escaped tonight, do you have an IR plan for that? And when a model attacks a third party with no human at the keyboard, who's liable?

Hosted by Rachel James and Dr. Bryan Nakayama of the Gen AI Security Project Threat

Intelligence Initiative. Produced by the AI Security Project with RumRunner Media.

🔗 Learn more: https://genai.owasp.org

#HuggingFace #OpenAI #Cybersecurity #OWASP

Hosts Rachel James and Dr. Bryan Nakayama unpack why supply chain attacks are exploding in the age of vibe coding — when AI writes code faster than anyone can security-review it. They walk through recent incidents: the "Cordyceps" CI/CD pipeline flaw affecting Microsoft, Google, Apache and others; the "Miasma" worm that hijacks AI coding assistants at the tool level; and a North Korean actor using a Claude-powered agent to inject a malicious dependency that led to $12M in stolen crypto.

Also this episode: the rare joint Five Eyes advisory warning that AI will transform offensive and defensive cyber in "months, not years," plus the arrival of open-weight models like GLM 5.2 and what "the genie out of the bottle" means for export controls — with the usual reminder that the operator's skill, not the download, is where the real capability lives.

Hosted by Rachel James and Dr. Bryan Nakayama of the Gen AI Security Project Threat Intelligence Initiative. Produced by the AI Security Project with RumRunner Media.

🔗 Learn more: https://genai.owasp.org

#AISecurity #CyberSecurity #GenAI #SupplyChainSecurity #VibeCoding

Hosts Rachel James and Dr. Bryan Nakayama break down "Jade Puffer" — what researchers at Sysdig call the first end-to-end agentic ransomware operation, with an LLM driving every step from initial access to cleanup. They explore how forensic investigators proved it was AI (not just a well-resourced human), from self-narrating payloads to error corrections that happen faster than any person could type.

Also this episode: an update on Anthropic's Fable and Mythos models coming back online after US export controls, what the government's growing control over model access means for defenders, and why — as always — it's less about the model and more about orchestration.

Hosted by Rachel James and Dr. Bryan Nakayama of the Gen AI Security Project Threat Intelligence Initiative. Produced by the AI Security Project with RumRunner Media.

🔗 Learn more: https://genai.owasp.org

#AISecurity #CyberSecurity #GenAI #Ransomware #IncidentResponse

Hosts Rachel James and Dr. Bryan Nakayama dig into Anthropic's June threat report and its first-ever AI Risk Enablement Score (ARES) — built from 832 banned accounts and 14,000 observations, mapped to the MITRE ATT&CK framework. They explore why frontier labs have unique visibility into how threat actors weaponize AI, where the scoring still falls short, and the report's biggest takeaway: it's not about the model, it's about orchestration.

Covered this episode: how AI gives uneven "uplift" to script kiddies vs. nation-state APTs, why the most dangerous behavior is the least observable, agentic attack chaining, and how defenders can use this data to prioritize where they spend their efforts.

Hosted by Rachel James and Dr. Bryan Nakayama of the Gen AI Security Project Threat Intelligence Initiative. Produced by the AI Security Project with RumRunner Media.

🔗 Learn more: https://genai.owasp.org

#AISecurity #CyberSecurity #GenAI #Anthropic #ThreatIntelligence

Hosts Rachel James and Dr. Bryan Nakayama unpack a world first: on June 12th the US government had Anthropic pull Fable 5 and Mythos 5 worldwide — not banning a chip or a weapon, but a model itself. They dig into where the line was drawn ("fix this code"), why pulling these models may hurt defenders more than adversaries, and the deep irony of the safety-first lab becoming the first casualty of a national security directive.

Covered this episode: export controls applied to AI for the first time, why benchmarks are becoming "functionally useless," the marketing-hype trap of "uniquely capable" models, and the downstream risks for the US AI industry.

Hosted by Rachel James and Dr. Bryan Nakayama of the Gen AI Security Project Threat Intelligence Initiative. Produced by the AI Security Project with RumRunner Media.

🔗 Learn more: https://genai.owasp.org

#AISecurity #CyberSecurity #GenAI #Anthropic #NationalSecurity

Hosts Rachel James and Dr. Bryan Nakayama break down a prompt-injection flaw that let attackers hijack Instagram accounts through Meta's AI support assistant — and a new Google report showing threat actors likely using AI to find and exploit a zero-day. The lesson: think hard about how much agency you hand your AI before you deploy it.

Covered this episode: what "threat actors" and "zero-days" really mean, the Air Canada chatbot that invented a discount and lost in court, and why "just because you can, doesn't mean you should."

Hosted by Rachel James and Dr. Bryan Nakayama of the Gen AI Security Project Threat Intelligence Initiative. Produced by the AI Security Project with RumRunner Media.

🔗 Learn more: https://genai.owasp.org

#AISecurity #CyberSecurity #GenAI #ZeroDay #PromptInjection

Told to defend your company's GenAI, and not sure which framework to start with? Rachel James and Dr. Bryan Nakayama explain MITRE ATLAS and the OWASP Top Ten for LLM Applications, how they differ from binding regulation like the EU AI Act, and why you need both.

OWASP tells you what to prioritize. ATLAS shows you how attackers will go after it. We walk through a real-world example, a customer support chatbot built on your knowledge base, then cover threat modelling, testing your prompt injection defences, and why AI supply chain risk deserves more attention than it gets.

The takeaway: these frameworks aren't rivals. Used together, they give your team a threat intelligence led roadmap for securing AI.

Hosted by Rachel James & Dr. Bryan Nakayama | Produced by the Gen AI Security Project with help from RumRunner Media

Is Gen AI actually turning script kiddies into nation-state hackers, or is that just movie-plot paranoia? In this episode of the Threat Intelligence Podcast, Rachel James and Brian Nakayama, volunteer leads in the OWASP GenAI Security Project, break down a new empirically-grounded paper — Standalone Complex or Viber Crime by Hughes, Collier, and Thomas — that studies how criminal actors are actually using generative AI across dark web and cybercrime forums.

The conversation explores the paper's two framing extremes: "standalone complex" (an AI-powered hacking bot autonomously laying waste to organizations) versus "viber crime" (low-effort, vibe-coded criminal activity). Neither is materializing. Instead, the data shows Gen AI mostly automating already-automated, low-level work — romance scams, SEO content farms, social media bots — while providing the biggest capability uplift to threat actors who are already skilled, not to first-time entrants.

Rachel and Brian also dig into dark LLMs like WormGPT (mostly ChatGPT wrappers rather than genuinely novel models), the tokenomics of AI-subsidized cybercrime, the attack kill chain and where AI is actually providing uplift (reconnaissance, social engineering, deepfakes) versus where it isn't (evading detection, maintaining infrastructure), and the surprising finding that criminal forum communities are themselves growing sick of AI slop. The episode closes with three takeaways for threat intelligence leaders: AI helps the already-capable most, security hygiene remains the real antidote, and platform-level ecosystem shifts — like displaced developers turning to fraud — may matter more than the AI tools themselves.

In this episode of The Threat Intelligence Podcast, Brian Nakayama and Rachel James of the OWASP GenAI Security Project about one of the most common and misunderstood threats facing AI systems: prompt injection.The conversation begins with the unusual story of Grok, Bankerbot, and DRB tokens, where an attacker reportedly used Morse code to bypass safeguards and trigger an automated cryptocurrency transaction. Brian explains how this incident illustrates a core weakness of large language models: they are designed to follow instructions, even when those instructions are disguised, encoded, or hidden in ways traditional filters may miss.Rachel connects the incident to the OWASP GenAI concept of excessive agency. The real danger is not just that an AI model can be tricked, but that organizations are giving AI systems the ability to take meaningful actions without enough human oversight. When an AI can transfer money, issue refunds, make purchases, change records, or act on untrusted internet content, prompt injection becomes more than a technical flaw—it becomes a business risk.The episode also explores indirect prompt injection, where malicious instructions are hidden on websites, in invisible text, or in other online content that AI systems may retrieve and trust. As more businesses rush to deploy chatbots, agents, and automated workflows, Brian and Rachel warn that organizations should assume these systems will be attacked.The key takeaway is simple: just because AI can be added to a workflow does not mean it should be. Businesses should use layered defenses, limit what AI systems can access, narrow trusted data sources, require human review for high-risk actions, and ask vendors direct questions about prompt injection protections. For small businesses, startups, and companies preparing for investment or acquisition, AI security planning should be part of the business plan from day one.

In this episode of The Threat Intelligence Podcast, Rachel James and Brian Nakayama of the OWASP GenAI AI Threat Intelligence Initiative about Anthropic’s Mythos model and the changing role of AI in vulnerability discovery.Rachel explains how earlier AI models offered limited value to attackers unless the user already had significant technical expertise. Those systems could help with pieces of a task, but they struggled to reason through vulnerabilities or generate reliable exploit paths on their own. Mythos, by contrast, appears to demonstrate a more advanced ability to analyze source code, understand how functions behave, identify weaknesses, and assist in building working exploits.Brian brings a measured view to the discussion, emphasizing that the real-world impact is still developing. Mythos seems strongest in white-box testing, where the model has access to code, but there is still limited evidence about how effective similar systems will be in black-box attacks or full attack orchestration. The conversation also explores cost, exploit yield, AI harnesses, open-source model competition, and the possibility that advanced capabilities could spread through distillation or cheaper tooling.The episode also looks at Project Glasswing, a controlled-access program designed to give vendors time to find and fix vulnerabilities before attackers can exploit them. While this is a positive sign that AI companies are trying to act responsibly, it also creates a new risk: access to powerful AI security tools may become a target for attackers, especially through stolen credentials and API keys.The central message is that defenders have been given a head start, but not much of one. AI is unlikely to make every low-skill attacker instantly dangerous, but it may help well-resourced actors move faster. Organizations should prepare now by tightening API key security, reassessing patch timelines, strengthening vulnerability management, reviewing bug bounty and disclosure processes, and making sure they have the people and procedures needed to respond when exploitation windows shrink.