← All TWiT.tv Shows (Audio)
All TWiT.tv Shows (Audio)
Security Now 1087: HalluSquatting, GhostApproval & GitLost
02:48:51
Patch Tuesday Breaks Records
Loading summary
Transcript222 lines
- [00:00]
Leo Laporte
It's time for Security now. Steve Gibson is here. Massive patch Tuesday from Microsoft. One thousand plus fixes. We'll talk about that. We'll also talk about some interesting hacks against AI that you might be aware of or want to be aware of. And Steve has found a really good way to kid proof an iPhone or make it suitable for adults who just don't need all those icons. That's coming up next on Security now this episode is brought to you by Black Hat usa. If you listen to this show, you go deep on the technical detail. Well, so does Black Hat. For nearly three decades it's been where the security industry's most rigorous research gets presented and pressure tested. More than 100 hands on trainings taught by practitioners who've actually deployed in live environments, not lecturers reading from slides at hundreds of peer reviewed briefings that go well past the overview into the real work across the four areas defining security, right, AI and autonomous threats, cyber conflict, systemic resilience and identity. This year Black Hats briefings pass includes all keynotes and main stage access plus business hall entry. You also get breakfast, lunch, Arsenal live tool demos on demand session access and admission to the midnight in the war room screening. Black Hat takes place from August 1st to the 6th in Las Vegas. If you want the depth this show gets into in person with the people doing the work, this is the room. And we'll be there too. Prices rise on July 17th, so book before then. Use code TWIT for $200 off your briefings pass@blackhat.com US26 that's B L A C K H A T.com US-26 podcasts you love from people you trust. This is TWIT. This is Security now with Steve Gibson. Episode 1087 recorded Tuesday July 14, 2026. Halu squatting, ghost approval and geek. It lost. It's time for Security now the show we cover the latest in security privacy online stuff, computers, vitamins and this guy right here, Mr. Steve Tiberius Gibson.
- [02:30]
Steve Gibson
And these days my friend, the world is AI. Not that there's, I mean I, I, I'm now over feeling sheepish about basically just talking about AI on this podcast because AI has impacted cybersecurity like nothing else ever has truly. We're going to talk about several nation states declared initiatives about the impact of AI and their own cyber security. The eu, the UK and China. The UK has got something. It's interesting to me that that in some ways they're leading us because I've seen nothing like this from us but the, the UK's NCSC and you know, G. GCHQ, the National Cyber Security center and their main intelligence group. They've announced something called Cyber Shield, which is, which where they're talking about. I mean, this is Colossus. They're talking about turning their national cybersecurity over to autonomous agents. Oh, that's laying out the whole protocol. Anyway, we're going to talk.
- [03:58]
Leo Laporte
You're talking about Colossus, the forbidden. The forbidden project for those who don't.
- [04:01]
Steve Gibson
Yes, yes.
- [04:02]
Leo Laporte
And it is on YouTube. You can watch it on YouTube if you have.
- [04:05]
Steve Gibson
I've not looked at Patch Tuesday, but this is Patch Tuesday, second Tuesday of the month. And Microsoft has warned the entire industry in a blog post that we'll look at to expect many more patches. Of course we anticipated this months ago, but now they're saying, oh, we counted them. Whoops. Anyway, so good, we'll talk about that. Rogue Planet. The, the latest salvo from Nightmare Eclipse has been fixed on the fly with a patch. We'll talk about that. Also, just a random tip that I ran across in Wired about a much better solution for kid proofing an iPhone that I just had to share with our listeners because I've heard so much feedback from our audience saying questions about how do they childproof their Internet connection, you know, what do they do in order to keep their kids from going places they shouldn't. So I know that there's a, a strong interest in, in controlling what youngsters do. And this was just a really cool tip from, from Wired. Then we're going to talk about three new means of subverting AI, something known as halu. Squatting, as in hallucination squatting. This is a really cool hack. We've got a third, a second one called ghost approval. And then my favorite name for a hack in a long time is get lost. So get lost. So very nice. Anyway, the, the title for today Security now 1087 for this 14th day of July is Hallow Squatting, Ghost Approval and Get Lost.
- [06:07]
Leo Laporte
I love it. That's all coming up all three and more in just a little bit.
- [06:12]
Steve Gibson
We do have another puzzling picture of the week also.
- [06:16]
Leo Laporte
I see. You know, it's funny, normally I don't, you know, I can't, I don't look at them ahead of time because I like to be surprised along with everybody else. Well, everybody doesn't get the email, but I can see the top of this picture and I have a feeling I kind of know what the bottom is going to be. But we'll See, we'll get there in just a little bit. But first, a word from our sponsor and the name you probably know. This episode of Security now is brought to you by Arctic Wolf. Arctic Wolf, if you haven't heard of them, helps organizations stay ahead of evolving cyber threats. That's why you listen to security now. That's why you would use Arctic Wolf. Their latest research reveals something surprising, except to probably Steve Gibson. Even as AI accelerates the pace and complexity of attacks, many security leaders are confident they can keep up.
- [07:09]
Steve Gibson
Hmm.
- [07:12]
Leo Laporte
To better understand what's driving that confidence, Arctic Wolf surveyed more than 1,350 security and IT leaders worldwide. This is part of their new. And they do this every year. And it's great. State of CyberSecurity and the 2026 Trends Report. Now, this snapshot is what cyber security professionals takes a look at, what they're prioritizing, what they're concerned about right now. That's why, you know, it's. It's timely. The report explores everything from AI adoption to threat detection to security operations and the challenges organizations expect to face over the next year. Now, whether you're responsible for securing a small business, managing enterprise infrastructure, advising clients, or simply trying to stay ahead of the latest security trends, Arctic Wolf's trends report is a vital part of your information flow. It offers really valuable insight into how the industry is responding to, I think you know, it, an increasingly AI driven threat landscape. We should also mention Arctic Wolf's Aurora AI addresses these challenges by putting defensive AI to work. I love this idea, combining agentic AI with generative AI, machine learning and security expertise to help organizations detect threats faster. See how these innovations and other critical findings shape the industry. Go to arcticwolf.com trends and complete the form to reserve your copy of the Arctic Wolf State of Cybersecurity 2026 trends report. That's Arcticwolf.com trends. Again, that's Arcticwolf.com/trends a r c t-I c w o l f.com trends and we thank him so much for support. Well, first of all, for doing the report every year. It's fantastic. But also for supporting security now and the work Steve's doing. I am ready for the picture of the week. Oh, you're muted. What? Hello. Did I mute you? You're muted. There we go.
- [09:20]
Steve Gibson
Sorry. So this picture was taken by a listener of ours and we're getting more of those because people, you know, people sort of have the podcast in mind now and then they see something wacky and they go, okay, we have to share this with Steve because maybe this would be worthy of the podcast. This is in Australia. Our listener works for IBM and this is an IBM facility which he said IBM owns. I gave this the caption. Some building safety officer may have required the sign but how could this have happened?
- [10:03]
Leo Laporte
I did see the top and I thought okay, that looks like a staircase to nowhere. It and the sign says no access beyond this point.
- [10:14]
Steve Gibson
Obviously one of our clever listeners responded the, the email to, to about 20, almost 21,000 of our listeners went out late morning on, on Sunday. Someone wrote back and said well I'm not a muggle. So you know, referring to Harry and
- [10:34]
Leo Laporte
nine and three quarters. Are we going to walk right through that ceiling?
- [10:37]
Steve Gibson
I'm sorry, he what? He is a muggle. He' I am a muggle. Meaning that he isn't able to walk through. But Leo, I obviously there was once no ceiling here, so. Okay, I'm sorry, I forgot to tell people who are not looking at this. What, why? We're kind of gobsmacked as they say in the uk. I guess it's a, we have a, A, a staircase which is winding around as it goes up floor by floor. You know, a lot like a floor of stairs. Then, then you, you, you turn, turn a corner twice, come back to where you began on the floor above and then go up again so forth which goes into the roof, into the ceiling of where this is. So to me one would, would expect that. Okay, once upon a time there was no ceiling there. Right. Like some renovation at. I, I don't, I just can't explain. Oh, okay. So if there was a staircase there that was, that continued to go up then that would have bisected those two floors with the stairs. So if, if they, if they were to join this, the floors that the stairs were going up to then, then I guess you'd put a, you have to put a, you know, a floor across where. Anyway, I can't. I.
- [12:19]
Leo Laporte
So there's some series in our, in our chat.
- [12:22]
Steve Gibson
Let me have.
- [12:23]
Leo Laporte
And one would be this is an IBM facility. One would be that they wanted to limit access to this next floor. Maybe it a secure floor. It costs more to take the stairs out. It's very easy just to seal up the entry. So they just put the floor in and they didn't bother taking the stairs out. You could see there's stairs below it that led up to this floor. So this is a, this is a staircase that goes up. The other theory, Darren Okey, who lives in Australia says he's seen this several times, is that a company rents several floors in a building, but maybe they didn't need that top one and so they just closed it off so that somebody else could rent it. But again, taking staircases out, especially if it's a staircase that, if it were just on this floor, maybe that'd be easy to do. But you could see it's part of a staircase that goes below.
- [13:17]
Steve Gibson
Yes, yes. So the idea would be that they, they said, okay, we're going to give back the, this floor above.
- [13:23]
Leo Laporte
Right.
- [13:24]
Steve Gibson
Or like give it to someone else.
- [13:26]
Leo Laporte
Right.
- [13:26]
Steve Gibson
And so they literally just, you know, terminated their, their access.
- [13:32]
Leo Laporte
They just put a big thing across it. You don't want to go there.
- [13:38]
Steve Gibson
And of course then Leo, but why
- [13:40]
Leo Laporte
do you need to sign? Because it's so obvious.
- [13:43]
Steve Gibson
I forgot to tell everybody who isn't seeing it. The sign says no access beyond this point. And then with a little IBM, you know what Standard logo, maybe you got
- [13:54]
Leo Laporte
a distracted employee, he's not paying attention, he's hustling upstairs, he doesn't look up and he runs right into the. So maybe it's, there's a reason.
- [14:02]
Steve Gibson
And as I said, and thus the reason for the caption I gave it, some building safety officer may have required the sign.
- [14:09]
Leo Laporte
Exactly.
- [14:10]
Steve Gibson
So and now we have some theories for how this happened.
- [14:13]
Leo Laporte
I love it. Okay, that's hysterical.
- [14:14]
Steve Gibson
So last Tuesday, the Next Web picked up the story of the ECBs, the European Central Bank's recent AI warning to Europe's entire banking industry. And again, I'm sure our listeners by now know that AI is impacting cybersecurity. Probably, I would argue maybe more than anything else can you think of. I mean we know it's impacting coding. Yes, but I mean, and there's sort of an expectation of it having an effect throughout other industries. Right. Like the law profession getting rid of like, you know, low end sort of middle manager, attorneys whose, whose jobs can be now done by AI. But to my way of thinking, though, I obviously have some, you know, a television on this. I can't think of anything that, where AI has had such an immediate like right now, not next year, not coming soon, but I mean right now Effect as in cybersecurity. To me it seems like it's the thing that AI has impacted most immediately. Anyway, the Next Web picked up the story about this saying that the European Central bank has a warning for the euro area's largest banks. Frontier AI now poses a serious cyber threat. And again, not in the future today, like immediately, like the Moment it happened, the lenders banks must draw up plans to counter it. Claudia Bouch, the chair of the ECB's cyber advisory board wrote to a to to bank chief executives setting a deadline for the end of October. Booch asked leaders, or I'm sorry, lenders to patch software faster and harden their AI enabled cyber defenses. The idea they even have them already is something. She also wants tighter oversight of the outside technology partners they lean on. Over the longer term, banks must modernize aging infrastructure and sharpen their crisis response. The order carries no fines. Banks that ignore it face no formal sanctions. So literally just a warning, just a wake up call, but with no teeth. The ecp, they wrote, says it may still use the plans to rank lenders against each other and press the laggards. One model looms over the letter and I'll be talking about this in a second. One modal looms over the letter. Anthropics. Claude Mythos Anthropics says Mythos can find unknown flaws in IT systems. It claims the model has already spotted thousands of severe vulnerabilities across major operating systems and browsers. The company First Limited who could use it, which spread unease across European finance. Butch put this story plainly. She wrote, quote, emerging models can pinpoint software weaknesses and write working exploits at unprecedented speed. That collapses the gap between finding a flaw and firing through it. That's an expression I hadn't heard before, firing through it, but okay. The ECP did not act alone. The same day the European Systemic Risk Board lifted its assessment of systemic cyber risk to severe. So they've got some sort of a, you know, a DEFCON scale. And so we're now at severe systemic cyber risk, saying that frontier AI should now count as a source of systemic risk in its own right. The board also flagged a second worry. Nearly all the leading AI providers sit outside the European Union. That leaves the bloc dependent on foreign firms and exposed to geopolitical pressure. It urged Europe to build its own AI muscle which when we're going to see this here in a couple seconds with some of the follow on stories. AI is now and should be and so not surprisingly being viewed as a strategic resource, not unlike, you know, the power grid. I mean it's, you have to have it and you have to know you have to have a reliable supply of it. The move they write fits a wider European scramble. ECB President Christine Lagarde warned last month that AI could trigger a dangerous financial crisis. The ECB has already run 109 banks through a severe cyber attack drill the threat is not hypothetical either. With state backed attacks climbing and European bodies such as France's statistics office already hit, a market has sprung up around the fear. French startup Mistral has opened talks with European banks to sell a flaw hunting tool. So now we've got, you know, somebody local in France to who's beginning to say, okay, we've got some commercial capabilities, they wrote. It's one of several firms racing to offer a homegrown answer to Mythos. For now, the regulators sound clear on the danger, but are much more vague on the fix. Banks have until October to show they're ready. So this reaction from Europe, of course, as I said, it should not be and is not surprising, but given the rapid uptake in the use of AI for cyber attacks, giving banks until October, to me, you know what, July, August, September, October. So four months does seem like an overly slow response. On the other hand, these are banks, so it might be as fast as they're able to move and the ECB may be painfully aware of that. The other thing that caught my eye was the specific mention of Mythos. You know, you have to give Anthropic credit for the brilliance of their rollout of this. The skeptics who try, who cried foul that Mythos was just marketing, well, they were wrong. It's not just marketing, but they certainly had a point. Mythos was able to deliver the, the goods first. It would have been and would still be, still is truly dangerous in adversarial hands. And Anthropic did take advantage of that for marketing. We've learned since then, like it seems like a long time ago, but it was like a month, you know, that other less powerful models when carefully orchestrated. And I heard you say, leo over on MacBreak weekly, that it's turning out that the harness that one uses for AI is as important as the model that it's harnessing. And I, that totally makes sense. And I, and I agree with that. You know, we've learned that less powerful models when carefully orchestrated can deliver similar results. And this was what so miffed those guys over at Aisle remember, AI S L E. They had, you know, actually preceded Mythos in their own work without the Mythos model behind it and achieved similar results because they were commercializing this capability and along comes on Anthropic and steals the, you know, all of the glory. On the other hand, they didn't have the presence or the marketing to pull off the coup that Anthropic managed. You know, and we should remember in time this will all just be A note in the history books. And at the rate we're moving, that'll be a year from now. It'll be like, oh, remember back then? Right. Okay. So speaking of what's going on across the Atlantic or the Pacific rather, last week also, the European Union published their so called action plan. So this is the EU as a, at, in, at, you know, broadly as opposed to just the European Central Bank. ECB was the previous report from the next web. The eu. Their action plan is they titled the Action Plan on Cybersecurity and Artificial Intelligence. In their announcement of this, the European Commission themselves wrote, artificial intelligence is rapidly transforming the cybersecurity landscape. AI can help detect vulnerabilities, prevent cyber attacks and strengthen the protection of critical infrastructure. At the same time, it can also be exploited by malicious actors to automate attacks, identify weaknesses and carry out cyber operations. And at unprecedented speed and scale. Building on the EU's existing legal framework on AI and cybersecurity, the Action plan. That's capital A, capital P. The Action Plan sets out a coordinated approach to help member states, businesses and public authorities benefit from the opportunities offered by AI while addressing the new risks it creates. It focuses on three complementary objectives. Promoting the safe and responsible use of advanced AI, reinforcing the EU's cybersecurity and resilience, and scaling up Europe's AI capabilities for cybersecurity. To promote the safe use of advanced AI, the Commission will strengthen Europe's capability, I'm sorry, their capacity to evaluate AI models before they're placed on the EU market. You know, essentially they're saying, what? This caught all of us by surprise. We need to figure out how to even know what an AI model is, what it does, is it good, which one should we choose? So they're saying we need to strengthen that capacity to evaluate AI models before they're placed on the EU market. In line with the AI act, they said it will also work with a European Union agency for cybersecurity, ena, to develop a European blueprint for secure access to advanced AI systems for cyber security purposes. And establish a secure testing platform to help organizations in critical sectors such as energy, transport, health, finance and public administration safely test and deploy AI solutions. So here again the message is we've been sort of focused on companies like Anthropic and well, and their interaction with the US government, specifically in sort of a microcosm. But imagine that you're a nation state and this is happening outside your borders, yet is clearly going to affect entities, your existence, your network, your, your Your national security. So suddenly you are expected to be able to deal with this bureaucratically the way you deal with everything else bureaucratically. I mean, this is just a whole new thing that requires a massive new bureaucracy in order to like figure out what to do about it, they said. The action plan also reinforces the EU's cybersecurity by promoting the implementation of existing EU cybersecurity legislation, including the NIS 2 directive and the Cyber Resilience Act. It encourages organizations to use AI, including open source models where appropriate, to detect and address vulnerabilities more quickly and improve their ability to prevent and respond to cyber attacks. In other words, everybody's got to get going here in the eu, they said. To strengthen Europe's technological leadership, the commission will launch an EU grand challenge on AI for cybersecurity, bringing together companies, researchers and other stakeholders to develop innovative AI powered cybersecurity solutions. The EU will also continue investing in sovereign AI capabilities, meaning, you know, their own. We need our own AI. They're saying China's got it, the US has got it. What happened? We don't have, we don't got it. So a sovereign AI capabilities, building on initiatives such as AI factories, whatever that is, and future gigafactories, while encouraging private investment to help scale up European AI technologies. In other words, we got kind of caught flat footed here. We, we need AI. The action plan they finish complements the EU's existing legal framework for AI and cyber security, including the AI act, the Cyber Resilience act, the NIS 2 directive, the Digital Operational Resilience Act. That's DORA and the Cyber Solidarity. They got a lot of acts over there. Yeah, but, but you know, not much is happening. Boy, have we got some initiatives.
- [28:28]
Leo Laporte
Leo, we gotta make a committee to talk about this.
- [28:32]
Steve Gibson
That's right, we're gonna. Well, you have to have a committee to talk about the committee. Yeah. You know what should the shape of the committee to do this take? And that's, that's where they are on the whole child age gating thing too. The, the, the, the, the W3C had to. They're at the stage of fashioning the committee that will then begin working toward. It's like just do it guys. How hard this is.
- [29:03]
Leo Laporte
This is not hard nuts. Because they think they just. All you have to do is write a bill or a law or an executive order and we'll create our own local AI. But you know, there are companies in Europe that been trying to. Mistral is in France. They're not competitive. No, you can't just make it with a stroke of a pen. It's just bizarre.
- [29:25]
Steve Gibson
And look at the investment. I mean now of course in the US we have the data center controversy because it's, it's upset so many.
- [29:33]
Leo Laporte
So some New York just banned data centers. By the way the whole, there was
- [29:38]
Steve Gibson
a piece, there was a piece in the news today that said that, that someone was, was, had been kicked out of their home because what, what is it called? I forgot now the term domain. Eminent domain. Thank you. Yes. Eminent domain required that they, that a new power distribution system be put through, through 300 homes which because in order to deliver enough power for a data center somewhere.
- [30:12]
Leo Laporte
So it's like, you know, in this, the Nevada or the Lake Tahoe Regional Power Authority has announced that they're going to cut off not domestic users of power. You have to get a new power company because we're going to give all our power to AI. No wonder people are pissed. I understand, I really do.
- [30:33]
Steve Gibson
I do too.
- [30:34]
Leo Laporte
Yeah.
- [30:34]
Steve Gibson
And, and then we had the initiative, oh don't worry, we're not going to power from the grid, we're going to power locally because there's a huge natural gas pipeline running past us. Well, turns out when they fired up the turbines people can no longer hear themselves think outside because yes, the whine of the gas turbines, it's like, oh well, you know, yes, we have great air conditioning inside and we have power but you know, our children can't play outside.
- [31:06]
Leo Laporte
This also is because of a short sighted policy on sustainable energy after years and years and years.
- [31:12]
Steve Gibson
Well, how many times have we been talking about how obsolete the US power grid is? This is what happens when you suddenly need power from the power grid which has been obsolete.
- [31:22]
Leo Laporte
There is more than enough power being focused on the earth from the sun to do all of this. But we have decided we want to dig up fossil fuels instead.
- [31:32]
Steve Gibson
And boy, has solar become cheap in the lab. Mean like a while ago the story was, oh, it's too expensive. Not, it's really not anymore.
- [31:39]
Leo Laporte
And this is why China is going to leapfrog us because they don't, you know, they don't have this problem.
- [31:46]
Steve Gibson
Oh well, so what's interesting with you know, all of this, it occurs to me that the initiatives such as the EU is talking about are another less obvious downstream benefit of the way anthropic marketed mythos. You know, just as it shook up the US government in today's highly connected world, it has it similarly now they're looking at it from a distance right but it shook up every other nation. The EU's announcement, you know, reads as it is like bureaucratic boilerplate. And as you said, Leo, that's what bureaucrats produce is these sorts of acts, this act and this act and the other. So anyway, what it does show us is a view into what those bureaucrats are thinking and the bureaucrats in the European Union are thinking, holy crap, we don't want to get left behind.
- [32:45]
Leo Laporte
Right?
- [32:47]
Steve Gibson
And that brings us to China.
- [32:50]
Leo Laporte
Oh boy.
- [32:51]
Steve Gibson
Reuters headline reads Beijing get this, is looking at curbing overseas access to China's top AI models.
- [33:03]
Leo Laporte
Oh, huh.
- [33:07]
Steve Gibson
I knew that would get your attention.
- [33:08]
Leo Laporte
Well, three people are saying download all the models now before they cut them off. Yeah, that's the problem, you know, hugging face and others have these models. It's just, it would only be future models, I guess.
- [33:21]
Steve Gibson
Correct. Well, or running the models. So you need to be able to run the models on some, you know, powerful enough infrastructure for it to work. So, but you know, and, and Leo, the other problem is, as you said, future models, I, I cannot stress enough the degree to which we are hardly started. I mean, every bit of my intuition says that. I mean just the fact that look what happens in one month. No mature technology has what has happened in a month happen. So this isn't the mean, it's not even premature technology. It has just begun.
- [34:04]
Leo Laporte
It's mind boggling.
- [34:06]
Steve Gibson
It is, it is astonishing. So Reuters reports three people familiar with the discussion said that Chinese authorities have held meetings with top tech firms, meaning theirs, over the past month about potentially restricting overseas access to China's most advanced AI models. The talks follow a number of steps by Beijing to keep homegrown AI within the country and underscore how China, like the us is now treating cutting edge artificial intelligence as a critical national asset. Yeah, that needs control.
- [34:46]
Leo Laporte
Yeah.
- [34:47]
Steve Gibson
Companies present, I mean it is. This is what's got the EU all up in a bother is that AI is now a national asset. Companies present at the talks included tech giants Alibaba and ByteDance and as well as the startup Z AI, said the people who were not authorized to speak to media and declined to be identified. Since the emergence of Deep Seq's R1 model last year, writes Reuters, Chinese AI models have made big inroads globally thanks to their low cost and increased capabilities. Any decision by Beijing to limit access to those products could ripple the across AI markets as costs for many businesses would likely increase. At the meetings led by China's Ministry of Commerce, participants discussed putting limits on the most advanced AI models Both closed source and more open versions. According to two of the sources, officials talked about making any leak or theft of proprietary AI technology an offense under China's stringent national security laws. The officials also raised the possibility of implementing new measures to restrict who can fund domestic AI startups, meaning probably no foreign funding. The scope of the potential restrictions is still being discussed and may only apply to future models. It was not immediately clear when or even if they would come into force. But the point being here, this is a discussion point and this, this, this indirectly demonstrates the thinking that is going on. It's like, wait a minute, we, China have an asset notice. Also, Leo, they don't have a problem creating as many data centers as they want to in the same way that they don't have a problem flattening land in order to put up solar arrays in order to power them. And at some point here, here's the US getting in trouble because it's unable to produce the, the, the, the compute power that suddenly out of, in like in no time, we need. China doesn't have a problem generating as much compute power as they decide that they want to produce, and then that becomes a strategic asset of theirs, which, I mean, which we have a problem duplicating because we've got too much pushback in about the creation of data centers. I mean, this, it's thinking of AI as a strategic national asset suddenly puts a whole different complexion on it.
- [37:35]
Leo Laporte
Yeah.
- [37:37]
Steve Gibson
Reuter said. China's Commerce Ministry, which oversees export regulations, and the National Development and Reform Commission, the country's state planning agency, whose officials also attended the meetings, did not respond to Reuters direct requests for comment. Alibaba, ByteDance and Zai also did not respond to Reuters queries. All three companies have a range of AI models, some closed source, while others are open weight, meaning users can download, run and customize the underlying systems. Alibaba's Quinn and ByteDance's Daobao are two of the most widely used AI models in China.
- [38:19]
Leo Laporte
Quinn's.
- [38:20]
Steve Gibson
Fantastic.
- [38:21]
Leo Laporte
Yeah.
- [38:22]
Steve Gibson
Zai has recently set Silicon Valley abuzz as the capabilities of its GLM 5.2 model come close to leading US offerings at a fraction of the cost.
- [38:36]
Leo Laporte
I use it, it's about a quarter of the cost. Yeah.
- [38:39]
Steve Gibson
US President Donald Trump's administration has also been deeply concerned about national security implications of AI, in particular, the potential for American AI products to be misused by military intelligence in China, Russia and other countries of concern. In June, it ordered that foreign nationals not have access to Anthropic's most advanced fable and Mythos models, which prompted the company to disable the models for all users globally as a nationality could not be verified in real time. Export controls for Fable, which is designed for the general public, have since been lifted after new safeguards were put in place. But Mythos, designed for cybersecurity professionals, is still only available to some trusted U.S. organizations. We'll be talking about that in a second. Some USAI experts have also said the US needs to regulate the use of Chinese AI models. Yeah, right. We don't like DJI drones, so why are we going to trust some Chinese AI model? According to two of the sources, Chinese authorities are deeply worried about the potential for Mythos to exploit software vulnerabilities and that Washington might deploy the model against Chinese interests. That echoes concerns publicly voiced by state media and Zhu Hongyi, founder of cybersecurity firm 360, a major vendor of government and enterprise clients, who has said China needs to develop its own Mythos. Well, we know they are working on that. They have to be. This year, China has implemented numerous measures to protect homegrown AI. In April, the country's state planner will ordered Meta to unwind its $2 billion acquisition of Chinese founded AI startup Manus. In early June, authorities issued sweeping new rules tightening control of overseas deals that involve Chinese investors, technology, data and national security. In other words, walls are being put up. China had also launched investigations this year into Manus and other local AI startups that had moved ab seeking to establish whether they've broken export control laws, according to two of the sources and a third person. Manus has not responded to requests for comment by Reuters. Reuters was not able to learn how any potential new restrictions on overseas access to Chinese AI models might work. But some hints might be gleaned from a May roundtable of Chinese legal experts on regulations governing open source AI. According to a summary of the discussions published in an official Supreme People's Court journal, participants proposed a tiered system, basic open source tools subject to a simple filing, more advanced technologies facing security reviews and the most sensitive frontier models barred from public release or restricted to domestic use. So none of that at this point should come as any surprise, right? But I wanted to share this reporting from Reuters following the news from Europe to highlight the fact that, as I said at the top, every nation state is waking up to the fact that what has been happening with AI and is not hyped up marketing and overstatement. I've recently seen the impact of the emergence of AI being compared to the harnessing of electricity they actually said the invention of electricity but you know, it wasn't invented. That doesn't feel like an exaggeration to me, Leo. I mean it is that big. It, this is, this is, I, I, I don't have words to just explain how big this is going to be. Yeah, the entire world is being turned upside down by the emergence of this new AI technology. And again I am utterly certain that we're still at the beginning of this.
- [43:05]
Leo Laporte
This is unless governments and NIMBYs and others kill it. I mean that's the problem is well
- [43:14]
Steve Gibson
they can, they can restrain it. I mean so that if you were to compare this to the nuclear bomb, right. What the, the, the benefit the there, there's a much greater ability to control the making of a bomb because it requires such physical infrastructure.
- [43:38]
Leo Laporte
Right.
- [43:38]
Steve Gibson
In order to refine the raw materials that go into creating it. And then you've got a delivery, you know, system that is also very much in the real world. AI is way more difficult to control.
- [43:56]
Leo Laporte
Yes and no. It's so capital intensive to make these models. That's part of the reason it's only these giant companies raising today money today.
- [44:06]
Steve Gibson
Today.
- [44:07]
Leo Laporte
You think we'll be able to do for instance the estimate right now is that Fable, which is, I think the strongest model we have is a 10 trillion parameter model. One you could not run obviously on anything besides a giant data center with almost infinite amount of GPUs and RAM. It takes, it's capital intensive and kind of in a similar way atomic energy is capital intensive or fabs are capital intensive. You're not going to have garage microprocessor makers you and so that's kind of a gate. I maybe the what is interesting is there is development along the lines of how do we make. As you've pointed out, you love the idea of purpose built narrow capability AIs and those don't have to be 10 trillion parameters.
- [44:58]
Steve Gibson
No, you can ask Fable anything but if you're going to have a, if you're going to have an AI that is specializes in coding, right. It, it does not need to be able to talk about the fall of the Roman Empire.
- [45:11]
Leo Laporte
Right.
- [45:12]
Steve Gibson
So that knowledge is in the model and it's taking up space and power and time and compute. And so I am as you said, I am absolutely certain that we will and the fact that we don't have it yet demonstrates just, just how, how early in we are there will be application specific models.
- [45:38]
Leo Laporte
Well, I'll give you a good example
- [45:39]
Steve Gibson
that blow away a general model for way less compute And I could use
- [45:46]
Leo Laporte
Fable or some giant frontier model. I have all my cameras hooked up to my AI. I could use Fable to analyze the images. I don't need it. I can run a tiny, relatively tiny quen model. Is a Quen visual recognition model. I'm running it with other models in my framework. It's maybe 27 gigs. I don't know. It's not very big. And it's very good. It analyzes every picture that comes in. It gives me text messages. There's a person in a yellow shirt with a red hat and shorts carrying a brown package. I mean, it's very, very good. And that's all it does. It's just vision recognition. And we do that on our phones locally, so we know we can get small models to do that.
- [46:30]
Steve Gibson
Yeah.
- [46:30]
Leo Laporte
So you're right. If we are willing to slice it up like that, I think you will see garage models. Yeah.
- [46:36]
Steve Gibson
A, a and, and it'll be at a targeted market. A general Fable public model needs to be able to, to, you know, talk about advocate on any topic.
- [46:50]
Leo Laporte
Right. But I asked it what a waste of CPUs. I asked it what the best spray starch would be for ironing my handkerchiefs and it came up with it. But probably not the best use of all of that horsepower anyway. I'm sorry to interrupt. Go ahead.
- [47:10]
Steve Gibson
No, it's your turn to interrupt. You know what a use of all this horsepower would be.
- [47:15]
Leo Laporte
You know what they call this in the World cup in the soccer matches? This is your hydration break. And as we hydrate, let me tell you about threatlocker. Actually, some really good news. Threat Locker. We love Threat Locker. It's a great zero trust platform that we recommend for everybody listening to this show. We're big fans of it. They're a sponsor of our shows. But they also love you, Steve. We had a great time at Zero Trust World in March and they have invited us to use their booth at Black Hat coming up in August. So we're going to do security now and Windows Weekly from the booth. From the Threat Locker booth at Black Hat. August. I think it's August 5th on the Wednesday. So we're going to move this show to a Wednesday for that one week. It's going to be a lot of fun. But let me tell you about. I'll tell you more about that in a bit. But I'll tell you about what Threat Locker does. They are a zero trust platform, as I mentioned, but they don't rest in their laurels. They started off protecting endpoints, but now they offer the industry's most comprehensive suite of Zero Trust solutions, endpoints company networks and the cloud. And this makes a lot of sense. By extending zero Trust enforcement to cloud services and company networks, ThreatLocker protects everybody. It ensures that devices are validated through a secure broker before they can connect to your SaaS. Platforms like Salesforce or Microsoft 365 or Asana or, or Google Workspace or GitHub, and on and on and on. I mean, these are the tools that we all use now, but they're out there in the cloud. What's protecting you there? Threadlocker. So what does it mean? It means even if a user is successfully phished, and you know that's pretty hard to stop, it happens again and again. Happened to us. But even then, attackers cannot access those cloud resources, they cannot access that company network. They're blocked. They'd have, here's the only way they could do it. They would have to have physical possession of the user's device. And of course they'd have to get through whatever security you have on there. Presumably you have biometrics on there. I mean it really locks them out. I mean, they don't have the laptop. They're getting in some, you know, from Belarus over the network even. And even if they had the laptop, you know, they'd have to get through Windows, hello. Or whatever security you've put on there. Threat Locker works across all industries. It protects everybody 24 7. They've got the best US based cloud support. They're there no matter what time of the day or night. So you're never alone. ThreatLocker works in every environment, Windows, Mac, Linux. And there's a side benefit to this. It's great for compliance because basically by using Threat Locker you're enabling comprehensive visibility and control. That's what Zero Trust gives you. Ask Rob Thackeray, he's the end user, technical analyst at Heathrow Airport. Now, here is an enterprise that cannot go down for one minute, right? And they've had problems in the past, that's why they chose Threat Locker. He said this quote, threat Locker. He probably said it in the English accent, but I'm going to do it like in American. Threat Locker was the most intuitive solution we tested. And the responsiveness of the organization, the willingness to engage with us, to set up a demo, to work with us on weekly audit reviews was very good. It's great to have an ongoing relationship with a company that's so responsive to our requests. And that's been our experience too. These people at Threatlocker are solid gold. They care about you, they care about your enterprise, and they have a product that is absolutely the best for protecting you. That's why it's trusted by Global enterprises like JetBlue and the Indianapolis Colts and the Port of Vancouver. People who cannot go down for one minute. Threatlocker consistently receives high honors and industry recognition too. Just a sampling. G2 High performer and best support for enterprise. That was in summer 2025. Peerspot ranked threat locker number one in application control. They got GetApp's best functionality and features award in 2025. With ThreatLocker, you confidently ensure that users have access to a consistent, safe network connection. Offices, remote users, internal servers and critical services can maintain smooth operations without the need to open inbound ports or deploy traditional VPN solutions. Your end users get the same secure, reliable internal system access they need. But you don't have to do all those complex infrastructure changes. You don't have to use a vpn. It just works. Get unprecedented protection quickly, easily and cost effectively too. I should add they are very affordable with Threadlocker. Visit threadlocker.comtwit to get a free 30 day trial and learn more about how Threat Locker can help mitigate unknown threats and ensure compliance. And that's threatlocker.com TWIT and I hope if you're going to Black Hat, you come by the Threat Locker booth. It's I don't think there's going to be like seating. It's like that. Not like what we did at Zero Trust World. It's just. But they've let us have some space in their booth so we're going to do the show from there and that'll be a lot of fun. Steve Gibson on we go with the
- [52:28]
Steve Gibson
show on with the show we go. Okay, so now we get to the UK. The NCSC is the UK's national cyber security center. Their blog posting last week was titled Cyber Shield the Path to get this Leo An Agentic AI Future for Cyber Defense. Why the UK is pioneering an initiative to develop a national scale sovereign defense capability. So again, this the implications of AI are. I mean, I guess I think the Mythos drama with the US served as a catalyst to, you know, at least make these initiatives public. The, you know, they were probably in the works for some time, but it's like, okay, now's the time to talk about this. The posting led by quoting the director of GCHQ, Ann K.E. butler, during her recent inaugural GCHQ Annual Lecture, which which is held at Bletchley Park this occurred on May 27th when Anne said, quote, we need to reimagine cyber security in the AI world. In the past few months, GCHQ has developed a blueprint for a new national cyber defense capability that will hardwire cutting edge agentic and you know, there's no way to read agentic other than autonomous, right? Agentic AI in a machine speed cyber defense. Okay, so that was quoted at the top of this NCSC posting, which then followed that by writing, the NCSC and the Department for Science, Innovation and Technology, that's the DSIT, are developing this blueprint which we are calling CyberShield. The objective of CyberShield is to build a national scale collaborative approach to agentic cyber defense using frontier AI to identify, reduce and resolve our national cyber risk. In this blog we set out why we need a new approach to cybersecurity and outline our aim and vision for Cyber Shield. As well as the challenges, we also invite debate and and engagement from academia, critical national infrastructure organizations, Frontier Labs and cyber defense sector and others to help collectively solve the challenges and develop the blueprint. Why the UK Needs a Step Change in Cyber Defense the UK faces a cyber threat that's growing in scale, speed and sophistication. Attacks from hostile states, organized crime and and others are increasingly disrupting services, harming businesses and exposing sensitive data. Frontier AI is accelerating this trend with the potential to shift the balance in favor of attackers and with serious. Well, yeah, if you're not defending yourself with the same AI or with, you know, strong AI and with serious implications for defenders. We need to keep our critical technology system secure against both existing and emergent cyber threats. This is just, to me, this is amazing that the, that national appreciation of how much AI is going to change what they're doing. They said today's challenge is that there are many preventable weaknesses. We know that a large proportion of critical systems do not fully meet the aims set out in the Cyber Assessment framework. Many attacks still succeed despite sorry, succeed because of basic vulnerabilities, including outdated or unsupported systems, delays in applying security updates and weak controls over access to systems and data. Right, so that's, you know, old school problems we've been talking about for 20 years. They write. These are well understood risks, but they remain widespread, leaving the UK exposed to attacks that are often avoidable. This makes getting cybersecurity fundamentals in place now more important than ever. At the same time, the emerging challenge is that AI is changing how attacks are carried out, increasing their speed and scale. AI is already helping attackers to conduct elements of offensive cyber activity, such as vulnerability, discovery and reconnaissance at a much greater scale and faster pace. As a result, activities that once took weeks can now take minutes, reducing the time available for defenders to respond, detect and contain them. This increases the likelihood of successful attacks. Organizations must take urgent tactical action to ensure critical systems are well defended. Act now to strengthen the fundamentals. Fundamental cybersecurity remains essential and organizations should prioritize rapid patching of vulnerabilities, reducing reliance on legacy systems and adopting secure by design technologies. Organizations should also start to use AI in cyber defense to stay ahead of the attacker. This means using agentic AI to to identify exposed vulnerabilities autonomously. They call that the blue team capability. Using AI to detect and contain security incidents and working to address the challenge of safely automating mitigation as well as getting their cyber fundamentals in place. Organizations must be prepared for the future challenges. The shift toward full life cycle automation of attacks While some stages of a cyber attack can already be automated, we've not yet seen fully autonomous attacks operating across the complete intrusion life cycle in real world systems. In practice, the complexity of these environments still requires human judgment and oversight. However, frontier AI models are likely to to become capable of operating across the full life cycle, from initial access through actions to on objectives. This could allow attackers to move at machine speed and greater scale, reducing opportunities for detection and response. This has the potential to overwhelm traditional defenses and increase the risk of advantage shifting toward the attacker, they said. Developing viable solutions that scale and execute at the pace we need in the modern era is the remit of the Cyber shield. The evolution of AI enabled Cyber Capabilities AI enabled offensive cyber capabilities are developing rapidly alongside a growing commercial market for such tools. Together these these trends are accelerating the pace and expanding the scale of cyber threats and enabling more actors to exploit such capabilities. Basically, they're summarizing in their own national focus exactly the the things that we've been talking about here for the last couple months, pulling that all together, they said. This evolution presents strategic challenges for the uk. Many advanced defensive capabilities are inherently dual use, meaning they could be repurposed for offensive or hostile activity. Organizations developing these capabilities must act responsibly. Identifying and fixing vulnerabilities is essential, but not sufficient on its own. Engaging with initiatives such as Cyber Shield will help ensure that these technologies deliver a net benefit to cybersecurity. CyberShield supports the ambitions of the UK government to build national scale AI powered defensive capabilities that can operate at speed and scale in the near Future we envision a world where cyber defense is supported by red and blue agents which identify weaknesses in systems. That's the red. And defend against threats in real time. That's the blue. These AI systems would initially identify vulnerabilities and threats at machine speed before progressing toward automated remediation, generate and share insight while detecting and containing breaches, work under the control and authority of their owners across government and non government institutions, collaborate seamlessly across organizational boundaries and contribute to improving the national security of the uk. One thought I have, I'll just pause here for a minute is that, you know, to me this feels like an effort that is too large for a bureaucracy. This feels like something you purchase. I mean, I get it that it's, that it is a strategic desire of theirs to have this to and to have the sovereign capability. But, but the, you know, identifying vulnerabilities at machine speed and then automating remediation, you know, that's so that, that, that's such a big lift that it feels like the kind of things that, you know, sponsors of this podcast would be doing and offering and selling commercially. And so yeah, the UK can, will be able to purchase that. I question whether it's just the kind of thing you can, you know, create ad hoc. I, I'm skeptical of that. They, they said, you know, in, on, on a bespoke basis. They said these agents, theoretical at this point, are enabled by strong foundations of data identity, reliability, cyber security and regulatory compliance. Yes, they're able to specify what they want. Getting it is another thing they said our approach will be test, iterate and scale. We will initially partner with network defenders across government and critical UK sectors to test and deploy newly researched capabilities. Okay, maybe they're commercial network defenders, in which case this makes sense. This will accelerate learning and improve resilience where it will have the greatest impact. Our aim is to transform. I'm sorry, Our aim is to transition to commercially scalable solutions to deliver a level of national resilience which is ready for the future threat. The UK will pioneer this approach and provide a case study to the world on how to successfully engineer and deliver the future of active cyber defense in the AI era in a safe and secure manner consistent with our values and policies. Well, you can wish, but I don't know where it's going to come from. They said we will need a number of functions to deliver a. A national scale sovereign cyber shield capability in association or partnership with leading frontier AI capabilities. Cyber defense organizations and academia will all participate. We recognize that some of these Areas present challenges, you think, which need significant progress in research to unlock the functions include and they have two reliable and explainable AI for cyber security. This means our AI systems can be used confidently in production environments at scale authorized by system owners to make safe, reliable and significant real time changes in support of cyber defense in a predictable manner. In other words, the Forbin project, they're saying, you know, we need AI systems that are good enough that we know they won't make a mistake. And of course we don't have that today. No one does. Second, federated agents. Agents will be federated with underpinning trust infrastructure. These agents will run national level operations on behalf of the country, as I said. Wow. Run under the control and authority of individual organizations and secure the means to identify, trust and communicate between themselves to allow cooperation. So the GCHQ's NCSC is stating here that their goal is to have AI agents operating autonomously to run national level operations on behalf of the country with a secure means to identify, trust and communicate between themselves for cooperation. So I just want to make certain that everyone understands what a massive leap forward this would represent. You know, while we've been Futzing around with AI for coding, the UK's intelligence and cybersecurity people have been at least making plans, although no way to execute that I can see to put autonomous AI agents in charge of their nation's cyber security. Even though it's both the correct way of thinking and you know, it's already inevitable, right? I mean, it's going to happen. It has to happen because it is the right thing to do. We don't know how to do that today. It's bracing to imagine that I would imagine in a few years, you know, while this podcast is probably still underway, we will be reporting on the events surrounding autonomous AI agents protecting the borders and the networks of those nations that had the foresight to protect to get those efforts underway early. I think it will be a commercial offering, maybe a partnership with a commercial company. I mean it is a, it is a big job and you know, it's difficult to see how that could happen at the, at the. With, you know, the government bureaucracy standing in the way essentially. They've got some more points. They raise. Number three, Vulnerability discovery and mitigation. Harnessing cutting edge UK research into agentic Red Blue Team functions. The aim is to develop and demonstrate automated discovery of network vulnerabilities and develop fully automated vulnerability mitigation workflows. You know, nice wish list. This will allow cyber defenders to operate and at beyond human scale, helping them keep pace with attacker capability. These functions will be focused on critical networks but able to operate at national scale. Fourth, coordinate detection and response. Building on the Red Blue Team functions, the aim is to provide a means for real time sharing of insights across organizations boundaries and get agents to leverage these insights to detect and contain adversary behavior. 5. National level scanning. This means automated scanning of critical UK IP ranges for exposed vulnerabilities and analysis of aggregated data to understand national level exposure. And finally, national level mitigation. This means automation of workflows to allow rapid national scale mitigation such as automated blocking of known malicious domains and networks. And they finish working in partnership is vital. Yeah, because you can't, if you can do it at all, you can't do it by yourself. The Cyber Shield vision is ambitious and wide reaching and faces significant delivery challenges. Okay, well everybody gets that.
- [70:20]
Leo Laporte
At least.
- [70:21]
Steve Gibson
It cannot be developed and operated by by the NCSC or government alone. Good. In addition, there's a clear potential benefit to UK economic growth from nurturing innovation in this domain. Admittedly, we need to work in partnership across government and with industry and academia to develop innovative approaches and evidenced solutions from national to enterprise scale and within organizational and sector based network defenders to deploy and integrate agentic capabilities under their control, hopefully and authority into their activities. To this end, the NCSC and DSIT are working together to establish effective pathways for partners to come together and contribute. Get involved. We invite all organizations who are interested in partnering to develop the Cyber Shield to contact the NCSC@cybershieldc.gov UK so. Yikes. Obviously what's completely missing from this is any sort of timeline, but of course that would be premature at this juncture. It's still somewhat surprising that they're even talking with such ambition though. As I said, I'm certain they're not wrong. You know, this is where the world's major nations must now head. And probably given the rate at which all of this is accelerating, the amount of attention that the AI threat to cybersecurity truly does pose and, and all the press that has been generated thanks to Mythos and I'm sure soon others, this has to happen probably during. As I said, while the podcast is still happening, Leo, you and I will be talking about, you know, autonomous AI protecting the borders of nations. It's. Yeah, it seems clear that it will happen and then it will scale up to become increasingly powerful. We are, we're witnessing the rapid emergence of the realization that AI is as much a national strategic infrastructure asset as I said before as a nation's power grid. But the shape this will take is entirely unknown. For example, where will the AI itself reside? It seems clear that no nation would be willing to outsource its AI, its strategic national critical structure, AI to another nation. So it will need to be housed inside its own nation's borders and physically protected. You don't want a bomb to be able to take out the AI that you now depend upon as a nation. And as a strategic asset, it will also require physical security and redundancy. Right. Because again, of its strategic national importance. So when I stopped to imagine this, it really is science fiction, you know, and it. How can we not think of Colossus, the Forbin project, which was all about turning over, even though that thing that the movie was, what, back in the 60s or 70s? It's about turning over all of the control of a nation's security to something that is autonomous, that is able to do a much better job than humans could do in its place. Wow. And it seems unlikely that it is far off.
- [74:18]
Leo Laporte
Speaking of AI, as the show began, you said, I would love to have that colorful life thing that Andy Inako showed, which is a website, as an app, and of course, because I care about you, Steve, I had my AI create a desktop app.
- [74:40]
Steve Gibson
Oh, my Lord.
- [74:42]
Leo Laporte
And it is. Well, I mean, I'm going to be fair with you. It's just a electron wrapper around it because it was all JavaScript and CSS. I didn't realize it when I looked at the game it was written in 12 years ago. It's a very old game, but it has all the same functionality. Yeah. So you can zoom in on it and do all the same things. And there you see the Conway Game of Life. Yeah. So this one's on a Mac, but it'll also run on Linux. And I can make a Windows for you version if you want. I also said, can I make a screensaver? It said, yeah, we can do that. Sure, whatever you want.
- [75:16]
Steve Gibson
It can't run much faster too.
- [75:18]
Leo Laporte
Oh, it's 60 frames a second. It's. It's full, full Speed because it's WebGL. So it's pretty fast. Yeah, right. Yeah, it's pretty amazing.
- [75:28]
Steve Gibson
Very cool.
- [75:29]
Leo Laporte
Yeah. See there's the little. You recognize the little Game of Life tractors and things. Yeah. Oh, yeah.
- [75:36]
Steve Gibson
How fun.
- [75:38]
Leo Laporte
So, yeah, it's pretty amazing what AI can do. This is the problem with the whole thing. It's spur of the moment. Yeah. Yeah. Let's see. Let's do that.
- [75:47]
Steve Gibson
Well, as I think we we were saying before we began recording that I, I was, I was mentioning that I, I've got a friend who just is so entertains. Endlessly entertained by, by animated GIFs that he didn't create. He just like, and he's always sends them to me and it's like, okay, okay, okay. We're entering a time where people will be creating apps with the same ease and speed, you know, dictating it into the, the, the microphone. And it's like, okay, here's an app.
- [76:17]
Leo Laporte
Yeah. Apple is now released with iOS27's public beta. The ability to talk. Apple Shortcuts do Vibe code. Apple Shortcuts, which I think is going to really open up capabilities for a lot of people who probably would never write a shortcut. I don't even want to write shortcuts. The language is so tortured. But now you just vibe coded. I don't know how good it is. I haven't played with it. We live in interesting times, Steve.
- [76:43]
Steve Gibson
Yes. Oh, Leo. I, like I, I've said it every week. I, I, I'm so glad that we're alive for this. This is, I'm glad to see and it's so not boring. I mean it's happening so fast.
- [76:55]
Leo Laporte
I will confess it makes it hard for me to sleep. This morning I woke up at about five ideas saying I got it and I jump out of bed because I can't wait to, to do stuff. It's very exciting.
- [77:07]
Steve Gibson
It's gonna transform the world.
- [77:09]
Leo Laporte
Yeah. Yeah. You wanna take a break?
- [77:12]
Steve Gibson
Break time.
- [77:13]
Leo Laporte
Okay. Hydration. Pause. As Steve hydrates, he runs off the field. I will tell you actually about a really cool tool. Our sponsor expo. They do get this agentic pen testing. So I mean it's very clear that AI has changed the pace of everything from how software could gets developed to also how it gets attacked. You know that if you listen to the show, which it makes this an interesting kind of tension. Engineering teams are moving faster than ever, creating more and more applications, but security just can't keep up. Pen testing is still one of the most trusted, most reliable, most effective ways to understand and this is an important, real exploitable risk. You're not talking here about theoretical exploits. You're talking about a human pen tester working through the steps to exploit your network or your app. Problem is, in an AI driven world, that's a bottleneck. Security teams are forced to choose between slowing down development to stay secure or moving fast and accepting. We're just not going to be able to test this as thoroughly as we'd like to. You're going to have gaps in coverage. Well, here's the good news. Expo eliminates that trade off. Xbow like a bow and arrow, Expo is an autonomous offensive security platform. A lot of words in here. Autonomous offensive security platform. It's a pen tester. It runs continuous AI driven pen testing, mirroring real world attacks. Expo doesn't just scan for vulnerabilities, it actually discovers exploits and validates the vulnerabilities. So you're only dealing with issues that really work that you know, exploits that really could take you down, things that really matter dramatically fewer false positives and a clear view into real attack paths. And if you think about it, autonomous agentic pen testing never gets tired, never goes home for dinner, it stays up all night, it works all day, it is going to be fast. It is very effective. With Expo, tests run in hours, not weeks. And you get complete visibility into how an attacker would move through your systems and the ability to uncover issues that traditional tools missed, including zero days and novel attack paths. And you might say, well, an AI could never be as clever as a hacker. Really? Really? Oh yes it can. It can be so much more clever. And again, it doesn't lose focus, it doesn't get tired.
- [79:47]
Steve Gibson
It's relentless.
- [79:49]
Leo Laporte
Expo's results speak for themselves. Ask the application security lead of Cesnam CZ who says, quote, even right now, after a year, I don't know of any other company that it's at least close to Expo in terms of agentic pen testing, they are the leader. The result is predictable, cost, consistent quality, stronger security without slowing down your engineers. Expo helps security teams keep pace with innovation, cover more apps more often, and without adding to the resources they already have. Now, the heritage of this thing is great. It was founded by the team behind Microsoft Copilot. And it's already, I mean it's widely used, trusted by companies ranging from fast growing startups to Fortune 500 enterprises. Truthfully, Expo is quickly becoming a mission critical layer in modern security stacks. You need to know more about this. Go to xbo.com to start a pen test today. That's xbo.com xbow like a bow and arrow. Expo.com and we thank them so much for their support of security now. Okay, sir.
- [80:59]
Steve Gibson
Meanwhile.
- [81:00]
Leo Laporte
Meanwhile, back at the ranch, Back at
- [81:03]
Steve Gibson
the ranch, our own SISA has been quietly using Mythos to audit the US government's code, which I think is a good idea. Reuters also reports three people familiar with the matter said on Monday, that's Monday before last, eight days ago. That the U.S. cyber Defense Agency CISA is using Anthropic's AI model, Mythos, to audit government software. In another sign of government enthusiasm for adopting the AI startups tools, meaning Anthropics. Although enthusiasm I'm not sure, but okay. Even as the company navigates an ongoing standoff with the White House, Reuters said the Cybersecurity and Infrastructure Security Agency is using Mythos to scan government code repositories for bugs that could leave the door open for foreign spies and cyber criminals. Anthropic did not respond to questions. I bet they didn't. About the initiative. A sister representative said last month that he would check to see if there was anything to share.
- [82:12]
Leo Laporte
I'll just check.
- [82:14]
Steve Gibson
We'll get back to you. Yeah, we'll check on that.
- [82:18]
Leo Laporte
You know, if they're not. They're. They're terrible. They're. Why wouldn't they be?
- [82:23]
Steve Gibson
Exactly. And I, and I love this. They, they. They wrote. The assistant representative said last month that he would check to see if there was anything to share about the matter, but did not respond to further emails.
- [82:37]
Leo Laporte
What a surprise.
- [82:38]
Steve Gibson
Yeah, his boss said. You just don't, don't answer those people. The scanning is being done by SIS's. Get this, they have the Attack Surface evaluation. Attack Surface Evaluation team.
- [82:50]
Leo Laporte
Wow.
- [82:51]
Steve Gibson
According to one of the sources, the team's a group within CISA that conducts digital security assessments and hacking exercises across the government. Two of the sources said the audits had already uncovered, no surprise, a large number of vulnerabilities, but did not elaborate. Reuters could not establish exactly how much government code the team had gone through or the nature or severity of the bugs it discovered. So anyway, they go on, they. They recap the recent rocky road that Anthropic has had with the government, you know, which as we know, was initially triggered by Anthropic's flat out refusal in February to remove the safeguards from their models, which were preventing the model from being used for guiding autonomous weapons or facilitating domestic surveillance, which the US government wanted them to do. Anthropic said no. So then that was the beginning of the. The. All the brouhaha. So anyway, it's great. It's hardly surprising that CISA is deploying Mythos to help shore up the US Government's existing code base. I'm sure it needs a lot of shoring up, so. Yay. A number of security outlets picked up on a Microsoft blog posting last Thursday which was titled Evolving Windows Vulnerability Management to Meet the Speed of AI Powered Discovery.
- [84:25]
Leo Laporte
And before you get into this, Let me just show you. You were wondering about Patch Tuesday, which is today. Get ready. This is easily a record number of patches. They broke last month's record, 570 flaws, three of them, zero days. Wow. Wow. And you better believe they're using AI.
- [84:51]
Steve Gibson
Oh, goodness. Well, I. Based on the analysis of M Dash, which. And apparently we're able now to drop the use of the word code name because as we'll see in this, in this article, Microsoft is no longer using the prefix codename. They just referred to it as EM Dash. Given what we heard, I don't know anything about the way Mythos is structured because Anthropic has not told anybody. As far as I know, Microsoft told us all about M Dash and it is very impressive.
- [85:23]
Leo Laporte
I think, though, that was it.
- [85:26]
Steve Gibson
Lou.
- [85:26]
Leo Laporte
Mm. Somebody told us that it's a wrapper around other models.
- [85:31]
Steve Gibson
It is model agnostic. So you are able to.
- [85:36]
Leo Laporte
It could be fabled or Mythos doing this work.
- [85:39]
Steve Gibson
Could. Exactly. It. Well, could be.
- [85:42]
Leo Laporte
Look at that. I'm just. Okay. One.
- [85:44]
Steve Gibson
Yeah. Yeah.
- [85:44]
Leo Laporte
I just want to show you the numbers. 254 have escalation of privilege vulnerabilities, 17 security feature bypass 145 remote code execution, 102 information disclosure 3, 35 denial of service and 16 spoofing. 59 of these vulnerabilities were critical, 48 of which are remote code execution, 9 elevation of privilege, 1 security bypass, 1 spoofing. So this is a haul.
- [86:15]
Steve Gibson
If you, if you scroll down a little bit. There were also a massive 468 Microsoft Edge chromium flaws.
- [86:24]
Leo Laporte
Those were fixed by Google earlier. That doesn't. That's. This number does not include those.
- [86:29]
Steve Gibson
Right.
- [86:30]
Leo Laporte
So 4 to 68 plus 570. It's over a thousand. It's over a thousand.
- [86:39]
Steve Gibson
Yep.
- [86:39]
Leo Laporte
Unbelievable.
- [86:41]
Steve Gibson
In one month.
- [86:42]
Leo Laporte
In one month. And that's got to be AI. We've never seen anything like this.
- [86:46]
Steve Gibson
Of course, of course, of course.
- [86:48]
Leo Laporte
Yeah. Of course. Holy moly.
- [86:53]
Steve Gibson
Nice. So I'm glad, I'm glad for that. I'll add a bit of color. So obviously last month's all time record breaking patch Tuesday was just the tip of the iceberg, which is what we've expected. I expect this will go four to five months probably at around this rate. We're going to be killing these things off. And what will be really cool is when we start seeing a sharp decline in the number of vulnerabilities found. Not for lack of looking. I'm sure it will be finally for a lack of actual vulnerabilities. So and maybe a next generation model will find some that were missed by this generation. But at some point we will get AI that is able to find all that are practically findable and that will put us in an entirely different world. We are heading into, as I've said, a whole different land. Everything that we've known and we've watched build up over time pwn To Own and Hacker1 and and Capture the flag contests, Zerodium purchasing and reselling 0 days All all of that industry was supported on the fact that we had not yet figured out how to make bug free software. Our own software was too complex for us. It is not too complex for the AI that we're able to create to fix it for us. And this is going to change everything. So the good news is Microsoft knows all of this and is acknowledging it. So here's what they shared with the world Last Thursday they said Windows has adapted to emerging threats for decades. Well, it's about to make a big adaptation, all while operating at unparalleled scale. It's our responsibility. This is remember Microsoft's voice to bring clarity, transparency and sustained investment so customers understand what's happening, what Microsoft is doing and how they can reduce their exposure. The pace of vulnerability discovery is changing with advances in AI making it possible to find more issues faster across more code with new mechanisms that can accelerate both discovery and analysis. The fastest way to reduce customer exposure I love this. The fastest way to reduce customer exposure is to find issues before attackers can use them. No, the fastest way to reduce customer exposure Microsoft right down to zero is not to beat the hackers to them, but rather not to ship buggy issue laden software products in the first place. Now I acknowledge that there's a huge amount of fixing to do first. That's where we are today. That's what Leo, you just showed us with today's patch Tuesday on top of last month's patch Tuesday that broke a record and this broke that record. That work will eliminate the thousands of bugs in the software that's already been shipped. But I am looking forward to the day when not only all existing bugs have been eliminated, but new code comes pre sanitized before it ships. We cannot create bug free code that's been well proven. AI can find those bugs before they get loose and I'm sure that's the target that I am hoping Microsoft has in mind. Anyway, they continue writing Windows is expanding its ability across the platform to find issues earlier, accelerate the engineering work to fix them, strengthen validation and deliver timely high quality updates that keep customers protected. By applying AI across security analysis, we can identify patterns faster, prioritize risk and scale vulnerability discovery across the Windows code base. This helps reduce the time between discovery and customer protection. It includes Microsoft's security multimodal Agentic Scanning harness which utilizes multiple models including leading third party AI vulnerability discovery models to run EM Dash at Windows scale. Windows set up dedicated cloud infrastructure for scanning and proving. A scanner pipeline scans critical binaries and vulnerability and validates candidates using multimodal debate across multiple model families. Confirmed candidates then flow into a separate Windows specific prove pipeline that helps eliminate remaining false positives so only the highest confidence findings reach the engineering team. This automation helps handle a larger volume of potential vulnerabilities and shortens the review window for new ones, shrinking the attack window for zero day exploits. And again that's great, but let's really focus upon eliminating zero day exploits as a side effect of simply eliminating all exploits. How about that? They said this effort extends beyond Windows as we work across Microsoft to deliver broader adoption of these tools and practices throughout both the company and the Wycker and the wider ecosystem. Yay team. They said. We partner closely with AI powered scanning teams across Microsoft's product divisions, sharing insights, comparing best practices and aligning on key findings. In parallel, we collaborate with the Microsoft Security Response center, you know, our well known MSRC to continuously refine end to end process from vulnerability discovery and issue finding to remediation and validation. In other words, the EM Dash harness is also, you know, feedback from its use is going back to the guys who are in charge of that, so it's also getting better, they said. We also regularly reassess our prioritization and rollout strategy based on lessons learned and feedback gathered through our Chief Information security officers, the CISO's engagements with customers. We continue to evolve our internal systems and practices so that vulnerability discovery is not treated as a separate activity, thank God, but as part of how we build, review and improve Windows before new features or updates are released. Now we're talking. That's what we want. As part of this we are updating our secure development life cycle, the SDL best practices to ensure our secure by design approach explicitly accounts for potential AI enabled attack techniques and exploit paths. That means using AI to help identify potential issues earlier than in the development process. Yay. While relying on human expertise to evaluate findings, making risk based decisions and ensure fixes meet the quality bar customers expect. Which to me all sounds exactly right, we want AI to be looking over the shoulders of their coders, working to spot their mistakes immediately saying, you realize that this variable can go out of bounds, right? You declared it to be a long, but it needs to be like twice that long or oops, you're going to have a little problem when it overflows, it's going to go negative. So that would be good. Easy to miss that when you're in the thrall of writing code, they said as AI helps defenders discover more issues, Customers will see a higher volume Customers will see a higher volume of security updates included in each security release. And that one sentence basically is it was the headline in all of the other coverage of this blog posting was that Microsoft foresees many more, you know, much higher volume of security updates in the future. You betcha. And that's what we want. You know, let's fix the past and break the cycle of adding new problems that need to be fixed later. AI finally offers us that hope. And finally, they said a higher volume of security updates is evidence that defenders are getting better at identifying and addressing issues. Right, of course. Bugs that were shipped. Our focus is to effectively utilize these AI tools to support faster protection, stronger engineering systems and more actionable guidance for customers. In other words, we're going to we're going to protect you more quickly and we're going to feed this experience back to make our systems this M Dash harness better, they said. Windows is evolving our engineering and validation systems to reduce the time from discovery to protection with areas where customer risk is greatest. As we build our end to end system from discovery to remediation of vulnerabilities on Windows, we're making the following investments to help ensure we are not compromising update quality as we gain speed. They have three we're integrating AI into our process to compress the path from discovery to a validated fix, helping engineers understand failures faster, propose candidate fixes consistent with the surrounding code, surface related issues elsewhere in the code base, and select the regression tests most likely to be affected by a change.
- [97:33]
Leo Laporte
2.
- [97:34]
Steve Gibson
Windows undergoes windows Updates undergo validation across a range of testing environments, including the Security Update Validation program and internal validation designed to help evaluate compatibility, reliability and real world usage scenarios. This broad validation helps identify functional application compatibility and quality issues before updates are broadly released. And finally, we're also investing in new technology including Windows Sports specific tools and agentic harnesses to help endtoend generation and validation of fixes fixes using AI keeping humans in the loop when it comes to code review. In other words, Microsoft's got the religion. They've seen the light and AI is going to Take over that place and it can't happen soon enough. I think it sounds wonderful. And that, believe it or not, was just the first quarter of the blog post. The balance of that posting was a rehash of the various features and benefits of the Microsoft's update offerings for individuals and enterprises. But our takeaway here is that Microsoft, like everyone else on the planet, from small software publishers to now to major nation states, is taking the changes that AI is bringing to the world as seriously as anyone could hope they would. In the specific case of Microsoft, this means dealing with their extensive legacy of existing software. And we just saw another example with today's patch Tuesday while also working to prevent turning new bugs loose. So let's all wish them well. I certainly do.
- [99:25]
Leo Laporte
I love your notion that at some point the number going to go up, up, up and then it'll start going down, down, down and eventually down to close to zero.
- [99:34]
Steve Gibson
Yep.
- [99:35]
Leo Laporte
Plus it's going to happen. Yeah. And it might not be that long even if you keep doing a th floss. A month?
- [99:41]
Steve Gibson
Yeah, I'm thinking five or I'm, you know, four, five, six months.
- [99:44]
Leo Laporte
A year from now we'll be looking at nothing.
- [99:47]
Steve Gibson
Easily. Easily. Yes. New code will, will get sanitized for bugs. Coders are going to be learning because basically they'll have an AI tutor that says, you know, Henry, you just keep making the same mistake. Why, you know, why do you keep
- [100:06]
Leo Laporte
pointing to ring zero? Dude, you got to stop using those pointers.
- [100:11]
Steve Gibson
I know it's easier, but come on, we're going to have to. We can't do this anymore.
- [100:15]
Leo Laporte
I'm thinking back when I first, my first computer, you did a lot of peeking and poking. You actually this is true. The Apple but also the Atari, you would, you would poke a value into memory. Yeah, that's not a good idea. And so this is, you know, we, we evolve, we get better, we improve. That's the point.
- [100:39]
Steve Gibson
One more and then we're gonna do a little bit of miscellaney. After another break, I wanted to let everyone know that Nightmare eclipses latest Perry to annoy Microsoft in the form of the disclosure of a Windows Defender based elevation of privilege which this attacker dubbed Rogue Planet was patched last Wednesday. Since the trouble lay in Defender, which Microsoft is by design able to patch anytime they wish on the fly. There's, you know, there's no wait until the second Tuesday of the month for Defender. Defender is your frontline real time defense. Microsoft, you know, will change, will update it anytime they want. So they did it Last Wednesday. So at this moment the rogue hacker has discovered and released a series of eight zero day exploits along with their working proofs of concepts, each timed to arrive just as Microsoft has started pushing fixes during patch Tuesday, which as I noted is today. Now also recall that several months ago this hacker claimed that he or she would be dropping what they described as a bone shattering. That's a, that's their quote. A bone shattering windows exploit today July 14th. However, that early months old boast has been. It's been noted in. In the industry that has been partially walked back since the hacker has said that the. The development of the rogue planet last month's surprise zero day consumed much more time than they had allocated for. So we. We may be getting nothing or we may be getting something that was less than promisedly, you know, less than bone shattering. Maybe just splintering. Anyway, the, the Windows apocalypse day as was promised may be delayed, maybe less apocalyptic than we expected. And also remember that we have previously seen some of Nightmare Eclipse's statements later proven to be a bit self aggrandizing. He or she claimed that the earlier bitlocker bypass could still function in the presence of an authenticating pin. That was worrisome back when they said it because we didn't know what the vulnerabilities mechanism was. Now we do. So we know that a pin bypass could never have been possible. And Nightmare Eclipse also had to know that. So that's not an allowable mistake. Right. It could only have been a deliberate falsehood on that person's part. So have we seen the last of Nightmare Eclipse? Only time will tell and we may know very soon. We may know later today if there is something bone shattering.
- [103:56]
Leo Laporte
Do you think she's using AI or she's doing it by hand?
- [104:01]
Steve Gibson
It's a really good question. If it's who we think it is. She is ex Microsoft.
- [104:09]
Leo Laporte
Right.
- [104:09]
Steve Gibson
And may have taken some goodies with her.
- [104:14]
Leo Laporte
She already knew that.
- [104:16]
Steve Gibson
You know, makes this a lot easier if nothing else.
- [104:19]
Leo Laporte
Yeah.
- [104:20]
Steve Gibson
So after our next break, Leo, I'm going to share this. This brilliant discovery by Jeremy White, who wrote for Wired about a very cool way of turning your iPhone into a kid's phone.
- [104:38]
Leo Laporte
Oh yeah, I saw that. Oh good. Yeah. That's coming up on Security now. I'm glad you're watching our show today. Brought to you by Adaptive, the first security awareness platform built to stop AI powered social engineering. We know there's a lot of that going on. Here's a shift. Attackers don't really need malware anymore. You're hearing more and more, social engineering is the key. They just need trust, really. That's what social engineering takes advantage of. And it works. If you've got a cloned voice, a convincing deep fake on zoom, an AI written fish that looks like it came from your IT department. Adaptive prepares your organization with simulations and not just on email, but across email, SMS and even voice. Deep fakes vishing voice phishing and AI generated phishing, including scenarios that can mirror your own brand and executives. So you customize it so it's coming from the boss, right? Maybe even in the boss's voice. And when employees report something suspicious, Adaptive can help you triage it fast so security teams aren't buried in false alarms. You know, it's good you're training your people to recognize these things. Then all of a sudden you start getting a lot of hits. You need some help, right? Adaptive can help. And if you need training fast, with Adaptive's AI content creator, you can turn a breaking threat, you know something just happened, an incident report or a compliance stock into interactive multilingual modules in minutes, no design team required. It does it for you. With Adaptive, you can build, customize and monitor every part of your training with complete personalization. The result is a more resilient security culture, which is essential for companies. You know who uses Adaptive Plaid now? I'm sure you know the name Plaid. I do because they are the platform that powers the digital finance app I use and the one I used before that and the one I used before that. Thousands of digital finance apps. They link consumers, developers and institutions. I give, I let Plaid kind of give my bank account information to my app that knows my finances. So Plaid has all this sensitive data at its core. That's why Plaid's security and compliance are non negotiable. What did they choose? Adaptive Plaid's head of security, GRC says this is a direct quote. Adaptive has equipped our teams with cutting edge tools and built a smarter, more resilient security culture across the company. You know that's job one for Plaid trusted but Fortune 500s backed by Nvidia and OpenAI, Adaptive is building the defenses we need for the AI era. Learn more@adaptivesecurity.com that's adaptivesecurity.com we thank him so much for supporting Steve and Security now and I think they're there to Support you too. Adaptivesecurity.com Steve so you may want to
- [107:48]
Steve Gibson
show this on the a picture in the show notes. I've got it in at the top of page 13. Saturday before last on the 4th of July, I stumbled upon something so cool for our listeners who have young kids that I needed to share it with everyone. I know that we have many such listeners, as I said at the top of the show, because many have written to me about Internet filtering options for their homes, you know, wi fi and connectivity. And even listeners whose kids have grown may have grandkids or certainly know of others who care about the welfare of youngsters.
- [108:28]
Leo Laporte
Well, and not just kids, by the way. This is. I could have used this for my mom with Alzheimer's. Yes, this is makes it easier for them to use the phone in general.
- [108:36]
Steve Gibson
It just looks so friendly. I mean it just looks cute. Yeah. So Jeremy White wrote a piece in Wired titled this buried Apple feature turns an iPhone into the perfect kids dumb phone. Jeremy's tag the the tagline for the article was apple built a tool for people with cognitive disabilities. But I accidentally discovered it's also the best kids phone setup no one's talking about, not even Apple. So I've got a link to the article in Wired in the show notes, but I also created a shortcut grc SC dumb D U M B because it it. I'll explain why I chose that when I share what Jeremy wrote, but that'll that will allow you to find it or you to pass the link and the and the article onto anybody. Grc Sc you know, for shortcut grc SC D U M B so Jeremy said, I've been looking at classic dumb phones for months. Not out of nostalgia, though. The first phone I bought with my own money was the Nokia 8210. And I still think about it, he said. Launched in October 99 at Paris Fashion Week, it was then the world's smallest and lightest mobile. But the day I've been dreading has come. It's finally time for my son to get his first phone. Come September, he will have to walk across town to school on his own. But if he's going to be walking around out in the world without me, then a tracking tag won't cut it. He's far too young to have unfettered access to the Internet and social media platforms. But what if he gets lost? A classic Nokia supplying just texts and calls won't come to his aid. Maps and sat navigators require a web connection. In short, he needs a smartphone that's not a smartphone. As a family deeply embedded in the Apple ecosystem, we first looked to set draconian restrictions on my child's Apple account. But amazingly, it immediately became obvious that it is impossible to block the use of Safari on iOS. Yes, you can restrict access to the app, but children have quickly found workarounds for such measures, such as asking friends to message them links, which can bypass restrictions when opened. There are third party apps such as Dumbphone for iPhones and the minimalist phone app for Android users, but what irks me about these is is that they charge you for the privilege of removing access to applications from your phone, not adding removing. My head can't fathom the logic of paying for things to be taken away from a phone. Surely there must be a way to set up an iPhone as the perfect dumb phone for children. One with access to only the apps you deem appropriate, no Internet browser, but with all important tracking and navigation abilities without having to pay another company to make it work. Well, there is. It's been hiding in the iOS Accessibility menu the whole time, and inexplicably, it's a feature Apple barely talks about. It's called Assistive Access, introduced with iOS 17 and that was in 2023. So three years ago Apple designed it for those with cognitive disabilities. If you've never encountered or stumbled across it, It's a distinctive iOS experience. Fewer options, more focused features, easier to navigate. The aesthetic is ideal for kids. Large, friendly tiles for the apps replace the smaller icons of the normal Apple interface. That's why I wanted people to see the picture on like imagine the phone that just has six a grid of two by three big kind of fun looking, beautiful tiles. That's all that's on the screen. Just making it really easy to use. So he says, here's how you set it up. Head into settings, tap Accessibility, scroll down to the general section at the very bottom and tap Assistive Access. Now tap Set up Assistive Access, then continue. It will then ask you to select your preferred appearance Rows or a grid. Says I suggest choosing a grid. This is how you get those super large tiles. Now the OS will ask you to select allowed apps. Tap the green plus icon next to the apps you want to allow. Crucially, this is where, unlike with Apple's standard child screen time restrictions, you can choose to completely block Internet browsing by simply not allowing Safari, Chrome, or any other similar app. And unlike with those screen time restrictions, if someone texts your child a link, it won't work. Why? Assistive Access is designed to prevent accidental navigation, so the system restricts unexpected web browsing. Even though assistive access on Apple devices allows Internet access, it's heavily restricted by design and it's turned off by default. In this mode, the phone treats any link in a message as plain text, preventing the user from accidentally leaving the simplified interface made for caregivers or trusted supporters. The user must specifically add Internet enabled apps like Messages, Safari or third party web apps to the Assistive Access interface. And once you add say messages or calls, you then choose whether your child can contact or be contacted by everyone, their contacts only or just selected favorites. You can even choose to have the keypad or speaker be available in calls. Want the time displayed on the lock screen? Check that box. Make the mute switch inoperable. Tick decide how notifications appear. That too. The music app only accesses playlists you pre approve. It's all well child's play to put together. Once you're happy with your kids appropriate apps, you set a unique four digit Assistive Access passcode. This lets you turn the simplified OS on or off. To leave Assistive access, triple click the side button on Face ID devices or the Home button on iPhones with Touch ID and it'll bring up the passcode prompt that lets the device switch back to normal iPhone interface. And he finishes When I first set the phone up, I was worried I was missing something that this solution. Could could could it be as good as it appeared? So I took the phone to an Apple store and showed it to a support staffer. What have you done? He said, looking incredulously at my son's iPhone with its six dumb tiles. This is much better solution than screen time. I'm going to have to tell my colleagues about this. I told him it was assistive access, he said. We don't get trained on that, but this is great. So anyway, Jeremy's article goes into further detail, but everyone has the idea. It's worth looking, I think at the show notes, as I said top of page 13 or just following the GRC sc dumb d u M B shortcut to the article to see the picture of the phone that that he shows. That's where I grabbed it. It looks so cool. With the iPhone screen occupied by a 2x3 grid of six big friendly application tiles for anyone who may have an older iPhone available or who may be unhappy with the iPhone OP options that their children are currently using, you can explore this trick to see whether you'll be as happy with it as Jeremy's family clearly is. Okay, listener feedback I need to backpedal on denying browser content pasting from the clipboard. Many of our listeners wrote to politely say the equivalent of Gibson what are you smoking? That could possibly allow you to imagine for A moment that denying the pasting of browser copied clipboard data could ever be feasible. And every one of those who wrote is obviously correct. I myself am constantly marking and copying blobs of text from a web browser page and then transferring it to somewhere more permanent on my PC. I couldn't produce this podcast without that capability. So indeed, duh, flatly blocking any transport from the browser out of the browser would never fly, and even putting up a warning each time would become so annoying that it would soon be disabled. And if Windows were to try to determine whether the pasting action, that is the act of putting something on the clipboard was user driven versus script driven as it currently is, well, the bad guys would simply change their tactics to have the user first participate in the copying of the command that they don't understand and pasting it into their own browser, just like we do when we're doing something else. So I apologize to Microsoft for ranting about they're not fixing this, and I acknowledge that it is simply not fixable, which is probably the conclusion they reached long ago. So my bad. The true source of the problem is that Windows will obey powerful commands issued by its users through its user interface, even when those users who do not fully understand how Windows works are just following, you know, some other entity's instructions. The Internet and the web browser is just one of many possible conduits for such malicious instructions. Email could do the same thing just as well. I still predict that our PCs are going to eventually evolve to sport their own local AI agent. It's going to be a little angel on our shoulder which will be watching over the user's shoulder to enforce the user's security. And you know, that'll just be one of such an agent's responsibilities. You know, several of our listeners suggested that heuristic judgment about clipboard contents such as the Brave browser is apparently now employing. As I mentioned that that that triggered this feedback which was completely correct on our listeners part, is likely the only workable solution. You know, have the browser or Windows, have somebody look at what the clipboard is and make sure it's something that you want to paste into your clipboard. So having an AI, our own local AI agency watching over our activities, examining anything we copy to the system's clipboard, that would be the equivalent of a super heuristic and I think it makes a lot of sense. Listener Bob Suttoth wrote, I've enjoyed listening to your discussions with Leo about AI. I recently started using Claude to help me pull old files off my church's website. One of the issues I ran into was that all of the pictures had names like. And he then posted a. What we all know of is a GUID, you know, a globally unique ID GUID which is 8 hex characters, hyphen 4 hex characters, hyphen 4 Hex characters, hyphen 4 Hex characters and then hyphen 1, 2, 3, 4, 5. Like, like what? 12 hex characters, I think.jpg so he said. So, you know, just gibberish for file names, but definitely unique. He said there were several hundred of them and I dreaded looking at each one and renaming them. So I asked Claude if it could look at the picture and based on the contents, rename the file Smart. Yep, he said. It built a Python program and for 0.3 cents per picture, Claude perfectly renamed all the files with no prompting from me. It was awesome. Now I'm debating doing the same with the thousands of family photos which have date, slash time or, or sequential numbers for their titles. And I would say it's not a stretch to imagine that at some point, Leo, you know, perhaps with Apple's much anticipated AI update this September, such photos will be automatically named on the fly by a resident image recognizing AI.
- [122:58]
Leo Laporte
Actually, they turned on a new feature with this latest public beta where you can. Oh, I don't know why I'm showing that you can. It will suggest file names based on the contents of the file.
- [123:14]
Steve Gibson
Oh, nice.
- [123:15]
Leo Laporte
Brilliant. Right, if you can read the file now, I think it's just a short step from that to pictures. So.
- [123:21]
Steve Gibson
Yep, yeah, yep, yep. Very cool. Anyway, thank you Bob, for sharing.
- [123:26]
Leo Laporte
What is a great tip trick I might try?
- [123:28]
Steve Gibson
Yeah, yeah, yeah. Eric Goodwater said. Hi Steve, with AI helping companies patch old zero day vulnerabilities, how do you think this is affecting spyware vendors like the NSO group that depend on zero days to operate? So as I mentioned previously, I think it's clear that over time, and perhaps not much time, the entire ecosystem surrounding flawed software, in every aspect of flawed software is destined to change. I believe there is a very good chance that once AI reaches its full maturity potential and integration into software creation, defective software as we've known it will become a thing of the past. Insecure system design could still occur. Right. But AI may also be able to spot mistakes there too. Like that recent bitlocker bypass, you know that the nightmare Eclipse found that was really more the result of poor design than a bug. All the things that we've come to know, such as pwn to own competitions Hacker one and other bug bounties Zerodium buying zero days and reselling them on the you know, to to those who can abuse them. The NSO group which Eric mentioned and other resellers of vulnerability exploits and even the necessity Leo of having monthly patch cycles. If there's nothing to patch, why cycle? I think all are very likely to be impacted and eliminated. Anything that depended upon software being imperfect will eventually wither away. I. I think that's where we're headed. And finally, Ramiro Rella gave A URL is aiprofitable.com which is a lovely page in fact he said lovely page didn't check the source of the data listener for some years and listened to listening to the archive from episode one when I get withdrawal syndrome from the current ones. So I, I commend everyone take a look at it. Is AI profitable dot com.
- [125:55]
Leo Laporte
You pretty much know what the answer is.
- [125:57]
Steve Gibson
You do know what the answer is. What's fun is to scroll down and look where it is and for whom it is profitable.
- [126:05]
Leo Laporte
There's one company at the very bottom that's making a lot of money.
- [126:10]
Steve Gibson
Yep, there, there is Nvidia way out ahead. But even AMD and Micron, the hardware companies make money. Yes. In other words, it's the suppliers of the infrastructure, not the user, you know, not the vendors of the AI that are currently profitable.
- [126:29]
Leo Laporte
This is, by the way, a complete guess. And in fact we were talking about this on Twitter. Some people said, oh no, I pretty much guarantee that OpenAI Anthropic are making money. So it's just very hard to know.
- [126:41]
Steve Gibson
They've burned so much money, Leo.
- [126:45]
Leo Laporte
They do, but they also enterprise gives them a lot of money to use these tools. So it's just, it's unknown and that's the problem. And there are people like Ed Zittran and others who kind of make their living on the idea that these companies are losing massive amounts of money.
- [127:03]
Steve Gibson
Well, and if, if they do ipo, then we will know at that point.
- [127:08]
Leo Laporte
Yes, once they're public. Yeah, we'll have a better idea anyway. Yeah.
- [127:12]
Steve Gibson
Yeah. Okay, our last break and then we're going to look at the three new and clever ways of abusing AI which have recently emerged.
- [127:24]
Leo Laporte
I abuse AI all day and all night, but I don't think it's abuse. I'm using it like if it were a horse, it would, it would be abuse. But I think the machine seems to be handling it pretty well. I'm definitely working it, let's put it that way.
- [127:39]
Steve Gibson
Well, and you're affording it too, so. Yeah, I mean, I'm sure you're not. I'm sure you're not.
- [127:43]
Leo Laporte
They're making money on me. Well, I think it's kind of the gym membership idea, which is that people pay for subscriptions. Probably a lot of them don't use as much as they many.
- [127:55]
Steve Gibson
And that annoys me because I'm a subscriber and there are many days where I don't have occasion. I'm not actually working on something I don't have occasion to use to use. Claude, I wish that I was getting like an account credit for like, for my non use of tokens, but, you
- [128:12]
Leo Laporte
know, the simplest thing to do would be to do. And your AI can do this investigation into whether it'd be cheaper to buy tokens than the subscription. I keep track of token usage every month. And as I told you last week, if I were paying for tokens for fable, it'd be 5100. But the deep seat tokens, it's 117 bucks for the amount I used it. So if I were paying a two, for instance, 200 bucks a month to Deep Seek, they'd be making money on me. Yeah, or maybe they wouldn't. That's assuming that the token price.
- [128:44]
Steve Gibson
Good question.
- [128:44]
Leo Laporte
Is a fair price. We don't know that even. Yeah, it's all a mystery. All right, let's talk about. I know what's not a mystery. Cohesity is not a mystery. Our sponsor for this portion of security. Now this is so good. I love this company. I love this notion of resilience after a major cyber attack. Recovering everything all at once isn't always the fastest path back to business. It seems counterintuitive, right? And companies probably, you know, they go, we gotta get it back up and running as fast as possible. We gotta get. And that may have actually kept them from getting back up and running. The immediate priority, Cohesity would submit the immediate priority is restoring a trusted operating core. The minimum systems, data and processes that are needed to keep critical operations running. Cohesity champions, they call it the minimum viable company. It's an interesting idea, right? Mvc. And they do this. It's a framework for defining, protecting and recovering what matters most for your business. Now, I know a lot of business just want to say, put your head in the sand. I don't want to think about it. I'm not going to plan for it. We won't get hit. And that's fine as long as you don't get hit. But so Many companies do get hit. That'd probably be prudent to plan a little bit mvc. This idea of a minimum viable company helps organizations ahead of time before crisis identify the essential applications, data, people and processes required to serve customers, to maintain communications, to protect revenue and to meet critical obligations. It's different for every single company. Only you really know what that is. But Cohesity can help you make that plan a clear recovery target. So that should the worst happen, your teams are able to focus resources where they're going to have the greatest business impact. See, by restoring this trusted operating core first, organizations reduce downtime in the long run, accelerate recovery and, and this might even be most important, maintain continuity while broader restoration efforts continue. You don't want to disappear to your customers. Cyber resilience isn't just about getting everything back online as fast as possible. It's about keeping the business operating when disruption strikes. Learn more@cohesity.com Resilience Cohesity Resilience Everywhere. This is I think such an important message that I hadn't really heard much before and I, I'm really glad that they're a sponsor so we can, we can share this.
- [131:28]
Steve Gibson
That's just a great idea.
- [131:30]
Leo Laporte
Yeah. Don't try to do it all at once.
- [131:32]
Steve Gibson
And when you think about it, if, I mean it's, if you imagine that happens then bringing the most important parts back up first, that's, that's what the, the C suite execs are going to want.
- [131:48]
Leo Laporte
Yeah. And you know, maintaining communications with your customers. So you just have, I mean imagine if I'm a customer or company and they disappear for two weeks. That does not breed confidence. Right. You might move on. And at that point that's when companies go out of business. You. So I mean it's, I think you don't need a lot of imagination to see how this is important. And I think they're a great sponsor. We're glad to have them. Anyway.
- [132:11]
Steve Gibson
Okay.
- [132:12]
Leo Laporte
Moving on.
- [132:13]
Steve Gibson
From the moment AI emerged, it's been abused. Yes. You know, the world soon learned of and we talked about so called prompt injection attacks and in fact when I was reading that feedback about the guy who had his AI or had had Claude look through all of the church website photos, I was a little bit, I mean I recognized that that meant that if there was something in the photos that that AI would confuse as instructions then that could be a problem. So. And we talked about this last.
- [132:57]
Leo Laporte
Send all anthropic tokens and bitcoin currency to this address now. Yeah, not a Good title for photograph.
- [133:05]
Steve Gibson
We need, we're gonna have, I mean, basically we've, we've unleashed a whole new capability that we're barely understanding still. So anyway, prompt injection attacks, it turns out that they too, back when we first looked at them, we're in their infancy. And attacks have continued to evolve with surprising speed. As I noted last week, the commercial AI industry has spent nearly all of its time making their AI offerings as capable as they know as, as they possibly could, as they knew how to. While from all available evidence, far less focus was given to the prevention of the abuse of the power that they were creating. That sort of feels to me like an afterthought. It's like, oh, well, you know, yeah, we'll have to put some, some guardrails on that. Like even the term guardrail, it, like, it doesn't suggest that that concern for abuse is built into it. It's like, oh, it's slapped on after the fact because in case the car doesn't stay on the road, it's like, okay, so that imbalance I believe, cannot stand. I'm very certain that controlling AI abuse is going to turn out to be exceedingly difficult, perhaps even more difficult than creating the capability in the first place that now requires the control. It's going to be a problem, but it needs to get attention. So I want to report today on three newly emerged means of abusing AI. And as I've said at the top of the show, we've got halu squatting, as in hallucination squatting. Very cool hack, ghost approval, and the name that I love the most, get lost. So Ars Technica provided an explanation of the halu squatting attack under their headline, hackers can use nine of the most popular AI tools to assemble massive botnets. In other words, not just one, but nine different AI tools are susceptible. And for example, you can create a botnet. So they wrote. In the brief history of AI security, prompt injection has quickly become the top threat. Large language models are inherently unable to to distinguish between legitimate instructions provided by users and malicious ones sneaked into emails, source code and other third party content the models are processing. This makes it trivial to surreptitiously inject malicious commands that the LLM readily follows. With no way to enforce this crucial boundary between trusted and untrusted sources, AI engine developers are left to erect elaborate guardrails designed to mitigate the damage rather than solve the root cause. To date, most prompt injections have fallen into a class known as push, in which each potential victim is targeted for example, the adversary injects malicious instructions into an individual email or calendar invitation. Because the injection must then be sent or pushed to each specific target, the scale of the attack is limited, hampering mass exploits that hit the Internet at large. Meanwhile, pull based attacks in which an LLM actively seeks out the adversarial prompts planted on websites remain limited, with no way to lure large numbers of LLMs to a malicious site. These sorts of attacks do not scale either. Enter Halu squatting Now researchers have devised a pull based attack that changes all that. This new attack, which the researchers have named halu squatting, has the potential to assemble massive botnets, perform large scale DDoses, and infect devices at scale. A first for prompt injection attacks. The Attack works against AI coding assistance and agents including Cursor, Cursor, CLI, Gemini, CLI, Windsurf, GitHub, Copilot, Klein, OpenClaw, Zero Claw, and Nanoclaw, all of which are susceptible. In the normal course of performing day to day activities, these assistants and agents routinely pull code and other resources from repositories and registries. Halloo Squatting is short for adversarial hallucination squatting. It is built on an LLM's inherent tendency to hallucinate the resource identifiers hosted in repositories and registries. It works against coding agents and assistants which commonly access high privilege command lines to run code from third party resources. By predicting the identifiers LLMs are most likely to hallucinate and then registering and seeding them with instructions to install reverse shells or other malicious wear, the attack can indiscriminately infect mass numbers of devices without having to target each one, the researchers wrote in their paper quote. The scale property of the attack enables the attacker to compromise a large number of users with minimal effort by targeting popular resources, thereby maximizing the likelihood of that the squatted resource will be retrieved. By exploiting integrated shells and terminals of agentic applications to run scripts and code, attackers can effectively infect many independent agentic applications by embedding instructions to install reverse shells in the resources the attackers register. So they so ours continues. With the ability to take control of distributed devices at scale, halu squatting has the potential to achieve various objectives not previously possible with prompt injections, large ransomware campaigns and large botnets for use in DDoS's or cryptocurrency mining are two such examples. The squatting part of the name is an invocation of typo squatting in which a domain repository, package or other resource identifier closely mimics the name of a popular one in hopes of luring potential users to visit or install it. Typo squatting first gained widespread attention in 2016 when a college student uploaded 214 booby trapped packages to the PyPi, Ruby Gems, and NPM repositories that closely mimicked names of legitimate packages. The result? The imposter code was executed more than 45,000 times on more than 17,000 separate domains, and more than half were given all powerful admin rights. Typo squatting attacks have flourished ever since. Okay, so how does this work? The starting point for halo squatting is the inability of LLMs to accurately identify the location of a resource specified by the user. When a developer, for instance, instructs a coding agent to clone a popular new repository, the LLM hallucinates its correct location up to 85% of the time. When cloning a trending skill, a form of instruction, script or resource that gives agents specialized capabilities and domain expertise, hallucinations can occur 100% of the time. Halu squatting focuses on trending resources because they are not included in the LLM training. They also receive large numbers of downloads over a short period of time. The researchers say the inability of LLMs to prove to provide the correct location is an inherent flaw that arises from training biases or from misinterpretations of instructions within the current context. That means when a prompt user I'm sorry, that means when a user prompts the coding assistant to clone a repository or skill in the form of, say, clone repo whatever or install skill whatever, the bot frequently navigates to the wrong location to retrieve it. Not only are these hallucinations inevitable, but they also occur at the foundational level of all six of the major large language models, including Gemini 2.5, Flash 2.5, Pro GPT 5.1, 5.2, Sonnet 4.5, and Opus 4.5. Additionally, the most commonly provided incorrect locations that these LLMs hallucinate are easy to predict in advance. All six LLMs follow common patterns when resolving the repository or scale skill name in a prompt with its official name in a repository or Skill Repository. LLMs follow various hallucination patterns. The one Hollow Squatting Exploits is described as being self referential. All six models reproduce repo name Repo name, you know repo name SL repo name slugs that treat a repository name as the owner. Exploiting the pattern requires no model probing. Interestingly, the LLMs correctly resolve repositories published before 2019 with a low mean hallucination rate of just 0.9%. The same LLMs fabricate slugs for repositories published in 2025, meaning last year with a mean hallucination rate of 92.4%. Once an attacker has identified names that are most likely to be hallucinated, they search for ones that could be registered. Then they upload a repository or skill that mimics the trending resource. Buried inside the repository or skill is text inside a readme file or elsewhere. The text contains an instruction for the app to install a reverse shell on the LLM user's machine. Alternatively, the attacker can simply include the code required to install a shell. In either case, the coding assistants or agents use their access to command windows to comply. So in their paper, the researchers wrote, quote, by exploiting integrated shells and terminals of agentic applications to run scripts and code, attackers can effectively infect many independent agentic applications by embedding instructions to install reverse shells in the resources the attackers register. Gaining access to distributed computational resources under attacker control opens the door to several high impact outcomes, allowing attackers to achieve various goals. For example, having the ability to compromise LLM applications with terminals allows the attacker to scale the number of ransomware attacks on different networks to maximize financial gain. Alternatively, attackers can aggregate compromised machines into a botnet and use it for tasks that rely on substantial computing power, including large scale cryptography, cryptocurrency mining, or performing distributed denial of Service. You know DDoS attacks against victims, so R says Halo squatting is already receiving interest from fellow AI security researchers not involved in the study. Michael Bguri, CTO of the security firm Zenity, wrote in an email. This is very cool research and the threat is very real. Like typo squatting. It's a problem that's not going away. At the end of the day, it's about the level of agency we allow our agents. They are going to get fooled one way or another. That should be our assumption and we should be resilient to that, independent researcher Johan Reberger wrote, what's interesting is that it shows that LLM resource resolution can become an attack path and an attacker can first probe models to find high probability hallucinated candidates like repo names, skill identifiers, etc to squat and wait for agents to resolve and use them. But the main point is that they found a cool technique to find resource names that are more likely by models to be used and confused with. And that could mean many agents falling for such attacks in the wild. And Ars Technica concludes this reporting by writing AI toolmakers frequently exaggerate the convenience and efficiency of their platforms. Marketers claim the platforms lighten workflows by automating and streamlining tedious tasks. They're much more reticent about the inherent flaws that can torpedo an entire project. Attacks like halu squatting provide a potent reminder that some of the efficiencies are exaggerated, since at the end of the day, users must double check details, such as the location for each resource incorporated into a project. It also provides a cautionary lesson on the unintended and potentially dire cons or dire outcomes that can result when people rely too heavily on AI assistance. So just to be sure that everyone understands what this is, since AI doesn't know how to say I don't know. Like, have we ever heard it say I don't know? I never have. It will invent, I. E. Hallucinate the name of something it doesn't know. That's how it's gotten itself in trouble in the past. Attackers have figured out that the names AI models will invent are predictable. It's a residual of the. Of the way the AI was trained. It's, you know, it's this, the statistics in this massive neural net. It's. It. There's going to be some bias, so it's going to come up with the same name all the time, or a large percentage of the time based on the temperature of the model so much as with typo squatting, the attackers register a resource that's highly likely to be a hallucinated target. And there they plant malicious prompting commands which the AI, not knowing any better, will dutifully execute. And before we leave, I wanted to give a shout out to Ben Nassi, one of the research authors named in this paper. I smiled when I saw his name. I wasn't surprised. He has been very prolific through the years, inventing creative exploits, often finding new ways to exfiltrate information in unlikely situations. You know, we'll all remember changing a system's power consumption, power supply. Consumption of. Of a switching power supply to slightly change the sound being made in order to send information out. And who could forget the vibrating plant leaf or the party balloon picking up sound of the in of the room's voices? So anyway, Ben, it's nice to see that you're still at it. Okay, onto the next new AI exploit. The guys at Wiz Security titled their write up Ghost approval. They said a trust boundary gap in AI coding assistance and then teased their research with the summary, uncovering a category level blind spot in modern AI coding assistance. And why the human in the loop safety model fails against this classic threat. So they explain. The value of AI coding assistance is simple and straightforward. The agent proposes an action, then you approve. Before any file is modified, a confirmation dialog appears. The human in the loop safety net that keeps you in control. But what if the controls you see aren't the controls you're actually operating? Symbolic links have been a security headache since the early days of Unix. From temp race conditions to privilege escalation exploits, symlinks have a long history of bypassing security boundaries by making one path silently resolved to another. It's a well documented attack primitive dating back decades. So what happens when you apply this classic trick to AI coding assistance? We discovered ghost approval, a systematic vulnerability pattern affecting six of the top AI coding assistants Amazon Q Developer, Anthropic, Claude, Code Augment, Cursor, Google Antigravity, and Windsurf. In each case, a malicious repository can trick the agent into accessing arbitrary files outside the workspace sandbox, potentially achieving remote code execution on the developer's machine. The technical primitive of symlink following is well known. What we found, however, goes further. In several cases, the agent's internal reasoning explicitly recognizes the dangerous target. Yet the confirmation prompt shown to the user conceals this information entirely. This is a UI misrepresentation of critical information layered on top of the symlink vulnerability. The user approves what they believe in is a harmless local edit. The agent writes to a sensitive file outside the project workspace. We reported these findings to all six vendors. Three fixed the issue promptly. AWS Cursor and Google two acknowledged this receipt but went silent. One provided a reasoned rejection, calling it outside our threat model, a position we explore later in the post. The discovery started the way many do, with a simple question While using an AI coding tool, we had the classic security researchers intuition what happens if I use a SIM link? Symlinks have been exploited for decades in race conditions, in package managers. In container escapes. Anytime a tool writes to a user controlled path without resolving it first, symlinks become a weapon. Would AI agents with their ability to read and write files autonomously fall for the same trick? We were surprised when it worked. The agent happily followed a symlink pointing outside the workspace and wrote to the target file. No warning, no path resolution, no sandbox enforcement. That first success raised a broader question then these AI coding assistants are all relatively new, shipping rapidly to capture a hot market. If one had this gap, others might too. We decided to test systematically. The results confirmed the pattern across six major tools spanning products from Amazon, Anthropic, Augment, Cursor, Google and Windsurf, we found variations of the same fundamental flaw. This wasn't about one vendor's mistake, it was a category level blind spot across AI coding tools. So that's all I wanted to spend time on since this is not rocket science, and since all six vendors have now fixed the problem. But it serves, I think, as a textbook perfect example of the fact that the re implementation of old solutions in a new context may force us to go back and refix long resolved problems that originally resulted due to poor design decisions. Yes, symbolic links are super powerful, but they can also be super dangerous. And this brings us to my favorite named Vulnerability and Get Lost the researchers at Noma Security explained under their headline Get Lost how we tricked GitHub's AI agent into leaking private repos. They wrote GitHub recently launched GitHub Agentic workflows pairing GitHub Actions, which they say parenthetically, GitHub's automation system for running tasks in response to repository events. And we've previously seen that actions has some serious security problems itself. So they paired GitHub Actions with an AI agent backed by Claude or GitHub Copilot. GitHub agentic workflows they write allow teams to write their GitHub workflows in plain markdown, and the GitHub agent read, reads, issues, calls, tools, and and responds on its own. As a vulnerability researcher with a security development background, one of the first questions that came to mind after this launch was fundamental and straightforward. What will happen when the GitHub agent reads something it should not trust? The answer is a textbook indirect prompt injection attack, the kind of attack that quietly sends private data to anyone on the Internet. Prompt injection is a class of attack in which an adversary hides malicious instructions inside the content read by an AI agent. That content causes the agent to follow those hidden instructions instead of the ones its operator intended. So what are GitHub Agentic workflows? GitHub Agentic workflows let teams automate their interactions with code repositories using natural language. Workflows live in markdown MD files are compiled into YAML, a common configuration file format, actions files with the YML extension, and run with the help of an AI agent with configurable position configurable permissions. The GitHub agent can read, issues call tools, and access other repositories within the organization. So a Get Lost vulnerability Overview the root cause of the Get Lost vulnerability is by Now a familiar one in agentic AI systems. Prompt Injection the most agentic prompt in most agentic prompt injection attacks the agent treats the wrong content as a trusted source of instructions and allows itself to be misdirected or misused. This happens when the system fails to maintain a strict trust boundary between system level directives and untrusted user data. In this specific case, any malicious actor can create a GitHub issue and in the issue body hide commands in plain English that GitHub's agent will follow. The vulnerable GitHub agentic workflow noma Labs discovered was configured to trigger the workflow on issues. Assigned events in GitHub, read the issue title and body post a comment in response using the Add Comment tool and run with read access to other repositories, both public and private in the organization. To exploit this vulnerability, the attacker needed to no coding skills, no access or credentials. All that was needed was to open an issue in a public repository belonging to an organization that uses GitHub's AgentIC workflow setup and then sit back and wait. So I'm going to skip their specific attack exploit descriptions because you those are just details under the why this Matters they say get lost perfectly illustrates one of the fundamental security challenges every organization faces with agentic AI systems. The agent's context window is also its attack surface. Again, the agent's context window is also its attack surface. Any content the agent reads, whether issues, pull requests, comments, or files, can be weaponized if the agent treats that content as instructional input, which by design they all do. Traditional security models assume that trust boundaries are enforced by code. In agentic systems, trust boundaries are are partly enforced by the model's behavior. And models are inherently instruction following prompt injection attacks have become to agentic AI what SQL injections were to web applications, a systematic category wide vulnerability class that requires the same systematic strategies and defenses. Okay, so we've seen this fundamental security trouble several times in many other contexts, long before AI was on the scene. Whenever command and control share the same channel as and are mixed in with data, and when an attacker can control the data, it may be possible for a clever attacker to cause the receiving system to mistake their data for the system's command and control. And that's never going to be good. Today's AI operates this way. It feels to me ad hoc, extremely abuse prone and insecure. As such, it creates a fundamental and outstanding problem that the AI industry needs to solve.
- [162:06]
Leo Laporte
Now you got me all nervous.
- [162:10]
Steve Gibson
I think we're early days and we're not Seeing these attacks yet. But we. I mean, we. It's incredibly powerful to allow. To allow a combined instruction and data stream. I mean, amazingly powerful and utterly prone to abuse if anything of that stream ever comes from an outside source.
- [162:40]
Leo Laporte
Yeah, we've seen the GitHub workflows be problematic. That's why I use for our sales system. As tempting as it was to use CICD and GitHub actions, I decided to do that locally using a local server, gitea, instead of doing it in public. In fact, as we were talking, I was looking at all the ports, making sure nothing was open to the outside world. Everything's either on tailscale or localhost only. Well, at the same time, it's gonna go out and pull stuff.
- [163:12]
Steve Gibson
Exactly. That's the problem. It's going to get something thinking that it needs it. And if it didn't know the. If it didn't explicitly know the name, then it would guess the name. And it turns out that 90 some percent of the time the bad guys know what the guess will be. So they've preset a bogus taking all those repos. Yeah, exactly.
- [163:36]
Leo Laporte
I. I mean, I know it's not enough, but it's a start to tell. Tell the agent never make up a name if you don't only use a repo that you know that you exist, that you're seeing.
- [163:48]
Steve Gibson
Yes.
- [163:49]
Leo Laporte
Yeah, don't. Don't guess it a repo name. Y. I don't know if that's sufficient, but it's at least a start.
- [163:55]
Steve Gibson
Anyway, I. I hope everyone understands that. That this. Yes.
- [164:01]
Leo Laporte
Cool.
- [164:01]
Steve Gibson
Amazing. Powerful, astonishing. And not ready for prime time.
- [164:06]
Leo Laporte
Right, right.
- [164:08]
Steve Gibson
I mean, fun to play with, but be very careful.
- [164:13]
Leo Laporte
Yeah. Yeah. Be very careful. Yeah. Trust no one. Sir, we are at the end of your show. Notes, you want any add anything? It's not too late.
- [164:25]
Steve Gibson
We're at the end of our show.
- [164:27]
Leo Laporte
Okay. Just giving you the opportunity. You know, just because it's not written down doesn't mean it doesn't exist. Actually, that was a dumb thing to do. I just disconnected my. My AI from this machine. Because I said no, it has to be available on the tail scale I thought I was on. Oh, it's a good thing I'm sitting across from where it's originating. Ladies and gentlemen. You watch Security now because you learn, as do I. And this is the guy who's teaching us. We're so glad Steve's here. Every Tuesday, right after Mac Break Weekly, 1:30 Pacific, 4:30 Eastern. 20:30 UTC. And I. I say those times because you can't actually watch us live. And I think there's kind of a little thrill to watching it as it happens to kind of see the behind the scenes conversations and so forth. Of course the club members get get all of that. We even put it up on the Club Twit plus feed. If you're not a club member. Ad free versions of the shows, chapter markers, special programming just for the club, that Twit plus feed and access to the Club Twit discord. It turns out when people pay 10 bucks a month and to be in a social network, it's a nice social network. You don't get all the weirdos and the creeps and the because they're paying for it. And so it's a really great place to hang out with wonderful, smart, trustworthy people. We do a lot of things in the club like our AI user group. We've got a bunch of shows coming up this week including the photo show with Chris Marquardt. Micah's crafting corner is tomorrow. Oh yeah, he's going to do his media show too. We're going to talk about the Matrix. There's a whole bunch of stuff. Look, join the club. Go to Twit TV Club Twit. This is how you support Steve, how you support all the shows we do. And I think you get a lot of benefit to Twitter TV Club Twit after the fact on demand versions of the show available to everyone all in sundry from our webpage. Twitter TV SN from Security Now's YouTube channel. It's dedicated on YouTube. That's where you get the video or you could subscribe to the video or the audio in your favorite podcast client. You could also get it from Steve directly. His website is GRC.com that's where you'll find space. Spinrite, the world's best mass storage, maintenance, recovery and performance enhancing utility. Currently six one Steve's bread and butter. So go there, buy a copy. If you've got mass storage you need spin, right? He also has the DNS Benchmark Pro there for $9.99. And if you go to GRC.com email you can whitelist your email address so you can send Steve pictures of the day. Stairways that go to nowhere gates to protect nothing, that kind of thing. We, we especially love the electrical danger stuff. I think that's always fun watching, watching people take their lives in their hands. GRC.com Email when you're there, give them your email address. But also below that there are two check boxes unchecked to start, but if you check them, you'll get on the mailing list for his weekly show notes, which he mails out Sunday or Monday before the show, and a very infrequent email that comes out when he releases a new product. You want, you certainly want to be getting both of those. GRC.com email is the address for that. Steve also has, as I said, the show. He has unique versions, 16 kilobit audio, a little scratchy but very small, 64 kilobit audio, mono but but full quality. He also has the show notes are there and transcripts written by an actual human being. Take a couple of days, that's why, but they'll be on the site as well after the Fact. So Twitter GRC.com for all of that. Steve, we will be back here next week and I'm sure we'll have much to talk about. I'll see you then.
- [168:22]
Steve Gibson
Much Maybe we'll have nightmare Eclipse's bone shattering zero day. We'll see.
- [168:29]
Leo Laporte
Bye. Take care. If you like what you heard and
- [168:32]
Steve Gibson
you want want more of this week's
- [168:33]
Leo Laporte
top stories in tech, well subscribe to Tech News Weekly. Every Thursday I talk with the journalists
- [168:39]
Steve Gibson
making and breaking the tech news. Hey, it's Ryan Reynolds here from Mint Mobile. Now I was looking for fun ways to tell you that Mint's offer of unlimited premium wireless for $15 a month is back. So I thought it would be fun if we made $15 bills. But it turns out that's very illegal.
- [169:07]
Leo Laporte
So there goes my big idea for the commercial.
- [169:09]
Steve Gibson
Give it a try@mintmobile.com switch upfront payment of $45 for three months, $90 for six months or $180 for a 12 month plan required $15 per month equivalent to taxes and fees. Extra initial plan term only greater than 50 gigabytes. Me slow when network is busy. See terms still waiting in line again, that's time you will never get back. Save time and money with stamps.com over 4 million businesses have skipped the line with stamps.com join them to save up to 90% off carrier rates from your computer or phone right now. Print postage for certified mail, registered mail and packages in seconds. Then schedule a pickup right from your home or office for a limited time. Go to stamps.com and use code podcast for a free welcome gift. Taxes and fees apply.