Security Now 1088: A Nefarious Novel Use for AI

Summary

Security Now #1088: "A Nefarious Novel Use for AI"

Hosts: Steve Gibson & Leo Laporte
Date: July 22, 2026

---

Overview

In this rich, insightful episode, Steve Gibson and Leo Laporte dive into the latest threats (and responses) in cybersecurity, with a focus on the rapidly evolving role of AI. The main story: a novel and nefarious use of AI by threat actors—not to break into networks initially, but to process massive, exfiltrated data after a breach, amplifying extortion opportunities and streamlining ransomware operations. Along the way, they also explore novel password and credential challenges posed by agentic AI, prompt injection attacks, a critical WordPress flaw, and a quietly-patched OpenSSL vulnerability.

---

Key Discussion Points & Insights

1. State of Security and Recent Vulnerabilities

• Nightmare Eclipse's "Bone Crushing" Exploit

  • Recap of the serial Windows attacker "Nightmare Eclipse," who teased a major exploit. The actual exploit dropped ("Legacy Hive") is less severe than advertised, allowing limited privilege escalation, and seems intentionally crippled, perhaps due to increased pressure from Microsoft.

    "No bones were crushed or chipped or very much disturbed this month." (Steve, 16:00)

• Microsoft Patch Tuesday Trends

  • July's Patch Tuesday broke records with 570 vulnerabilities patched, 59 of which were 'critical'. Over 25% allowed remote code execution.
    • Steve expects that as AI is woven into coding practices, the number of discovered/patched flaws will eventually drop dramatically.

    "We're going to be dropping, if not to zero, to like a whole different level ... bounties and so forth are just going to go away." (Steve, 25:03)

  • Adobe has increased patch cadence to twice monthly; the industry's volume of fixes is accelerating—but Steve predicts the curve will reverse soon.

2. OpenSSL Vulnerability (“Holobyte”)

• • Newly discovered "Holobyte" flaw enables denial-of-service on any unpatched OpenSSL endpoint with just 11 bytes—potentially affecting every software or device that bundles OpenSSL for TLS (Apache, nginx, Node.js, Python, etc.).
    • The bug: trusting a header length claim and over-allocating memory—still possible in 2026!

      "This fix was silently included ... switching to an incremental buffer growth strategy. What a concept." (Steve, 37:04)

    • Steve notes the immense difficulty of ensuring all uses of OpenSSL are patched, especially in embedded and "appliance" devices.
  • No known exploitation yet; recommends immediate patching.
  • Illustration of how AI-driven discovery is outpacing the patching infrastructure's ability to keep up.

3. Agentic AI: Credential and Password Challenges

1Password & Claude Integration

• Credential Handling for AI Agents
  • 1Password, working with Anthropic’s Claude, introduces a "zero-exposure" architecture: Claude agents can use credentials to log into websites on user's behalf without seeing (or memory exposure to) passwords or OTP tokens.
    • User is prompted (via Touch ID or Face ID) for every credential use.

      "Claude is kept on a leash and is able to work without exposing the user's credentials." (Steve, 52:01)

  • Security model discussed: agents get just-in-time, scoped-to-task access—never prolonged, never the whole vault.
  • The need for a new security model for agentic AI is underscored.

Bitwarden's Multi-Pronged Solution

• • Bitwarden introduces a suite for "agentic AI access":
    • Secrets Manager: Just-in-time, scoped secrets for AI agents/dev workflows.
    • Access Intelligence: Detects "shadow AI" usage—when employees connect AI agents to business systems without security review.
    • Agent Access SDK: Allows human-in-the-loop credential approval for agents.
    • MCP Server: Enables managed, auditable, and restricted credential provisioning—especially important in enterprise environments.

"All of the credential management systems we've carefully designed … must now be adapted for use by untrusted AI agents." (Steve, 76:27)

Security Model Dilemmas

• Prompt Injection Risks
  • If an AI agent receives credentials (however obfuscated), it’s only one prompt-injection or misstep away from being manipulated into handing secrets to an attacker or taking dangerous actions.
  • New security pattern needed: temporary, single-use, revocable tokens; AI-specific delegation models.
  • Human convenience vs. security tradeoff discussed in depth (e.g. not wanting to touch Touch ID every time an agent logs in somewhere).

4. Prompt Injection: New Agent Data Injection Attacks

• New “ADI” Prompt Injection Research
  • Recent paper finds AI agents susceptible to subtle "delimiter injection" in structured data (e.g. a review or comment containing fake delimiters), causing agents to misconstrue structure—such as generating additional buttons or records that don't exist.

    "It's just another example of the fundamental security flaw … incredibly powerful to be able to freely mix instructions and data, but it's also a security nightmare." (Steve, 82:41)

  • Emphasizes how LLMs “guess” structure where non-AI code would enforce strict parsing.

5. Critical WordPress Core Flaw

• WP2Shell—Emergency Forced Patch
  • First core (not plugin/theme) unauthenticated remote code execution for WordPress in years (“WP2Shell”), introduced Dec 2025, still present June 2026.
    • Forced core update pushed to all sites, overriding administrator preferences.

"Props to them for having such a [forced update] mechanism ... this is as bad a vulnerability as any we've seen from WordPress." (Steve, 93:28)

6. Listener Feedback & Philosophical Reflections

• AI Coding—Exponential Code Growth
  • AI empowers even non-programmers to produce working software, dramatically increasing the code "surface area" worldwide.
    • Security paradox: even if AI gets better at making code bug-free, the sheer VOLUME may outpace audit and secure deployment.
• AI as Bureaucracy
  • Yuval Noah Harari’s insight (via listener letter):

    "Bureaucracy is the machinery that lets strangers cooperate at scale … AIs are native bureaucrats." (listener quote, 121:33)

• Human Factor Remains; New AI Factor Emerges
  • While AI will reduce certain classes of coding bugs, human (and now AI-centric) error will breed new surprises in security.
  • The need for continuous vigilance and adaptability is highlighted.

---

Feature Segment: A Nefarious Novel Use for AI

[1:36:03]

Not “How You’d Think”—AI in Ransomware Operations

Traditional Focus: AI for Exploit Discovery

• For years, defenders and attackers focused on a looming arms race—AI-powered vulnerability discovery and exploit development.

Reality: Attackers Don’t Need More Entry Points

• “Getting into networks is not that difficult. Sadly, it's like they don't need anything more.” (Steve, 01:48)
• The novel, nefarious use: AI is now leveraged AFTER the breach, during ransom operations.

Case Study 1: Fulcrum SEC & “Database Weaponization”

• Exfiltrates vast, complex databases—terabytes, hundreds of thousands of files.
• Uses AI (LLMs) to:
  • Map, link, and summarize sensitive data (PII, financial, medical, IP, etc.).
  • Generate step-by-step instructions for understanding victim systems, even when novel or poorly documented.
  • “Within minutes, an AI can produce a lookup table, reverse hashes, correlate identifiers—the kind of analysis that would otherwise take deep insider knowledge or many hours of human effort.” (paraphrased)
• Ransom notes are detailed, professional, and anchored in specifics gleaned from the data (vs. vague threats).

  “We understand it is a lot to wrap one's head around. This is a big one … What this means functionally is that starting from any single customer, one query produces a complete identity package …” (quoting threat actor, 147:22)

Case Study 2: Dragon Force—AI as the Negotiator

• AI-written ransom demands and negotiation emails in perfect native English.
• Fakes legal expertise, outputting plausible, threatening warnings about regulatory disaster for the victim.
• Psychological pressure, professional tone, and loss of “tells” (non-native English, Google Translate artifacts) make attribution harder and negotiation riskier for victims.

  "For criminal purposes, it doesn't matter if the claim is true. It only matters if it sounds plausible. If there's one thing LLMs are good at, it's making a wide range of statements sound entirely plausible." (Steve, 153:38)

External Example: Novo Nordisk Attack

• 700,000+ files, 1.3TB exfiltrated; AI used to analyze, classify, and create detailed reports/messages, compounding pressure on the firm.
• Paid for LLM time using the victim’s own stolen OpenAI API keys.

  "To add insult to injury, Fulcrum SEC claimed it had used an OpenAI key it had stolen from the victim to pay for the ChatGPT summarizing the victim's own data." (Steve, 154:57)

Industry Implications

• Leveling the playing field: AI allows less-experienced or foreign-language attackers to conduct coercive operations with a new level of professionalism and sophistication.
• Negotiation “Fog of War”: Victims are often outmatched in negotiation unless they have trained professionals/lawyers; adversaries now appear more knowledgeable than ever.
• Ransom Demands Based on Data Value: Instead of arbitrary numbers, attackers use exhaustively analyzed data to set ransom terms, making threats more credible.

Strategic Recommendations

• Organizations need a mature IR plan, legal counsel, and cyber insurance—not just cybersecurity tools.
• “Victims must expect threat actors have already mapped and valued every byte of their exfiltrated data.” (paraphrased)

---

Notable Quotes & Memorable Moments

• "No bones were crushed or chipped or very much disturbed this month." — Steve Gibson, on the "Legacy Hive" Windows flaw [16:00]
• "We're going to be dropping, if not to zero, to like a whole different level …" — Steve, on AI eventually eliminating code bugs [25:03]
• "Claude is kept on a leash … able to work without exposing the user's credentials." — Steve, on agentic access via 1Password [52:01]
• "We've jumped into all of this without taking any time to think it through … everything about the way [AI] wants to operate is insecure." — Steve, on AI & prompt injection [82:41]
• "All of the credential management systems we've carefully designed … must now be adapted for use by untrusted AI agents." — Steve, 76:27
• "Bureaucracy is the machinery that lets strangers cooperate at scale … AIs are native bureaucrats." — Listener, quoting Harari [121:33]
• "To add insult to injury, Fulcrum SEC claimed it had used an OpenAI key it had stolen from the victim to pay for the ChatGPT summarizing the victim's own data." — Steve, 154:57
• "We need a new way to manage this … good luck, because I don't know how." — Steve, on the struggle to secure agentic AI credential delegation [81:56]

---

Important Timestamps

• AI’s novel abuse by attackers: intro – [01:48], [1:36:03]
• Windows “Legacy Hive” exploit/Nightmare Eclipse – [12:56] to [24:53]
• Record-breaking Microsoft Patch Tuesday numbers – [24:53] to [28:39]
• OpenSSL "Holobyte" vulnerability – [28:53] to [42:08]
• 1Password + Claude agentic access – [46:43] to [63:55]
• Bitwarden’s agentic AI solutions – [69:35] to [81:47]
• Prompt Injection: Agent Data Injection – [81:47] to [91:39]
• Critical WordPress core RCE vulnerability (WP2Shell) – [93:25] to [98:31]
• Listener questions (& AI coding reflections) – [103:24] to [132:15]
• Main feature: AI as threat actor's post-breach tool – [1:36:03] to [1:59:57]

---

Tone & Approach

Fun, curious, and occasionally irreverent (especially about coffee); but always careful, prescient, and practical—even when contemplating AI’s existential challenges to security. Leo and Steve balance enthusiasm for new tech with healthy skepticism and actionable security advice. The “what could possibly go wrong?” refrain is a running theme—often proved prophetic.

---

Conclusion

If you care about the evolving AI-driven security threat landscape—from new exploits and software flaws to the rapidly advancing capabilities of attackers after they’re inside—this episode covers it all, with practical advice and sharp analysis. The take-home message is clear: AI is becoming just as valuable for attackers as for defenders, especially in the “business” of ransomware, and we’ve only just glimpsed the start of how this will reshape cyber risk and response.

---

For anyone building, defending, or just using today’s increasingly automated systems: listening (or reading) Security Now remains essential.

Transcript

[Leo Laporte]

It's time for Security now. Steve Gibson is here. Man, there's so much to talk about. Big flaw in open SSL1 password and bit warden try to solve the agentic AI password crisis. A new prompt injection attack AI users should be aware of, and a new way people in the bad guy profession are using AI. Kind of makes sense. All that plus a great picture of the week coming up next on Security Now.

[Steve Gibson]

Podcasts you love from people you Trust.

[Leo Laporte]

This is TWIT. This is Security now with Steve Gibson. Episode 1088, recorded Tuesday, July 21, 2026. A nefarious novel use for AI time for security now. Hello, everybody, boys and girls, children of all ages. It's time for this guy Right here, Mr. Steve Gibson, our security guru. Every Tuesday we gather together to sit at Steve's feet and learn about the perils that we are suffering here in this modern world. Hello, Steve.

[Steve Gibson]

The perils of remaining plugged in on the grid.

[Leo Laporte]

Yeah, if we were all air gapped, we'd be okay.

[Steve Gibson]

Well, you know, Stuxnet managed to jump an air gap.

[Leo Laporte]

That's a good point. So even so, don't pick up USB keys in the parking lot, boys.

[Steve Gibson]

Oh, no, no, no, no. We are at episode 1088 for this July 21st. Our title is A nefarious novel use for AI.

[Leo Laporte]

Oh my.

[Steve Gibson]

There are actually two. We've talked about the way bad guys are in an arms race with the good guys in finding vulnerabilities which they could then exploit in order to get into systems. It turns out that that's actually not one of the leading uses the malicious mal uses Malign uses of AI. It turns out that getting into networks is not that difficult. Sadly, it's like they don't need anything more. They got so many ways in. Now it's just a matter of like the eeny meeny miny mo. Anyway, but they've come up with a use for AI after that which is novel and nefarious. So we'll be talking about that this week. But first we will look at the fact that the bone crushing we we had been promised did not happen this month. Not much did from Nightmare Eclipse. We are going to revisit and look more closely at last week's which is to say July's patch Tuesday. A widespread and worrisome flaw has been uncovered in open ssl. And open SSL jumped on this quote, quietly fixed it, pushed out changes. The problem is it is so widespread that there's no chance it's going to get fixed everywhere and we'll look at the consequences of that. A bunch of our listeners said Steve, I just saw an article saying that Claude can now access your 1Password credentials and this is where we deploy the what could possibly go wrong? Also Bitwarden is aware that we need a whole new kind of coverage of security. We're going to look at that. Also. The day ends in Y so we have a new prompt injection attack. There has been a very rare, very serious update for WordPress which unlike previous where this. It's in some random add on that, you know, five people in Milwaukee have installed in this case. This is in the core. So I hope everybody. No, it's really bad. I hope everybody who is staying up to date with WordPress I think it was introduced in.

[Leo Laporte]

At the.

[Steve Gibson]

At the early December of. Of. Of.

[Leo Laporte]

Of.

[Steve Gibson]

Of. Of 2025. So it's been around for about six or seven months and it's significant. We've got also lots of interesting listener feedback. I've just, I made time for. Because I've just. We haven't had as much as I've wanted recently. And then we're going to look at the new ways AI is being used by bad guys after they get into someone's network. And it's not again, it's not sort of the techie side. It's not, you know, better exploration of the network. It's interesting and of course we've got a fun picture of the week. So yeah, I think worth tuning in for episode 1088 if only to get

[Leo Laporte]

new ideas on how you can exploit people's networks. Worth it using AI we will have that picture of the week in moments. All I know is it has something to do with coffee.

[Steve Gibson]

I'm excited and that got my attention. I gave it a kind of a lame, a lame title. I said because coffee is life. Because, you know, it is. It is, it is. But anyway it's a fun sign that we will.

[Leo Laporte]

I. I've gotten you know it really into what they call pour over which is the really the silliest kind of coffee making where you using a filter and you. There's all sorts of steps and the different grinds and all this stuff. It's not expensive. That's. That's the only good. The bad thing is it. It's very time consuming and it's chemistry and there's a lot of books and stuff but I've. But it's so good.

[Steve Gibson]

A lot of books and stuff.

[Leo Laporte]

There's a lot of reading. It's chemistry. Like you should see this book that I have, it's got all of these. It's by a physicist. It's called the Physics of Filter Coffee.

[Steve Gibson]

It is possible to create a stunning cup of coffee.

[Leo Laporte]

I mean, you really can because there's different volatiles, different chemistries, the time, the temperature of the water, the size of the filter. All of this stuff makes a huge difference. The size of the grind and so you can lots of dials to turn, but once you get it right, it's really good. And I've never drank coffee black before, but because you can really make it to your taste now, it's like it's my reward. I say you can't have it till you work out. And that's what I got here. It's a bad thing. So coffee is life is what I'm saying. I'm agreeing with you 100%. We'll get to that. Picture of the week, our show today, brought to you by. I've been talking about the things Canary for a decade now. Love this. It's a honeypot that is easy to set up, easy to configure. It can look like anything. A Windows server, a Linux server. You can have all of the services lit up like a Christmas tree. Just a few handful of, you know, juicy services that a hacker cannot resist. It could be nas, it could be a SCADA device, it could be an Exchange server, a SharePoint server. I mean, there's literally, I think, more than a hundred different configurations. And they're really good. They have the right Mac address. You know, a hacker looking at it is not going to be able to tell. It's funny, Haroun, one of the founders, said they may be suspicious. You know, hackers are a suspicious bunch, but they can't resist because that's what they're there for, is to break into that SharePoint server or that Windows server or that NAS and get the juicy goods in there, right? So if somebody's inside your network with that thing's Canary, they're going to see that and they're going to say, I got to attack it. I got to at least try to log into it, right? You can also use your things Canary to create lure files. They look like regular files, documents or spreadsheets or I mean even things like you can make a wire guard configuration. See a bad guy seeing that would go, oh, I want that, because now I can get into their wire guarded, proxied stuff and things like that, right? But even though they look exactly like all of those things, they're not. The minute A bad guy tries to open that file or tries to log into your fake SSH server, you're going to get an alert. No false alerts either, just the alerts that matter in any way you want it. Email, syslog, they have web hooks. It could be through Slack, it could. I mean, just text messages or all of the above. So it's very simple. You choose a profile for your ThinkScanary device. You register it with the hosted console for monitoring and notifications. You spread some of those lore files around. You can even put them on your cloud, which will let you know, somebody's in my Google Drive, for instance, because nobody should be accessing that file. Then you sit back and wait. Attackers who've breached your network, malicious insiders, evil maids. Any adversary will inevitably make themselves known just by accessing the Things Canary. And then you got them. Visit Canary Tools twit. For just 7,500 bucks a year, you can get five things canary. You also get your own hosted console. For that price you get upgrades, you get support, you get maintenance, or. Oh, one more thing I should tell you. If you use the code Twit Twit in the how did you hear about us? Box, you're also going to get 10% off. And it's not just for the first year. It's for as long as you have your things Canaries, you can always return your Things Canary. They have a very generous 60 day money back guarantee and that's for a full refund. You get it all back. I should also tell you, in the 10 years that we have been talking about the Things Canary and offered that guarantee, no one has ever claimed it. Go to canary tools/twit. Enter the code TWIT in the how did you hear about us? Box. 10% off. You need this thing Canary Tools slash Twit. And we thank him so much for their support of Steve's good works here that he's doing at security now.

[Steve Gibson]

Okay, so what we have underneath this because Coffee is life title, which it is, is a. Is. Is a sign that someone took a picture of, which describes itself as the. It's wonderful. The. No. The. The. The no nonsense coffee guide.

[Leo Laporte]

This is like on a chalkboard outside a coffee shop.

[Steve Gibson]

Yes, exactly. This is like. Okay, so it, it, it shows on the left are the, the fancy, you know, French or Italian terms for some random yuppie coffee. And then in the right is the equivalent. So we have the Americano, which has been crossed out and then at next to it says black coffee, flat white, crossed out white coffee. Cappuccino crossed out frothy copy coffee.

[Leo Laporte]

Good, good, good.

[Steve Gibson]

Latte, milky coffee, espresso, miniature coffee, macchiato, milk topped coffee.

[Leo Laporte]

Yeah, just a little tap.

[Steve Gibson]

Yeah. Mocha, Chalky coffee.

[Leo Laporte]

C H O, C C. Yes, Chalky, yes.

[Steve Gibson]

Tea not coffee. And hot chocolate. Still not coffee.

[Leo Laporte]

Oh, I want to go to this place. Oh, that is so true.

[Steve Gibson]

Yes. It's just like. And we'll give you your milky coffee Gibson. That's right.

[Leo Laporte]

No AI here that. Somebody hand wrote that one on a chocolate. That's for sure.

[Steve Gibson]

So. And I noticed down there's a. There's a pound sign. It says Pub on the hoe.

[Leo Laporte]

Ho must be the name of the place.

[Steve Gibson]

That's my guess. Yeah, some farm, Some farm theme somewhere.

[Leo Laporte]

Oh, that kind of hoe. Okay. Farm implement. Yes, that's right.

[Steve Gibson]

So it's difficult to know exactly what's going on with our prolific and talented. There's no. No discounting that.

[Leo Laporte]

Oh, it's in the United Kingdom in Plymouth. Ah, the Pub on the Hoe I have found exists.

[Steve Gibson]

And they have a no nonsense coffee sign.

[Leo Laporte]

I love it. Sorry, go ahead.

[Steve Gibson]

Yeah, so it's difficult to know exactly what's going on with our prolific and there's no discounting it. Talented Microsoft taunting hacker who calls him or herself Nightmare Eclipse. Remember seven months ago, who this hacker who's given us a run of zero days. They warned that a quote, bone crushing vulnerability and exploit proof of concept would be disclosed this month, presumably timed as they have all previously been, to maximize their unpatched exposure interval by landing them on successive months patch Tuesdays. And we talked, we said last Tuesday on patch Tuesday. Well, hello, where is this? We did, however, indeed get another one last Tuesday. Though it falls far short of bone crushing, I'm not even sure it would be considered bone chipping. It will certainly be Microsoft annoying, however. But it's probably also Microsoft relieving since it amounts to a rather limited use elevation of privilege, vulnerability and exploit. Nightmare Eclipse gave this zero day the name Legacy Hive. Hive is what the Windows Registry blobs are called. You know, it's this hive and that hive. So the hacker called this Legacy Hive. And with limitations it allows attackers to escalate their privileges on currently like fully patched Windows systems right up to date. But then here's where things get weird. Nightmare Eclipse claims that they deliberately toned down the proof of concept to make it less annoying for Microsoft.

[Leo Laporte]

Okay.

[Steve Gibson]

The story is that while it exploits a security vulnerability in the Windows profile service, it's been Modified to require a. That is, the proof of concept has been modified to require a standard user's credentials and another username like an admin account name in order to make its exploitation more difficult for attackers to weaponize. And what I find suspicious about this is this does not sound like the Nightmare Eclipse. I mean, what's. It's not such a nightmare, right? So if this is true, which I actually, I think I tend to doubt, it would appear to represent a change of heart, you know, like a capitulation on Nightmare Eclipse's part. And I wonder if it could be the result of Microsoft's saber rattling getting a little, you know, hitting a little too close to home. The hacker wrote, quote, the proof of concept requires another standard user's credentials and a third username which can be an admin account. If the proof of concept is successful, it will end up mounting the target user hive in the current user classes root. The proof of concept was stripped down as an attempt, get this. The proof of concept was stripped down as an attempt to prevent public exploitation. The original proof of concept did not require additional user credential and was not limited to user class dat hive. Any hive could be loaded using this vulnerability. But you would need some brain cells to make the proof of concept do it. Okay, so the industry security researchers were quick to confirm the vulnerabilities. Proof of concept, that is. It did. It works. It does what they say. And Microsoft replied with their standard uninteresting bureaucratic boilerplate, you know, which we've seen every time before. So we can now add Legacy Hive, this latest one to Rogue Planet Blue Hammer, Red Sun, Yellow Key Green Plasma, Mini Plasma and Undefend, all of which Microsoft has patched the month following or sooner and many of which were seen being quickly taken up and used by real attackers to actually injure real Windows users and their networks. So maybe there's some guilt on, on Nightmare Eclipse's part. Maybe that's the reason, you know, the real injury that this hacker was causing to innocent Windows users that they decided to make the vulnerability less easy to quickly abuse. On the other hand, maybe they couldn't make it stronger. You know, I, I have no basis for that speculation beyond I guess my just my faith in human morality since, you know, this, this campaign that Nightmare Eclipse has been waging has, was also really hurting Windows users. So anyway, it's unclear whether this is the bone crushing exploit that Nightmare Eclipse promised. It would be really bad if it were possible to arbitrarily load various registry hives like into different user profiles that could be used for all kinds of problems, especially in any kind of a server scenario where it could be devastating if the restrictions on the use of its proof of concept were lifted. So that, you know, as I said, Windows Registry Hive remapping could be performed without any a priori knowledge of the victim's system, then that would have been a real bone crusher. So on the other hand, we've previously seen Nightmare Eclipse clearly and deliberately exaggerating their capabilities in the past, you know, referring to that them saying, oh you there, there's a way to bypass the pin on the BitLocker bypass exploit. We know now there was no way to do that. So that was an exaggeration. Maybe this is that too. Microsoft knows because they'll see what the problem is to that this represents when they go about fixing it and see whether or not it actually could have been a lot worse had the hacker wanted it to be. But in any event, no bones were crushed or chipped or very much disturbed this month. So. And apparently it's just not easy to get the proof of concept to do anything very significant. So are they done? Are we going to see something next month? I guess we'll need to stay tuned. But speaking of this month and next month, last week we were only able to touch on the release of July's Microsoft patches since they occurred as we were recording the podcast. And Leo, you were able to give us the overview of. Yeah, 573 of zero days among them. So scanning down the seemingly endless and astonishing list of security vulnerab. I mean really consider scrolling your browser down.570 individually enumerated and described problems, bugs, security, you know, vulnerabilities that were fixed. It, it really is something to see. So it occurred to me that now we would not only need AI to find those, we would be needing an AI to help us keep track of them because wow, I mean it is astonishing. There's almost too much to cover here in detail and I'm not going to try, but I want to sort of hit the highlights here. Among the record breaking by a large margin, 570 security vulnerabilities. 59 of those 570 were rated critical. They're given critical ratings by Microsoft. 48 of those 59 allowed for remote code execution. So we had in one month, 48 of the 59, 48 critical out of a total of 59 critical were remote code execution vulnerabilities out of a total of 570. So more than one in ten another nine broke out of Windows privilege management to allow attackers to obtain system privileges overall independent of the ranking of the vulnerabilities. You know, like critical moderate information, so forth. 145 of the 570, which puts it at more than 25% overall enabled remote code execution one way or the other. So there were so 48 were critical RCEs, but the balance to bring the total to 145 remote code executions one way or the other and also 254 bringing it to 45% of those 550 total were privilege of elevation. Privilege elevation attacks that would allow an attacker who had obtained a minimum foothold in a system to bump up their privileges to full root system access, which they pretty much need to do in order to do anything extra nasty and also in order to obtain long term access to the system. So it seems to me that the one thing Microsoft is not doing based on what we're seeing, is restricting their rate of discovery and disclosure. They're not like dribbling these out. Each of the past three months has broken their all time previous security vulnerability patch record and each time by a significant and significantly growing measure. So it's accelerating in addition to being continually record breaking. So this makes me extremely interested. I mean I cannot wait to see what next month will look like. And I, and I heard you saying, I think it was on the, on your Sunday podcast you, you mentioned to the two co hosts with you Leo, that I had been expecting that we would see increasing numbers of patches followed by decreasing numbers of patches as they're see as, as the available pool of things to fix dry up. Inevitably that's going to happen.

[Leo Laporte]

I've been raising that with everybody that Steve Gibson says eventually we'll get to, I don't know if we get zero, but we'll get to fewer, far fewer.

[Steve Gibson]

Well, the thing that they missed that I'm factoring in also is that AI will be in the, the code design path in the future, I expect. I mean there's no reason to release a bug that your AI is able to find later. Why not find it first? I mean find it pre release, right? That's the other thing that's going to happen. It's the reason I think we're going to be dropping, if not to zero, to like a whole different level. So low that things like pwn to own and HackerOne and bounties and so forth, they're just going to go away.

[Leo Laporte]

Because I think that could happen very soon, to be honest.

[Steve Gibson]

Yes, yes.

[Leo Laporte]

And you Know, I think that's part of the development cycle now. It is certainly when I'm developing with Vibe coding, why inevitably I do a security audit as I'm going, let alone at the end.

[Steve Gibson]

I mean it must be that Microsoft is already using AI to write code. Why, why, why would they be lagging there?

[Leo Laporte]

Right? I would, I mean goodness. Yes. So, and it catches all the obvious things. You know, the buffer overflows, the writing ring zero, all this maybe what I said on Sunday, you know, Rowhammer isn't going to go away probably right. That kind of, it can't.

[Steve Gibson]

Yes. Not all security problems are code errors.

[Leo Laporte]

Right. You can micro code will be better. So maybe you won't have those kinds of, you know, pipeline errors where it's

[Steve Gibson]

like well, but you could still have an open port, you still have a dumb, a dumb password.

[Leo Laporte]

Exactly. Nobody's going to stop that. No, that's forever.

[Steve Gibson]

One whole big class of problems is probably going to go away and I think it's going to pro at the rate we're seeing this being jumped on again. I'm just, I can't, I am so excited to see what, what happens next month with Patch Tuesday because and I should also mention it's not just Microsoft. All the big publishers are seeing in fact Adobe has switched to twice a month updates because they've, they're just their run rate of patches, they're, they are patching so much now that they thought okay, we can't wait another three weeks after finding a problem. We need to wait one week and do a mid month patch. So we're going to see this industry getting cleaned up pretty quickly. On the other hand, there may be also that unfortunate haves and have nots bifurcation where the big publishers, the Adobes, the Microsofts, the Oracles, the big guys, Apple also certainly who are able to just dump all this excess cash they have into token purchasing. They have the ability to do this. Smaller publishers may not. Although I just saw Synology updated my boxes for an AI discovered problem that it had. So even the smaller guys are saying hey let's why not you spend some money on some tokens and make our product better. So wow. The, the, the, the shape of this patch curve is really going to be interesting. My guess is we may see fewer next month. I don't know.

[Leo Laporte]

I, I, that'll be interesting if just, I mean, I think you're right. The velocity will certainly go down.

[Steve Gibson]

Yeah.

[Leo Laporte]

I mean nobody would deny that. It's just the, at what rate?

[Steve Gibson]

Right.

[Leo Laporte]

And to what Final resting point.

[Steve Gibson]

Exactly.

[Leo Laporte]

Yeah.

[Steve Gibson]

Okay, so Hollow Bite is the name that Okta gave to their discovery of a very worrisome denial of service that exists in open ssl. Any problems discovered in the massively used. I mean, like, it's, I mean, it's hard to describe how wide widespread the use of open SSL is. There are, you know, certainly private TCP IP stacks. Windows has one, Apple has their own. But like anything that wants to create a TLS connection now, which is some, some embedded device or a widget or whatever, it's got open ssl. Now there are, we've talked about, there are some embedded TLS libraries that, that are used by, at, at the, you know, really small embedded level. But OpenSSL as we know, we've been talking about it for decades, you know, is what you use, Apache uses it, nginx, web servers use open SSL. The runtime libraries like Node JS, Python, Ruby, PHP, MySQL they're all using open SSL. So because open SSL is widely used and embedded, this vulnerability affects all of these systems. So Okta discovered a means force. And it's really sad that actually, because it's so simple. It's like really, guys, this is, this is still a vulnerability today for sending just 11 bytes of TLS data to any unpatched open SSL endpoint. You know, meaning all of those servers that I mentioned and the various application libraries to cause the connection to over allocate a memory buffer in anticipation of receiving the remainder of the declared incoming data. So once again, this is why I'm sort of disappointed in this problem. So it's one of those where the header declares how much data follows and then it doesn't. But because the header is parsed first the library says, oh, here comes 128k of data. So it pre allocates a buffer to contain the data, which then never arrives. It's like, guys, how really in this day and age that's, you're still coming across those kinds of problems anyway by doing that over and over and over, making a connection, sending 11 bytes, an attacker using very few resources at their end, meaning you don't need lots of servers and lots of bandwidth or anything. You know, some random proxy that exists in some guys, you know, LG TV that's got taken over can bring down a major service. Okta provided some background and color which I want to share. They wrote. Every so often a vulnerability reminds us how deeply our digital infrastructure relies on foundational libraries. Recently the Okta Red team discovered Holobyte a denial of service Vulnerability in open SSL by sending a malicious payload of just 11 bytes, any remote unauthenticated attacker can force a server to allocate disproportionate chunks of memory before any security handshake even begins. The TLS handshake begins with a client hello message wrapped in a record. Each TLS handshake message begins with a four byte header that declares how large the incoming message body will be. Existing versions of OpenSSL allocate a receive buffer based on that attacker declared length before any data has actually arrived. Like I said, really? In this day and age, we're still doing that. When the malicious 11 byte payload arrives, the TLS state machine reads the 4 byte handshake header and triggers an unvalidated pre allocation based on the header's three byte length declaration. Because there's no payload validation at this early stage, the system's mallo the memory allocator allocates up to 131k. As I said, 128k binary based solely on the untrusted packets claim. The worker thread then blocks, waiting indefinitely for the data that will never arrive. Holding connections open to exhaust threads is a classic trick like slow loris that we talked about years ago. Holobyte introduces a far nastier compounding effect due to how the GNU C library glibc handles memory. When an attacking connection drops open, SSL frees and releases the buffer. However, glibc does not immediately return small to medium size, which 128k is considered allocations back to the operating system. It retains them for potential reuse. Therefore, by launching waves of connections with randomized claimed sizes, meaning that they're not going to be reused perfectly, an attacker prevents the allocator from reusing the those freed chunks. This fragments the system's memory allocation heap heavily, causing the server's resident set size to climb continuously. Even after the attacker disconnects, the server remains permanently bloated. The only way to reclaim that memory is to terminate the process. You know, shut down the web server or whatever services you using open SSL frequently it just means having to reboot the system. You've. You've killed that service, they said. To measure the threat, we tested unpatched and patched open ssl instances running nginx under various load conditions. In a standard 1 gig of RAM environment, an unpatched server was out of memory, killed at 547 megabytes of frozen fragmented memory. In higher spec testing with, for example a 16 gigabyte RAM allocation. The memory successfully locked up 25% of the system's total memory while staying safely under the connection ceiling limits, meaning standard connection limiting defenses won't stop it. The open SSL team resolved this by switching wait for it to an incremental buffer growth strategy. What a concept. What a concept. Leo. You mean you actually don't allocate memory until you get something to put in there?

[Leo Laporte]

That's amazing. Who'd have thought of that?

[Steve Gibson]

Wow. This fix was silently included as part of OpenSSL version 4.0.1 release, with silent back ports to release 363-3-57346 and 3021. Under this revised memory allocation strategy, rather than trusting the header's claims outright, OpenSSL now grows the buffer only as bytes are actually received over the wire. Wow. A breakthrough. A claim which with no follow through, now costs the server nothing. Even though Open SSL handled this as a hardening fix rather than a CVE security advisory, we recommend upgrading your distributions open SSL packages immediately and I'll just put a big amen on that. I went over to the open SSL repository and saw that open all of those stated versions were updated more than five weeks ago. This ha. This occurred on June 9th. So this would have meant that all of the various dependent packages Apache, nginx, Node js, Python, Ruby, PHP and so forth would have needed to incorporate that update into their own builds and then make those available. Then any public exposure of them would need to be updated and relaunched. Now the problem we always have is that those are only the most well known, prominent and you know, obvious users of open ssl. It is doubtless used in countless other systems. For example, I was secure, I was curious about my own fully patched and and up to date Synology, nas. So I SSH into it and issued the command open SSL space version and I was promptly informed. Openssl1.1.1.u which was dated 30-05-2023. Since I follow my own advice, my own residential network has exactly zero open ports. To the outside world, you just can't have any. And here's a perfect example of why this was not a problem anybody knew about. They silently patched it and pushed the updates out. You know, even downplaying it as some hardening rather than giving it a CVE that would have brought it to the attention of the bad guys because they know that how bad this is. I mean this lets you crash and and freeze and lock up any open SSL receiving service. So for Random end users. I. I would say it's unlikely to be much of a problem. It's not going to be the end of the world. But the chances are very good that most, if not every single piece of enterprise border equipment is also based on a version of open ssl, which was published more than five weeks ago. So unless you have, unless your vendor has updated and pushed and made available updates, and hopefully you didn't wait because you shouldn't these days to update your appliance, if any of that did not happen within five weeks, then that's the systems you're using can probably be brought to their knees again. Doesn't let the bad guys in, but it lets them shut down your network. So although Okta didn't disclose whether this newly disclosed vulnerability was found through the use of AI, it is exactly the problem that the entire industry will now be facing. As I've noted, our browsers and operating systems have already developed quite mature systems for keeping themselves up to date. But many network appliances have not seen the need to do the same. Difficult to get a device, which isn't asking if there's anything new for it to suddenly start doing that. So in the intermediate term, there's probably going to be a flood of newly discovered vulnerabilities and updates which, you know, users of these systems need to be staying current with things exactly like this that need to get fixed and who knows what else we're going to be seeing in the short term. Yikes. What I do know, Leo, we're going

[Leo Laporte]

to be Coffee is life. Cheers. While Steve and I are imbibing our caffeinated beverages, I might want to tell you about our sponsor for this segment of security now, Zscaler, the world's largest cloud security platform. The potential rewards of AI in your business are, you know, too great to ignore, but it's prudent and Steve's going to talk about this in a second to remember there are risks. There are risks, including the loss of sensitive data and attacks against enterprise managed AI. And of course the bad guys love generative AI. It increases their opportunities to rapidly create phishing lures to write malicious code to automate data extraction. And as we will soon learn even more, there were 1.33. I'll give you an example. 1.3 million instances of Social Security numbers leaked to AI applications. And probably that was, with all best intentions, inadvertent, right? I mean, I, I just told you that I had to redact all my socials and private personal information from my tax returns because I Wanted my AI to analyze them. Well, are your employees, and I think this happens all the time. I just read an article that said employees are often using their own personal AI accounts because they've run out of tokens or it's easier at work. How often does the employee say, you know, let's analyze these tax returns, upload the tax returns and forget that that's got all your Social Security number, your ein, whatever it is you use at work. And they're just giving that, you know, to some server somewhere. You gotta, you gotta rethink your organization's safe use of public and private AI. You want to use it, I admit, I know, but you also want to really think about how to lock it down. Well, that's what Chad Pallet was thinking about. He's the acting CISO at BioIVT and he says Zscaler helped them reduce their cyber premiums. Get this, by 50% at the same time as they doubled their coverage and improved their controls. Let Chad explain. With Zscaler, as long as you've got Internet, you're good to go. A big part of the reason that

[Steve Gibson]

we moved to a consolidated solution away from sd, WAN and VPN is to

[Leo Laporte]

eliminate that lateral opportunity that people had

[Steve Gibson]

and that opportunity for misdirection or open access to the network. It also was an opportunity for us to maintain and provide our remote users with a cafe style environment.

[Leo Laporte]

Thank you, Chad. With Zscaler Zero Trust plus AI you can safely adopt generative AI and private AI to boost productivity across your business because you're protected. Their Zero Trust architecture plus AI helps you reduce the risks of AI related data loss and protects against those enhanced AI attacks to guarantee greater productivity and compliance. Learn [e-mail] security that's zscaler.com security we have gone back to Steve Gibson and his empty chair. Let's look at his books. Bookshelf. The Linux programming interface. There's JavaScript up there with the Rhino cover. Oh, Windows secrets. That's good. Python plus JavaScript. Look at the thick one there. I think the Rhino one might be JavaScript. The good parts. That's a skinny little book. And then there's the JavaScript. Everything you need to know. That's about 8 inches thick. There's the blinking lights, the speak and spell. Long gone. In fact, you should enjoy this vision of Steve's studio because it isn't going to be here much longer. He's going to move to his new studio and we will no longer see the blinking. Well, you'll bring the Blinking lights with you. I hope. Lori might not let you.

[Steve Gibson]

It's gonna be a whole different look, okay? Different look.

[Leo Laporte]

You want me to send my lighting designer your way?

[Steve Gibson]

No.

[Leo Laporte]

No. Okay. He doesn't care. It's all I can do to get him to shave before the show, kids.

[Steve Gibson]

And I missed it this time. Yeah, I. I realized I.

[Leo Laporte]

Last night I was, well, the grizzled Steve Gibson. That's how we know that he's serious. He cares. All right, let's talk about Claude.

[Steve Gibson]

Okay, so.

[Leo Laporte]

Or as Paul Thurat calls it, Claude crazy.

[Steve Gibson]

One of this podcast's favorite rhetorical questions is what?

[Leo Laporte]

What could possibly go wrong?

[Steve Gibson]

So it's bearing that question in mind that I share this next bit of news that Anthropics Claude AI is now able to access and use it's Mac users passwords stored in their 1Password vault. Which of course then begs the question, our favorite question, what could possibly go wrong? And I'll just note that 1Password is a past sponsor of the Twit Network. Last Thursday, 1Password posted a blog entry with the headline 1Password for Claude. Give Claude access without giving up your credentials. And okay, this is the first of two pieces of news that I want to share. And then we're going to be looking more at AI access to credentials, because this is going to be crucial if you've got agents running around doing stuff on your behalf. Well, they need to be able to look like you and act on your behalf to services that require you to log in. So since this is clearly the future, and I think we're going to be seeing a lot more of this, I wanted to spend some time so 1Password wrote AI agents are moving from helping people think to acting on their behalf in browsers, apps and accounts. That changes the security model. Once an agent can click Buy, update and submit for you, the key question becomes what identity is it acting under and what access should it get? Claude can compare deals, add an item to your cart, update account details, or complete a purchase, but once it reaches a login page, you face a trade off. Do you give the agent your password or stop and do the task yourself? Neither is the future we should build toward. Until now, there's not been a secure, easy way for agents to use credentials without exposing them. 1Password for Claude enables credential access without credential exposure. 1Password for Claude is built on a zero exposure architecture. Claude can complete browser tasks that require logins and one time passcodes, but the credentials never enter the model or its memory. 1Password they wrote, stays the source of truth for the secret, and access is granted only at runtime. When Claude needs to sign in, one password shows the user which credential is being requested and why. After user consented biometric approval, one password injects the credential directly into the page. Claude never sees the vault item password or one time code. Access is scoped to the current task and ends when the task is complete. After autofill, 1Password checks that secrets were not exposed on the page. If submission fails, it clears the filled values before returning control. Nancy Wang Wang1Password CTO said, quote, we need a new security model that is purpose built for agents, not just humans. The answer is not handing agents your secrets. It's to let a user give an agent permission to use a credential without letting the agent see it. Claude knows it used your login. It does not need the password or one time code. In its context, that distinction is where trust in agents starts. And the foundation we're building with anthropic. Okay, so this is not handing over unsupervised 1Password access to Claude. There was, I think it was, maybe it was the Verge that picked this story up, and I saw their coverage of it first, and there were 31. 31 replies by people who apparently didn't actually read. Yeah, the Verge's cover.

[Leo Laporte]

They don't get what's going on. They looked far superior to the way people were doing it, which is storing all that stuff in clear text on the hard drive.

[Steve Gibson]

Exactly. And it was funny because the comments on the Verge's article, I just scanned them because I was curious what people thought of this, was like, oh, hell, hell no. And oh, my God. And. And it's like, yeah, the point is, this has been well thought through. And as you said, and as I said, this is not giving the agent your password in. In clear text. So it's deliberately blinding Claude to the credentials needed to log in to whatever, some online service where it will then be operating with some autonomy. You know, essentially Claude is saying, hey, could you please log me into Expedia or whatever, so that I may proceed to do what you have asked me to do. And in reply to this, 1, Password's new system pops up a dialogue, asking the user to, on the fly, interactively authorize this login so that Claude may proceed. You know, and this is a Mac, apparently. So in the example, the user places their finger on Apple's Touch ID sensor, or, you know, if it's using face id, smiles at the camera and. And Then that that authorizes one password to perform this in a blinded way on, on the user and Claude's behalf. So Claude is kept on a leash and is able to work without exposing the user's credentials. I'm sure it would be worth remembering that most of us remain persistently logged into many of the online services we routinely use and visit. So if our AI agent is driving our web browser, it presumably obtains the same persistently logged on privileges which we enjoy. In other words, you know, we do still need to be careful since it can still do everything we would be able to do if it did not require us to log in freshly. Maybe if this was a concern for people, it might make sense to have such an agent using a different browser, that is that does not share cookies with the browser that you normally use. You know, effectively give it its own browser whose cookies had been pre wiped so that there were no persistent logons available to that requiring you then to be asked every time that the agent wants to do something. Anyway. 1Password provided a couple of what this looks like in practice. Examples for, for everyday AI users, they wrote, your audible credits are about to expire. Instead of logging in, navigating to the store, navigating in the store and then manually redeeming a credit, you ask Claude to review your wish list and choose a new title for you. Claude navigates to the site. You provide approval for Claude to use the credential from your vault. 1Password provides the login and the audiobook lands in your library. You never typed a password or one time token and Claude never sees either. What's funny, Leo? I heard.

[Leo Laporte]

Oh, I'm just saying that's a silly use, but okay, if that's what you want.

[Steve Gibson]

Okay, yeah, yeah. I mean, and then they're, they're like, it makes sense.

[Leo Laporte]

Get me the book. Yeah, buy me the book.

[Steve Gibson]

Their example for business use is a small business owner could ask Claude for a stripe revenue summary or to flag any unusual activity. Claude can navigate the dashboard. The business owner approves Claude to use their stripe login details. 1Password can handle the credential in the 1Time code and the business owner receives the answer without going through the multi factor authentication or exposing the secret to Claude. So they said these are just two examples. The same pattern works across the sites where Claude in Chrome can take action. If the credentials are stored in 1Password, Claude could use them. You approve, 1Password supplies the credential and Claude finishes the job. Even when the task changes, the access model stays the same and your credentials Never leave one password. And Leo, you know, I don't think there's any danger in this podcast running out of things to talk about because all of this is going to go so wrong.

[Leo Laporte]

That's true, but it's something you need to solve and this is the problem. I mean, there's really no great way to do this. As Paul points out in our Discord Chat, if the AI has a credential, then you're just one prompt injecting, step away from it. Giving the credential to a bad guy.

[Steve Gibson]

Exactly.

[Leo Laporte]

But it needs the credential. It's the same problem the DVDs had with the CSS key. It had to be in memory on the DVD player. That's why a high school student was able to crack the CSS key on the DCSS key on the DVDs in about an hour, because he said, oh, it's going to be in memory. I just have to find the memory. And now I've got the key. So, yeah, it's. I have, you know, I use Bitwarden to do this. I've gone through a bunch of different processes. You try to lock it down as best you can. The best way would be if you, If I. If I think about it, you tell me if I'm wrong. And there are services that do. This is a one time token that is revocable and is only usable once. That's what you hand to the AI to then access the service. But of course, the service would have to support that as well, and.

[Steve Gibson]

Right. Essentially we've stumbled into the need for a new security model. Some means for allowing autonomous agents.

[Leo Laporte]

Would pass keys or squirrel be a good solution? No,

[Steve Gibson]

those are just less hackable traditional models.

[Leo Laporte]

But there's still a secret. And if the secret is gets handed off, your sol. What. What Darren's pointing out is really true is that nobody who uses these things wants to be stuck at the keyboard typing in passwords at any point.

[Steve Gibson]

Right.

[Leo Laporte]

Or giving confirmation or saying.

[Steve Gibson]

Or even having to keep their finger on the touch ID button in order to say yes, yes, yes, yes, yes, yes, yes, yes.

[Leo Laporte]

I frequently am using my AI here, up in the attic, off site or downstairs. I don't want to have to run upstairs and touch the keypad. Yeah, but that is more secure. If I do. I don't know what the answer is. I hope you come up with something for us.

[Steve Gibson]

They then address the need for a. What they call, well, what we all call agentic mode. And they explain agentic mode protecting the vault. When an agent Controls the browser, so they write One Password writes. There's a second problem. What happens when a browser based agent takes control of a browser where 1Password is installed without proper guardrails? The agent could try to interact with the extension itself, right? I mean, like it's acting as the user. So 1Password doesn't know the difference. Agentic mode is how we close that gap. Agentic mode is a new feature in the 1Password browser extension that gives every user visibility and control over browser based AI agents. When a comparable. Sorry. When a compatible AI agent takes over, the 1Password extension automatically locks down, the interface is hidden, and the agent can only use the logins and one time codes explicitly approved for for the current task. The rest of the vault stays out of reach. Agentic mode works even if the integration is not set up and even if one Password is not required for the current agentic task. It also supports additional agents beyond claude. For example, I'm sorry, for qualifying enterprises, there's nothing new to configure. Employees using One Password for work credentials automatically get the same protection. Every credential request from an AI agent is visible, explicit, and requires authorization. Okay, so this is clearly different and distinct from that previous 1Password for Claude feature. Agentic mode appears to be a recognition of the fact that browser based AI agents will be indistinguishable from their human counterparts to browser extensions. Browser extensions won't be able to tell the difference, including a password manager. So this would mean that unless a password manager proactively determines to what entity it is granting credentials, that is what type of entity, human or not, any browser based AI agent would automatically be granted and would obtain the same benefits and freedoms as that browser's human user. And obviously that could lead to some disaster. 1Password concludes their posting by writing. 1Password for Claude is just one part of the access layer we're building into AI agents across the ecosystem, including securing developer credentials with 1Password MCP server. Whether the agent is working in a browser, IDE, repo terminal, or CICD workflow, the principle is the same. Secrets should be issued at runtime, scoped to the task, and governed from one Password. As agents become more capable, they become a new class of identity they need governed access to, just like humans and machines do. 1Password for Claude applies that model to browser based delegation. Claude can act with explicit user authorization and only gets the access it needs when it needs it. The credential stays encrypted, controlled, and out of the model's context. 1Password for Claude is available now For Mac across business, family and individual plans. To enable this integration, you'll need the 1Password desktop app, the 1Password browser extension, the Claude desktop app, and the Claude in Chrome browser extension. Okay. In other words, at this point, 1Password for Claude is only for Apple Mac and Google Chrome together. But this highlights the dangers inherent in moving control from the user to an AI agent. And, and Leo, I mean, to me, thinking about the. The Paul's comment in the Discord chat, this doesn't really give us what we want, as you said. Right. I mean, we want our agents to be autonomous. We want them to be able to have the freedom to act on our behalf. But boy, is that risky.

[Leo Laporte]

So I'm sure this isn't optimal, but I. Okay, I have Bit Warden, which has integration, by the way, for it. They're the ones that came up with this Agent Secrets ui and I'm about

[Steve Gibson]

to talk about that.

[Leo Laporte]

Yeah, and I don't. I'm not sure if one Password is using it or not. If they did their own thing, Bitwarden opened it up, they made it open so that 1Password could use it.

[Steve Gibson]

Well, Bitwarden is open source, so they

[Leo Laporte]

wanted everybody to use it. I don't know what 1Password is doing. I'm using the bitwarden command line and I have SOPS encrypted the API token and the key. But I was having to enter the Bitwarden password every time I booted up the machine

[Steve Gibson]

in order to unlock that.

[Leo Laporte]

Yeah, of course. This is a SOPS encrypted file. Somebody would have to steal my machine and then find the Age key, which is somewhere else on the hard drive, and then unencrypted. I mean, they could do it. So I just put the Bitward and password in there. I figured, you know, what the heck? So now I don't have to. It's completely. The machine boots up, it gets everything it needs from a. It also gets the SSH password, by the way, from a SOPS encrypted thing. And then it can talk to all the machines. It can do all the things it needs to do. I know it's risky and that's the

[Steve Gibson]

problem is we want that flexibility. And our current security models, architectures weren't built for this. And so they're going to be stretched for a while until we figure out what to do.

[Leo Laporte]

There aren't companies that will you give them all your credentials. This is where I stop. But you give them all your credentials and then they become a trusted provider and they give the AI A token. That's a one time use token and it's logged so they know how it was used. The AI then has to go through this provider which then gives the password to audible or whatever.

[Steve Gibson]

So there's a gatekeeper.

[Leo Laporte]

There's a gatekeeper. In order to do that you have to give the gatekeeper all the passwords.

[Steve Gibson]

Yep.

[Leo Laporte]

Or tokens or whatever secrets you have. So they have your secrets, you've got to trust them. But then they don't live anywhere on the machine, so. And you have logging and it's a one time password and all that. So that might be all right. If you find a third party provider that you trust. This is for enterprise, by the way. That further complicates it because it's just me. What If I had 20 employees who needed this kind of stuff? Then we got another matter. It gets complicated is I guess the answer. Go ahead. I'm sorry. No, just let me know when you solve it, will you?

[Steve Gibson]

That's a, that's a useful discussion. And clearly this company that, that you were referring to, they saw an, an opportunity to, to interpose themselves. I guess what I'm wondering is how does, if, if, if you've told them that you want your agents to have access to a certain set of accounts, how do they then? I mean certainly they can log it, but all they're doing is basically saying yes, yes, yes, go ahead. Whatever the agent wants to do.

[Leo Laporte]

They know your IP address, they know maybe your agent has a secret that it passes on. I mean they're right. There's going to be some authentication for the agent, I'm sure.

[Steve Gibson]

Yeah.

[Leo Laporte]

You know, there's also this OAuth. A lot of agents use OAuth. I use OAuth with Anthropic, with OpenID, with Zai, with a lot of them. So it's storing an oauth token, which I guess if somebody got a hold of that they could use.

[Steve Gibson]

I mean, you know, all the stories we've covered about people losing their cryptocurrency, this feels like that, this feels like we're going to have. So, oh, too bad happened to him, blah blah blah, you know, oh, it's definitely that. And I'll be the one that. Well you, you did have the wisdom to pull back from open claw, like say oh yeah, I don't think that's really what we want.

[Leo Laporte]

I've done everything I can to lock it down without totally inconveniencing myself. I mean, well, I have to enter the password every time you, you live

[Steve Gibson]

Security as a consequence of spending the last two decades with me. But a lot of people don't.

[Leo Laporte]

No, I know.

[Steve Gibson]

I mean, most people, they kind of, oh, yeah, I want to let my agent do whatever it wants. And they. And they just think, well, just let it have my password manager.

[Leo Laporte]

Everything's encrypted. Lux encrypted. File vault encrypted. The Borg backups are encrypted. If you came in here and you took my hard drive, wouldn't be able to see anything on it. I'm just, you know, I'm doing everything you taught me. And I know it's not perfect, but,

[Steve Gibson]

well, and so you're safe, but you're one guy. I'm thinking we're going to see. Oh, yeah, a lot of these. You know, I mean, how many times have we talked about people getting their wallet, their crypto wallets?

[Leo Laporte]

Absolutely.

[Steve Gibson]

Same. I'm not saying that it's. I'm just saying that this feels like the same class of problem. I agree 100% that, like, this is like, yes, it's exciting and it's fun and it can do stuff, but it's going to go off the rails. Okay, let's take a break and then we're going to look at Bitwarden's solution to secure agentic AI access.

[Leo Laporte]

Bitwarden, our sponsor. We do love Bit Warden, and they've been working on this. I know, I talked to them at rsac. They've been trying to solve this too. I mean, this is one of the next big frontiers, frankly, why we're not

[Steve Gibson]

going to be ending this podcast even after all the bugs are fixed. This is not a bug, this is a feature.

[Leo Laporte]

What could possibly go wrong? It's such a good motto. Our show today, brought to you by adaptive. Now, this is something we've talked about, Steve. It's what we talked about at Zero Trust World. The problem's coming from inside the house. ADAPTIVE is the first security awareness program built to stop AI powered social engineering. That really, right now you look at shiny hunters. How do they work social engineering? They trick your employees into giving up the goods. That's a big shift. Attackers don't need malware anymore. They just need trust. And they do it in all sorts of sneaky ways. A cloned voice, a convincing deep fake on a zoom call, an AI written fish that looks like it came from your IT team or the boss. Adaptive is the solution. It prepares your organizations with simulations. And not just email anymore, Right? SMS and even voice. Yes. Adaptive will do deep fakes. They will do vishing, that's voice phishing. They will do AI generated phishing. And they can include scenarios that mirror your own brand and executives. So they can test your employees with a call from the boss that sounds exactly like the boss. And when employees report something suspicious, Adaptive can help you triage it fast so security teams aren't buried in false alarms. If you need training fast with Adaptive's AI content creator, you know, let's say, let's say you just read this morning, oh, here's a new attack, you know, the, the copy click paste thing or what, whatever, you can take that intelligence, that breaking threat. You could take an incident report, a compliance doc and turn it into an interactive multilingual module in minutes. You don't need a design team, you just need Adaptive. With Adaptive, you can build, customize and monitor every part of your training complete personalization. So the result is a more resilient security culture. And that is absolutely essential if you think about it. You know who uses Adaptive? Plaid. Plaid's platform powers thousands of digital finance apps and links. Consumers, developers, institutions. I use Plaid. That's how I hook up my financial app to my financial institutions so they have my secrets with sensitive data at its core, Plaid security and compliance are non negotiable. And I'm glad to hear, hear this. Plaid's head of security, GRC says quote, adaptive has equipped our teams with cutting edge tools and built a smarter, more resilient security culture across the company. That's what you need, right? Trusted by Fortune 500, backed by Nvidia and OpenAI, Adaptive is building the defenses we need for the AI era. Learn more at adaptivesecurity.net that's adaptive security.com we thank him so much for a great tool and for sponsoring Steve's security now. Thank you Steve. And let's again say Bit Warden is a sponsor as you go into this story.

[Steve Gibson]

Yep. So their recent blog posting, Bitwarden's was titled how Bit Warden helps secure agentic AI access to your credentials. And in this they further clarify exactly what we've been talking about. These new challenges which especially enterprises face as autonomous AI agents begin roaming the network. I mean, they've noted that this is already a problem, that there are already employees using what they refer to as shadow AI. Anyway, they said businesses are increasingly pressured by by competitive markets and investors to leverage AI productivity within their processes and operations. According to Cisco, 83% of IT leaders agree that business units are deploying agents faster than security teams can support. Yeah, no kidding. Regardless of the speed at which businesses implement agentic AI. Employees are using agents, often without explicit IT approval and therefore granting unvetted agents access to companies credentials. This phenomenon is known as shadow AI. Without proper security measures, agentic AI can introduce serious vulnerabilities. They list three over scoped access AI agents may access systems, information, credentials and data not explicitly authorized by the company or users. Second problem Unapproved actions Over scoped access and permissions can grant agents the ability to complete unapproved actions, potentially interrupting operations, exposing business information, or damaging the company's reputation. And finally, data leakage Sensitive information like plain text credentials can be shared with an AI provider or who does not have the capabilities to effectively secure this information, leading to a potential data breach. And I'll just pause here to note that the data leakage problem seems particularly significant to me. It's why I'm so biased toward local AI solutions. Somehow you know the Chinese AI models are inexpensive and they are remaining highly competitive. And of course we know that you, Leo, routinely use Chinese supplied AI for much of the work you're doing.

[Leo Laporte]

I'm using it right now because you

[Steve Gibson]

can get good enough work for 1/10 the token cost of domestic models. And I don't know whether we were speaking of it during the podcast at the top of the podcast, but just last Friday the Chinese company Moonshot released their Kimi K3 open source model or open Weight model, which stunned the world again, very much the way Deepseek had previously done. So independent analysis places the Kimi K3 very close, certainly on a par with some of the frontier models from anthropic and OpenAI. Okay, so here's the problem. For an AI agent to use credentials, they must be, as you said, Leo, in plain text at the time of the agent's use, since the AI agent is standing in for the human whose work it's doing. But there's a massive security disparity here. In the human user case, the plaintext credential is stored locally and remains local while it passes through the human user to the credential verifier wherever you're logging in or proving who you are to some online trans network system. But this is not the case when the credential user is an AI agent powered by a data center in Shanghai, China. In order to be used by the AI, it must pass through, I.e. the credential must pass through that China resident agent. This requires that the credential visits China as plain text, if only transiently. So the overarching security issue here is that all of the credential management systems we've carefully designed and implemented for use by trusted humans must now be adapted for use by untrusted AI agents. This would be like preventing a human user from having any access to their own credentials. We'd be saying we'll log you into that service on your behalf, but at no point will you be able to access or alter your own credentials in any way, you know, blinding the users to their access to their own credentials. So you know, think about that for a second. What's required is that we separate the and this is new separate the use of credential gated systems from any management of those systems credentials. Nearly all of today's services freely intermix the services use with its credential management because the assumption is that the user can be trusted to manage their own credentials. But the use of AI agents means that will no longer be true. And that's a complete change in the security model that we've been using up until now. So Bitwarden's blog posting continues. They write what companies and organizations need. Organizations need a way to benefit from AI agent productivity while protecting sensitive company information from data leaks and business ecosystems from unauthorized access. Bitwarden delivers security solutions that empower businesses and individuals with end to end encrypted credential access across human, machine and non human identities like AI agents. And they list four things that they've created. The Bit Warden now has there's Bit Warden Secrets Manager which provision AI agent access to predetermined development secrets to use in scripts and CICD pipelines. Then there's Bit Warden Access Intelligence which uncovers shadow AI identify They described it as identify AI applications being used within the organization and by whom. The third is Agent Access SDK which I think is what you were talking about LEO Enable Just in time Human in the loop Credential access to approved agents with this development toolkit. And then finally Bit Wardens MCP server access Generate, retrieve and manage passwords via self hosted AI assistance while maintaining zero knowledge encryption. And the blog post goes into and discusses the need for and the solution provided by each one of those four things. Their Secrets Manager, their access intelligence for uncovering shadow AI use for corporate secrets Their Agent Access SDK and their MCP server. I've got a link in the show notes for anyone who might be, you know, staring at these problems themselves and wondering what to do. So Bit Warden covers all that and and notes that they it's all open source and for business enterprise users where it's not free. They've got very good control over the. The way it is expensed.

[Leo Laporte]

Yeah. So this is, by the way, Casey is who I interviewed at rsa. Casey Babcock, the author. She's the product manager for this. Yeah.

[Steve Gibson]

So what these blog posts, both by 1Password and bid Warden, make very clear, I think, is that in order for AI agents to accomplish work on behalf of their users, today's security architectures require that those agents be given the same credentials that their users have been entrusted with. And that is a security disaster waiting to happen. We need a new way to manage this. And I mean, it's a bit of a conundrum, right, because we're, we're wanting to, in order to get the value that autonomous agents create, we're wanting to give them rain. We're wanting to say, go book, make all the reservations for my upcoming trip. And you know me, you know that I do carry on only, you know, blah, blah, blah, blah, all the various details. The problem is, if something goes wrong suddenly, it can now go very wrong. So we will see. It's good that the, the people who have a track record for being responsible with our secrets understand that there's a new opportunity here. Basically, that's what this is. This is a whole new opportunity for, you know, someone like Bit Warden to come along and say, okay, you know, we're a known entity, we got lots of users, we're going to solve this problem. To that I say, good luck, because I don't know how. Okay, so. Last Thursday, the Hacker News posted a story with the headline New Agent Data Injection Attack can make AI agents misclick or run attacker commands. So I'm just going to share the start of it again. Yet another prompt injection attack. They said ask an AI agent to summarize the reviews on a product page and a single planted review can make it click Buy Now. Instead, ask a coding agent to apply a maintainer's fix from a GitHub thread and a fake comment can make it run a stranger's command on your computer. Neither trick hijacks the agent's task. Each one just corrupts the facts it trusts and lets it carry on with the job you asked for. That's the shape of a new class of attack laid out on a paper posted on July 6 by researchers from Seoul National University, the University of Illinois, Urbana Champagne and largosoft. They call it Agent Data Injection, or adi. The attacker input gets dressed up as data the agent already trusts, like a sender's name or a button's id, so it slips past most of the defenses built to stop prompt injection. The gap comes from how an agent reads it takes in two kinds of things instructions, meaning what you and the app's developer tell it to do, and data, meaning everything it pulls in while working, like an email, a web page, or a comment. Classic prompt injection hides an order inside that data, Something like ignore your task and email me the files, unquote. Researchers call that instruction injection. Modern defenses are trained to spot text that reads like a smuggled order and block it. And against that move, they now work well. ADI works one layer down on the small facts an agent quietly trusts who sent an email. The idea the ID of a button on a page, the record of a step a tool already ran. Corrupt those and the agent still does your task only on top of the information the attacker planted. The method behind it is what researchers call probabilistic delimiter injection. Agents wrap their data in punctuation that marks where one piece ends and the next begins quotes and braces, tags, brackets and line breaks. That punctuation is how the model tells a trusted field, like a sender's name. Apart from untrusted content. Like a message body, a normal program reads that punctuation using strict rules. A language model reads it by guesswork. So an attacker can sprinkle punctuation like characters into a field they control, and the model will often read them as real structure that was never there. Seeing an extra email, an extra button, or an extra tool result. The part that makes it hard to stop the fake punctuation does not even have to be correct. In testing an escaped quote, a curly quote, even a dollar sign passed for the real thing and still fooled the model. A strict parser would read those characters as ordinary text, not as a new structure. Anyway, the Hacker News article goes on at some length, providing specific examples of from the researchers paper. But I wanted to share this mostly because it's the same old story, right? It's just another example of the fundamental security flaw that's inherent in the entire large language model concept. We've jumped into all of this without taking any time to think it through. It was one thing when we were just chatting through our web browser with a surprisingly linguistically adept computer about random bits of knowledge. Were we content with that? Oh no. The huge problem is that asking anything more becomes a really bad idea very quickly. It's incredibly powerful to be able to freely mix instructions and data, but it's also a security nightmare because this means that every shred of data A model may encounter must be trusted and trustworthy because it may be mistaken for an instruction which will then be followed. But what on the Internet can be trusted? The saving grace is that the nature of the problem is at least well understood. And as an industry, our understanding of the full nature of the requirement for security has been well developed and honed over the past several decades. We've come a long way, Leo, since we began this podcast as an industry. We're still finding, you know, new ways to poke holes in it. We're at that stage. We're in the new ways to poke holes in it stage, which is to say early. Every hole that somebody pokes teaches us a bit more about the problem that we're facing. My intuition suggests that the cost of truly securing this technology is going to be extremely high, since everything about the way it wants to operate is insecure. So it's not about creating security problems. I mean, it's riddled with them. It's about finding and stopping each and every one of them. Which brings me back to expecting a future where not all AI is similarly secure. Someday it will be trivial to produce an AI to use an AI without guardrails. And, you know, we can today, apparently it's very simple to take one of the open weight models and massage it a little bit in order to completely loosen and discard the guard rails, such as they are, that have put in play, been put in place for an OpenAI model. So, you know, a local AI, an AI without guardrails will be extremely useful. But as we've seen, it will be. You will need to use it with extreme caution because it will be so easily subjugated by any data that it ingests, which it trusts and. And should not. So, you know, I still shake my head to realize that, like, we're even talking about things like this, Leo, and that they're true, that this is not science fiction. I'm still dizzy by this. It's just. It is. I don't all. The only word we really have is revolution, but it really is a revolution.

[Leo Laporte]

It seems like so recently, and actually it was so recently that I even was skeptical. I said, oh, it's just, you know, it's autocorrect. It's just spicy autocorrect. And it ain't. I mean, it is, but it isn't.

[Steve Gibson]

Fortunately, apparently we still have Paris to keep our feet on the ground.

[Leo Laporte]

Yes, thank God she didn't let me get away with anything. But I like that. It's good because to challenge you we should be skeptical of this, right? And it's very easy. You know, humans are easily fooled by magic tricks. I don't, I don't want to be fooled by a magic trick. It doesn't feel like a magic trick.

[Steve Gibson]

But you know, you know. And a couple years ago, the first contact with chat GPT it was like oh wow, this is amazing. But then it said something that was ridiculous.

[Leo Laporte]

It was easy to get how dopey it was at the time.

[Steve Gibson]

Yeah, it's getting harder to oh, what's happening now? I, I asked Claude a question and in I, Lori and I were discussing something I don't remember now what. I asked Claude a question and I began reading back its answer out loud to her and about halfway through I stopped myself. I said this is an AI producing this, right? This, this answer to a query. I, I was just, I mean it's like holy crap. I mean it, it's just amazing.

[Leo Laporte]

Okay.

[Steve Gibson]

Something that is not AI at last as we. But not good.

[Leo Laporte]

Don't get your hopes up because there'll be more coming.

[Steve Gibson]

There will be more. We'll be back there. A true WordPress emergency has emerged. As we've noted many times through the years, nearly all WordPress vulnerabilities arise from the use of inexpertly written third party add on extensions to the core WordPress base installation. But not this time. WordPress has issued an emergency forced update to every system overriding even those systems own administrators settings. I mean it's that bad. The Cybersec Guru site writes the following. A newly disclosed vulnerability chain in WordPress core has prompted one of the project's most aggressive emergency responses in recent years. Security researchers have revealed a flaw dubbed WP2 new WP numeral 2 shell. You know WordPress to shell that allows an unauthenticated meaning anybody no login needed unauthenticated attacker to execute code against vulnerable WordPress installations. So remote code execution on any WordPress unlike the majority of WordPress compromises that depend on outdated plugins or vulnerable themes. This issue resides entirely within WordPress's core and affects even a freshly installed website with no plugins and and no custom themes to limit exposure, the WordPress security team released WordPress 7.0.2 and WordPress 6. 9. 5 while simultaneously enabling forced automatic security updates for affected installations. This is a mechanism WordPress reserves for use when remediating its most severe security incidents and frankly props to them for having such a thing. This is unfortunately the world we are moving to. It's going to be necessary. Although they write. There are no current There are currently no confirmed reports of active exploitation. Security professionals expect attackers to begin reverse engineering the patch immediately. Administrators should treat this as an urgent patching priority. So what is WP2SHELL? The vulnerability, publicly known as WP2SHELL, is a pre authentication remote code execution chain affecting recent versions of WordPress. Unlike authenticated vulnerabilities that require an attacker to first obtain admin credentials, this flaw can be triggered through a single anonymous HTTP request. That distinction dramatically changes the risk profile. An attacker does not need administrator privileges, user credentials, installed plugins, a vulnerable theme, or any prior access to the website. If the site is running an affected version, the vulnerable code is already present. Researchers from Asset Note, part of Searchlight Cyber, discovered the issue and reported it responsibly through WordPress's HackerOne bug bounty program. Okay, so I did a little bit of digging. The vulnerability was first introduced into WordPress 690 back on December 2, 2025, and it's been carried forward since then. The 7.00 release inherited that new 6.90 vulnerability with its first release toward the end of May. Actually, it was May 20th this year, so hopefully WordPress forced update will have updated all vulnerable systems before the news of this vulnerability can draw attacks. This is as bad a vulnerability as any we've seen from WordPress. So anyone running the 6.9x any version beginning with 6.9 dot or 7.0 dot should now be at least at 695 and 702 or the latest second beta of 7.1. It's important, and thanks and a tip of my hat to our listener Simon Zarafa for bringing this one to my attention. We're now going to jump into some listener feedback, Leo, after taking another break.

[Leo Laporte]

Yes, well, that's a good time to tell you about our Sponsor of the hour, Delete me. And this has nothing to do with AI, but it does have to do with a sleazy group of people on the Internet known as data brokers. Man, I hate data brokers. They're like cockroaches. What do they do? They collect information about you, your business, every possible bit of information, and then they sell it on to anybody, anybody who's willing to buy it. It's not expensive. Could be a marketer. That's the most benign interpretation. It could be a hacker, it could be a nation state, it could be China. It could be anybody. Now, if you're a business owner, this is important to you. It's important to your security. Because as a business owner, you can't hide. You've got to. Most businesses need to be public, right? But the uncomfortable truth is promoting your business leaves you and your team exposed. I'll give you an example. 90% right now, 90% of business owners, their home address is easily discoverable online. The home address, not the business address. And the average business owner has more than 600, 600 pieces of personal information sitting there on the open web. Personal email, personal email, phone number, home address, even details about your family. And of course details about your coworkers, your direct reports, the people who work for you. And that information is how a hacker can create a believable phishing email. It's how it happened to us. We got phishing texts purporting to come from the CEO, used her phone number. They knew who her direct reports were. Furthermore, they knew what their phone numbers were. All of that made it more credible. Fortunately, we have smart employees. They didn't fall for it. But it scared us enough that we went out and signed up for Delete Me because it was very clear at that time all that information was public. And bad guys could use this data to run hyper targeted phishing attacks. They have your real details, so they don't sound like strangers. They sound like clients or partners you already trust. We got a phishing email from a partner asking. It was an rfp, a request for proposal. They wanted to buy ads, we thought. But the link in the email, I guess their email had been compromised. Which looked like it was to Google Drive, wasn't It was to Google Drive, but it went through a man in the middle. So our employee entered the password, the login, the two factor, the whole thing. The attackers got into our Google workspace. That's why attacks using verified personal information. They knew our partners are five times more likely to succeed. And the average incident costs small businesses more than $120,000 on average. That means it could be more. One in four businesses will be impacted this year alone. Don't let that be you. That's where Delete Me comes in. Reducing your exposure by up to 95%. How? Because delete Me removes you and your employees personal information from those data broker websites. That starves hackers for the fuel they use to build their target list. And it's not a one time thing because they're like cockroaches, these brokers. They move around, they change their names, they go out of business, they go back in business. So DeleteMe constantly monitors and removes your data. And then you will get regular privacy reports. So you always know where things stand. We love that. We got the email the other day. This is what we found. This is where it was. This is what we removed. Fortune 500 companies and government agencies have been using DELETEME for over 15 years and for that very protection. And now that same enterprise level protection is available even for your small business. Protect your business and your peace of mind. Do what we did. Go to joindeleteme.com twit-biz to start protecting your business with Deleteme today. If you use that link, you'll also get a free year of social media protection for every seat you purchase. Okay, I'm going to give it to you again. Write this down. Join DeleteMe One word. JoinDeleteMe.com TWiT-BIZ okay, you need that URL JoinMe.com TWiT-BIT if you forget that, you can go to our Twitch sponsors page, Twitter TV sponsors and it's there's a link there. Follow that link. Don't Google it. Go to that site. You know, because they're out there, the bad guys. They're always trying to get us. Join the lady me.comtwit-biz we thank them so much for a great service which we use and support Steve and Security now on we go with the listener feedback.

[Steve Gibson]

So Irfan Reid says hi Steve and Leo, I've been here tuning in. I've been tuning into Security now and twit since 2009, so when I heard your recent show featuring the Agent Smith Persona for LLMs, I knew I had to reach out.

[Leo Laporte]

Isn't that cool?

[Steve Gibson]

Yeah. I have a simple open source project called MCP Speak that gives LLM agents their own voice and distinct personality. I originally built five Personas for my MCP server, ranging from a sarcastic senior engineer to a tech priest. After listening to your episode, I couldn't resist adding an Agent Smith Persona to the mix. The results are incredibly fun, especially when you configure the settings so the agent addresses you as Mr. You know, Laporte. Mr. Gibson. Beyond the novelty, it's genuinely useful for multitasking on long running operations. The LLM agent can simply speak up and notify you out loud whenever it needs input or finishes a task. The project runs locally on Mac OS and utilizes the native built in say command for text to speech, so there's no need for external voice API keys. If you or your listeners want to check it out, the project page is right here. Thanks for decades of great content and keep up the awesome work. And I have a link in the show notes at the top of page 13. It's fellowgeek.com GitHub IO and so there you can find his MCP speak project. I went over and took a look. It looks like he did a good job. You clone the repository and run a setup wizard with the Command, you know, Python 3, space setup, Py, and off you go. Irfan shows manual integrations for Google, Anti Gravity, Claude command line interface, Claude desktop cursor, IDE and the Windsurf editor. And he provides personalities for the sarcastic senior, the eager intern, the existential emo, the pun master, the tech priest, Agent Smith, and Gothic poet. So this is cool. Share that with our listeners.

[Leo Laporte]

I wonder what he's using to generate the voices. I'll have to look.

[Steve Gibson]

He said he's just using macOS's say command.

[Leo Laporte]

Ah, okay, okay. That's built in. Sure.

[Steve Gibson]

Yeah. So he said that avoids the need for any external voice API keys.

[Leo Laporte]

Yeah, I use a local model called Kokoro that does all my agent voices. I do exactly the same thing. I have different voices for all my agents.

[Steve Gibson]

And do they have different personalities?

[Leo Laporte]

Well, I haven't gone that far. One's an American female, one's an American man, and one's a British man. I know the accents are. I guess they sort of do have different personality. I want Smith.

[Steve Gibson]

You're able to differentiate. I think it was pretty obnoxious, Leo. Mr. Smith was way over the top.

[Leo Laporte]

But you kind of need this because when you're. So if you have multiple agents, when they're finished, you kind of want them to tell you they're finished so you can come on over and. And see what's going on. Yeah, yeah, this is cool. Very good idea.

[Steve Gibson]

Chris Gallner said, hi, Steve. I've listened to Security now since episode one, and it's funny how time passes in that time. That is to say, while he's been listening to this podcast, he says, I got married, raised two amazing kids, and still listen to you and Leo every week. Hi, Leo. He writes back.

[Leo Laporte]

I kind of did the same thing, actually.

[Steve Gibson]

Well, and I really thought this was cool. I mean, we've been in people's lives for 21 years, and that's a long time. Lot. A lot can have changed in their lives in that. In that interval. He said back then the same thing. All my agents have unique voices like this.

[Leo Laporte]

Oh, sorry. That was my agent talking, I guess

[Steve Gibson]

he said back then, 1997, 98. He said, I was a Cobalt programmer. There was no such thing as vibe coding, and to be honest, I don't even know what that is. Today I find myself Listen to this. I find this very much like you, Leo, he says. Today I find myself with chat GPT 5.5 open on the left, Codex 5.6, SOL open on the right, and all the program specification documents in the Explorer window. I was taught to design first, think it through, and plan before writing a single line of code. It was good advice then, and it's good advice today. GPT 5.5 lets me have discussions about what I'm trying to write and helps me write and review the specification. It really is amazing at doing all that grunt work, something I'd have given a junior engineer and work that I did myself decades ago. Providing SOL with a specification blew my mind. It reviewed the specification, broke the project into milestones, then broke those milestones into slices. Even now, while writing this, I can see C code flicking across the screen in the background as it works on Milestone one of Slice six. When it finds contradictions, collisions or cannon breaking ideas, it challenges them and asks for an authoritative decision. I discuss these with GPT 5.5 and eventually respond to 5.6. It kind of reminds me of the Forbin project, except I'm still a key component between the two. Seeing my little app go from concept to a working program with more and more features appearing as each slice and milestone progresses really does leave me in a state of awe. One day this will be commonplace, but right now, this really is an amazing time to be alive. Cheers. Chris Gallner, Sydney, Australia so Leo, I know this is the experience you've been having, and I thought that Chris beautifully captured that experience. And as I said, it's so cool that he's been with us for 20 years while meeting and marrying his wife, fathering and raising a pair of kids. Yeah, you know, while many other podcasts have come and gone, we've been here from the beginning and we're still going strong.

[Leo Laporte]

Thank goodness. I thought I might not live to long enough to see this stuff really take off.

[Steve Gibson]

I never. I never anticipated this. No, I never expected this to happen.

[Leo Laporte]

Pretty amazing.

[Steve Gibson]

And the AI guys didn't? No. No one caught them by surprise, too. What happens if we make it bigger? Oh my God, it's talking,

[Leo Laporte]

it's talking, it's. And it's saying things that sound almost like a human.

[Steve Gibson]

Well, what freaked me out in the very beginning when I first dipped my toe in, I thought, you know, what is this? What have we figured out? And it turns out, oh, it's a neural net. It's just big.

[Leo Laporte]

Yeah. And the bigger it gets, the smarter it gets, the smarter it gets. Which is very. I mean there must be a limit. Maybe not. I don't know. Fable they're estimating is 10 trillion parameters

[Steve Gibson]

there, there was some mention, I did a little bit of reading about Kimmy that although it is. It's 2.8 trillion, it's 2.8 trillion and all and one of the problems it currently has, it is hallucinating a bit more than our, than we're used to on our, you know, our commercial frontier.

[Leo Laporte]

Other things though that can cause that. For instance context pollution and getting corrupted context windows and stuff. It's a, it's a very, it's a fascinating. I wish I knew more about how these people engineer.

[Steve Gibson]

Did you hear that the AI companies or I think it's I SBN DB is in the middle. They are buying up paper books and scanning them because it's the. Anything before 2022 will not have any AI slop in it. And so they're deliberately. Oh yeah, they're deliberately feeding old texts because they were human written, human curated, human edited.

[Leo Laporte]

And you can't guarantee that going forward, can you? We don't know.

[Steve Gibson]

You can't guarantee it on the Internet. You don't. I mean the Internet is full of, you know, slop. Yes.

[Leo Laporte]

Actually our friend John Graham Cumming was doing this in a jokey way. He mentioned that, you know, there is a brisk market for pre nuclear steel. Steel that was made before the atomic bomb because all the steel since is. Is contaminated with radiation. And so there are things like medical equipment where you want steel that has zero radiation. And so it's sunken ships. It's, you know, it's, it's odd places. So there are, there's a brisk market for that. It's very, very valuable. And he, so he likened it to that. It's pre AI pros. Yeah, it's a great idea. I think we are, we're far too gone for that at this point.

[Steve Gibson]

A listener of ours, Rich Ingersoll said. Hi Steve, I oversee vulnerability management for a large enterprise in New York. I, I redacted the name of the enterprise. It is quite significant. He said I'm still listen and sprawling. I'm still listening to the latest episode of Security Now. But your discussion of Cyber Shield, remember that was the UK based initiative, really piqued my interest. I wanted to raise awareness to you about something our cloud vendor is implementing. We have a smallish but ever growing presence in the cloud. So we're using Wiz to monitor that environment. Recently they introduced two of three agents that seem to accomplish what Cyber Shield is aiming for. Red, Green and Blue agents. Currently only two of these agents are available. The third will be implemented soon. The end goal is to perform detection, investigation and remediation at machine speed rather than human speed as human response is too slow. To learn more check out and then he he gave me a link to the you know Wiz IO blog/introducing hyphen Wiz agents. He said anyway, wanted to share some info from the trenches. If you decide to use this feedback, I would appreciate only my name being used. Thus I eliminated where you know what large enterprise in New York he's affiliated with. But before I talk about Wiz, I wanted to mention how cool I think it is that the enterprise he Rich works for even has a vulnerability management role. Right? You know, bravo to them for having that and obviously for picking Rich, our listener to oversee it. Our our reporting frequently encounters the work of Wiz security. You know they're very active in in this space. So I was curious about this new offering of theirs. The page that Rich linked to explains the roles of these three agents, among other things. But I'm just going to jump to that. They said Meet the agents Red, Blue and Green. We built three specialized agents to operate across the entire security life cycle. These aren't simple assistants. They're intelligent systems that can reason, investigate and take action grounded in the Wiz security graph. The Red Agent is your AI powered attacker. Red Agent regions through application logic to uncover complex logic driven vulnerabilities typically left hidden. It acts like a sophisticated security researcher, but with AI speed and scale, reasoning about application behavior, adapting its approach in real time and validating exploitable risks across your Web applications and APIs. It empowers you to stay one step ahead of attackers. Blue Agent is your built in threat investigator when a threat is triggered. Blue Agent gathers evidence across cloud, telemetry, runtime signals and identity context to comprehensively investigate the threat and produce a clear verdict on its severity. It approaches threat investigation as a seasoned incident responder would, providing its full investigation logic so you can resolve threats with convenience and speed. Green Agent is your path to zero criticals. Green Agent acts as a built in investigation and remediation engine, continuously analyzing your highest risk issues to close the gap between detection and resolution. Like a seasoned security engineer, it synthesizes context from across Wiz including the security graph code to cloud relationships, identity ownership and historical remediation patterns to identify the true root cause of a risk and the safest, most effective resolution teams get environment specific step by step remediation guidance so fixes are durable. Together this team of agents form a continuous loop of validation, investigation and resolution, all grounded in real context across your environment.

[Leo Laporte]

Wow.

[Steve Gibson]

Again sci fi. As Chris observed through the AI enabled environment he's now coding in. Chris, a couple notes ago, someday this will all be commonplace, but today it's an amazing time to be here and participating. Rich's pointer to Wiz Security, who already has the first two of these three agents up and running, and his reference to the UK's Cybershield plan, which we talked about last week, does give me pause to wonder. Perhaps having the UK bring up something like this won't be as far fetched as I suggested last week. Maybe it's not in house, but certainly if Wiz is scalable to the size of a nation, then something like this could be feasible. It would be massive. But if there's anything these AI systems seem to be able to do with some ease, it's scale. Wow. Our listener, Greg Taylor shared a picture. It's at the bottom of page 15. Leo, he said, hi, Steve. I've seen this before. Talking about our picture of the week last week at a Charles Schwab building where I worked for many years on back end trading systems. He said, that's me there.

[Leo Laporte]

See, they didn't have the sign that says no exit.

[Steve Gibson]

He said there were four floors in the building, but the stairs kept going. It's got to be like a plan flaw or something, right? Like, I mean, here there were not more floors. There were only four.

[Leo Laporte]

Well, somebody built that staircase. No, I mean, you don't just put that in if there's nowhere to go. It must have been something, somewhere to go. Maybe the roof, I don't know.

[Steve Gibson]

Although notice that the wires stop the wire railings, so that's not.

[Leo Laporte]

That's when they realized they weren't gonna get anywhere. Yeah, but they didn't put in a railing. I. You know, that's odd.

[Steve Gibson]

It really is odd.

[Leo Laporte]

Yeah. I have to think. I mean, no builder look, a human put that in. Nobody's gonna put that in if it doesn't go anywhere, right? Wow. I don't know.

[Steve Gibson]

Bruce Barrons said, hi, Steve Love the podcast. Longtime listener, Spin ride owner, etc. He said, I was listening to 1087. So last week, today, after watching Yuval Noah Harari's video last night, and he provides a YouTube link, he said, you and Leo were complaining about bureaucracy and bureaucrats Interestingly, Harari's topic was bureaucracy. His take is that, quote, bureaucracy is the machinery that lets strangers cooperate at scale.

[Leo Laporte]

That's right. Huh, good point. I like that.

[Steve Gibson]

Actually, he said, bankers, lawyers, accountants, civil servants and religious authorities create trust by moving information through systems. And that quote, AIs are native bureaucrats.

[Leo Laporte]

That's true. Oh, wow, I didn't think of that.

[Steve Gibson]

He said, the implication is interesting. We shouldn't. We shouldn't fear Claude the Terminator. We should fear Claude the bureaucrat. He said, the other question 1087 raised in my mind is whether after 5 or 6 months of mythos fixing all the code, will there be a need for security now? Maybe Mythos will put you out of a job. Regards, Bruce. So, first of all, like you, Leo, I love the notion of casting bureaucracy as the machinery that lets strangers cooperate at scale. I mean, that's, that's really nice. I think that's a great observation, which makes sense on so many levels. Secondly, if after five or six months of Mythos and others fixing all the code and there being the possibility of no need for security now, I could not think of a better way to bid everyone a fond farewell. However, one lesson we've learned is that not all security mess ups are the result of software bugs. Many of them, yes, but certainly not all traditionally, and we've touched on this theme a couple times already today, traditionally, we've been inclined to observe that there's always that human factor to screw things up. But now we've introduced a brand new and very wild card into the mix. I would not be at all surprised to be observing a year or two from now that the AI factor will have become a new source of surprises. And in the security world, surprises are not a good thing. So I, I really do expect that we're going to be seeing a whole new type of of problem arise from AI. This is weird. Keith wrote and sent a a screenshot. He said, I figure you may have already known about this. Nope. But in case you did not, I didn't. General Motors has recently sent out an email stating that they will be removing the second factor option I've been using with Bid Warden from my account and forcing me to use either text, SMS or email.

[Leo Laporte]

Oh, that sucks.

[Steve Gibson]

He says. Anyway, the email they sent is included below and if you use this, just call me Keith. And so I snapped it for the, for the podcast. It's GM's logo and. And the headline in bold authenticator app verification ending. They write, hi Keith, you're using a third party Authenticator app to sign in to your GM account by the end of August, this verification method will be removed. To continue signing in, choose a new verification method and then it gives two options. Text, SMS recommended, or email. They say if you don't make a change, we will switch you to SMS or email verification when Authenticator app verification is removed. Thanks your GM team. And there's a button to update the verification method. So what the heck.

[Leo Laporte]

Why?

[Steve Gibson]

I really wonder. Yeah, what the backstory here is for this. I wonder whether they offered the use of second factor Rolling six digigit authentication. You know what? We're all used to totp style authenticator app to their subscribers in the interest of heightened security, but then had so many technical support calls from people who didn't know how to use it or were somehow becoming all tangled up that they just decided, you know, insecure or not, life would be simpler if we went back the way things were without two factor authentication at all. I don't know that that's the case, but it's hard to understand. I mean it's not like it's like, you know, everybody else is using it without any trouble at all. I recently had the experience of creating an account somewhere as part of, you know, maybe buying some furniture or something related to the the home moving that Lori and I are still working on and which we've been entirely focused on for the past couple months. Whatever that, you know, whatever the site was, all they wanted to create an account was an email address and I expected to then be prompted for a password.

[Leo Laporte]

But no, I hate huh, everybody's doing this now. Yeah, drives me nuts.

[Steve Gibson]

They said an email with a button to click to verify never was any password requested or mentioned. And as we know, I've observed in the past that since all forms of typical password recovery ultimately reduce to prove that you're you by responding to the email we just sent you, this solution is pretty much as secure as anything else from this view. As I noted at the time, any password based system is actually a login accelerator. Using a password allows the slower email loop system to be bypassed. So I agree with you Leo. I mean, drives me nuts having a username and password we're able to log in instantly with a a proper password manager.

[Leo Laporte]

You know, I know why they do it because people lose their passwords or yes, you know, and they don't want to do customer support. So a lot of like 404 Media for instance, I have an account there. I have to remember what email I used to log in and Then I have to wait. I enter the email and go check.

[Steve Gibson]

And they often don't send the email immediately.

[Leo Laporte]

Right. It's a real speed bump and I just hate it. And I'm seeing it more and more and more. I don't, I just don't get. It's not more secure, it's not less secure. I guess that's the other side.

[Steve Gibson]

Not less. It's not, it's not less secure, it's just slower. A password is an accelerator, right?

[Leo Laporte]

That's a good way to think of it. Yeah. Give us passwords, guys. You know, very frustrating listener.

[Steve Gibson]

He, Kai. First name is he, second is Kai. He wrote, I agree that we are headed into a whole different world, but let me suggest to you that the world might not be as uniformly rosy with regard to software as you suggest. This is clear. It is clear that AI can, when harnessed to do so, find and sometimes fix issues in both software design and software implementation. If the software of the future was roughly similar in size and scope to the software of today, then as AI reduces in cost over time, more and more CICD pipelines would adopt AI enabled review tools and software would dramatically raise its trustworthiness. And, and he. So again he couches this. If, if the software of the future was roughly similar in size and scope. So then he says, but consider this, AI will also dramatically increase the amount of code in the world. This is what I referred to earlier in the podcast. He said, my recently retired father, having no background in programming, built his own website with AI. He has no clear notion of what can go wrong when it comes to security. He doesn't have a CI pipeline. He doesn't even know the right questions to ask or how to evaluate the answers he might get. I have a fear that security issues will become widespread as AI copies and pastes the mistakes of the past at speed and scale. Okay, so the comment our listener made that interests me the most was something, as I mentioned before, I had never really considered before, which is that AI enabled code generation promises to dramatically increase the total amount of code in the world. Leo, you got a lot more code around there now than you did a year ago.

[Leo Laporte]

I get more code in one day that I got all last year.

[Steve Gibson]

Yeah, it's too fun and easy and possible now. And so of course we absolutely know what's going to happen, right? Already non coders are using AI to create systems they could never have before, and existing coders are becoming far more productive. All of that is going to mean much more code for what it's worth. I see that as a hugely positive development for the world. The many things computers could do for people have until this AI coding revolution been completely out of reach for most of those people. They were limited to using what someone else designed and created. Now we're approaching a natural language interface that allows anyone to have a discussion with an AI about what it is they would like to have their computer do for them. And snap, crackle and pop. This amazing genie we've created is able to turn their descriptive discussion into working code. It is beyond huge. It is utterly transformational. And to that I say you go, grandpa.

[Leo Laporte]

Yep, I'm going to. And you're going to. Mr. Gibson, would you like to take a break or you want to.

[Steve Gibson]

Our last break or. Nope, our last break. And then we've got. We're going to look at a two nefarious novel uses for AI. I wanted more alliteration. So at one point I had new in there.

[Leo Laporte]

New nefarious uses.

[Steve Gibson]

Well, new and novel. That's like.

[Leo Laporte]

Okay, new novel nefarious.

[Steve Gibson]

Yeah, yeah.

[Leo Laporte]

Nooses. I just wanted to show you that today. Already I've done 46 million tokens through to Quinn, the new Quinn 38 model. Yesterday I did 88 million. Fortunately, the cash hit rate is very high, so my usage is still pretty good.

[Steve Gibson]

But well on non podcast days. Leo, you got a lot more token.

[Leo Laporte]

Yeah, that's true. Yesterday it was. Yeah, I was cranking, I was cranking. It's so much fun. I just, I have so much fun. Anyway, it's hard. You know what? I. Now I'm the boring guy. You know how, you know, people who like, want to tell you their dream? I'm that guy. I said, let me tell you what

[Steve Gibson]

I did today with my AI.

[Leo Laporte]

You won't believe it. And people are going, uh huh. Okay, Leo, I'm sorry everybody. I really am. Let me tell you about something you care about. Arctic Wolf, our sponsor for this segment of security now arc. I love the name Arctic Wolf. It helps organizations stay ahead of evolving cyber threats. And let me tell you, they're evolving. The latest research from Arctic Wolf reveals something surprising. Even as AI accelerates the pace and complexity of attacks. Get this. And this is false confidence. Many security leaders, they asked him, remain confident they can keep up. I'm not having any trouble at all. I can keep up. To better understand what's driving that confidence, Arctic Wolf surveyed more than 1,350 security and IT leaders worldwide. This is in their new State of Cybersecurity 20, 26 trends report. They do this every year. It's fantastic. It's a snapshot of what work in cyber security professionals are prioritized, prioritizing what they're concerned about right now. And the report explores everything. I mean, it's AI adoption, of course, threat detection, security operations, and the challenges organizations expect to face over the next year. Whether you're responsible for securing a small business or managing enterprise infrastructure, advising clients, maybe you're an MSP or you're simply trying to stay ahead of the latest security trends. This, this, you gotta get the Arctic Wolf Trends report. It offers valuable insight into how the industry is responding to an increasingly AI driven threat landscape. And by the way, while you're there, you might want to check out their Aurora AI from Arctic Wolf. Aurora AI addresses those challenges. It's defensive AI that combines agentic AI, generative AI, machine learning and security expertise to help your organization detect threats faster. And this is a huge innovation. Check out how these innovations and other critical findings are shaping the industry. Go to arcticwolf.com trends just fill out a simple form and you can reserve your copy of the Arctic Wolf State of Cybersecurity 2026 trends reported. That's Arctic wolf.com trends that's all you need to get your confidence shaking just a little teeny weeny bit. Okay, Speaking of which, let's go. Let's talk about this AI thing.

[Steve Gibson]

Given how large language model AI has proven to be so capable of discovering vulnerabilities in existing code, pretty much everyone has viewed the malicious abuse of AI through the lens of the classic arms race, right? With the chicken and the egg or the the spy versus spy, whatever. With this view, the question is whether the good guys are going to be able to discover vulnerabilities, then patch and deploy and deploy this less vulnerable code before the bad guys are able to discover their own vulnerabilities, which will then allow them to develop exploits and attack the existing still vulnerable code. In other words, who will be the first to either fix or exploit the deployed vulnerabilities? It's only natural that this would be where everyone's focused. But the old truism necessity is the mother of invention comes to mind when we learn that those ever nefarious bad guys turned out to have an entirely different type of AI solvable problem. Thus the necessity that no one had stopped to consider. As necessity would have it, AI has been proven able to provide massive leverage in an area that had never been considered before. One thing that's interesting is that we've actually touched upon this problem that bad guys have faced in the past. We've wondered how ransomware baddies who arrange to download terabytes of victim data are able to make heads or tails of their plunder. And I've of course, for anyone paying attention, you now know where AI comes in. And having revisited this previously open question, everyone listening, as I just said, now knows exactly what's going on here. Instead of helping them to penetrate a victim's network, AI is now being employed to help them understand the value of what they've obtained once terabytes of that victim's data has been exfiltrated. So this is indeed a nefarious novel use of AI. The firm GlidePoint Security recently published their April to June 2nd quarter 2026 report titled Ransomware and Cyber Threat Insights. It's a 28 page report which examined the many various aspects of the ransomware phenomenon we previously covered. I'm not going to share most of it, but their section titled AI is an enabler but not how you would think addressed this entirely new aspect which exists at the intersection of a classic problem faced by ransomware perps and new LLM AI capabilities. The subhead of this section is titled How Threat actors are using AI in ransomware Negotiations. They write contemporary discourse around threat actors. Usage of LLM AI ranges from legitimate concern by defenders to outright fear, uncertainty and doubt mongering by others. Since the AI boom began in late 2022, AI innovation has moved at an unprecedented pace, making it difficult to separate the potential from the actual in real time. It's imperative to isolate signal from noise by grounding claims on the subject in empirical data. Fulcrum SEC, a data extortion group we first identified in late 2025, has deployed LLMs operationally during ransom negotiations involving the theft of a victim's highly complex production database. GRIT is their acronym for guidepoint Research and Intelligence Team. So grit, these people who are writing this has observed what we assess to be the processing of exfiltrated data by the group through an unidentified LLM to generate step by step instructions for linking user identities across several databases. We base this assessment on the analytical outputs complexity relative to FULCRUM sex known baseline capability, as well as the precision of the threat actors language during negotiations. Okay. In other words, these GRIT guys have been carefully watching and documenting FULCRUM sex activities for the past at least since late 2025. So nearly, well, at least half a year or more. So they know that these bad guys would be incapable of making either heads or tails out of the download of a large raw database. But at the same time, they know that a contemporary AI agent could do this without breaking a token. They wrote. Due to the complexity of the database schema, this analysis of a victim's data would have been implausible without either deep internal knowledge of the victim's database architecture, a substantial period of focused human attention, or AI assistance. Given the abbreviated time in which the negotiations occurred, we find it unlikely that a threat actor would have the capacity to fully untangle a complex database schema. And given the time available, we've included a recreation of the usage of AI during the negotiation. So they write, we understand it is a lot to wrap one's head around. This is a big one. Regarding how we linked identities across the databases, the short answer is your own schema makes it trivial for us to do so. Nearly every table in both databases shares a single key. That one key links most everything. This is by design, or your own analysts wouldn't be able to work with the data. Here's a more technical walkthrough of how it works in practice, even when some values were hidden or hashed in your production databases. Step 1. Start with the primary identifier. And it's been redacted from their report, so it's just referred to as primary identifier. So start with that. But in the actual text, they refer to it. Your staging tables contain this primary identifier in plain text. The main source is a table that stores about X million unique customer names, dates of births, and home addresses. Every row has a linking key attached to it. That's the starting point. Step 2. Follow the linking key to everything else. That same linking key appears in dozens of other tables across your databases. One simple database query connects a single primary identifier to driver's licenses and state IDs, bank account and routing numbers. Yikes. Email addresses, phone numbers, and so on. In other words, a really bad breach. Each of those is one query away from the primary identifier. No guesswork is required. The linking key is a direct link to your own engineers. Sorry, A direct link your own engineers built into the schema. Step 3. The hashed primary identifiers were not real protection. Some tables stored primary identifiers AS cryptographic hashes SHA256 instead of plain text. But primary identifiers are only X digits and only roughly X million possible values. A single computer can hash every possible primary identifier in under X minutes, producing a lookup table that maps every hash back to the original number. We reversed millions of them in minutes. If these had been hashed in a cracking resistant algorithm, we would not even have bothered trying. We would have needed a data center's worth of compute power running full blast for months to make a real dent in them. That's impractical. It's worth noting that user passwords were properly hashed. So again, your team knew how to do this, but chose not to apply it to other data. Finally, step four the encoded primary identifiers were even weaker. Your tables stored primary identifiers with a simple character substitution, that is each character shifted by a fixed amount. One becomes nine, two becomes colon, and so forth. A one line script reversed number of these instantly. This is known as a Caesar cipher and it's from ancient Rome. It is not secure. What this means functionally is that starting from any single customer, one query produces a complete identity package. The primary identifier results in a name, date of birth, address, driver's license, bank account, email, phone, employer, income, credit score, security question answer, password, hash, full loan history, and for hundreds of thousands of your customers, verbatim notes about the most difficult moments of their lives. The data warehouse was designed to work this way. We're happy to answer any more questions at your request. So GuidePoint's feeling is that there's no way this Fulcrum Fulcrum SEC group could have possibly performed all of this reverse engineering work on the downloaded database material. Given the time they observed, they had to have used the speed offered by AI. GuidePoint continues their examination of this specific Fulcrum sect event by writing Additionally, Fulcrum SEC used LLM generated language during their negotiation with the victim, communicating in language clearer and more precise than any typically observed for non native English speaking threat actor groups. The language help the group anchor their position and drive negotiations from their side, in effect saying quote, we know what we've taken here, this is what it is and this is why we've set the ransom at this amount, unquote. This is markedly different from most threat actor negotiations where operators commonly use open source platforms like Crunchbase or ZoomInfo to establish ransom amounts based on market data. By applying LLM capabilities analytically rather than generically, Fulcrum SEC established a firm negotiating stance from which they had little incentive to diverge. Okay, so there's the first of two concrete examples. Then they look at a group known as Dragon Force and they write where FulcrumSec used LLMs to process and weaponize data. Dragon Force demonstrates a second and equally significant use case, deploying LLMs to manufacture plausible pressure that would otherwise require capabilities the group does not have. Dragon Force is an established ransomware as a service group previously covered by GRIT CRQ2 2025 report. Building on that prior analysis, GRIT has observed Dragon Force incorporating AI and LLMs into its operations, a meaningful shift from its earlier trade craft. Most notably during negotiations and in advertisements for potential affiliates, the group has claimed to have legal counsel on staff. The statement, which is almost certainly false, is designed to pressure victims by implying that Dragon Force has insight into a victim's reporting requirements and legal exposure arising from the data leak. The notion of a criminal ransomware group retaining attorneys fully versed in international data requirements is observed absurd until you realize the lawyer is an LLM for criminal purposes. It doesn't matter if the claim is true. It only matters if it sounds plausible. If there's one thing LLMs are good at, it's making a wide range of statements sound entirely plausible. So what does this mean? AI and LLM use gives threat actors a structural advantage in negotiations. They significantly reduce language barriers, increase negotiation professionalism, and amplify available psychological pressure to bear against the victim. Historically, analysts could use imperfect non native English as a soft attribution marker of adversary geographic location. Even tools like Google Translate would leave telltale signs. But contemporary LLM reduces or even eliminates that signal entirely. It is not a marginal development. Attribution confidence decreases, negotiation dynamics shift toward threat actors, and the gap between sophisticated and unsophisticated groups narrows in ways that make victim preparation critically more important. More broadly, increased threat actor AI LLM use reinforces the efficacy of the RRAs, the ransomware as a service business model. Conti pioneered the RAS model, structuring affiliate programs and playbook driven syndicate operations that set the template that's now being further professionalized and automated by AI tooling. AI and LLMs allow less sophisticated and non native English speaking groups to approach negotiations in a more professional manner, establishing negotiations with unprepared victims on their terms. GRIT will revisit this topic throughout the year to assess the question Will threat actors continue refining AI LLM integration in their processes? Will it plateau or will the use of AI LLMs be more limited to specific groups? GRID anticipates threat actors will continue to streamline LLM usage in the near term, primarily through the two vectors negotiation communications and exfiltrated data analysis. More complex, sophisticated or novel adoption of AI and LLMs will almost certainly be more limited, but may trickle down in the long term. So what are the next steps for defenders? What do defenders do Threat actor adoption of AI LLM tooling raises the floor for negotiation sophistication across the board. It reinforces organizations need for cybersecurity insurance, legal counsel and an understanding of the data present in their environment. It also suggests that negotiations should be conducted by trained professionals. While threat groups do have some predictable behavior, individual operators are criminals who may act erratically cause dire consequences for the victim organization. Engaging qualified professionals gives organizations a clear understanding of threat actor playbooks and current behavior, enabling them to distinguish routine bluffs from credible threats. Expert legal counsel is also essential for understanding reporting requirements and potential legal ramifications. A mature and up to date incident response plan can assist with the coordination of all these factors. Okay, so that was guidepoint's example of two very real world threats. Their report was a bit more sanitized than I was hoping for, so I did a bit more digging to find some additional reporting on Fulcrum sec. That first group guide point discussed the reporting I found added some interesting information. It said as an example of the consequence of this Group's use of AI. In June of last month, FulcrumSec reached out to Data Breaches.net regarding their compromise of the Danish pharmaceutical company Novo Nordisk, the maker of WeGovy, a well known semaglutide GLP1 agonist drug. Fulcrum SEC claimed to have stolen 1.3 terabytes of data containing, wait for it, 700, 717 files.

[Leo Laporte]

Yikes.

[Steve Gibson]

Okay, so I'll briefly note that this is a textbook example of wondering what to do with the presumed treasures that were just plundered from the victim. On the one hand, it's hot damn, we just sucked out 700, 717 individual files with an aggregate size of 1.3 trillion bytes. But now what? Hopefully there's some really juicy data that we can use for blackmail extortion. But where would it be exactly hiding among, think of it, 0.7 million individual files. Okay, so continuing they wrote, Fulcrum SEC said it had captured valuable intellectual property, including five publicly undisclosed drug programs in development, drug and RNA delivery programs, and private AI models for particular medical and drug discovery purposes. The group told data breaches that it used a team of AI agents to analyze those private models and that it believes the stolen data could save competitors three to five years of program development. Its initial ransom demand to Novo Nordisk was for US$25 million. The information about the intellectual property Fulcrum sex stole was coupled with a description of Novo Nordisk's security posture, which the group claimed was absolutely catastrophic and boggles the mind to us, they write, this sounds like Fulcrum SEC is attempting to frame the incident in a way that that would have any class action lawyer salivating. It wouldn't be the first time a data breach has resulted in a lawsuit. So presumably this is part of Fulcrum sex extortion pitch. Their modus operandi also includes using AI to generate detailed reports, which it then provides to threat researchers and journalists, nicely formatted complete with logo and all in order to apply more pressure to victims. For example, after compromising the technology company Avnet in October of last year, the group gave the VX Underground X account a report on the breach. According to VX Underground, the group provided, quote, an autobiography, a breakdown of the data they possess, their motives for the compromise, information on their logo design and why their logo was chosen, a complete stolen file, listing of the compromise, a breakdown of the files, what it is, what they are, what they contain, and images of the files. VX Underground said the group had done, quote, every bit of research and write up for us. To add insult to injury, Fulcrum SEC claimed it had used an OpenAI key it had stolen from the victim to pay for the chat GPT, summarizing the victim's own data. So I started out noting that necessity is very often the mother of invention. Since none of us are on the inside of any of these ransomware gangs, we have a difficult time imagining what their problems might be. So the world comes up with, hey, they're probably going to use AI, just like software publishers will, to discover previously unknown vulnerabilities and then use those to compromise systems. While that will doubtless be one use, the evidence suggests that the bad guys don't need new ways of getting into other people's networks as much as they need help. After the data has been successfully exfiltrated and is in their hands, they need AI's help with determining the value of what they just grabbed, and then help negotiating with the data's legal owners, who almost certainly speak a language they do not. Appearing tough, competent and knowledgeable is every bit as important after the threat as obtaining the stolen goods was in the first place. They have, after all, zero interest in the data itself that they've just obtained. Its entire value to them lies in what cold, hard cash they can trade for destroying that data they now hold. And for that, AI has been the best thing that ever happened to them.

[Leo Laporte]

Wow. Yeah, I mean, that's the promise of computing, I guess. And AI. Imagine making it easier.

[Steve Gibson]

Imagine you you exfiltrate 700, 000 proprietary files of Novo Nordisk and you. And you uncover five other drug programs that are in development and enough detail to say, well, you know, you got some competitors who'd probably like to see all this. What's it worth to you for us not to give it to them? 25 million seems cheap to me.

[Leo Laporte]

Yeah, actually, Novo Nordisk is in the process of going after Lily because they don't like Lily, the competitor who makes Zepbound and which is a competitor to Wegovy and Mounjaro, which is a competitor to Ozempic. They're saying false advertising. And so these two are in a fight. I could, I could easily see Lily saying, well, let's just see what you're up to. They wouldn't do that publicly in any way because of course that would be a big no, no. But you can see there might be some interest. Wow, Steve. Again, you've both terrified and amused.

[Steve Gibson]

As is our goal every week we

[Leo Laporte]

do security now on Tuesdays right after Mac break weekly ends up being around 1:30 Pacific, 4:30 Eastern, 20:30 UTC. I mentioned that because you can watch us do the show live. We stream into the club Twit Discord. So the folks who are in the club get kind of beyond the velvet rope access. But you also can watch us. Everybody can. On YouTube, Twitch, X dot com, Facebook, LinkedIn, Kick. Hello everybody out there. Nice to have you watching after the fact. On demand versions of the show are available in a number of places. Steve has his own, by the way. There's 575 people watching on those channels right now. Hello. Steve has his own copies of the show. He's got. Actually, all of his are unique. He's got a 16 kilobit audio version, which is very compact for people with limited bandwidth. He actually did it for Elaine Ferris, who does our amazing transcription. She lives in a horse ranch in the middle of nowhere.

[Steve Gibson]

I think 20 years, 20 years ago she was using kite string Internet. And so we, we needed to keep the bandwidth down.

[Leo Laporte]

She's probably got better bandwidth now. I hope she does anyway. She does a great job. So that's another version of the show. He's got human written transcriptions. Those take a few days after the show to come out. He's got a 64 kilobit audio version. Maybe Elaine gets to listen to that now with more bandwidth. That's full audio quality. He also has the show notes. Those are great. 20 pages plus of all the links, the pictures. It's really Nicely done. It's a little magazine article actually. Little magazine total that you can download. You can also get that though automatically if you want. Go to G. His website is grc.com [e-mail] email you can submit your email to get whitelisted. So you can send him pictures of the week and you know, thoughts that he might use in reader feedback. But you can also check the boxes below. They're unchecked by default because Steve's a good guy. But if you want to be on the mailing list for the show notes, the weekly show notes, you get that every Sunday or Monday before the show. Also a little used mailing list for new products. Steve has right now two things he sells on his website. One is Spinrite, which you should know. It's been around for how many years? 30 years now. It's forever.

[Steve Gibson]

Late 80s.

[Leo Laporte]

Wow.

[Steve Gibson]

Yeah.

[Leo Laporte]

Longer than most of our listeners, let's put it that way. I got software older than you. You can get that. That's a must have for anybody who has masters storage. So it, it helps the fixes of performance concept can be used to recover data and it also. Let's see. So data recovery, performance enhancing and something else. What else does it do? It does something else. There's three things. It's great. You need it. If you have mass storage, you need spin. Right. I did it out of order and I can't remember the third thing. I don't know why. You also can get his really useful DNS benchmark pro. That's 10 bucks. 9.99. And that's great because it'll tell you what the best DNS server is for your particular system which isn't the same as anybody else's. So it's really good to know. Very helpful. Both of those GRC.com along with the show notes and the show and all of that. And there's a lot of other stuff. He does so much free stuff. That's why you should support him with the paid stuff he does. Shields up and let me, you know the. What was it? It was never 10. Now it's in control. So you don't have to ever update your windows if you don't wanna do. You still get security updates, you just don't get the next version.

[Steve Gibson]

Right, right, right. You still get updates. It just doesn't move forward unless you want it to.

[Leo Laporte]

That's exactly what you want. All of that. @grc.com we have our own unique copies of the show. A 128 kilobit MP3 audio version for no apparent reason. And we also have video for the apparent reason that Steve's a hell of a good looking fella and you want to see him. He's the Alex Trebek of podcasts is what he is. You should. You should go to Twit TV SN for those. You can also get it on YouTube. There's a YouTube channel dedicated to Security Now. Great way for sharing clips to the boss. Boss. You ought to hear this. You ought to hear this. And probably the best way to get it is to subscribe. Just go to your favorite podcast client. We'd like Pocket Casts, Overcast. I mean, there's just a million of them. Pick the one you like, subscribe. It's free and you'll get it automatically. Now, what's not free is supporting Security now by joining Club Twitter. I want to encourage you to do that. It's 10 bucks a month. You'll get rid of the ads. Even this mention of you know, the club will be gone because there are no ads. You also get chapter markers, which is really nice. So you can jump along as you watch in the show notes. You can go to the parts you want or whatever, skip the AI if you want, or go directly to the AI if you want. You get to choose. You also, as members of the club, get access to the Discord, a great place to hang out with other Security now listeners and all the members of the club. You get all the special programming we do in the club, Twit Discord. And you also get the warm and fuzzy feeling of knowing you're supporting what Steve is doing, what Twit is doing. Without your support, we couldn't do it. You cover a huge amount of the operating costs. So Please join TWiT TV Club TWiTS. Best way to show you appreciate what we're doing here. Steve, I think we're done. I will see you next week.

[Steve Gibson]

I'll be here. See you then. Bye. Hey, everyone.

[Leo Laporte]

Hey, everybody. It's Leo Laporte. You know about MacBreak weekly, right? You don't?

[Steve Gibson]

Oh.

[Leo Laporte]

If you're a Macintosh fan or you just want to keep up what's going on with Apple, this is the show for you. Every Tuesday, Andy Inocco, Alex Lindsey, Jason Snell and I get together and talk about the week's Apple news. It's an easy subscription. Just go to your favorite podcast client and search for Mac Break Weekly or visit our website, Twitter, tv, mbw. You don't want to miss a week of Mac Break Weekly security now.

[Steve Gibson]

Hi, Ryan Reynolds here for Mint Mobile. Are you looking for a beach read this summer? May I suggest your big wireless bill? It's got suspense, mystery, a slightly flat emotional arc, and a shocking twist where you realize you've been overpaying the entire time. Fortunately. Fortunately, though, Mint Story is better. Every plan $15 a month, even unlimited. That's it. Happy ending, zero tears. Give it a [e-mail] Switch upfront payment of $45 for three months, $90 for six months or $180 for a 12 month plan required $15 per month equivalent taxes and fees Extra initial plan term only greater than 50 gigabytes may slow

[Leo Laporte]

when network is busy.

[Steve Gibson]

See terms Goldbelly's asking what's the one food you'd fly across the country for? Maine's famous lobster roll? Maybe Chicago's iconic deep dish? Or Texas's legendary barbecue? Well, you can skip the flight. Goldbelly ships America's most iconic foods straight to your door nationwide. And here's the best part. Right now, they're celebrating national restaurant month with $50 off your first order. That's 50 bucks. It won't last forever. Order now on goldbelly.com A burst pipe, a dead water heater, the AC calling it quits? Who do you call? HomeServe is an easy way to handle unexpected home repairs with plans covering stuff basic homeowners insurance usually won't.

[Leo Laporte]

Instead of scrambling for a contractor, you

[Steve Gibson]

make one call to get the repair process started. Join the millions of customers who trust HomeServe right now. Go to HomeServe.com podcast for 50% less your first year. That's HomeServe.com podcast savings compared to Renewal price void in Florida.