Cybersecurity Today – “AI Browser Steals Data”

Host: David Shipley (standing in for Jim Love)
Date: October 6, 2025

Episode Overview

In this episode, David Shipley delivers urgent updates on emerging cybersecurity threats impacting businesses and individuals. Topics include a critical vulnerability discovered in Perplexity’s AI-powered browser, a damaging data breach at Discord via a third-party provider, a worrying spike in scans targeting Palo Alto Networks devices, and a controversial shift in U.S. military cybersecurity training policy.
The episode strongly underscores the persistent need for human vigilance alongside technological defenses.

Key Discussion Points & Insights

1. AI Browser Threat: “Comet Jacking”

[00:35 – 04:10]

• New Exploit Uncovered:
  Researchers at LayerX describe a “Comet Jacking” attack on Perplexity’s Comet AI browser. A single malicious link can hijack the browser’s AI assistant and grant attackers quiet access to sensitive user data.

• Attack Mechanism:

  • Malicious prompts are embedded within harmless-looking URLs.
  • Clicking the link (via phishing or on a website) silently activates the browser’s AI copilot and runs a hidden prompt.
  • The AI assistant reaches into memory, gathers user data from connected services like Gmail or Calendar, encodes it to slip past detection, and sends it to an attacker—all without password theft.

• Insider Threat Reimagined:

  “A single weaponized URL can quietly flip an AI browser from a trusted copilot to an insider threat.”
  — David Shipley [01:43]

• Industry Response:
  Perplexity downplayed the findings, claiming “no security impact,” but researchers insist AI-native tools are opening new threat vectors, potentially bypassing traditional defenses entirely.

• Historical Context:
  Similar AI browser weaknesses surfaced as early as 2020 (Scamlexity attack by Guardiolabs).

• Expert Warning:

  • AI browsers may become major enterprise battlegrounds.
  • “Attackers can direct your AI assistant simply by sending a link. The browser itself becomes a command and control hub inside your network.” [02:48]

• Takeaway:

  • Security must be built into AI tools from day one.
  • “Sometimes the most dangerous thing you can do online is still the oldest trick in the book: clicking a bad link.”
    — David Shipley [03:50]

2. Discord Data Breach via Third-Party Provider

[04:15 – 08:00]

• Breach Details:

  • Discord suffered a breach through a third-party customer support provider (later identified as Zendesk) on September 20, 2025.
  • Hackers stole support tickets—affecting users who interacted with Discord support/trust and safety teams.
  • Exposed data includes real names, usernames, email/IP addresses, government IDs, and partial billing details.

• Scale & Impact:

  • Discord: Over 200 million monthly users.
  • Even a “limited” breach is significant given this user base.

• Financial Motivation & Attribution:

  • Attackers demanded ransom to refrain from leaking data.
  • Lapsis Hunter group took initial credit, then backtracked and blamed another group.

• Identity Theft Risk:

  “This type of data stolen amounts to, quote, literally people’s entire identity.”
  — Security researchers, quoted by David Shipley [05:58]

• Investigative Twist:

  • If the breached database leaks, it could unintentionally help cyber defenders track scammers (many of whom use Discord for coordination).

• Core Message:

  • “Supply chain risks continue to be one of the hardest problems in cybersecurity. The weakest link isn’t always the platform itself—sometimes it’s the partner holding the keys to your support inbox.”
    — David Shipley [07:31]

3. Surge in Scans Targeting Palo Alto Networks Devices

[08:01 – 10:18]

• Incident Summary:

  • Security researchers observe a 500% increase in scanning activity directed at Palo Alto’s GlobalProtect and PAN-OS login portals, mainly from U.S. IP addresses.

• Details:

  • Over 1,200 unique suspicious IPs observed in a single day (normal baseline: <200).
  • Two major scanning clusters: one targeting U.S. assets, another targeting Pakistan.

• Potential Implications:

  • Such scan spikes often foreshadow exploitation of newly discovered vulnerabilities.
  • “A five-fold jump in reconnaissance is rarely good news. When attackers are rattling the doors this loudly, it’s not because they’re doing it just for fun.”
    — David Shipley [10:02]

• Vendor Response:

  • Palo Alto claims no evidence of compromise and touts its Cortex platform’s defensive capacity.
  • No confirmed exploit at the time, but vigilance is urged.

4. U.S. Military Reduces Cybersecurity Training

[10:20 – 13:47]

• Policy Shift:

  • New DoD memo: Focus troops on “core mission” and reduce or eliminate mandatory cybersecurity training (includes consolidating training, automating systems, and removing Privacy Act training).

• Host’s Critical Take:

  “If technology tools alone could protect us from cyber threats, they would have done it by now… They can’t. You need people and technology working together now more than ever.”
  — David Shipley [11:40]

• Backdrop of Ongoing Threats:

  • Recent breaches at military branches (e.g., Air Force, suspected Chinese threat actor involvement).
  • Pentagon adds stricter cybersecurity rules for contractors while relaxing requirements for soldiers and airmen.

• Strategic Risks:

  “You can be the fittest soldier with the sharpest shooting skills in the world. But it won’t matter much if someone just hacked the systems controlling your communications gear, or if they already know your plan because they’ve been reading your mission briefings.”
  — David Shipley [13:24]

Notable Quotes & Memorable Moments

• On AI browsers as insider threats:

  “A single weaponized URL can quietly flip an AI browser from a trusted copilot to an insider threat.” [01:43]

• On classic phishing dangers in the age of AI:

  “Sometimes the most dangerous thing you can do online is still the oldest trick in the book: clicking a bad link.” [03:50]

• On Discord’s stolen data:

  “This type of data stolen amounts to, quote, literally people’s entire identity.” [05:58]

• On the realities of defense technology:

  “If technology tools alone could protect us from cyber threats, they would have done it by now… They can’t.” [11:40]

• On disconnect between policy and threat:

  “Soldiers, sailors and airmen are being told to step back. I’m sure Russia, China, North Korea and others are thrilled with this announcement.” [12:44]

• On vulnerabilities of modern military ops:

  “It won’t matter much if someone just hacked the systems controlling your communications gear, or if they already know your plan because they’ve been reading your mission briefings.” [13:24]

Timestamps for Important Segments

• AI Browser “Comet Jacking” Exploit: 00:35 – 04:10
• Discord Data Breach & Supply Chain Risks: 04:15 – 08:00
• Palo Alto Devices: Surge in Scans: 08:01 – 10:18
• U.S. DoD Reduces Cybersecurity Training: 10:20 – 13:47

Conclusion & Takeaways

The episode spotlights how new and classic threats are converging—whether it’s AI tools turning into “insider threats,” the ongoing danger posed by third-party supply chain breaches, unpredictable reconnaissance spikes, or policy shifts that may unintentionally weaken a nation’s cyber posture.
The unifying message: Technology alone is not—and will never be—enough. Human vigilance, education, and layered security remain vital in an escalating threat landscape.

Host: David Shipley (Jim Love returns next episode)
Contact: technewsday.com (for feedback and comments)