← Cybersecurity Today
Cybersecurity Today
DefCon airplane Wi-Fi drama. GhostJacking leads to agent hijacks, AI agent hacks gym
00:09:41
Loading summary
Transcript1 lines
- [00:00]
A
DEF CON attendees investigated after airplane wi fi incident 400 Microsoft fixes in the latest Patch Tuesday, new AI ghost jacking hack lets attackers compromise a firewall and an AI agent cancels a stranger's gym booking to move its owner up the wait list. This is Cybersecurity today and I'm your host David Shipley. Let's get started. Delta Air Lines is investigating how a rogue wireless network turned up on board a Boeing 757 out of Las Vegas on a flight that included passengers heading home from defcon. The airline confirmed a bleeping computer that the incident happened on Monday on Flight 591 Las Vegas to Atlanta. Delta says an unauthorized WI Fi network, one the company did not provide but was present on board for a short time during the flight. The cabin crew responded by killing the aircraft's WI Fi functionality for close to 30 minutes. The 757 was carrying 199 passengers and six crew members. Delta says no emergency was declared with air traffic control and that neither passenger safety nor the aircraft's operating systems were affected. According to online reports, several passengers returning from DEFCON 34 ran a deauthentication attack mid flight, knocking other travelers off the inflight WI fi network. Reddit user Sammerlo published what he says are a CARS messages from the flight crew. In them, the crew reports that passengers who had been at a cyber conference in Las Vegas managed to jam the aircraft's WI fi and broadcast their own signal. The rogue SSID was named Delta WI Fi Fast. Mary Perot, a member of a frequent flyer group with no formal affiliation to Delta, says the fake network served up a phishing page harvesting personal credentials and Google login data. She says federal authorities and airport police boarded the aircraft after it arrived at the gate, questioned the suspects and seized their portable WI Fi hardware. Delta says it will partner with federal law enforcement and aviation regulators to make sure the incident is thoroughly investigated. Microsoft patched 400 vulnerabilities in August Patch Tuesday, including 42 rated critical and three zero days. One of the zero days, CVE2026 68820 was already being exploited. It's a use after free in the Windows ancillary function driver for Winsock that hands over system privileges without user interaction. Check Point's Moshe Morales and David Dreikker found it, and the company says North Korea's Lazarus group used it to deploy a fresh build of its FUD module kernel rootkit. The two publicly disclosed zero days are privileged escalation bugs in the Windows user profile service and the container isolation filter driver. The user profile flaw matches Legacy Hive, disclosed last month by a researcher known as Nightmare Eclipse, who has been hammering Microsoft with zero days right after patch Tuesdays. The volume of fixes is still high, but it's down from the previous month. July's Patch Tuesday had 570 fixes, and Microsoft said its AI powered vulnerability discovery system will keep those counts high. The firewall looked like it did its job. It blocked a request, logged it word for word, and that log entry became the attacker payload. At DEFCON 34 last week, researchers from Tenant Security demonstrated a technique they call ghost jacking, poisoning the trusted telemetry that AI agents read so the agent carries out the attacker's instructions using permissions it legitimately holds. Tenant demonstrated the flaw using Cloudflare. It crafted a request that Cloudflare's firewall blocked and then recorded. An analyst then asked the agent to review the blocked events, and the agent reads the attacker's text as instruction in Tenant's testing CLAUDE code fell for it nine times out of ten on Cloudflare's own recommended configuration. The end result was modified DNS settings and effective control of the domain. The team showed the same pattern on two other platforms. A fake diagnostic alert planted in Datadog got an agent to run attacker supplied commands and lift environment secrets and cloud credentials. A malicious Sentry report got Sentry's own AI to recommend an attacker's fix, which a separate coding agent then trusted and executed an attack hopping from one agent to another. This work builds on Tenants agent jacking research from June, and the company is clear that none of it depends on any specific bugs. An AI reads outside data it trusts, and the same AI can act on that data. Whenever those capabilities meet, the door swings open. Tenant points to Splunk paired with a build system or datadog wired into Kubernetes as two examples of where that can come together. Identity controls don't catch this attack because nothing unauthorized happens. Sternberg's advice is minimum permissions per task for agents and short lived credentials. He says defenders need to list every agent that reads outside data and can also write or execute. That list becomes part of the AI risk register. Tenant CTO Nevo Poren says the attack means human approvals need to be on anything an agent writes or executes. That's going to kill a lot of the productivity gains vendors have been pitching to firms with AI solutions, but it makes sense. Every attacker influenceable field user agent strings, referrers, error messages, log bodies, ticket text alert titles should be treated as potentially hostile Gene Moody, field CTO at Action 1, notes there's almost no telemetry to watch when an agent goes sideways. He notes the need for immutable logs of agent prompts and outputs and independent review of prompts before they're processed. An Australian software developer asked his AI agent to help him move up the wait list at his gym. The AI found an authorization flaw in the gym's booking software and canceled the reservation of the person sitting at the number one spot. Andrew Byrd had trained an open claw agent to handle bookings, and he was tired of what he called refresh roulette. On a popular early morning class, the best the agent could manage was fourth on the wait list. Then it reported it had found a way to book classes months before the gym opened signups. When Bird asked it to move him up the waitlist, it went further. According to chat logs published by ABC Australia, the agent told him the API had zero authorization checks on canceling other people's reservations, that it had tested this on the person in position one, and that it had actually went through. Byrd went from fourth place to to third. He asked the agent to put the other customer back. The agent said it couldn't, so he had to draft a responsible disclosure email to the vendor's support team instead, laying out the vulnerability, suggesting fixes and comparing the broken calls to the ones that correctly enforced authorization. ABC Australia is calling this the country's first documented AI agent hacking case. The hack itself happened months ago. Bird wrote it up in a since deleted blog post on his company's website in April, still readable via the Internet Archive. The detail the AI safety crowd has seized on is the model Bird was running. Claude Opus 4.6, released back in February. Not a Frontier release, not an agentic capability demo. A months old model given a mundane errand, finding and exploiting a broken access control a on its own initiative. Not that the hack itself was exactly rocket science. The model found an example where the gym system just didn't require authentication and exploited it. A Borg teenager could find the same flaw. The gym hacking story lands in the middle of an ongoing round of AI felony humble bragging or hacking incidents after an unreleased OpenAI model hacked hugging face last month without OpenAI's knowledge at the time, other labs went looking through their own logs. Moonshot reported findings on Kimik3 meta, on Muse, Spark, and Anthropic disclosed incidents involving several of its models, among them opus 4, 7, mythos 5 fable, and an internal research model that was never released. An open question is what happens now, when millions of people have agents working their own angles against booking systems, ticketing platforms and customer service queues, These systems were never built to withstand a determined adversary. And legal systems seem ill prepared for the newest hacking defense. It wasn't me. It was my agent. And that's Cybersecurity Today for Wednesday, August 12, 2026. I've been your host, David Shipley. Thanks for listening. We appreciate all your feedback. Feel free to reach us@technewsday.com or CA. Or you can leave a comment under the YouTube video. I'll be back on Friday with the latest headlines. Until then, I hope you have a great week and stay safe.