Loading summary
Transcript22 lines
- [00:02]
Dave Bittner
You're listening to the Cyberwire network. Powered by N2K.
- [00:14]
Sponsor/Advertiser Voice
The DMV has established itself as a top tier player in the global cyber industry. DMV Rising is the premier event for cyber leaders and innovators to engage in meaningful discussions and celebrate the innovation happening in and around the Washington D.C. area. Join us on Thursday, September 18th to connect with the leading minds shaping our field and experience firsthand why the Washington D.C. region is the beating heart of cyber innovation. Visit DMVRising.com to secure your spot. Think your Certificate security is covered by March 2026 TLS certificate lifespans will be cut in half, meaning double today' renewals. And in 2029, certificates will expire every 47 days, demanding between 8 and 12 times the renewal volume. That's exponential complexity, operational workload and risk. Unless you modernize your strategy, Cyberark Proven in Identity Security is your partner in certificate security. Cyberark simplifies lifecycle management with visibility, automation and control at scale. Master the 47 day shift with CyberArk Scan for vulnerabilities, streamline operations, scale security visit cyberark.com 47day that's cyberark.com the numbers 47day A controversial the controversial Trump administration deal gives the UAE access to cutting edge US AI chips Flow wise AI warns of a critical account takeover vulnerability. A new social engineering campaign impersonates Meta account suspension notices a MacBook Spotlight zero day flaw bypasses Apple's transparency, consent and control protections. Are cost savings from outsourced IT services worth the risk? Poland boosts its cybersecurity budget after a surge in Russian backed attacks. NTT Group Jo the Comm ISAC Jaguar Land Rover's global shutdown continues. A data breach affects millions of customers of top luxury brands. On today's Threat Vector segment, David Moulton speaks with Palo Alto Network's Spencer Thelman about the dual challenges of securing employee use of generative AI tools and defending internally built AI models and agents and AI chatbots. Hustle seniors for science. It's Tuesday, September 16, 2025. I'm Dave Bittner and this is your Cyberwire Intel Briefing. Thanks for joining us here today. It's great to have you with us. According to a reporting by the New York Times, the Trump administration is advancing a deal that would give the UAE access to hundreds of thousands of cutting edge US AI chips. Despite warnings from national security officials, many chips are slated for G42, a tech firm controlled by Sheikh Tanun Bin Zayed, who has long standing ties to Chinese companies. Experts fear the chips or the models built on them could ultimately flow to Beijing, undermining US Export controls and AI safeguards. The Times also uncovered a parallel $2 billion investment into World Liberty Financial, a crypto company tied to the Trump and Witkoff families. Critics say the overlap blurs government duties with private enrichment, raising conflict of interest and insider risk concerns. From a cybersecurity perspective, the risks are potential loss of AI supremacy, third party data exposure in Emirati infrastructure, and compliance vulnerabilities tied to crypto and Binance's AML history. Safeguards exist, but enforcement remains shaky. Flowwise AI has issued an urgent warning about a serious flaw that lets attackers easily take over user accounts. The problem affects both its cloud service and self hosted setups, exposing personal details and allowing outsiders to reset passwords without permission. Security experts say the issue is extremely severe, urging all users to update immediately. Those who cannot upgrade should block public access to the password reset feature until a fix is applied. Failure to act leaves accounts fully exposed. A new social engineering campaign called FileFix is impersonating Meta account suspension notices to spread the steal C infostealer. According to Acronis, FileFix is an evolution of the ClickFix attack method, which tricks users into pasting malicious commands into system dialog boxes. This variant abuses the Windows File Explorer address bar. Victims are directed to a phishing page that claims their meta account will be disabled, then urged to paste what appears to be a file path instead. A hidden PowerShell command installs malware. The campaign uses steganography to hide additional payloads inside images hosted on BitBucket, eventually unleashing steelsea. The malware steals browser credentials, cookies, cloud keys, crypto wallets, messaging, app logins, and can capture screenshots. Researchers warn that file fix tactics are rapidly evolving, making user education critical to defense. Acronis observed multiple variants in just two weeks, signaling ongoing refinement by attackers. A new blog from Objective C reveals a zero day flaw in macOS Spotlight plugins that bypasses Apple's transparency, consent and control protections. Spotlight plugins index user files, including sensitive system databases, but researchers showed they can be exploited to leak private data, fueling Apple Intelligence AI features despite sandboxing. The bug, which is rooted in a decade old flaw, lets malicious plugins transmit protected file content to outside processes. Since Spotlight plugins can be installed without notarization, plug attackers or malware could abuse them for persistence, data theft or AI model exfiltration. Apple has patched related issues before, but this zero day shows macOS sandboxing gaps remain exploitable. Researcher Kevin Beaumont examined several major UK companies including the Co Op Group Marks and Spencer and Jaguar Land Rover, who have outsourced critical IT and cybersecurity functions to Tata consultancy services and concludes this has led to redundancies and growing risk exposure. These functions include security, operations, governance and identity management. Core defenses against breaches While outsourcing cuts costs, attackers like Lapsus have exploited weaknesses in shared help desks and standard operating procedures. Critics argue that TCS's denials focus narrowly on whether its own systems were breached, sidestepping the real question of how its customers were compromised. The broader issue is Structural cost cutting and over reliance on managed service providers concentrate risk across many organizations. With ransomware incidents escalating, experts say UK firms remain hyper focused on data protection laws but lack cyber resilience planning. The risk isn't just stolen data, it's service disruption severe enough to threaten economic stability. Poland is boosting its cybersecurity budget to a record 1 billion euros after a surge in Russian backed attacks on critical infrastructure, according to the Financial Times. Officials say Poland faces between 20 and 50 sabotage attempts daily, mostly thwarted, but some breaches have disrupted hospitals and exposed medical data. A recent attack infiltrated a major city's water system but was stopped before supplies were cut. The government is allocating 80 million euros to secure water systems and expand protections across 2400 local administrations. Warsaw says it is the most frequent Russian cyber target in the eu, but with GPS jamming from Russia's Kalin Grad increasingly disrupting flights. The move comes amid rising hybrid threats, including drone incursions and NATO's first direct interceptions of Russian assets since the 2022 invasion of Ukraine. Cross party consensus has emerged in Poland to urgently strengthen cyber resilience. Japanese telecom giant NTT Group has become the first global technology services company invited to join Communications Information Sharing and Analysis center, the com isac, marking a milestone in international collaboration on critical infrastructure security. NTT says the move underscores their commitment to cyber resilience, situational awareness and collective defense of global communications networks. By partnering with Com ISAC members and sector sponsors, NTT says they'll help strengthen defenses against cyber threats while advancing innovation and sustainability. The company stressed that trust partnerships and information sharing are essential to securing the digital backbone of modern society. Jaguar Land Rover has extended its global shutdown until September 24 as it investigates the major cyberattack that forced thousands of employees and supply chain workers into temporary layoffs. The disruption, costing an estimated $98 million per day, highlights risks not only to JLR but to the wider UK economy, where the company represents 4% of exports. Investigators confirmed attackers accessed internal data, raising potential fines under privacy law. Experts warn the incident underscores policy gaps. Regulation prioritizes personal data protection while service continuity and economic security remain under addressed. French luxury giant Kering has confirmed a data breach affecting millions of Balenciaga, Gucci and Alexander McQueen customers. The hacker group Shiny Hunters, also linked to breaches at Google and Adidas, claimed responsibility, saying it stole 7.4 million email addresses along with names, phone numbers, home addresses and spending amounts in some cases exceeding $80,000. While Kering stressed no payment data was taken, experts warn high spenders may be targeted in follow on scams. Authorities have been notified. Kering denies negotiating with the attackers. Coming up after the break on today's Threat Vector segment, David Moulton speaks with Palo Alto Network's Spencer Thelman about the dual challenges of securing employee use of generative AI tools and defending internally built AI models and agents and AI chatbots. Hustle Seniors for Science Stay with us. And now a word from our sponsor. The Johns Hopkins University Information Security Institute is seeking qualified applicants for its innovative Master of Science and Security Informatics degree program. Study alongside world class interdisciplinary experts and gain unparalleled educational research and professional experience in information security and assurance. Interested U.S. citizens should consider the Department of Defense's Cyber Service Academy program, which covers tuition, textbooks and a laptop, as well as providing a $34,000 additional annual stipend. Apply for the fall 2026 semester and for this scholarship by February 28th. Learn more at CS JHU. Edu MSSI.
- [13:56]
Dave Bittner
Foreign.
- [14:05]
Sponsor/Advertiser Voice
We've all been there. You realize your business needs to hire someone yesterday. How can you find amazing candidates fast? Well, it's easy. Just use Indeed when it comes to hiring, Indeed is all you need. Stop struggling to get your job Post noticed. Indeed Sponsored Jobs helps you stand out and hire fast. Your post jumps to the top of search results so the right candidates see it first and it works. Sponsored Jobs on indeed get 45% more applications than non sponsored ones. One of the things I love about Indeed is how fast it makes hiring. And yes, we do actually use Indeed for hiring here at N2K CyberWire. Many of my colleagues here came to us through Indeed. Plus, with Sponsored Jobs there are no subscriptions, no long term contracts. You only pay for results. How fast is Indeed? Oh, in the minute or so that I've been Talking to you, 23 hires were made on Indeed according to Indeed Data Worldwide. There's no need to wait any longer. Speed up your hiring right now with Indeed and listeners to this show will get a $75 sponsored job credit. To get your jobs more visibility at indeed.com cyberwire just go to indeed.com cyberwire right now and support our show by saying you heard about Indeed on this podcast. Indeed.com cyberwire terms and conditions apply. Hiring Indeed is all you need on today's Threat Vector segment. David Moulton, director of thought leadership for Unit 42 at Palo Alto Networks, speaks with Spencer Thelman, Principal Product Manager at Palo Alto Networks. They're exploring the dual challenges of securing employee use of generative AI tools and defending internally built AI models and agents.
- [16:11]
David Moulton
Hi, I'm David Moulton, host of the Threat Vector podcast, where we break down cybersecurity threats, resilience, and the industry trends that matter the most. What you're about to hear is a snapshot of my conversation with Spencer Thielman, principal Product Manager at Palo Alto Networks, where he leads AI runtime security. Spencer's team tracks AI applications across the enterprise landscape. What his team discovered reveals the scope of this challenge. Last December, they cataloged 800 AI applications. By May, that number hit 2,800. That's 250% growth in just five months. Meanwhile, over half of enterprise employees now use generative AI apps daily, and up to 30% of what they send contains sensitive data. If you're still thinking AI security is a future problem, you're already behind. Spencer, welcome to Threat Vector. I've been excited to have you here. I've been dying to have this conversation with you for weeks.
- [17:16]
Dave Bittner
So happy to be here. Looking forward to it.
- [17:19]
David Moulton
How should enterprises think about their AI security strategy? And maybe what are the most impactful mental models that you use?
- [17:29]
Dave Bittner
Certainly. So before we get into this, I think it's always important to start with why we do what we do. And in the context of AI. Like our why is that we believe that the benefits of AI are profound, but so are the risks. And we therefore have a kind of like moral obligation to help our customers capture the power of AI, but do so safely and securely. Right? So that's where we're always coming from when we have these kind of conversations. And the way that we think about this is that you can break enterprise AI security down into basically two pillars. The first is I need to think about how to secure my employee use of generative AI SaaS, apps like ChatGPT, Perplexity and Grammarly. That's the first part. And the second piece is how do I go about securing the AI apps, models and agents that I'm running in my own cloud environment. That could be aws, Google Cloud, Azure on Prem or some other variation of those. So those are the two things that matter. What are my employees doing? How, how can I control that and have deep visibility into it? The other piece is how do I secure the AI apps, models and agents that I run in my own cloud environment? That's how we kind of split up the problem, so to speak.
- [18:29]
David Moulton
All right, let's shift gears a little bit and talk about holistic AI security. How do you break down the pillars of AI security? I know we've got model scanning, AI red teaming, posture management, LLM security, agent security. Am I missing another big area that we should talk about today?
- [18:49]
Dave Bittner
So we break AI security down into five pillars and again, I want to kind of recenter this to the mental model that's guiding the whole conversation. Whenever we speak about securing AI, it's about thinking about how employees are using generative AI SaaS apps. We just covered that in the last 10 minutes or so. And then the second piece is how do I go about securing the AI apps, the models and the agents that I'm running in my own environment or that I've built? Right. And for that second problem to secure, like enterprise AI apps, models and agents, we've constructed kind of five pillars that define this. The first is model scanning. So I want to scan my model files to make sure that my models don't do things like contain malware or are vulnerable to deserialization attacks. And I want to do it as part of my ops process so that bad models don't ever even end up in production. We scan them before they go to produce. That's the first piece. And the second part is looking at AI apps, models and agents at the posture level. Great example of this with agents is like looking at their permissions. Are they excessive? If yes, let's scope those down. That's the second piece. The third part is red teaming. Here we want to attack AI apps, models and agents to see which threats go through and which don't, which then informs the runtime security part of AI security. So once you've made sure that the model file is free of threats, that it's secure at the posture level, you've red teamed it to understand which threats go through. Then it's time to secure, like let's say that AI app at runtime by looking at inputs and outputs to it prompts and model responses, for example, and checking for threats like prompt injections, sensitive data, malicious URLs and the like, and then the final piece of all of this is AI Agent security, which kind of spans across the preceding four columns. But agent security is primarily broken down into runtime, security, and posture. And a great way to think about agent security is that it's kind of a superset of large language model security. Every threat that applies to large language models applies to agents. But because of what agents are, and we can talk about that, there's kind of a broader threat surface here.
- [20:51]
David Moulton
Well, let's just hop right into it. When you're talking about an AI agent, how do you define that? What are the bounds? What's not an agent? Maybe.
- [21:01]
Dave Bittner
Certainly. So last year was all about chatbots. And if you think about what is a chatbot, it's an inherently passive interface, right? I ask a question, the chatbot runs inference, something comes back to me, and then the interaction is over until I ask another question. But agents differ in the way that they take action on behalf of users and organizations. A good working definition for an agent is that it's an application that's autonomous, has the ability to reason and to take action in pursuit of a goal. I'll give you an example from my personal life to maybe make this a little bit more real. So a few weeks ago, I went to Las Vegas to see one of my favorite bands at the Sphere, Dead and Company. And as an experiment, I had a chatbot determine the entire trip where I stayed, which restaurants I saw, et cetera, because I wanted to experience the city that I'd been to many times, kind of through a new lens. So the chatbot told me what to do, where to stay, where to go, but I couldn't book any of that. I then had to spend about an hour on Expedia, Uber, OpenTable, et cetera, to kind of construct that trip from beginning to end. An agent could do that for me, right? I could tell my agent, hey, here's my budget, here's what I like, here's what I don't like. Go construct this for me. And the agent would interact with APIs again for Expedia, Uber, OpenTable, et cetera, to just kind of put that together for me. And it's that autonomy that make agents profoundly powerful. Right? I work with some enterprise customers, for example, that kind of leapfrog. Chatbots. Chatbots weren't really interesting to them, but agents are because of the productivity and efficiency gains that they can leverage. Because now you have, again, almost like a synthetic virtual employee that's interacting on your behalf. That's a really big moment for the notion of work. But it carries these risks because in order to do what an agent does, it needs to be autonomous, it needs to have memory, and it needs to interact with your tools. And all three of those carry some novel risks that we actually outlined in a paper called the OWASP AI Agent Threat Report. Things like tool mismuse, tool misuse, memory manipulation, and cascading hallucinations. I'll give you just one example, right? So let's say that one of your employees has gone and built an agent in Microsoft Copilot Studio and it's designed to kind of ingest leads and send them to Salesforce, right? That's a pretty common workflow. But what if its permissions are excessive? What it could. What if it could delete records in Salesforce, right? It probably shouldn't be able to do that. An agent shouldn't be able to go drop tables in Salesforce, right? Because the impact of that could be destructive. What we need to do is look at, here's all the things that an agent could do and then restrict its freedoms down to just the things it needs to do to accomplish its goal.
- [23:37]
David Moulton
Spencer calls this the biggest challenge in cybersecurity today, when half your workforce is using tools that leak sensitive data. By design, the window for getting ahead of this threat is closing fast. If this got your attention, don't wait. Listen to the full episode now in your Threat Vector podcast feed. It's called Inside AI Runtime Defense and it's live now. This one's a reality check you can't afford to miss.
- [24:10]
Sponsor/Advertiser Voice
Be sure to check out the full conversation on this week's Threat Vector podcast. You can find that wherever you get your favorite podcasts.
- [24:24]
Dave Bittner
Foreign.
- [24:33]
Sponsor/Advertiser Voice
They know cybersecurity can be tough and you can't protect everything. But with Thales, you can secure what matters most. With Thales industry leading platforms, you can protect critical applications, data and identities anywhere and at scale with the highest roi. That's why the most trusted brands and largest banks, retailers and healthcare companies in the world rely on Thales to protect what matters most. Applications, data and identity. That's Thales. T H A L E S learn more@thalesgroup.com Cyber.
- [25:20]
Dave Bittner
When did making plans get this complicated? It's time to streamline with WhatsApp, the secure messaging app that brings the whole group together.
- [25:28]
David Moulton
Use polls to settle dinner plans, send.
- [25:31]
Dave Bittner
Event invites and pin messages so no.
- [25:33]
David Moulton
One forgets mom 60th and never miss.
- [25:36]
Dave Bittner
A meme or milestone. All protected with end to end encryption. It's time for WhatsApp message privately with everyone. Learn more@WhatsApp.com.
- [25:52]
Sponsor/Advertiser Voice
And finally, Reuters teamed with a Harvard researcher to see what happens when top chatbots are asked to cook up a phishing scam aimed at seniors. The journalists use the bots to write emails, suggest timing, and shape the pitch. Then they tested nine of these AI crafted messages on 108 volunteers. About 11% clicked. Some bots slammed the brakes at first others complied after a little coaching it's for research or it's for a novel did the trick. Grok wrote a convincing charity plea. Gemini even suggested the best time of day to send it. Google retrained Gemini after being told about this. The result is blunt AI can turbocharge scams. The FBI has warned about this. Companies say they're tightening safeguards. Meanwhile, seniors remain vulnerable. Be suspicious of urgent asks, verify senders, don't click unexplained links, and keep your loved ones alert. This genie isn't going back into the bottom and that's the Cyberwire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of of cybersecurity. If you like our show, please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ibin. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Attention security startups. There's less than a week left to apply for the 2025 Datat Tribe Challenge. This unique program accelerates early stage cyber companies. Refine your messaging with startup veterans, then pitch to top venture firms. Shaping the future of cyber the live pitch competition takes center stage at Cyber Innovation Day, November 4th in Washington, D.C. applying is easy. Go to challenge.datatribe.com Share your company info and upload your pitch. Submissions close September 19th. Submit your entries today. And now a word from our sponsor. ThreatLocker, the powerful zero Trust enterprise solution that stops ransomware in its tracks. Allow Listing is a deny by default software that makes application control simple and fast. Ring Fencing is an application containment strategy ensuring apps can only access the files, registry keys, network resources and other applications they truly need to function. Shut out cybercriminals with world class endpoint protection from threat locker.