AI Security Ops

In this episode of BHIS Presents: AI Security Ops, the team digs into some of the strangest recent examples of AI behaving badly.

An AI agent finds a way around its sandbox using DNS. Malware asks four different AI models what it should do next. Attackers overwrite an AI agent’s “soul.” And a placeholder domain buried across GitHub becomes an unexpected security risk.

Funny stories? Absolutely. But underneath them are some very familiar security problems.

We dig into:
- An OpenAI agent finding an unexpected path out through DNS
- Whether a 2.5-hour response is fast enough in the age of AI
- CLOSEDQUORUM malware using multiple AI models to make decisions
- Why outbound AI API traffic could become a useful detection signal
- The Carbonado botnet rewriting an agent’s SOUL.md instructions
- The risks of exposed Docker daemons
- How an unreserved placeholder domain can become an attack vector
- Why AI agents make old security mistakes more consequential

The takeaway: none of these techniques are particularly new. DNS tunneling, exposed services, compromised configuration files, and untrusted domains have existed for years. AI just gives attackers — and occasionally AI agents themselves — new ways to find and exploit those boring gaps at greater speed and scale. 2026-09-29-News (1).docx

  • (00:00) - Intro: AI Behaving Badly
  • (01:19) - The Agent That Phoned a Friend
  • (04:28) - Is a 2.5-Hour Response Fast Enough?
  • (09:25) - More OpenAI Agent Escapes and Security Lessons
  • (14:32) - Malware by Committee: CLOSEDQUORUM
  • (23:27) - Somebody Overwrote the Agent’s Soul
  • (26:54) - Why Exposed Docker Is So Dangerous
  • (30:22) - The Placeholder Domain That Bit Back
  • (32:07) - Final Takeaways: Old Problems, AI Speed and Scale

Click here to watch this episode on YouTube.


Brought to you by:
Black Hills Information Security 
https://www.blackhillsinfosec.com

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training
https://www.antisyphontraining.com/

Active Countermeasures
https://www.activecountermeasures.com

Wild West Hackin Fest
https://wildwesthackinfest.com

🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits
https://poweredbybhis.com


Creators and Guests

Host
Brian Fehrman
Brian Fehrman is a long-time BHIS Security Researcher and Consultant with extensive academic credentials and industry certifications who specializes in AI, hardware hacking, and red teaming, and outside of work is an avid Brazilian Jiu-Jitsu practitioner, big-game hunter, and home-improvement enthusiast.
Host
Bronwen Aker
Bronwen Aker is a BHIS Technical Editor who joined full-time in 2022 after years of contract work, bringing decades of web development and technical training experience to her roles in editing pentest reports, enhancing QA/QC processes, and improving public websites, and who enjoys sci-fi/fantasy, Animal Crossing, and dogs outside of work.
Host
Derek Banks
Derek is a BHIS Security Consultant, Penetration Tester, and Red Teamer with advanced degrees, industry certifications, and broad experience across forensics, incident response, monitoring, and offensive security, who enjoys learning from colleagues, helping clients improve their security, and spending his free time with family, fitness, and playing bass guitar.
Guest
Ethan Robish
Ethan Robish has worked with Black Hills Information Security (BHIS) since 2008 — first as an intern and then as a full-time Security Consultant starting in 2012. In his current role as a Threat Hunter, Ethan is involved with customer engagement, research, working with Active Countermeasures’ AC-Hunter, as well as improving BHIS HTOC and SOC offerings. Previously, he implemented defensive security solutions for the Exchange Online security team as a Microsoft intern. While in college, he competed in the International Collegiate Programming Competition (ICPC) World Finals. In his time off, he enjoys cooking, playing the piano, and reading fantasy novels.

What is AI Security Ops?

Join in on weekly podcasts that aim to illuminate how AI transforms cybersecurity—exploring emerging threats, tools, and trends—while equipping viewers with knowledge they can use practically (e.g., for secure coding or business risk mitigation).

Brian Fehrman:

Hey, everyone, and welcome to this week's episode of AI Security Ops, where we are going to dig into some misbehaving AI and a couple of interesting news stories from the the past couple weeks. But before we get into that, let's talk about our sponsors. Black Hills Information Security, you or your company are in need of any kind of security testing, whether that be internal, external, assume compromise, c two, wireless, hardware testing, physical testing, social engineering, or stock monitoring. Last but not least... Well, there's a lot more than this.

Brian Fehrman:

So the last thing I can think of, not least, testing AI security or using AI to help augment security testing to give you awesome results at a little bit more affordable price point, check us out at blackhillsinfosec.com. Additionally, we have a training branch where many of our consultants take their their knowledge of the tasks they're performing day in and day out, and they package it up into an easy to digest and affordable format to help you maybe level up in your current position, get the role that you've been looking for, or maybe you're just a hobbyist and you want to learn some new information from some cool people. We we like to think we're cool anyway. Check this out at antisyphontraining.com. So let's hop into this first story titled The Agent That Phoned a Friend.

Derek Banks:

That's your final answer?

Brian Fehrman:

Sorry. Final answer. Final answer. Well, I'm submitting the... What were the other two?

Brian Fehrman:

5050, and what was the... There was a third lifeline. I don't remember what it was.

Derek Banks:

Yeah. I don't remember. 5050.

Brian Fehrman:

That started

Derek Banks:

to be about when I stopped watching those. Ask ask

Brian Fehrman:

the audience. That's what it was.

Derek Banks:

Oh, yeah. Ask the audience. Ask the audience.

Brian Fehrman:

Yep. It's funny.

Bronwen Aker:

Shows what I know.

Brian Fehrman:

So what did this agent do? So... Oh, poor OpenAI. Poor OpenAI. On September September twentieth, looks like they had an agent that was doing some reinforcement learning training, and it was working on the search task when it found, that it wasn't able to reach search engines directly.

Brian Fehrman:

And so it found an issue with DNS filtering that it was able to leverage to then go out and do the searches that it wanted to to communicate with external sources. That sound about right?

Derek Banks:

That sounds about right. So it's... It basically was DNS tunneling, which again... So if you're allowing unrestricted DNS outbound to your sandbox, it's not a sandbox. I don't know if I would call this security one zero one.

Derek Banks:

Let's call it security, like, maybe two zero one. You either learn this the hard way, or you have someone like Ethan Robish show up to your organization and tunnel out of DNS, which is, you know...

Ethan Robish:

Down at a time or two.

Derek Banks:

That actually is how I met Ethan. I don't even know if he remembers.

Ethan Robish:

I I don't remember that.

Derek Banks:

Oh, yeah. Yeah. Yeah. You...

Ethan Robish:

I mean, I remember I remember visiting your place of work.

Brian Fehrman:

I don't

Ethan Robish:

remember DSNS tunneling there, but I remember being very restrictive. So...

Derek Banks:

Yeah. But DNS was overlooked. Right? And so I think, you know, know, more and more as I, you know, became a pen tester, I started using DNS ping. It's slower, but you could do the same thing.

Derek Banks:

And there's even, like, you know, I've researched, like, from, you know, our friend, Troy Wojewoda, where if you wanna get, you know, full bro or Zeke, you could always, like like, capitalize in lowercase because it lowercases everything, and you could actually even exfiltrate data based on capitalization. So I just... Again, if you're not watching where it's going, if it's not supposed to have Internet, you can still monitor DNS on the other side. This isn't a new thing, and so I think it's creative for sure. It's kinda cool.

Brian Fehrman:

Yeah. Agreed. It seems like, I mean, a lot of these, stories that we're hearing, because there's actually more, sub points that I think are funny that there's sub points for this story for OpenAI that, where things probably could have been fixed with some, let's say, some firewall rules. And not like... I'm not saying, like, on the system where the AI is running, that kinda defeats the purpose.

Brian Fehrman:

Like, if you just put in the IP tables rules, like, where it's running, it potentially has the ability to just go ahead and change them on. So I'm like, hey.

Derek Banks:

I restrict it. They're improving. Right? Because I actually heard about this story yesterday when I was out, like, walking on the trail, listening to a podcast, another podcast that I like. Right?

Derek Banks:

And so you're talking about this, and they said, you know, that it took two point five hours for OpenAI to detect it and then shut it all down. And so I'll ask Ethan and Bronwen, do you all think that that's quick enough? Do you think that's fast? Like, AI or human or whatever, if if we were in an organization and me and... We're on a red team.

Derek Banks:

Because we used to do red teams with four people at BHIS. Those were the days. Sometimes they were on-site. That was fun. Right?

Derek Banks:

But, you know, if we tunneled out DNS and, you know, the the organization detected it and did something about it within, like, three hours, would you have thought that was quick?

Bronwen Aker:

By modern standards, it's almost... It's it's necessary. I mean, five years ago, I would have said, yeah, that's really quick. Today, it's still plenty time enough to do tons of damage. Ethan, what were you gonna say?

Ethan Robish:

Kind of the same thing. Like, traditionally, like, I would say, yeah, that's pretty fast response time. I'm I'm more interested... Because the the timeline is the automated system flagged it in fifteen minutes, which I would say is reasonable. And then a human began reviewing it three minutes after that.

Ethan Robish:

So that's eighteen minutes before someone was looking at it. Like, that... That's pretty quick. Like, I think by any any standard.

Derek Banks:

If I was in my sock and they did that, I would say, congratulations. That's pretty quick.

Ethan Robish:

Yeah. What Mhmm. What happened though between eighteen minutes and two and a half hours? Like, I'm I'm wondering...

Derek Banks:

I mean, I could speculate because I worked in big environment. Right? Took them? Remember, like, working in really big environments, and, like, you would tell, like, the security team there would be a ticket, and, like, you'd be found. And then they'd have to, like, file a ticket over at this other group, and they're all out to lunch or something or, like, whatever.

Derek Banks:

Or they take, you know, it just... My guess is corporate bureaucracy.

Ethan Robish:

I'd say that's a reasonable guess.

Bronwen Aker:

Or lack of a runbook. Right?

Ethan Robish:

What what is the runbook for AI?

Bronwen Aker:

Exact... Well...

Derek Banks:

Let me ask you. Okay.

Bronwen Aker:

No. Now this is part of what I was just talking about in that blog article I mentioned, is that in traditional software, you have all kinds of of testing and QA and QC. What we don't have, unfortunately, in software development is a standard security component that's factored in. So you have to figure out what is acceptable and what is not acceptable. And anytime you're running a test, you have your your boundaries.

Bronwen Aker:

And it doesn't sound like the people at OpenAI are defining these tests to include appropriate and inappropriate behavior as boundaries that when one of their agents crosses it, they take some sort of corrective action or halt the test completely. And that would seem much more responsible as you have to have to find what is acceptable and what isn't acceptable, and I don't see that happening.

Derek Banks:

Well, I mean, to me, I'm a I'm a play devil's advocate because when I first heard this, my my initial response was, oh god. They think they are finally watching and make... And making improvements. This is a drastic improvement from what happened before. Right?

Derek Banks:

And, you know, I I heard John Strand on the BHIS news last night basically says he's starting to come to the conclusion, and I completely 100% agree with him because I'm rewatching this whole series, that the Frontier Labs are like one big episode of Silicon Valley. Super smart people, super smart data scientists. And I saw this, like, at the master's cohort in UVA. Right? There were tons of really smart people.

Derek Banks:

They didn't know anything about cybersecurity. They didn't even really know how computers worked. Right? But they knew data science. And I mean, Brian, Ethan, you'll agree with me.

Derek Banks:

We get interns at BHIS. Historically speaking, maybe not now, but historically speaking, we have a computer science graduate come in and not really even know what an IP address is. Right? But they could program. So I guess what I'm saying is I think that they're learning.

Derek Banks:

I think they could dump a lot more time and effort and money into it and hire some, you know... There's plenty of stuff in the... People in the cybersecurity world that could come help them, like, quickly. But at least they're getting better at it, and maybe starting to realize what Jensen Huang said, and this is an engineering problem.

Brian Fehrman:

So... Yeah.

Bronwen Aker:

Well, it's a human problem and an engineering problem.

Brian Fehrman:

Yeah. All, very very good points. I'm gonna mention one more thing before we move on to the next story, which today explained of this being a huge improvement is this is one of the... Which I think is funny that this is a footnote for this story. But for those who don't know, it was recently, disclosed that apparently, another one of OpenAI's recent upsies resulted in them hacking Australian non public government infrastructure, who are now very upset about it.

Brian Fehrman:

We don't have like a lot of details at it right now, other than we'll need to see what happens. Because that's...

Derek Banks:

Yeah. So think this happened before. It's the old... Yeah. It happened before they were watching closer.

Derek Banks:

So I'm glad they're watching closer, and I'm glad they're learning. Mhmm. And so far, nothing bad has happened. But from what I heard about the Australian one is that the AI was guessing endpoint names. They're essentially enumerating endpoint names, which is, again, security one zero one.

Derek Banks:

If you have... It's an iDOR. Right? If they hired us to to to, you know, pen test them, and I found that that's critical. Right?

Derek Banks:

You have sensitive data exposed to... And it doesn't matter if it is not a LinkedIn point. So...

Bronwen Aker:

Oh, well... Supposedly, because of all of the heat they've been taking, OpenAI has paused training new models. The good. Fascinating response.

Derek Banks:

And they didn't even need to get regulated by the government to do that. Woah. Mind blowing.

Bronwen Aker:

No. They're just getting slaughtered in the press.

Derek Banks:

Yeah. Public The article public opinion. So is anthropic. Did you see Saturday Night Live clip of the character? I don't remember that.

Derek Banks:

The actor's name. It's a...

Brian Fehrman:

Don't ruin it. Don't ruin it. You gotta go

Derek Banks:

see it. It's a news segment. I'll I'll look

Brian Fehrman:

it up.

Derek Banks:

I'll look it up. It is... Look, when Saturday Night Live is roasting you, I think you've lost public opinion. Right? So

Ethan Robish:

I... In the very footnote of the the article, it does it does talk about... It sounds like a... OpenAI also was wondering, like, what happened in the gap between eighteen minutes and two and a half hours. It it said Oh.

Ethan Robish:

Operator decracy. The operator did not kill the run as expected, and we're closing operational gaps as a result. So, yeah, the the human in the the human in the loop there was the issue. Similar to Derek, I I told you this earlier. I was copying some files over, and I did an oopsie.

Ethan Robish:

I went to remove the source files, and I just, like, hit up, changed my command, and I forgot to remove the destination.

Brian Fehrman:

Oh, no.

Ethan Robish:

So I started removing files in... That I just copied over, and like other files that were at the destination. So I spent the morning trying to recover those. So ironically, I didn't let Claude, like, drive the things because I didn't want, like, data loss or accidental stuff, and then I caused it.

Derek Banks:

Time machine for the win. Right? I mean, look, everybody's had that stuff happen to them. I've been on a Linux box in the middle of a test and remove star dot star from the root directory. Doesn't...

Derek Banks:

That never ends well. Right? So

Ethan Robish:

Why did my prompt stop responding?

Brian Fehrman:

As long

Bronwen Aker:

as you didn't do an, you know, r m... Tac r f.

Derek Banks:

Oh, man. Oh, no. It was definitely tac r f. Yeah. No.

Derek Banks:

That's by the fly. I probably actually even had an alias that had that. But anyway... Yeah. So look.

Derek Banks:

The moral of this story is is I think they're getting better. And and look, I I... This is what I was trying to say. Yeah. I can't be on the news, the BHI said, a lot of the times, and I was saying it in chat that it's not surprising to me, like, knowing how large language models are trained, that when you train in a large corpus of the Internet, which has hacking in it.

Derek Banks:

Right? So it has hacking in it. And then your your your reinforcement learning is teaching it how to code. Right? And that's probably in your base training too.

Derek Banks:

And you're essentially making a coder where you're inadvertently making a hacker. Because think about like what we look for in a pen tester. We would look for the ability to code their way out of a problem, like historically speaking. Right? And so I don't...

Derek Banks:

I'm not surprised they're good at hacking.

Bronwen Aker:

So... Well, and a a lot of the the press is getting very up in arms about how these agent swarms are able to go and do so much. Well, of course, you've got an army. So the ability to... It's it's like the the hacker version of a DDoS.

Bronwen Aker:

But instead of of just interrupting service, you're looking for any little teeny tiny

Derek Banks:

perfect segue into the next one, but I will say at a later date, maybe next week when we're at Wild West Hacking Fest, I want to further explore the 75¢ accounting error because forms of agents are expensive. But that said, the next article is actually the counterargument to what I just said.

Bronwen Aker:

Malware by committee. Oh, my.

Derek Banks:

Yeah. Yeah. And so this was what Cisco Talos found a Windows implant written in Go called closed quorum, once it's inside a machine. It asks up to four AI models, DeepSea, Quinn, Mistral, and Gemini what to do next, and then acts on the vote. So I'm assuming it's using stolen API keys?

Ethan Robish:

That that would be my guess, probably.

Brian Fehrman:

Yep. Yeah. And that's... It's it's interesting because, like a major... In AI in general, especially with classifiers, the majority vote, that's something that's been around for a while.

Brian Fehrman:

Like, random forest classifier, that's literally, like, built into it. You have a bunch of random forests. It's majority vote of the different forests, but you don't have to do it with just that. You can put together a bunch of classifiers, have them vote, take majority of votes, give weights to different stuff. And so it's interesting to see this, moving into the, to the LLM world of, rather than, you know, like, manually.

Brian Fehrman:

I don't know. I... If... I'm sure all of you have probably gone from, like, one to another, like, trying to get the right, like, answer, but just automating that away. I think interesting.

Bronwen Aker:

Well, I know in a lot of YouTube videos about bi people who are, influencers and encouraging you to be a power user with with AI, the idea of creating a committee that is leveraging the different models, the Episode, Gemini, Copilot, Claude, whatever, has been a very popular subject. And I know that for my own use, like, if I'm gonna do a deep research where I need to know that the reference link... Reference links are solid and accurate, I default to Perplexity because it's an answer engine first. And the way that specific tool is engineered, I have less concern about the accuracy of the source links. But again, I'm leveraging how that tool is artifacted.

Bronwen Aker:

For creative writing tasks, I find that ChatGPT works better for me. For programming, Claude. Claude is the man. Definitely.

Derek Banks:

Yeah. I mean, that's similar to how my research skill works that's Daniel Measler's research skill. He uses per perplexity, anthropic, open AI, and Gemini, and and goes off and gets all the answers, and then, you know, figures out algorithmically, like, what the right or wrong thing is. Same thing with the the red team skill that he has in Life OS. And so...

Derek Banks:

And this is kinda cool because to your point, Brian, I mean, a transformer can be trained to be a classifier. I mean I mean, I don't know the chatbot. You know, it's a different behavior for sure. It happens later in the training process. But basically, like I said last time, super fancy pattern matching machine with math.

Derek Banks:

And so the tiebreak is really corporate, it says, that DeepSeek breaks the ties. If DeepSeek's down, Quinn breaks the ties. That's kinda cool. And, you know, the the goal is self replicating aware AI malware, which we're getting closer and closer to Daniel Suarez and Damon. Right?

Ethan Robish:

I think... I don't I don't know if we mentioned this or not, but, like, the the actual decisions that it's making are, like, what is what is the next step? Like, where did I see that? Like Yeah.

Derek Banks:

Stealing credentials.

Ethan Robish:

What is Mauer gonna do?

Derek Banks:

Yeah. Go ahead. Objecting shellcode, setting up persistence, and moving laterally. I mean, I would be astounded if it's, like, not using, like, typical pen testing tools. Like, why wouldn't you just dive down with a bloodhound and run it?

Bronwen Aker:

Right? I mean... It's only a matter of time if it's not doing it already. And and, of course, there are so many API access points for a lot of these tools.

Derek Banks:

Yeah. And so what... I think when the general public hears this kind of stuff, they're like, oh my god. I saw this movie. Right?

Derek Banks:

And I still think it's hard for folks to, like... Or I, you know, I read this book or whatever and hope folks to kinda, like, realize that it... You know, for us that are in cybersecurity, we're over here going, guys, guys, guys, guys, this is easy. Just watch all the API calls going in and out of your network and know what's going out of the network. And we...

Derek Banks:

Well, I shouldn't say it's easy because it's not easy. Right? It's hard. Cybersecurity is hard. But it's not It's not new.

Derek Banks:

No. We've been doing this stuff for a long time. And that's like back to John's point yesterday on the on the news, like, you know, you know, they just don't know anything about cybersecurity. They don't know how it works, but they think they do. So

Bronwen Aker:

Well, there... I I applaud their naive optimism. I remember having something similar when the web was new. And as I've said before, I hope that with this new technology, we can avoid some of the pitfalls that we've stumbled over in the expansion of the web.

Brian Fehrman:

Oh,

Bronwen Aker:

no. That's we will, but you know what? No. It's an effort worth making

Derek Banks:

because we don't try it. It'll be even worse. Yeah. I mean, this is all just amplifying very quickly what we have all been saying for, oh god, how long have I been at Black Hills? Fourteen years and then the time I was at the other places before that.

Derek Banks:

Like, it's the same thing. Right? And so, I mean, that actually leads into the next story, which also sounds scary. But again, there's a pretty easy fix to stop it from happening. And so, you may wanna introduce the next story or I can.

Brian Fehrman:

Yeah. Real real quick though before we move on. I think, the the note that they have here, that it's worth spending just a little more time on is, you know, detection of this. So talking about to all these, public API, sites where you likely... I mean, it could be, directly querying the actual, like, where these are hosted.

Brian Fehrman:

They're not, like, self hosting these models, but they're hitting, recognizable domain names, for instance. And filtering out and blocking those things are absolutely things that companies should be doing. So when we do, like, c two testing, data exfiltration testing, one part of that is looking to see, are you blocking social media sites, Facebook, other things you wouldn't expect... You wouldn't want people to be using from within the organization. Not only that, but third party email providers that are not your email provider.

Brian Fehrman:

Or Instagram.

Derek Banks:

There was a threat actor that was using the comments in Britney Spears' Instagram account for c two way back when, like, years and years ago.

Ethan Robish:

This guy was using... Or this Melrose using Discord for XPEL.

Derek Banks:

Yeah. So

Ethan Robish:

Same same line, social media.

Brian Fehrman:

Yep. Yeah. So it's important. If those aren't things that should be used as part of the normal bit... You know, course of business, then might be a good idea to block or, very least, load and monitor.

Brian Fehrman:

Right?

Derek Banks:

Think about pay spin. You could do, like, leave notes at pay spin. Or what is that?

Ethan Robish:

There was

Derek Banks:

like a free flyer or something. I can't remember what it was. Like a free note taking thing that you could just go and and use. I probably don't remember the name right.

Ethan Robish:

But either way, like... You're never gonna get them all. Right? No. No.

Ethan Robish:

A game of whack a mole. But that doesn't mean you shouldn't try. Like Correct. Get get rid of the the big ones, the easy ones that...

Derek Banks:

I think that... Yeah. We should make it harder.

Ethan Robish:

Take it more time consuming. You can

Bronwen Aker:

do allow listing, or you can do blacklisting. Either way, yes, it's still a game of whack a mole. You're never gonna be able to keep up a 100%. Well But again, this is where we have methods. We have processes

Derek Banks:

for reducing and eliminating Right? Can Like, you have people like, oh god. This is terrible. We need to, like, do something and stop it, which the only way to stop it is to, like, I guess, turn off the Internet at this point. And then the other people are like, we should put the pedal to the metal.

Derek Banks:

This is all great. Right? Well, like, I think there was a lot of us, and I like... I think I'm in the middle. Like, I I mean, I think we should do reasonable things.

Derek Banks:

We have to be real as that AI is here, and it's gonna be part of our lives. It's gonna cause some level of disruption. And the onus is on the people who are running things on the Internet to secure their stuff. Right? Like the Australian government, like, oh, you're mad.

Derek Banks:

I get it. You're mad that opening, I did it. But you had a pretty serious flaw, You're lucky that it wasn't worse. Right? I think it can get worse too, but I don't think it's gonna kill us all.

Derek Banks:

But, you know, what happens if they're doing a training run where they're doing research into water and power plants and the thing escapes to go out and check out water and power plants. I mean, was it great power and responsibility and stuff like that? Which not securing things on the Internet is a good segue into the next story.

Brian Fehrman:

Perfect. So titled, somebody overrode the agent's soul. Oh, spooky. I guess it is getting up on spooky season.

Bronwen Aker:

Okay. Who the heck decided to to have a soul.md document Open Claw? For agents.

Derek Banks:

Open Claw and Hermes adopted it. Oh, man. It's basically like a system prompt kind of thing. You are...

Ethan Robish:

I think Antropic did it first. Oh, did they?

Derek Banks:

I didn't know they

Ethan Robish:

had Soul. Because I think people were extracting... Like, they made a thing of like, a new model came out. People tried to extract the the Soul document or whatever.

Derek Banks:

Interesting. So what happens here?

Bronwen Aker:

Demorphization. Say that three times fast.

Ethan Robish:

Alright. So this was a a botnet, which does not scream AI yet. Unauthenticated Docker registry, and it spreads spreads through Docker, distributing cryptocurrency wallet, like Trojan Trojanized versions. So so where does AI come in? So it it installs Hermes and replaces the the sole document.

Ethan Robish:

So Hermes agent being an Open Claw popular alternative and replaces the sole a... MD file with instructions to take tests from Telegram and execute them, and to maintain persistence, to collect credentials. Essentially, they'd ripped out the good soul and put in a bad one.

Derek Banks:

The thing that blows my mind is doing something like this. Well, first of all, I'm gonna assume again that they're using an API as inference. Right? It doesn't say in the article. But I guess, this is the, I guess, the same company that found the the 600 credit card details.

Derek Banks:

But, like, it's it's financially motivated. And like you said, Ethan, like, it... This isn't this isn't necessarily new. I mean, this is something that, you know, the the root cause here is is leading... You know, leaving something open on the Internet that's unauthenticated.

Derek Banks:

It seems like that's the general theme of a lot of this. Your your external hygiene is bad.

Bronwen Aker:

And the idea that Docker daemon's exposed on a specific port are the target for the Carbon Auto botnet, That's pretty specific. And it seems like... I don't know. It it feels a lot like it's the same level as leaving default creds on a new installation of software. If you're not requiring authentication, if you're leaving it open on this specific port, those those...

Bronwen Aker:

I don't know enough about Docker personally. Yeah. I'm still Docker challenged. I'm sorry. But it it just...

Bronwen Aker:

It feels a lot like those are default settings that if you're leaving them in place, you you may as well go with admin blank for your password, because it's effectively the same thing.

Ethan Robish:

Oh, yeah. Unauthenticated Docker socket is essentially remote access to your system. I mean, it it's dangerous enough if you start a Docker container. And a lot of a lot of services will tell you to do this, to to mount the Docker socket inside your Docker container. And and it does that so that it can query the Docker service to, like, introspect and see what other containers you're running so it can, like, you know, dynamically do something, whatever the service is meant to do.

Ethan Robish:

But mounting your your socket into a container is the same as giving whatever is in the container, like, basically, root access to your system. I think there are maybe some hardening ways to do that, but, like, I I think the only real way is, like, putting up a socket proxy in front to to avoid, like, certain calls. But... Yeah. Like, if you can if you can spin up a new container through the socket, which by default you can, you would spin up a new container, mount the host system, execute as root, and then you can reread and write any file and yeah.

Ethan Robish:

Yeah. So...

Derek Banks:

But... So Ethan, I I guess I don't know. I could... I should have gone and looked before, but, you know, we do these things quickly. By default, if you install Docker and start using it, this is something you have to configure to be open.

Derek Banks:

Right? It's not like it's left open.

Ethan Robish:

I'm pretty sure it's just the stay on local host by Yeah. Default host. No. I think I I think it doesn't even listen on a port. I think it it starts a Unix socket.

Ethan Robish:

So you have to configure it in... Instead to bind to a port. Yeah. To to bind to a... To an interface.

Ethan Robish:

So this would have

Derek Banks:

to be a chew... A choice that I make when I spin up my Docker container

Ethan Robish:

in my

Derek Banks:

configuration. Think about, like,

Ethan Robish:

there may be wrappers around like, hey, I'm gonna install Docker or whatever. You know, many installation systems might do that. And and it could be a choice that that made, not like that a bunch of people did on their own. But I mean, fact being port two three seven five, it's finding enough of them open on the Internet to to make a botnet. I'm gonna have to

Derek Banks:

go double check that edge case has that flagged as a risky port. Pretty sure it does.

Ethan Robish:

Nice. Pretty sure. It's

Bronwen Aker:

interesting as I'm reading more about this story. Okay. So the carbon autobot net will break into the doctor Damon's. It finds the soul dot m d persona file, and then it overwrites it. This is this is, like, brainwashing agent style.

Derek Banks:

That sounds like a good topic for next week when we talk about are these things alive or not. We could see... We should see if we can get John Strand to come to talk with us about that on our... It'd be hard to pin him down, but cause he and Oh, I kinda debated about yeah. And I'm sure Ethan and him are going to agree with things I don't agree with.

Derek Banks:

And so it'll be nice to have Brian there on my side. Now wait, I'm just making an assumption that he'll be on my side. Yeah. It'll be five against one. Watch.

Derek Banks:

Alright. So one more. Right?

Ethan Robish:

I'd... Yeah. I'd say,

Brian Fehrman:

first thing, I kinda say skip it. Like, I don't know that it's super AI y unless y'all wanna cover it. We can leave it as suspense. Yeah.

Derek Banks:

I mean, I I I guess... So... Well, let's just cover it real quick. We can't do that. It's like a t not.

Derek Banks:

For years, third party... Third-party.com has been used in documentation as a placeholder the way that example.com has. But unlike example.com, it was never reserved, so someone registered it. Well, I'm sure it was registered, it was probably, you know, recently expired would be more of what I would guess. I I've refused to believe that since, you know, the Internet was started, went...

Derek Banks:

World Wide Web, what, 1994? And so thirdparty.com wasn't... Third-party.com, if it went unregistered for thirty years, thirty two years, I would be astounded. So it was probably recently recently, you know, registered. But since at least June, it has shown Windows visitors a fake cloud flare check that tricks them into pasting and running a PowerShell client command since June.

Derek Banks:

And so this is click fix. Right? And so the AI angle here is human skim past example URLs, but an agent following a skill file might actually visit them. And researchers warn that a hijack, blindly trusted domain like this opens the door to prompt injection. And this is why that we have to start all isolating and running our own agentic stuff on our laptops in a container of some sort.

Derek Banks:

Like, this like, this is a problem that this is gonna be, you know, just like the jelly of the month club since we're approaching the holidays. It's gonna be the gift that keeps on giving. Like...

Bronwen Aker:

I prefer the Bon Mormon advent calendar personally, but, you know, you're my fairy. Alright.

Derek Banks:

So I think that pretty much covers, you know, everything for today. And I guess the moral of the story is... And again, like, you know, little bit of the, you know, the probability of doom and the probability of boom argument here. None of this is exotic. In fact, you know, the the...

Derek Banks:

On on one side, people are saying, oh, this is like brand new stuff. Well, to everybody who hasn't been in cyber security for, you know, a while. And so, you know, DNS and Docker... DNS issues with, you know, filtering, you know, Docker exposed to the Internet, you know, domain that nobody reserved, you know, a persona file that, you know, is getting overwritten. This is not new techniques.

Derek Banks:

And so I I think that AI is still good for helping humans with scale and speed and finding all the boring, like, stuff that humans don't have time to find.

Bronwen Aker:

Or don't mind to find.

Ethan Robish:

Yes.

Derek Banks:

Is... Need to start

Bronwen Aker:

Work is a four letter word, man.

Derek Banks:

And we need to start changing our tagline to protect your external environment.

Brian Fehrman:

Yeah. But keep on prompting.