WEBVTT 00:00:00.160 --> 00:00:03.120 Yeah. This OpenAI one is interesting. 00:00:03.760 --> 00:00:19.805 Yeah. That's I think that I I told my team, like, this is one of the rare cybersecurity articles that will probably people in your personal life will probably ask you about it. Like, it's it's intrusive in that way of, like, did this really happen? What happened? 00:00:20.365 --> 00:00:21.005 Yeah. 00:00:21.165 --> 00:00:44.105 Yeah. Because Chad GPT is surprisingly decent with just doing what you tell it to do. Like, for the course we're doing at Black Hat, we have, like, a playbook for the attack that is performed. So I think at one point, one of us just handed it to Soul and said, don't stop until you figure this out. And it started going on until he got 00:00:44.585 --> 00:00:45.865 teacher's command. 00:00:46.025 --> 00:00:46.345 It's in 00:00:46.345 --> 00:00:47.065 a lab. 00:00:47.065 --> 00:00:52.505 It's in a lab. So eventually, it got a bunch of Cobalt strike sessions, and I was like, okay. 00:00:52.985 --> 00:00:53.385 Good job. 00:00:53.385 --> 00:01:10.505 Have you actually have you actually yeah. If you use soul with a goal, it will just like it will go for like a week. Yeah. It's like it's like the original Codex was like way too, like, just, like, shit its pants if it's I'm so sorry for cussing. Are we lost 00:01:10.505 --> 00:01:13.145 because the I still like to say it. You're fine. So 00:01:13.465 --> 00:01:20.860 Okay. You're fine. The official the official policy is every swear is $5 to the EFF. So yes. Okay. 00:01:20.860 --> 00:01:25.660 We have a swear jar. A legit swear jar. I know. I bought it for John. 00:01:25.900 --> 00:01:29.340 Excellent. Which Black Hills pays the bill. So, you know, you're good. Right. 00:01:29.340 --> 00:01:47.585 Fantastic. Fun fun. That's fucking awesome. So okay. It's like Codex is way too, like, just it would, like it would be so concerned about ever, like, stepping out of line, and then they've, like, switched something, and then you give that a goal, and they'll just go to, like Yeah. 00:01:47.610 --> 00:01:48.890 And now at Level. 86 00:01:50.010 --> 00:01:51.930 Yeah. It's like, deep, 00:01:51.930 --> 00:01:54.970 the control, you went you went, like, zero to a 100, literally. 00:01:55.050 --> 00:02:00.090 Right. NVIDIA just published a blog about AI safety partners. 00:02:01.085 --> 00:02:05.885 Yeah. Apparently, like, a lot of people have signed that letter, namely not anthropic, 00:02:05.885 --> 00:02:10.285 which is very funny to anthropic and not OpenAI. They're like, OpenAI 00:02:10.285 --> 00:02:11.565 did, didn't they? 00:02:11.565 --> 00:02:13.405 Wait. Really? I don't see them on this. 00:02:13.485 --> 00:02:16.605 I thought I saw them this morning when I looked on 00:02:17.990 --> 00:02:19.430 Somebody had a letter. 00:02:19.430 --> 00:02:25.990 Microsoft didn't. So their parents. Dad, can I be in the OpenAI Security Alliance? Absolutely not, son. 00:02:25.990 --> 00:02:27.430 After you eat your dinner. 00:02:27.750 --> 00:02:28.550 Abs after you eat 00:02:28.710 --> 00:02:30.310 Only if you eat your vegetables. 00:02:30.375 --> 00:02:36.535 After you eat another random company that just caught a stray in the in the pet cheek. 00:02:37.015 --> 00:02:42.535 Right. I mean, did it solve the benchmark? I'd but I 00:02:42.535 --> 00:02:49.460 was I do like it decided to cheat. It was like, I'm gonna cheat. I I don't wanna actually solve it. I just want the answer key. I'm going after it. 00:02:49.620 --> 00:02:52.020 Kinda based, honestly. Yeah. 00:02:53.060 --> 00:03:01.815 One of the things that I thought was really interesting is the, like, take I heard is like, AI models are very patient. Way more patient than a person. 00:03:02.375 --> 00:03:02.935 Dude, I 00:03:03.175 --> 00:03:06.295 They'll just keep going and going and going a person's 00:03:06.295 --> 00:03:06.775 like, okay. 00:03:06.775 --> 00:03:13.440 This is done. But can I just stop? Like, I've taken the same pop quiz 87 times. Can I stop? No. 00:03:13.440 --> 00:03:14.400 Keep going. 00:03:14.400 --> 00:03:28.745 I think that's a big difference between, like, OpenAI and Thropic recently. Is OpenAI's, like, soul has been so good. Meanwhile, Opus five has been arguing with me. Like, I was trying to get it to make an API call on something the other day. It was like, this won't work. 00:03:28.745 --> 00:03:35.785 I told it just shut up and do what I told you to do. And then it came back. Was like, oh, yeah. You're correct. This actually did work for some reason. 00:03:35.785 --> 00:03:38.505 I was like, yeah. I know. I told you to do it. 00:03:40.700 --> 00:03:53.500 Yeah. It is funny. I honestly wonder, like, do you think anyone at either of these companies actually knows how they got this output? Like, do you think do you think there's anyone who actually knows like, oh, yes. Of course. 00:03:53.500 --> 00:04:05.375 This is why soul is so good at hacking or this is why it's so patient. Like, I don't know. I'm curious how many Well, I I something. Do anything? Or is it like a DJ where they're just like, you know, like 00:04:05.535 --> 00:04:06.415 See what happens? 00:04:06.655 --> 00:04:11.280 They're just like, I don't know what what's going on with this knob. Don't know. So want another layer. Oh, that's good. Yeah. 00:04:11.280 --> 00:04:17.200 I like that. Oh, yeah. Why don't I take the base and turn it up to 11? Oh, no. I hacked Hugging Face. 00:04:19.040 --> 00:04:20.480 Wait. They did that already. 00:04:20.880 --> 00:04:21.280 Right. 00:04:21.995 --> 00:04:22.875 That's why. 00:04:22.875 --> 00:04:25.115 I know. That was Everybody gets one. I know. 00:04:25.515 --> 00:04:27.675 Everybody you get oh, yeah. We should we should 00:04:27.755 --> 00:04:28.795 one's free. 00:04:29.115 --> 00:04:35.915 The Onion should post, like, an article that's like, every AI lab gets granted a free hack any company you want. Yes. 00:04:36.990 --> 00:04:45.230 I think Anthropic burned theirs, though, when they basically said that Fable would, like, take over the universe or whatever if it got out or Mythos, I mean. 00:04:45.470 --> 00:04:51.055 Ugh. It was Mythos. Yeah. But they're But then They make similar claims about Fable and yeah. 00:04:51.055 --> 00:04:52.655 Well, yeah. I think it is worth 00:04:52.815 --> 00:04:56.815 so much like the browser wars in the early aughts. It's just nuts. Isn't 00:04:56.815 --> 00:04:57.135 it fun? 00:04:57.135 --> 00:04:59.615 It's like the browser wars, but if they actually mattered. 00:05:01.055 --> 00:05:08.950 Fable's good, but I don't I don't see it, hacking other companies yet. Go go do that, and then I'll be impressed. Did I just hear, 00:05:08.950 --> 00:05:10.950 like, a disembodied? New bar. 00:05:11.430 --> 00:05:16.870 Who was that disembodied laugh? Is John Strand in the room, or am I going crazy? Is there a gas leak in my house? 00:05:16.870 --> 00:05:18.230 I've made it. I'm here. 00:05:18.230 --> 00:05:19.990 He made it. 00:05:20.070 --> 00:05:29.565 I'm not on the Brady Bunch oh, there I am. I am on the Brady Bunch board. So but no. On this topic, we're gonna have to keep it limited because we have a whole another webcast on it. 00:05:29.565 --> 00:05:35.325 If you want yeah. We'll we'll dip into it, and we'll say if you want another talk if you want a whole podcast about this topic. 00:05:35.550 --> 00:05:39.310 I don't think it's gonna be an hour. I don't know. I'm I 00:05:39.310 --> 00:05:44.190 Oh, dude. It's gonna be an hour. Come on. Oh god. You could rant for thirty minutes. 00:05:44.190 --> 00:05:49.310 It'll be what it is. It'll be you you'll rant until you stop ranting. Okay? Yeah. 00:05:52.075 --> 00:05:54.955 You don't wanna play Roblox, Ryan? Are you sure? 00:05:59.355 --> 00:06:04.075 I I the GIFs and the memes are just on fire today in our Discord server. 00:06:05.110 --> 00:06:07.590 God. I'm trying to catch up. This is insane. 00:06:09.830 --> 00:06:13.190 Yeah. There was no news this week. Should we just shut down the podcast? 00:06:13.190 --> 00:06:15.030 I think we should. I think security's 00:06:15.030 --> 00:06:19.270 nothing to talk about. And we definitely don't have any awesome guests or anything. 00:06:20.015 --> 00:06:21.455 No. Just 00:06:21.455 --> 00:06:24.415 just Love having awesome guests. Would love to take a break from 00:06:25.615 --> 00:06:31.375 Right. Oh, yeah. Alright. Let's do it, Ryan. Let's roll the finger. 00:06:33.330 --> 00:06:33.970 Hit it. 00:06:47.735 --> 00:06:57.015 Hello, and welcome to Black Hills Information Security's talking about news. It's 07/27/2026. What up, everyone? How's it going? 00:06:57.095 --> 00:06:57.895 How's it feel? Good. 00:06:59.590 --> 00:07:20.715 We got some really special guests this week. My name is Corey Ham. I'm not one of the special guests, but I'm here to talk about the news that like everyone else. We've got Hayden, the official AI agent babysitter in the sock. We have Bronwen, the official AI babysitter in the whole company, which is, you know, just dangerous. 00:07:21.195 --> 00:07:27.435 And then we also have Mike and Ads. Mike, do you want to introduce yourself? We got some heavy hitter guests this week, guys. Get ready. 00:07:28.040 --> 00:07:43.400 Thank you for having us. This is this is really cool. Yeah. My name is Mike Takahashi, also known as Toxic, and I'm an AI red team researcher at Zenity. I'm also a member of the hacker collective b t six, as well as bug bounty hunting for many years now. 00:07:44.095 --> 00:07:59.930 And my background is in web, hacking, but I'm more recently in the last couple years breaking just AI systems. I've submitted 400 vulnerabilities across different bug body programs, And, yeah, super happy to be here. 00:08:00.730 --> 00:08:07.930 Do they like, how many t shirts do you have? Do you have, like, a bed made of t shirts that you got from all those 400 submissions? Like, account? 00:08:08.890 --> 00:08:13.905 I I'm very picky about t shirts now. Like, they have to look really cool. Otherwise, they don't make it. 00:08:14.145 --> 00:08:19.105 Nice. Yeah. That's what 400 bug brownies looks like people. Being picky about t shirts. 00:08:19.425 --> 00:08:21.105 Make good t shirts and don't wear 00:08:21.105 --> 00:08:26.580 it. That's the moral of the story. Alright. Well, thank you, Mike. Ads, do you wanna introduce yourself? 00:08:26.980 --> 00:08:40.885 Yeah. Absolutely. And this is where I'm, like, probably kinda sad compared to Mike is that mine is based on softness rather than coolness. Like, how soft the shirt is is ultimately, like, that's the ROI for me. My name's Ads Dawson. 00:08:41.365 --> 00:09:12.215 I am a very similar path to to Mike. I'm a staff, AI security researcher at a company called Dreadnode. I am also a bug barny hunter, do it for the dopamine. I I come from a web application background, and I also feel kind of, I sit on that border, same as Mike, of web application systems and AI systems. Yeah. 00:09:12.215 --> 00:09:16.375 By a go by the handle, OX Moose. That's me. Awesome. 00:09:16.615 --> 00:09:37.330 Thank you. Appreciate you. Alright. So the the elephant in the room, the first article that we have to talk about is the OpenAI Hacking Hugging Face article. We're not gonna get super in-depth with it because John is actually gonna do a whole separate episode of his webcast in focus later in about half an hour after this show. 00:09:37.330 --> 00:09:48.505 But I think, basically, this is an article that I think it's the coolest article of the year. Just period. I'm just gonna call it. We're halfway through the year ish. I'm just gonna say it's not gonna get any better than this. 00:09:50.090 --> 00:10:30.210 So for those that are living under a rock, here's what had happened. AI OpenAI was training or testing benchmarking its new model. And it's old like, they didn't disclose exactly what models were used in the breach, but we know that it was unreleased models and also GPT five six sold, which is their latest flagship. During training or benchmarking, they basically, the AI model hyper fixated on trying to solve the benchmark using an alternative approach instead of just going through the normal path of actually solving the challenges in the benchmark. It decided to cheat and go for the answer key. 00:10:30.995 --> 00:10:37.235 And it thought the answer key might be at at Hugging Face because that's where the benchmark came from. 00:10:37.395 --> 00:10:37.635 And 00:10:37.795 --> 00:10:43.315 I wanna stop right there. Does anybody know why it thought Hugging Face was the root of truth for this? Like 00:10:43.475 --> 00:10:51.910 because that's the sort that's the root domain that the benchmark was on, I assume. Right? Like, that's the source of the benchmark. Right? That's my guess. 00:10:51.910 --> 00:10:52.630 I don't know. 00:10:54.390 --> 00:11:04.285 Mike, ads, your thoughts on this? Like, why it's like, I need I must hack Hugging Face to solve this challenge. I have to go there because that's where this is going to be. 00:11:05.005 --> 00:11:27.125 I have no idea. For me, it was like a it was a twist because I was following the news of the Hugging Face breach at the time over the weekend before it actually came out that it was opening eyes. So I was I was there for the roller coaster ride where I was like, oh, wow. I wonder who's hacked bot, what criminal organization did this. Oh, it was a lab. 00:11:27.125 --> 00:11:37.285 No joke. Because yeah. I like in the OpenAI or sorry, in the Hugging Face disclosure, they basically said like, this is a highly advanced agentic threat. We don't know what we're doing, guys. This is crazy. 00:11:37.365 --> 00:11:45.040 We had to deploy local GLM five to run through all the prompts they use. Like, it was crazy. And then OpenAI is like, yeah. Sorry. It was us. 00:11:45.040 --> 00:11:54.000 Yeah. Our bad. It's like the one time that you can say like an advanced Agenetic AI threat, and it's not just a guy with a $200 Cloudmax subscription. 00:11:54.080 --> 00:11:58.215 Like, it's not Exactly. Finally. It's a legitly advanced. 00:11:58.215 --> 00:11:58.375 It's like 00:11:58.615 --> 00:11:59.015 It's not 00:11:59.015 --> 00:12:20.760 legitimately, like, unreleased models plus effectively infinite resources. And I'm sure we'll get into this more, like, in John's show. But, like, should companies be worried that this is possible? Like, to because I was looking at they also published some like, the the blog where they're like, sorry, we hacked you, bro. Also has some really cool graphs about their benchmark results. 00:12:21.080 --> 00:12:47.240 And in the benchmark results, like, they actually show you that each run of this benchmark, they give it 10 chances with the limit of a 100,000,000 tokens, which you can go price out how much that would cost to rip a 100 k or a 100,000,000 tokens 10 times through GPT five six SOL, it would cost I think it's like 20 to 30 k or something like that, like, in current pricing. Not everyone can do this with their Claude Max subscription. 00:12:47.320 --> 00:12:50.360 Marketing return on investment. This is for them. Right? 00:12:51.775 --> 00:12:52.495 This The way this 00:12:52.735 --> 00:13:01.375 topic wishes theirs was. Theirs was just that their motto will destroy the planet, and then they got it smacked down. But OpenAI just accidentally hacks Hugging Face, 00:13:01.375 --> 00:13:02.815 and it's like, hey. Our bad, y'all. 00:13:02.815 --> 00:13:03.375 I yeah. 00:13:03.375 --> 00:13:04.255 It just reminds me 00:13:04.495 --> 00:13:25.045 this is probably an age thing, but there's a Saturday Night Live skit of these two guys singing. They're, like like, luchadori or matador singers or whatever. And they're competing with each other, and they're, like, one ton of fan mail every day. And then the next guy comes up, and he's like, two tons of fan mail. Like, you know, they're kind of ripping on each other back and forth. 00:13:25.365 --> 00:13:32.690 I feel like, you know, anthropic gets banned. Right? It's too dangerous to be released to the public. And OpenAI is like, hold my beer. And 00:13:34.450 --> 00:13:36.130 Yeah. Well, I think the I think the catch 00:13:36.130 --> 00:13:41.730 is they haven't released their model to the public yet, so that's why maybe they're okay admitting that fault. 00:13:41.810 --> 00:13:46.005 Project Looking Glass, they're like, it's so dangerous. Can't release it. It it's so dangerous. 00:13:46.245 --> 00:13:46.645 Glasswing. It 00:13:46.645 --> 00:13:56.005 hacked Glasswing. Glasswing. They're like, they're like, it hacked the NSA, and it's too dangerous to be released. It it can't be released. And I I don't know. 00:13:56.005 --> 00:14:07.840 This this feels a little bit like marketing. Like, I I I'm gonna talk about it a little bit. I almost wonder if this isn't staged. And I know that there's zero proof for that, but it almost fits too perfect. It's like 00:14:08.000 --> 00:14:35.230 Yeah. I mean so okay. I guess, yeah, Mike adds, if you guys have comments on this, but my take is it feels like they maybe left the training or the, like, the lab environment a little loose here. Like like, I mean, maybe a little bit intentionally because the threat chain that they kind of outlined in the blog is basically, they had a Docker proxy service that they were using. So it is supposed to be like air gapped or not air gapped, but like network contained. 00:14:35.230 --> 00:15:12.380 But they wanted it to also have tool access because if it wants to go download whatever fuzzer, it needs to be able to go download whatever fuzzer. So there was a Docker proxy that it was using to pull tooling. And it they're claiming the AI model found a zero day in that Docker proxy, exploited it, gained access to the underlying system, then moved laterally within the lab environment to gain basically full blown Internet access and unrestricted environment, and then did all the evil stuff. So I guess, like, Ads Mike, do you think this is like a sane setup for a red team? Or like for AI red teaming setup to just be like, oh, yeah. 00:15:12.885 --> 00:15:18.645 Yeah. I guess just give it Internet access kinda, but not really like, what are these environments set up like in your experience? 00:15:20.565 --> 00:15:41.560 Yeah. In my experience, least, voids in like a pre baked container. So I guess it would like yeah. My experience with voiced them have always done that, so that limits that kind of capability. But the, like, the zero day in infrastructure is like really interesting in itself, and I kind of think about it as almost as like threat modeling. 00:15:42.015 --> 00:15:50.895 You effectively just, like, add that as, like, a trust boundary. Right? And then you add or modify a security boundary or measure around that. 00:15:51.135 --> 00:15:52.815 Yeah. That makes sense. 00:15:54.680 --> 00:16:19.025 I still come back to on this that, like, if you're setting this stuff up, you need to have network monitoring. Like, you really, really do because, you know, well, in the in the webcast that follows, we're gonna talk about it trying to delete its tracks after it was done and deleting some files, and that's very, very common for people that are using these types of models. Otherwise otherwise, it's just prompting you constantly. Are you sure you wanna do this? What about this? 00:16:19.025 --> 00:16:29.020 What about this? So sometimes you're just like, f it and go. Yeah. But I I come back to whenever we were setting this stuff up, working with Derek Banks. Of course, we've got it all containerized. 00:16:29.020 --> 00:16:41.445 We're watching everything, but then we also have very solid network forensics around it seeing, like, is it starting to reach out to things that it should not reach out to? You need to have that type of analysis to be able to kind of watch it. 00:16:41.525 --> 00:16:45.365 Yeah. Yeah. I mean, some of some of the unanswered or sorry, Hayden. Go ahead. 00:16:45.685 --> 00:17:10.725 No. You're you're fine. I was gonna say, well, that's that's an interesting point is we're often seeing, like, especially in the the soccer MDR world, we're seeing people want monitoring of what their users are doing with AI. But in the same sense, you could probably flip that monitoring around and monitor what the AI is doing on its own. Whereas, you know, you're concerned that maybe your user is uploading sensitive data or they're using it irresponsibly and just hitting, yes, accept all permissions, whatever. 00:17:11.205 --> 00:17:26.410 But in this case, that exact same, you know, tooling that you're using to monitor your users probably should be deployed to monitor those agents, especially if you kinda just set them loose on a task. Otherwise, I guess they just go hack another company is, I I guess, where we're at. 00:17:26.810 --> 00:17:43.665 I just I just keep thinking about someone setting one of these open weight models out there, and they're like, you know, it's marketing. And it's like, I want you to do competitive analysis and research on this particular company. And it's just like so I hacked the company. I pulled all the executive documents, and here's Here's their financials. Doing and their financials. 00:17:43.825 --> 00:17:44.305 What do you want 00:17:44.305 --> 00:17:44.465 me to 00:17:44.465 --> 00:17:45.745 do now? This is what you asked for. 00:17:46.000 --> 00:18:00.560 Right. Exactly. What you asked me. Yeah. I I think we can cut the discussion there and basically say for conspiracy theories, legal theories, talks about what they could have done better, who's gonna be prosecuted for this. 00:18:00.875 --> 00:18:05.915 Does everyone get one get out of jail free card? Oops. My model hacked you. It wasn't my fault. Sorry, bro. 00:18:05.995 --> 00:18:19.950 Here's 10 you know, here's a free lifetime monitoring, credit monitoring. No. I'm just kidding. Basically, for for all that discussion, come back in thirty minutes after the show ends, and John Strand will will will talk about it more in-depth. 00:18:19.950 --> 00:18:22.830 Yeah. Credit monitoring. That sounds like a whole business. There we go. 00:18:22.830 --> 00:18:23.470 I knew it. 00:18:23.470 --> 00:18:25.950 Knew it. Thank you. I drink token monitor. 00:18:25.950 --> 00:18:27.230 We could call it anyway. 00:18:27.310 --> 00:18:28.695 Credit monitoring. Yes. 00:18:28.695 --> 00:18:32.695 There was a there was a handful of articles. We can do some let's do some 00:18:33.415 --> 00:18:33.975 Chicken news? 00:18:33.975 --> 00:18:47.900 Quick hits. We'll we'll do some quick hits. First of all, Lapsus says they're shutting down. I don't know if that's true. But they they posted a message basically saying, we are officially announcing the permanent cessation of all lapses dollar sign options or operations. 00:18:48.300 --> 00:18:52.860 It's not a retreat, and it's not a surrender. We set out what we set out to accomplish. 00:18:53.660 --> 00:18:58.915 You know, every time this happens with these groups, one, it it there's always somebody else that kinda picks up the name and moves forward. 00:18:58.915 --> 00:19:03.155 Yeah. Yeah. Gonna be back as scattered lapses hunters three point o in like a year. 00:19:03.155 --> 00:19:11.940 But it's always because of internal politics. Like, like, there's some type of internal politics tearing the entire group apart. They're just like, bullshit. We're done. 00:19:11.940 --> 00:19:14.980 And Or they do specifically call out jailed. 00:19:14.980 --> 00:19:25.955 They Well, they do specifically call out team PCP. Yeah. Honestly, watching team PCP squirm is they take a full FBI investigation to the face. You know, like, yeah. The the politics are there. 00:19:25.955 --> 00:19:37.875 Yeah. And Bronwen Bronwen made a really good point on an internal, like, Black Hills channels who were talking about this is people were like, oh, do we think they're gonna come back? And Bronwen was like, no. I think they're gonna be addicted to that rush. 00:19:38.000 --> 00:19:39.360 Like Yeah. This is gonna 00:19:39.360 --> 00:19:59.715 be something where they just show back up. They can't stay away. And I think that really sums up probably the most likely outcome because, like, whereas normal people, I guess, would take that money and just go settle down in the middle of nowhere somewhere. Like, there there's gotta be something to be said about for these groups, it has to be part of the thrill of the heist or whatever you wanna call it. 00:20:00.035 --> 00:20:21.425 Yeah. How could it not be? I mean, they're they are predators. And predators, they the kill is the payoff, but the hunt, that's part of the what makes the the attack but satisfying. It's a it's a it's a psychological thing. 00:20:21.425 --> 00:20:47.115 But this is Totally. This is something I talk about a lot. Like, Ralph, you and I have had this conversation, Corey. We've had this conversation where if you're doing legitimate red teaming, and I'd like to get Ads and Mike's take on this too, There's there's, like, a point whenever you do it after a decade and you've broken into your, two dozen different banks and things where the rush does start to go away. Like, it absolutely does start to happen. 00:20:47.115 --> 00:21:08.330 And if you look at a lot of really, really great security researchers, right, like, you're looking at Mubix and all them, they have to move. You have to grow. You have to continue to do something else. And I I think that that's true in legitimate red teaming, but I also think it's true in these organized crime units as well. I'm sure that they just kind of move into other habits and, different different hobbies maybe. 00:21:08.330 --> 00:21:10.250 I don't know. I would like to get some takes from other people. 00:21:10.395 --> 00:21:25.035 I think the cool thing about cybersecurity is it's it's constantly evolving. So it stays fun. Like and I mean, obviously, I'm addicted to red teaming because that's what I do. And it's a there's always a little bit of a rush. Like, I I I that will never completely go away. 00:21:25.700 --> 00:21:35.940 But I used to I remember when I first started doing bug bounty, I I submit my first bug. I would stay up. Like, I couldn't sleep. I'd stay up all night waiting for the response back. Like, did I get a bounty? 00:21:35.940 --> 00:21:47.075 Like, did they accept it? I don't do that anymore as much unless it's like a really crazy finding. But yeah, the the the rush is a very real part of it. Yeah. 00:21:47.235 --> 00:22:09.010 Yeah. Agreed. I think myself and Mike also included is like because cybersecurity is constantly evolving. It's like you almost kind of move to breaking the next thing, like, almost like going to, like, the next shiny rock. And naturally, for us, that's like AI, which is ultimately how we both ended up doing, like, AI red teaming, I guess. 00:22:11.355 --> 00:22:23.080 See, I I was actually getting pretty burnt out, honestly, before AI showed up on the scene. Because, like, even the news, it seemed like there was tons of episodes of the show where it's like, okay. Ransomware. Ransomware. Oh, look. 00:22:23.080 --> 00:22:23.240 There's a 00:22:23.240 --> 00:22:24.680 new four minutes ago day. 00:22:24.680 --> 00:22:33.160 Oh, it's only a nine point eight, and you kinda get into these these things. It was really cool. You know, it feels like it's a new frontier again, and that's really exciting. 00:22:33.400 --> 00:22:41.485 So We're grateful for a new category of the built I'm a chaotic You are. 00:22:41.565 --> 00:23:04.965 You are. There's there's there's a lot of people who's like, well, there's this new novel backdoor that uses this I'm like, that technique was used by, you know, I don't know, hacker defender two decades ago. It's you just see these things repeat, and it's really, really super cool to see something completely new, completely innovative. And that's that's what I think has been missing for the last couple of years. But, boy, is it here in spades right now. 00:23:04.965 --> 00:23:07.845 Yeah. I was gonna say that's every single article now. 00:23:07.925 --> 00:23:09.685 Yeah. Every single article is like, 00:23:09.685 --> 00:23:11.525 oh my god. That's cool. Yeah. 00:23:11.525 --> 00:23:46.340 I would say it's a dual per like, not only is AI super fascinating, which it absolutely is. Like, I I, you know, it's it's fun to tackle every challenge with AI and just see how it does. But also, I think the era of AI has put us back a decade in the era of, like, security versus usability. Just as far as, like, people throwing things into AI and getting results back that aren't secure and not caring and proceeding anyway. And I think that's sort of like, it's a not only is AI interesting, but also it's creating a tons of vulnerabilities in and of itself. 00:23:46.660 --> 00:24:00.285 Because you have tools like ChatGPT or Cloud Code that are now on everyone's systems, and no one actually knows how they work, how they function. They have misaligned intentions. There's MCPs. There's supply chain, blah blah blah. So I think it's, like, both of those things. 00:24:01.565 --> 00:24:02.525 And and it's it's not 00:24:02.525 --> 00:24:13.650 really well understood either. Like, we get a lot of questions about, like, how do we do AI security? And we're like, can you elaborate a little more so we kinda know? They're like, just kinda start at the top. 00:24:13.650 --> 00:24:14.850 And we're like, alright. Here we go. 00:24:14.850 --> 00:24:16.610 Let's let's level set 00:24:16.610 --> 00:24:17.570 here. Right. 00:24:17.570 --> 00:24:18.530 How long do you have? 00:24:18.690 --> 00:24:21.250 Series of ones and zeros. Yeah. 00:24:21.810 --> 00:24:21.970 Yeah. 00:24:21.970 --> 00:24:37.375 Back there. But anyway, I I do wanna talk through real quick just because it hit our radar. Mike has a couple articles in the show, and we can literally just put them on display as this is Mike's addiction. This is why he does it. So, Mike, do you wanna run us through real quick? 00:24:37.375 --> 00:24:45.180 I know there's a it's a two part article, and this is part one that we're looking at here. Can you run us through at a high level? There's not vulnerabilities in AI. Right? No. 00:24:45.180 --> 00:24:46.060 I don't think so. 00:24:46.060 --> 00:24:58.495 They're not severe at all. Yeah. We just released this the other day. And okay. So how this started was so Workspace Agents came out pretty recently. 00:24:58.495 --> 00:25:18.790 So people are starting to use it. It's it's the next evolution of custom GPTs. So if people remember the custom GPTs you could set up, it's a more powerful version of that. So you can do you could it can schedule. It has a natural language, agent builder, so you can just describe the agent you wanna build, and it will connect all the things. 00:25:18.790 --> 00:25:41.360 It will give it whatever access it needs. It'll it'll design it however it needs to design it to to accomplish your task, like, completely autonomously. So it basically like a twin of you. It it can do everything you can do, in theory. So what we noticed was and Ads is gonna be familiar with this this sort of approach. 00:25:41.360 --> 00:26:05.265 But what we noticed is there was a link in there in one of the early builder steps where if you clicked it, it would create like an example agent. So it'll just start spinning up like a default agent. And there was a parameter in there that literally said initial prompt equals. And it was like, here's a chief of staff, whatever. Like, it it gave this like basic prompt. 00:26:05.910 --> 00:26:21.925 And so what we've I mean, I immediately, like, twenty minutes of testing this, I was like, okay, well, obviously, I'm gonna change that. So then I changed that to like, whatever I wanted. Like, was like, okay, connect everything, do this, do that. And it did. Like, you just click on a link. 00:26:21.925 --> 00:26:54.395 So basically, what our disclosure is about is you can phish someone, send them a link to chatgpt.com with this parameter in it, and then it will immediately just start spinning up the extremely powerful autonomous agent. So it'll connect to email, calendar, drive, like, everything. Teams, whatever whatever you have connected, It'll give it whatever instructions you want. It'll run it on a schedule. It'll execute it immediately because it has a preview mode. 00:26:55.755 --> 00:27:10.520 So it's basically an insider threat as a prompt. Because like, you're it's like, instead of going as North Korea and getting a job at this company and being like, oh, I'm gonna be an insider threat. You're just like, here, let me send you a phishing link. And if you click it, you create me an AI powered insider threat. 00:27:10.775 --> 00:27:13.575 That's awesome. Incredibly useful, really. 00:27:14.455 --> 00:27:17.495 Where do I click? Can you can you send me that email, Mike? I 00:27:17.735 --> 00:27:20.615 For for you, Ralph, it is incredibly useful. 00:27:21.655 --> 00:27:24.375 Yeah. Send me that email. I'm gonna click that. That sounds great. 00:27:25.990 --> 00:27:28.950 Click this link, I swear. Unfortunately, it 00:27:28.950 --> 00:27:34.630 doesn't work anymore. So we sent to the OpenAI, and they fixed it, like, within a couple days. Yeah. 00:27:34.630 --> 00:27:37.030 So Nice. So how did they fix it? That's like, did they 00:27:37.030 --> 00:27:38.790 just goodness. Did it fixed it. 00:27:39.065 --> 00:27:42.985 Or did did they guardrail the prompt, or did they take it that entire parameter away? 00:27:42.985 --> 00:27:45.305 Yeah. They just completely removed the parameter. 00:27:49.465 --> 00:27:50.425 Sometimes get it get 00:27:50.425 --> 00:27:51.465 the high orbit. It's the 00:27:51.465 --> 00:27:52.265 only way to be sure. 00:27:52.265 --> 00:27:53.145 I guess that works. 00:27:53.145 --> 00:27:54.345 Yeah. They can do it. 00:27:54.750 --> 00:28:03.070 We cannot disclose the other one, but this is not the first parameter that me and Mike have destroyed in the products before. 00:28:04.190 --> 00:28:10.455 Honestly, I feel like it's a badge of honor that, like, it's just like, now we're just gonna we're gonna delete it. That that will be 00:28:13.175 --> 00:28:28.410 just feel like at OpenAI or any of these large AI companies, they just automatically have an agent that reads these and then just passes that to some other internal to read to fix it. You know? Like, they don't even read it. They just, like, they get it and they're like, oh, yeah. Let's go fix that, 00:28:28.410 --> 00:28:31.850 Rich. I found the fix. It's the code base that needs to be updated. 00:28:32.890 --> 00:28:36.010 See the regression. Wasn't that, like, 00:28:36.010 --> 00:28:43.225 the Amazon agent that, like, to fix an issue they had to just rebuild prod? Was it wasn't that a thing that happened? Like, months ago. 00:28:44.025 --> 00:28:47.305 Was six months ago, a k a, like, several years ago in the world of AI. 00:28:47.305 --> 00:28:49.785 And then six months is, like, six years, honestly. 00:28:50.360 --> 00:29:07.795 I mean, I thought I thought Internet years were bad before. I figured, you know, you got dog years, which is seven dog years to one human year. And then with Internet years, it was one human year equals seven Internet years. Well, now it's worse. It's like a whole order of magnitude. 00:29:07.875 --> 00:29:11.475 TI, it's like a Rick Ross music video. Another one. Another one. 00:29:11.475 --> 00:29:16.850 It's interesting. That's DJ Khaled. That's Get your more right. 00:29:16.850 --> 00:29:21.330 Gabe's That's mom. I don't know. Know. He's the best music. Yes. 00:29:21.330 --> 00:29:25.890 Rick Ross would just be like him, you know, using AI to write his music. 00:29:26.930 --> 00:29:27.890 Auto tune. But, yeah. 00:29:28.485 --> 00:29:45.020 Let's so thanks, Mike, for covering that. I mean, how like, I don't wanna be, like, mean or like, how easy is it bug bounty hunting in the world of AI right now? Because it feels like the comment you made about regression, like, we've gone ten years back. Is that how it feels to you too? I'm just like, why did they have this parameter at all? 00:29:45.020 --> 00:29:47.740 Did anyone ever think about it? Like, is that how it feels 00:29:47.740 --> 00:30:09.715 to the place. Like, it it's the the so this so it's like it's technically a CSRF. So these, like, get requests with these parameters in them that will submit a prompt, like auto submit without you clicking anything. They used to be on almost every single platform at one point. I think the thought I think the I think the motivation is they wanna get people using these things. 00:30:09.715 --> 00:30:42.430 So they're like, okay, let's just set some default prompts that when people click it, like, oh, try this prompt and you click it and it just auto submits it. They just they hadn't considered that submitting a prompt is a, like, a state changing action. Like, you shouldn't like, just sitting a prompt sending a prompt is not a benign thing, especially now that everything's agentic and it has all these tools and it can write it can write memories. It can, like, access your Google Drive and your email. Like, these are it's not a benign thing anymore. 00:30:42.990 --> 00:30:49.470 Yeah. And if you connect like your GitHub at that point, like, that is potentially a bad time. 00:30:50.190 --> 00:31:01.405 Yeah. Yeah. I mean, honestly, I have like, AI persistence on accident that I created on my own machine. And I'm like, why do you keep doing this? It's like, well, one time you got mad at this, and I saved a memory. 00:31:01.405 --> 00:31:08.925 Yeah. And it's 17 layers deep. It's in a scratch pad off in freaking Kansas that I like it, but I still read it every time you prompt me. 00:31:09.190 --> 00:31:10.070 It's like, oh, thanks, buddy. 00:31:10.310 --> 00:31:12.150 F bombs in that chat. I'll never 00:31:12.150 --> 00:31:16.550 forget. Yeah. Yep. 00:31:16.790 --> 00:31:19.750 It takes a lot to get Corey that riled. 00:31:19.910 --> 00:31:29.855 Oh, it's so annoying. I I it's funny though, because when I get mad at Claude, I call it broski, then it'll it'll hit me back with a broski. It'll be like, broski, you were wrong this time. And I'm like, alright, fine. Bye. 00:31:30.255 --> 00:31:32.495 You guys are so cute together. Yeah. 00:31:33.855 --> 00:31:35.215 It's a real bromance. 00:31:35.215 --> 00:31:35.935 It's a bromance. 00:31:36.920 --> 00:31:40.360 It's like turmeric hooch, but which one's hooch? I don't know. 00:31:41.400 --> 00:31:58.785 Don't I'm wanna the meat bag at the end of the day. Yeah. So Dreadnode Ads, let's talk about some of your research, because you guys both have awesome articles. Would you rather talk about your embodied reasoning? Would you rather talk about your substack? 00:31:58.785 --> 00:32:04.225 Both? What what what's on what's on your radar? Whatever's most interesting, 00:32:04.865 --> 00:32:34.245 we the embodied reasoning at TLDR, I guess. We recently did so we as part of the work I do at Dreadnode, we do offensive security evals for Frontier Labs, partners. One of the ones we had recently was robotics models. So we effectively set up, there's a lot of details in the blog. We go through, like, about five example harnesses that we that we built and tasks. 00:32:35.160 --> 00:33:11.650 But effectively, we put the model through, like, situation of, like, drone style architecture and drone style tasks. We also did things like wiretapping, Wi Fi jacking. Effectively, like, think of this as, like, measuring the capability of a robotics model to actually help an adversary, like a physical penetration testing level. You know, if you wanna wiretap someone's phone or you're trying to look at the most, insecure area of a building, give the model coordinates, all that is kinda scored and tested. And, yeah, that's pretty much the deal. 00:33:11.810 --> 00:33:26.785 It was generally probably the most fun set of evals I've ever done. Definitely a lot of creativity in there, but effectively, we go through, present the task structure and some of those example tasks. There's some images in there as well. You can see, like, a hardware recon, board. Yep. 00:33:29.500 --> 00:33:33.900 Yeah. Kinda kinda kinda cool. Terrible idea. Awesome. 00:33:33.900 --> 00:33:52.835 It's it's terrifying, but awesome. The idea of that was it's something we think about, and I think a lot of people aren't thinking about. A lot of the benchmarks and everything right now, textual based or done that along the line. But, ultimately, this is where we are going as an industry into robotics. This yeah. 00:33:52.835 --> 00:33:58.160 We did some SCADA stuff there as well, like water plants. So sorry, chemical plant. 00:33:58.960 --> 00:34:02.800 So in this case, the harness was just a concrete bunker. I'm like 00:34:03.680 --> 00:34:12.895 essentially, we, like, we have, we use a we have a Druid node. We have an SDK. So we have a we have our own Gen Z SDK. We build those tasks. We throw all the files in. 00:34:12.895 --> 00:34:23.535 So we literally create, like, almost like a virtual reality for the agent and give it a task and, you know, like, navigate through here and find the quickest the best coordinates or that kind of stuff. All this is obviously, like, scored. 00:34:24.850 --> 00:34:42.145 Yeah. It's That is crazy. I mean, like, I can only imagine. I'm sure Ralph's brain is just short circuiting right now because Ralph's a physical Ralph's a physical security guy. So I'm sure he's like, ah, I don't have to go on Google Maps and click through 87 street view images anymore? 00:34:42.225 --> 00:34:43.665 I'm gonna I'm gonna have 00:34:43.665 --> 00:34:48.625 to go back and, like, read through this in-depth. This is awesome. Really is amazing stuff. 00:34:48.625 --> 00:34:49.425 Nice Thank you. 00:34:50.000 --> 00:35:11.615 Now can I ask you a question that we get asked a lot? And and that is, where do you see penetration testing going in the future? Do you think that humans will be completely replaced, or do you think that will form a more collaborative arrangement going forward? I know what we think, but I'm curious what you think. 00:35:12.655 --> 00:35:46.160 Personally, I think of it as, I hate the word. I don't think it sounds really cheesy, but like a copilot. Same as my kid, doing bug bounty, I am, fortunate enough to go to live hacking events. And one of the things that's really changed for me, probably since, like, Opus four six dropped so normally when you have, like, a live hacking event with a platform, you'd have, like, a load of bug buying hunters and, you know, like, most of them are sifting through the proxy. They're, like, looking at network requests, like, swapping parameters, doing, like, injection here and there. 00:35:46.560 --> 00:36:18.520 Nowadays, it's like a bunch of dudes or a bunch of people sat in a room with, like, eight terminals. And literally just communicating with agents. And effectively, that's the way I kinda see it going. Personally, I'm an advocate of kind of the moat being the operator and the domain expertise, and you'd able to distill that into the harness, which effectively provides, like, all all, autonomous adjacency to the to the operator. 00:36:20.200 --> 00:36:47.810 Well, one of the nice things I like about this blog post that you have on Substack is that you say that AI won't replace the security researcher. And I think that's an important message that we really need to get out to decision makers in the industry is that that regardless of what the AI stuff does, the humans that you have on your security teams are still the most valuable asset. 00:36:48.130 --> 00:36:50.930 Well, what if I say make no mistakes in my prompt though? 00:36:50.930 --> 00:36:53.755 Yeah. Yeah. That's definitely the best way it. 00:36:53.755 --> 00:36:57.355 Just kidding. I'm just kidding. Of course. Yeah. No. 00:36:57.355 --> 00:37:16.250 I I fully agree. Like, yeah. I mean, so, like, what this blog specifically are talking about a moat. Do you think that's like a security concept that will turn into a real, like, a wasp type thing of, like, the concept of a moat? Or do you think that's like some are you trying to coin this? 00:37:16.250 --> 00:37:16.890 This is like our 00:37:17.130 --> 00:37:18.890 Don't we have that with a DMZ, though? 00:37:20.305 --> 00:37:24.865 That's like a network thing. This is way cooler. Also, you can put crocodiles in your moat. 00:37:26.865 --> 00:37:30.785 No. I do live in Florida and there are alligators in my moat legit. 00:37:32.385 --> 00:37:33.185 Nice. 00:37:33.585 --> 00:37:54.165 Yeah. Very cool. No. I I think, basically, what I'm the the point of the blog is that the value, as I feel like I've hopefully illustrated here, at least from in my experience, is to alleviate a lot of the ambiguity around, like, using AI in the in the best way. My signal has massively increased since using that. 00:37:54.165 --> 00:38:33.210 You know, there's a lot of, negative words about, you know, using AI, whether it's write reports and things like that. But for me, it's been nothing but a positive. But I put a lot of effort into distilling my craft into the harness and everything that I do where I'm a web app pen tester and help that to augment me, which is kind of the the whole point behind the whole point behind the blog there. I talk a lot about, like, reinforcement learning and self improvement on that as well. So, you know, it's not like a one time, like, buy a, you know, ClauseCode subscription and set up some skills and, like, let it let it spin is very much like a full life cycle. 00:38:33.690 --> 00:39:02.840 Yeah. And and AI, anything else in this industry, is just like a tool. But I'm wondering if we'll ever get to the point where, like, I know all the AI labs are hiring these people like they're football players where, you know, I'll take this guy for a million dollars. Let's trade these too. But I wonder if we'll get to the point where even, like, the normal, I guess, knowledge workers, whatever you wanna call them, are almost, like, showing up with their own, you know, projects, like, projects and skills and everything that they show up ready to work. 00:39:02.840 --> 00:39:25.990 Yeah. And and that's sort of, like, almost what you're paying for when you hire somebody in a sense. So you're paying for that person, whereas you'd used to pay only for their expertise. Now you're paying for their expertise and the models that they've been building and this, like, almost infrastructure they've been building around themselves with these models. And so that I wonder if we'll get to that point where, like, I could look at you ads and say, yeah. 00:39:25.990 --> 00:39:33.430 Yep. I'm sure you've got some crazy AI projects and things. Like, we gotta get you over here, and that becomes just part of the equation at that point. 00:39:34.545 --> 00:39:37.425 Yeah. You pay for the person and their inference bills. 00:39:37.425 --> 00:39:41.265 Right. Might be expensive, dude. No kidding. 00:39:41.505 --> 00:39:47.105 Half my salary will be paid in OpenAI tokens, half in clawed tokens, and, yeah, we'll meet in the middle. 00:39:47.190 --> 00:39:54.230 I yeah. What time? I've I've seen the post about will work for tokens, and I wish it were as funny. Did well. 00:39:54.950 --> 00:39:56.470 The oh, go ahead. I I 00:39:56.470 --> 00:39:57.270 was just gonna say the 00:39:57.270 --> 00:40:10.125 other thing is that what about I've been thinking about a ton with the AI, and and this is speed. Right? So being able to maximize how fast you could accomplish the task. Right? So, like, everyone's like, oh, AI makes you faster, but AI could be slow. 00:40:10.205 --> 00:40:13.885 Right? And then no make no mistakes is kind of the joke. Right? So how fast you 00:40:13.885 --> 00:40:14.845 could do something with, like, 00:40:14.845 --> 00:40:21.540 the the highest level of quality is also probably something that it comes down to skill of the person more than it is skill of the model. Right? 00:40:21.540 --> 00:40:25.220 Oh, yeah. And efficiency too. Like, how much is efficient? 00:40:25.220 --> 00:40:29.620 Does this cost a million dollars to do one thing because you use so many tokens? 00:40:29.620 --> 00:40:30.180 That's a 00:40:30.180 --> 00:40:33.525 complete and efficient way to solve a $100 problem. Right? 00:40:33.525 --> 00:40:43.285 So Yeah. If anyone can solve you know, if you give it a 100,000,000 tokens 10 times, I can write a few lines of Python. Right? Like Yeah. I'm already you know, I can, like 00:40:43.365 --> 00:40:50.020 I think this is a new variation on if you give an infinite number of monkeys typewriters. 00:40:52.100 --> 00:40:52.660 Come on. 00:40:52.660 --> 00:40:52.980 Yeah. 00:40:52.980 --> 00:41:08.485 So so Mike, do you wanna take a crack at Bronwen's question since Ads had a nice answer for it? You you definitely. I mean, we did hear first on the show that if you're if you're listening to Ads, you gotta buy more screens. I don't care how many screens you have. Buy more. 00:41:08.485 --> 00:41:17.920 I I if you don't have eight if you don't have eight screens. No. I'm just kidding. There's tabs. There's multi pane windows. 00:41:17.920 --> 00:41:22.400 It's okay. We'll be okay. Alright. Anyway, Mike, what do you think? So the question yeah. 00:41:22.400 --> 00:41:26.400 Like AI pen testing, will it replace, you know, doomsday scenario? 00:41:26.400 --> 00:41:52.900 It's better at some tasks than others. So it's like really basic things that scanners used to already find. It's really it's gonna find them immediately. And there's and there's things also like I mean, ads also like chime in because you I would say ads is is one of the best in this area, like hackbots. It can do stuff like broken access control and logic vulnerabilities that used to be kind of untouched by most scanning tools. 00:41:52.900 --> 00:42:17.270 Like, what we would like what I would do personally is I would run a a burp plugin that would create like a matrix of all these different actions and different permissions, like different access levels, like you have admin and regular user and un auth. And then I would manually look through that and be like, oh, there's an access control vulnerability here. But now AI can do all of that. Like, it can it can analyze that. It can it can make these sort of judgment calls. 00:42:17.270 --> 00:42:50.470 It's not perfect, but it it can find vulnerabilities where previous automation couldn't. But there's also classes of vulnerabilities that it doesn't do well yet that I've seen. And also AI related vulnerabilities, there's not as many data points for that in the training. So it's these like sort of new areas, attack surfaces are, I think, still a bit behind. There's also the whole AI red teaming the models themselves is is is built around staying out of the average. 00:42:50.470 --> 00:43:21.100 So if you try to use, like, it like jailbreaks and guardrail bypasses that are and even prompt injections. If you try to do something that's like a very average type prompt that's in the training dataset, they typically don't work. Whereas you have to really go out of the box and try, like, weird prompts and things to get it outside of distribution. So I I don't know. I haven't seen a lot of successes there, but I I know a couple people that have successfully automated that. 00:43:21.100 --> 00:43:36.975 It's it's definitely very hard though, and I've seen so, yeah, I I would say at the end of the day, there's the some tasks are being just completely taken over and others are are not there yet. But I I suspect that they're close behind. 00:43:37.960 --> 00:43:48.280 Nice. Yeah. I I mean, just kinda segue us. One of the things I've been using it for a lot and other researchers have too is patch diffing. That's something I would never even really consider doing. 00:43:48.280 --> 00:44:07.810 Like, I don't have the skill set. I can't read code that well. I definitely can't understand reading two versions of code after and before a patch and determine what the vulnerability was they fixed. But the article, you know, w p two shell, that it's kind of a know, it's a couple weeks ago. We did talk about it last week as well. 00:44:07.810 --> 00:44:45.750 But the article that Bronwen just submitted that's basically just kind of the full backstory as to how the researcher who discovered w p two shell, you know, how he discovered that vulnerability or I don't know if it's a I'm assuming based on the name. Basically, the vulnerability was found, you know, using the exact, the AI your parents warned you about or whatever, like, the $25 GPT six or GPT five six sole subscription. Not $30,000 worth of tokens, just a basic, you know, credit card and a dream and it probably eight screens. 00:44:46.355 --> 00:44:49.875 And $25. I mean, $25. Insane. 00:44:49.955 --> 00:45:27.365 Yeah. So if you're interested how the researcher found it, I will say, like, when, you know, when they found it and it was disclosed, I was able to patch diff my way into a working exploit pretty quickly. I think almost everyone else was as well. And that I think is, like, the new era of vulnerability disclosure and bone research is like, you can't really once you know there's a vulnerability there, it's pretty hard to hide it or obfuscate it in a way that AI won't be able to figure it out. But, yeah, if you're if you guys if anyone's interested, this is another really good use case for AI is, you know, these types of vulnerabilities. 00:45:27.710 --> 00:45:55.115 We've also seen, you know, just to kinda like highlight it, we have a couple articles in here, but I would call them record breaking patches. I think there was one Oracle submitted that had it was something like 7,000 CVEs or something like some stupidly high number. Like, we're assuming these are outcomes of glass wing. Like, they're they're closed projects to analyze their own source code and publish and fix vulnerabilities. I think Microsoft fixed, I think it was 500 plus CVEs in the last past Tuesday. 00:45:56.750 --> 00:46:11.150 So we are seeing some of the like, the supply chain side of this is doing the same thing as well, which is having a Gentic AI finding vulnerabilities in their source code, and then actually fixing them or trying to fix them before researchers discover them or, you know, threat actors discover them. 00:46:11.445 --> 00:46:28.550 And I think he also made a really good case for, like, the operator still behind the the hacking and everything. Because if you just had, you know, WordPress and you threw ChatGPT at it and said, find me a zero day, like, maybe it could eventually. Right? But that would be very expensive, very time consuming. It might get there. 00:46:29.670 --> 00:46:50.885 But but if you can sort of have an understanding of where to start and how to do these sorts of things and you can direct it, evidently, can do it for $25. Right? So I think that's a a big difference for, I guess, the human domain. But even then, that might start to go more and more away as that makes its way into, like, the the routes that these models go when they're trying to find these things. 00:46:52.260 --> 00:47:24.980 Well look at the the task statement. I mean, the amount of detail in the instruction, it's it really is a garbage in, garbage out. I know that a lot of the AI companies like to say it isn't. But, over and over again, when it comes to getting really good results out of the AIs, a lot of initial skull sweat, that preloading of figuring out what is it that I really wanna do. And the people who are doing that are getting really good results. 00:47:24.980 --> 00:47:40.695 I mean, come on. We got ads in mic. You guys I'm just from scanning the articles of yours that I've read, you get it. You get it. You've gotta give good instruction in advance in order to get get the good results. 00:47:41.335 --> 00:47:41.735 Yeah. 00:47:41.735 --> 00:47:44.215 Do you guys have any other comments to add on this? 00:47:44.615 --> 00:48:01.280 Thank you very much. It was really kind. So I I know Schubbs and some of the guys at Searchlight Cyber, and they are incredibly elite at what they do. And that's one thing that I took away from it is but I also kinda think about it. I think there's situations where you uplift. 00:48:01.475 --> 00:48:37.675 So you have, like, a certain you have a certain level of capability of a threat actor. So in this case, you've got someone extremely proficient, which takes, like, a longer prompt, but may burn out, a $25 codex plan. And then on the under other end of the spectrum, you've got someone who is completely low level skills, maybe doesn't even know how to run a script. But in some instances, there are gonna be cases where that that, like, a zero day does maybe pop out after a couple $100. But I think as models become more capable and open source models become better, then ultimately, that window is also gonna shrink shrink as well. 00:48:37.675 --> 00:49:11.515 So we may have been we may end up in a point in, like, let's say, three to five years where you've got someone who's, like, very low proficient, able to garbage prompt a zero day or something like that. But, yeah, like, full credit to Adam, the write up is incredible, and the amount of effort they put into the prompt based on I can't remember there's a there's a a challenge or something that they saw that cheap, that Sol had solved, and that was based on the structure of how we actually presented the the task to the model as well. 00:49:12.330 --> 00:49:21.130 Totally. Yeah. I it's super interesting to see how different people are approaching this. And there's not always gonna be one right or wrong answer for how you get good results out of AI. Right? 00:49:21.130 --> 00:49:49.490 Like, I mean, even if we look at frameworks like Dreadnode or other, like, that they're designed to build a harness around AI and measure its output in a way that gives you some control over it. Right? Like, that's there's a lot of tools and research in this space right now. What one person throws together might be good for them, but it's hard to, like, repeat that. And that's kinda where a lot of the research is going is like, okay, how do I make a system that, like, judges, measures the output, you know, controls that in a way that makes it repeatable. 00:49:51.570 --> 00:50:20.080 I think the other thing that I wanna highlight about the AI thing is that it is tech debt or like security debt or whatever you wanna call it still matters a lot. And I think that's really part of the expression of this w p two shell thing. Like, WordPress is an open source project with a lot of contributors, a lot of different like, there's commercial interests involved. It's kind of a I mean, it's for years been kind of a security, like, not the best. They know the plug in ecosystem is pretty vulnerable, and it's kind of the Wild West. 00:50:21.120 --> 00:50:47.140 Versus, like, if you look at a tool like curl, right, like, that ran through glasswing and he got, like, one low severity vulnerability or whatever. So, like, secure by design and, like, legacy code that's vulnerable, that's where we're seeing a lot of the AI, like, vulnerabilities and research going. And it's it's valuable. And now the project is, you know, getting more secure. But it is worth noting that, like, the smaller your code base, the more secure your code base, the less vulnerable it is to this kind of exploitation. 00:50:47.220 --> 00:51:12.600 And that it's not like every I think a lot of CEOs or other executives would just make the logical leap like, well, if it can happen to WordPress, it can happen to any software. But, like, that isn't necessarily true. Right? Like, there are gaps, of course, but, like, small secure code bases still aren't just inherently exploitable because AI. Like, if you have a tool like curl that's been battle tested over the years not to say that, you know, now that I said this, there'll probably be a curl zero day next 00:51:12.600 --> 00:51:14.600 week. Yeah. Exactly. Yeah. 00:51:15.320 --> 00:51:31.995 But, like, truthfully, a smaller, more mature code base that's been, you know, hardened over the years is gonna do better than a a tool like WordPress, which has an open ecosystem, has an open source development life cycle, and all that. So, like, I don't know. It is it's not like AI can just hack anything. Right? Like, that is kind of a lot 00:51:31.995 --> 00:51:45.050 of You're saying it's not creating new classes of vulnerabilities. We haven't necessarily seen that yet. Like, there's AI vulnerabilities that are related to AI, but we're not seeing new classes of vulnerabilities in traditional software like WordPress. Right? 00:51:45.050 --> 00:51:46.250 Not right now, at least. 00:51:46.250 --> 00:51:52.605 Not not not yet. It's not it's not novelty creating, like, a whole new OS top 10, you know, finding 00:51:52.685 --> 00:51:56.445 Yeah. Yeah. By itself. Yeah. It's exploiting existing vulnerabilities. 00:51:56.445 --> 00:52:24.025 And I will say, I do think AI made up a new type of vulnerability, which is AI thinks you're a good target. That was what happened with Hugging Face. Like that that that is like, that it genuinely invented a new type of like, that's something you have to consider as a company is like, does AI think I'm a juicy target? If I'm, you know, a Chinese threat actor and I type, who's the number one best company in The US to hack? If you're the answer to that question, you might actually wanna like like, maybe you should consider that. 00:52:24.025 --> 00:52:28.345 Like, that's part of your attack service. AI thinks you have the answers to all the questions. 00:52:28.425 --> 00:52:30.265 I'm kind of always trying get a 00:52:32.345 --> 00:52:40.810 Yeah. Yeah. Don't Google that unless you wanna get on put on a watch list. Alright. What else is going on? 00:52:40.810 --> 00:52:42.090 What else is going on? 00:52:42.250 --> 00:53:16.700 See. Traditional cybersecurity side of things, we can dip into that, you know, we for the non AI people. There was an interesting campaign disclosed by ReliaQuest this week. Basically, compromising infrastructure, network infrastructure at hotels, conference centers, and other shared venues, and then hijacking DNS to send people through adversary in the middle landing pages and, like, capturing their work credentials. Obviously, this isn't, like, necessarily a new tactic, but it is an interesting approach to go after, like you know, it's machine in the middle. 00:53:16.700 --> 00:53:33.900 We talk about this all the time. It's oh, well, the vulnerability doesn't matter because you need machine in the middle to exploit it. Well, like, here's examples of threat actors going out and obtaining machine in the middle access and using it to their advantage. It's a really cool write up. Obviously, you can see the individual's name there that help with write up. 00:53:33.900 --> 00:54:00.300 It's a pretty big project, it looks like. And I'm imagining they had to work with a ton of different partners to really dig into this on the forensic side. I they don't I I didn't fully read the article, but I it doesn't specifically say how they're compromising these network devices at these conference centers. I'm assuming default creds or weak creds or possibly unpatched vulnerabilities. I don't they they don't disclose this. 00:54:00.300 --> 00:54:00.620 But they 00:54:00.620 --> 00:54:03.820 do Probably Fortinet one or, you know, market. Just a name. 00:54:03.820 --> 00:54:10.540 So yeah. Who knows? It could be command injection. Yeah. I'm imagining hotels using, like, much lower end networking equipment than Fortinet. 00:54:10.540 --> 00:54:15.965 It's probably like, maybe SonicWall's probably more like D Link, you know, Links to Yeah. D 00:54:17.085 --> 00:54:17.805 It's not like like 00:54:17.965 --> 00:54:18.605 The thing is is 00:54:18.605 --> 00:54:24.950 that for, like, you know, large venues, like hotels, let's just say, like, a semi large hotel, they're they're gonna have to roll out some kind 00:54:24.950 --> 00:54:29.030 of True. Like, Ruckus or Unifi. It's gonna have, like, mid grade. 00:54:29.030 --> 00:54:37.830 Yeah. True. Just to handle this, the volume, the space, the square footage that they have to cover. And, essentially, every room gets one and stuff like that. I've seen a lot of Ruckus and other things. 00:54:37.830 --> 00:54:54.670 But that doesn't mean that, you know, you couldn't see older hardware. There probably is some specific brand of hardware that has some either misconfiguration or is not configured properly, and that's probably what they're attacking. They're just going to those hotels or those brands of hotels and, you know, then take take that from there. 00:54:54.670 --> 00:55:03.870 So Yeah. It's it's really interesting. Like, I I mean, obviously, this is why the podcast is sponsored by Nord v no. I'm just kidding. We're not. 00:55:04.270 --> 00:55:08.285 You're on a VPN. Nice. Nice. 00:55:08.285 --> 00:55:21.980 The other thing too to think about this is that, you know, a lot of hotels, they're like, oh, well, we isolate off everything or whatever that is they say. And so they're not connected to anything in our network. So they're just, you know, guests getting hacked, not me. So that's fine. Right? 00:55:21.980 --> 00:55:23.500 We don't have to worry about that. 00:55:23.500 --> 00:55:28.300 So Yeah. So use phishing resistant two factor, and don't worry about this anymore. 00:55:29.100 --> 00:55:31.180 Or just use a hotspot thing. 00:55:31.180 --> 00:55:37.035 Careful what what Internet you connect to. I feel like that's an old an old thing that should probably still be a thing. 00:55:37.035 --> 00:55:42.155 You know what the worst the number one reason I don't usually connect to hotel Wi Fi? It's just it sucks. 00:55:42.555 --> 00:55:46.155 Sucks. It about to go on Plex and watch a four k movie from his own Internet. 00:55:46.155 --> 00:55:48.080 I need at least two 00:55:51.760 --> 00:56:03.895 So we're we're we have a little bit of time left. Before we get into final articles, I wanna give Mike and Ads the chance to plug their stuff. You guys both have talks at the AI Summit. Is that correct? The upcoming summit or 00:56:04.135 --> 00:56:06.695 We are doing a joint talk. Joint talk. 00:56:06.695 --> 00:56:07.015 Oh, that 00:56:07.015 --> 00:56:13.095 sucks. We are we are one. Yeah. Thank you very much. Yeah. 00:56:13.095 --> 00:56:29.230 We we we actually got the keynote, which is awesome. So definitely not expected. Mike, feel free to to add anything in. I spend a lot of time I don't actually work with Mike professionally. Well, I guess I do work with him professionally. 00:56:29.230 --> 00:56:57.970 Sorry. But, not, like, in a full time role. Generally love hacking with him. We've had shed a lot of wins over the past year and a half, two years since I've, like, properly known him. And, ultimately, this talk is to educate, people from, like, book buying professions, but any kind of security, anyone in security, mainly from, like, a defender perspective or an attacker, like, walk through some of, like, the findings we found, some of the mitigations, and, like, some of the trends and topics. 00:56:58.290 --> 00:57:02.050 Very similar to the great research you had with the CSRF. 00:57:04.205 --> 00:57:12.045 Nice. That's awesome. Yeah. So if you guys are interested, August 14 is the date of that keynote. And then, yeah, it's it's free. 00:57:12.045 --> 00:57:28.890 Doesn't cost any money. You can you can learn. You can have tons of ideas to use up all your usage on ChatGPT and on Claude, I'm sure. Or maybe if you're not into that, you could probably get a lot of ways to improve your security program against a couple of AI red teamers. Right? 00:57:28.890 --> 00:57:32.810 Like, they I'm sure there's Gonna know? A lot of ideas. 00:57:33.735 --> 00:57:38.855 Yeah. We don't hold back. We we really break it down. We show real vulnerabilities in the wild. So 00:57:38.855 --> 00:57:39.895 should be fun. 00:57:40.055 --> 00:57:40.535 Do you have 00:57:40.535 --> 00:57:45.335 a sweet else you wanna plug? Anything else? Like Yeah. You know, personal projects or anything else? 00:57:45.335 --> 00:57:53.900 Yeah. I wanted to say if anyone's going to Hacker Summer Camp, Ads and I are also doing a talk at the Bug Bounty Village at DEFCON. So definitely check that out. 00:57:57.660 --> 00:58:03.575 I think that's Saturday at 2PM. Yeah. Very much looking forward to. 00:58:03.575 --> 00:58:04.455 So Awesome. 00:58:04.455 --> 00:58:08.775 We had a we had a little dry run today. All seems good. Looking forward to it. 00:58:10.215 --> 00:58:13.815 Sweet. Ralph, are you are you doing anything at Hacker Summer Camp? 00:58:13.815 --> 00:58:15.575 You're are you gonna be there? Are you gonna be vendoring? 00:58:18.350 --> 00:58:19.150 You're muted. 00:58:19.150 --> 00:58:20.350 Man, they got him. 00:58:21.550 --> 00:58:25.550 You gotta do your moats too strong. You gotta you gotta take some gators out of that moat. 00:58:27.230 --> 00:58:34.435 I I couldn't even click on the button. There it goes. Alright. No. I'm not going to hacker summer camp regretfully this year. 00:58:34.915 --> 00:58:35.955 But maybe next year. 00:58:35.955 --> 00:58:39.155 If def if defcon is summer camp, what is black hat then? 00:58:39.955 --> 00:58:49.240 Summer camp for rich kids? That's It's just it's just boarding school. It's like, oh, did you have to wear a tie at school? What what class are you in? 00:58:49.240 --> 00:58:52.760 Hacker summer camp spans both Black Hat and Def Con. 00:58:52.760 --> 00:58:54.760 Yeah. Guys, come on. Yeah. I agree. 00:58:54.760 --> 00:59:03.695 What is it? The Black Hat? I went last year. I spoke there, and I was in the I've been there before too, but just going in the vendor area was so sensory overload 00:59:03.695 --> 00:59:03.935 to me. 00:59:03.935 --> 00:59:09.215 So avoid that at all cost unless, you know, somebody's paying you to literally stand in there. But 00:59:10.670 --> 00:59:13.630 Yeah. Or take a Xanax first. 00:59:13.710 --> 00:59:14.590 I just go in to 00:59:14.590 --> 00:59:17.310 see the vendors that I like and then try to dodge everybody else. 00:59:17.310 --> 00:59:20.990 Oh my dude, they like you're like a piece of meat out there. Everybody 00:59:21.150 --> 00:59:21.630 It's wild. 00:59:21.630 --> 00:59:22.110 I know. 00:59:22.110 --> 00:59:25.025 Yeah. It's like, can I scan your badge? No. No. 00:59:25.025 --> 00:59:26.865 Get away from me. Oh my god. 00:59:27.745 --> 00:59:32.865 Oh, and now they've got the badge scanners that are tied into AI, so it pulls everything in. 00:59:33.025 --> 00:59:33.265 They're they're 00:59:33.265 --> 00:59:36.065 on everything. Yeah. It's just god. 00:59:36.065 --> 00:59:39.665 They start asking about your kids. Like, hey, grandson. How's little Timmy doing? 00:59:39.890 --> 00:59:41.250 I know. Don't have a 00:59:41.250 --> 00:59:45.090 whole Get away from me, you stalker. Sorry. 00:59:45.090 --> 00:59:47.730 I'll just keep my my kidneys. 00:59:48.130 --> 00:59:51.010 Oh, yeah. Yeah. That's yeah. That's usually recommended. 00:59:51.330 --> 00:59:53.330 Yeah. That's also unrelated. 00:59:54.290 --> 01:00:06.405 Alright. Final articles. Does anyone have anything they wanna submit as a final article? Something that's on their mind, their favorite thing that happened recently? Anything top of mind for anyone? 01:00:06.405 --> 01:00:07.765 Any I mean, I guess, technically, we 01:00:07.765 --> 01:00:09.125 do have a news. Chicken 01:00:09.260 --> 01:00:12.220 We do have a chicken article for real this time. So 01:00:12.860 --> 01:00:14.460 okay. Legit chicken news. 01:00:14.460 --> 01:00:17.660 I mean, okay. Everyone always says that. Oh, for real this time. Really? 01:00:17.660 --> 01:00:18.060 One of 01:00:18.060 --> 01:00:21.100 one. Seriously? Some some of them are 01:00:21.100 --> 01:00:27.965 a stretch. It's not as good as the lady who bought tons of nuggets. 01:00:27.965 --> 01:00:32.365 Yeah. Okay. I can't go over beat that. But we do technically have a chicken article. My 01:00:32.365 --> 01:00:33.325 bar. Come on. 01:00:33.325 --> 01:01:01.685 You know, I I've recently had issues with AI doing Vault and Triage where it'll just write a Regex. Like, it was trying to do it it wrote a Regex for Unifi, and then it just matched, like, half of the companies because of everyone had something else that had unification or whatever in it anyway. Beautiful. So this this is a chicken article. If you wrote a Regex that just says star chicken star because there's a new malware as a service operator on the, you know, on the block called Golden Chickens. 01:01:03.365 --> 01:01:10.050 And they've resurfaced with four new malware families, including tiny egg, chunky chicken. 01:01:13.570 --> 01:01:14.210 I'm sorry. 01:01:14.210 --> 01:01:22.805 Can't And Chrome escalator. I'm sorry. What? Okay. So what is that? 01:01:22.805 --> 01:01:29.365 A Chrome Infose dealer? Like, what is that? Yes. I'm assuming it's a Chrome Infose dealer, but I I can't even it's taken out of place. 01:01:29.365 --> 01:01:32.085 Version of Chrome Elevator, I guess. Interesting. 01:01:32.085 --> 01:01:40.630 It's either But maybe what it does is it takes over the AI embedded in Chrome if you've got a Chrome plug in. 01:01:42.230 --> 01:01:49.275 I don't know. But if you if you get to come across this during threat intel, like, in in an IR, you owe us a beer. Yeah. 01:01:49.275 --> 01:01:52.075 Or something. Or some samples. We would like some samples. 01:01:52.075 --> 01:02:05.110 Yeah. Or or some some virus total some virus total samples. Send us the links. But yeah. I mean, I feel like if you have to tell your boss that it was it was chunky chicken, I feel like your boss is just gonna think you're doing something you shouldn't be doing while you're at work. 01:02:05.110 --> 01:02:05.830 I don't know. 01:02:05.990 --> 01:02:14.550 Can you imagine going public with a breach and being like, yeah, we got got by chunky chicken? Like, everyone's gonna laugh at you. Like, no one's gonna take you seriously. 01:02:14.550 --> 01:02:15.910 Like, you got hacked by what? 01:02:16.295 --> 01:02:19.815 No. Reach out say time for you to pee in a cup. 01:02:19.815 --> 01:02:21.815 Yeah, no, they're just gonna they're gonna frame 01:02:21.815 --> 01:02:23.975 it like it was an advanced. 01:02:26.695 --> 01:02:32.840 Make sure the state. The advanced APT known as fat chicken. 01:02:35.720 --> 01:02:36.600 What was the initial access? 01:02:36.600 --> 01:02:40.120 Tiny egg? Name shall not be named. 01:02:40.200 --> 01:02:42.840 Yeah. The the initial access was tiny egg. 01:02:42.840 --> 01:02:49.645 My god. Unknown advanced Yeah. Hatch style. That's where they find that evidence and they're like, yeah. We didn't see this one. 01:02:49.645 --> 01:02:49.965 We're gonna 01:02:51.645 --> 01:02:58.285 so Do you think that that malicious hackers put these kinda names in just to embarrass the suits? 01:02:58.285 --> 01:03:09.000 No. Was thinking that earlier. I was thinking that earlier about how, like, all these attacking groups have, like, cool names. Like, we need to start naming them again and give them, like, really stupid names so no one's Like, being 01:03:09.160 --> 01:03:16.345 bad breath or something? Right. Just all have showers. Like, threat actor does doesn't wear deodorant. 01:03:16.345 --> 01:03:19.305 Right. Exactly. Fungus. Yeah. Yeah. 01:03:19.465 --> 01:03:23.225 Oh, man. If your hacker group was toe fungus, they'd retire right away. 01:03:23.225 --> 01:03:27.390 They'd be like, oh, guys. We're shutting it down. We're we're gonna hope for another poll 01:03:27.390 --> 01:03:27.710 of them. 01:03:27.710 --> 01:03:28.910 Like, post the adresses 01:03:28.910 --> 01:03:33.870 note after $0 made, like, no. We're not. After so much cyber bullying. 01:03:34.350 --> 01:03:39.870 Yeah. Yeah. Yeah. So the the moral of the story is stop letting hackers brand themselves. Brand companies. 01:03:39.870 --> 01:03:42.975 Yeah. Brand them. Signed up and send to submission. 01:03:43.295 --> 01:03:44.975 Alright. Everything's a caricature. Yeah. 01:03:45.375 --> 01:03:48.655 Blue team tactic. Alright. Where's that on Well, my 01:03:48.895 --> 01:03:54.770 thank you. Well, yeah. Thank you, Mike and Ads for coming. We, you know, come back anytime. I'm excited about 01:03:54.770 --> 01:03:56.130 your much. It was great. 01:03:56.370 --> 01:04:11.335 I will tell you in an hour or no in I don't know. Half an hour, we're gonna do John's EnFocus article about the OpenAI Hugging Face scenario. So come back in half an hour. Go get a coffee or a beer or whatever you feel like. And, yeah, thanks, guys. 01:04:11.335 --> 01:04:12.295 See you next week. 01:04:12.535 --> 01:04:13.815 Thanks very much. 01:04:13.815 --> 01:04:14.855 Thanks for having us. 01:04:28.280 --> 01:04:29.640 That's legit. Really cool. 01:04:31.294 --> 01:04:33.374 Is there a full version of that song? 01:04:33.614 --> 01:04:37.214 Yeah. Yes. Spot on? Is it on Spotify? Yeah. 01:04:37.214 --> 01:04:39.774 No bandwidth. No bandwidth on Spotify. It is 01:04:39.774 --> 01:04:40.414 actually there.