SN 1088: A Nefarious Novel Use for AI - Ransomware Negotiations Go High-Tech

[00:00:00] It's time for Security Now. Steve Gibson is here. Man, there's so much to talk about. Big flaw in OpenSSL. 1Password and Bitwarden try to solve the agentic AI password crisis. A new prompt injected attack AI users should be aware of. And a new way people in the bad guy profession are using AI. Kind of makes sense. All that. Plus a great picture of the week coming up next on Security Now.

[00:00:32] Podcasts you love. From people you trust. This is TWiT. This is Security Now with Steve Gibson. Episode 1088. Recorded Tuesday, July 21st, 2026. A nefarious novel use for AI. Time for Security Now. Hello everybody, boys and girls, children of all ages. It's time for this guy right here, Mr. Steve Gibson, our security

[00:01:04] Guru. Every Tuesday, we gather together to sit at Steve's feet and learn about the perils that we are suffering here in this modern world. Hello, Steve. The perils of remaining plugged in on the grid. Yeah. If we were all air gapped, we'd be okay.

[00:01:23] Well, you know, Stuxnet managed to jump an air gap. That's a good point. So even so. Don't pick up USB keys in the parking lot, boys and girls. No, no, no, no, no. We are at episode 1088 for this July 21st. Our title is a nefarious novel use for AI. Oh, my.

[00:02:18] Sadly. It's like they don't need anything more. They got so many ways in now. It's just a matter of like the eeny, meeny, miny, moe. Anyway, but they've come up with a use for AI after that, which is novel and nefarious. So we'll be talking about that this week.

[00:02:39] But first, we will look at the fact that the bone crushing we had been promised did not happen this month. Not much did from Nightmare Eclipse. We are going to revisit and look more closely at last week's, which is to say July's Patch Tuesday.

[00:03:01] A widespread and worrisome flaw has been uncovered in OpenSSL. And OpenSSL jumped on this, quietly fixed it, pushed out changes. The problem is it is so widespread that there's no chance it's going to get fixed everywhere.

[00:03:23] And we'll look at the consequences of that. A bunch of our listeners said, Steve, I just saw an article saying that Claude can now access your 1Password credentials. You know, and this is where we deploy the what could possibly go wrong. Also, Bitwarden is aware that we need a whole new kind of coverage of security.

[00:03:50] We're going to look at that. Also, the day ends in Y. So we have a new prompt injection attack. There has been a very rare, very serious update for WordPress, which unlike previous where it's in some random add on that, you know, five people in Milwaukee have installed.

[00:04:18] In this case, this is in the core. So I hope everybody. No, it's really bad. I hope everybody who is staying up to date with WordPress, I think it was introduced in at the at the early December of of 2025. So it's been around for about six or seven months and it's significant.

[00:04:45] We've got also lots of interesting listener feedback. I've just I made time for because I've just we haven't had as much as I wanted recently. And then we're going to look at the new ways A.I. is being used by bad guys after they get into someone's network. And it's not again, it's not sort of the techie side. It's not, you know, better exploration of the network. It's interesting. And of course, we've got a fun picture of the week.

[00:05:14] So, yeah, I think worth tuning in for episode 1088. If only to get new ideas on how you can exploit people's networks, it would be worth it using A.I. We will have that picture of the week in moments. All I know is it has something to do with coffee. I'm excited. And that got my attention. I gave it a kind of a lame, a lame title. I said because coffee is life because, you know, it is. It is.

[00:05:44] It is. But anyway, it's a fun sign that we will. I've gotten, you know, it really into what they call pour over, which is the really the silliest kind of coffee making where you're using a filter and there's all sorts of steps and the different grinds and all this stuff. It's not expensive. That's the only good thing. The bad thing is it's very time consuming and it's chemistry and there's a lot of books and stuff. But it's so good. A lot of books and stuff.

[00:06:13] There's a lot of reading. It's chemistry. Like you should see this book that I have. It's got all of these. It's a biophysicist. It's called The Physics of Filter Coffee. It is possible to create a stunning cup of coffee. You really can. Because there's different volatiles, different chemistries, the time, the temperature of the water, the size of the filter. All of this stuff makes a huge difference, the size of the grind.

[00:06:41] And so you can lots of dials to turn. But once you get it right, it's really good. And I've never drank coffee black before, but because you can really make it to your taste. Now it's like it's my reward. I say you can't have it till you work out. That's what I got here. It's a bad thing. So coffee is life is what I'm saying. I'm agreeing with you 100%. We'll get to that picture of the week. Our show today brought to you by Thingst Canary.

[00:07:11] You know, I've been talking about the Thingst Canary for a decade now. Love this. It's a honeypot that is easy to set up, easy to configure. It can look like anything. A Windows server, a Linux server, you can have all the services lit up like a Christmas tree, just a few handful of juicy services that a hacker cannot resist. It could be a NAS. It could be a SCADA device. It could be an Exchange server, a SharePoint server.

[00:07:37] I mean, there's literally, I think, more than 100 different configurations. And they're really good. They have the right MAC address. You know, a hacker looking at it is not going to be able to tell. It's funny. Haroon, one of the founders, said they may be suspicious. You know, hackers are a suspicious bunch. But they can't resist because that's what they're there for, is to break into that SharePoint server or that Windows server or that NAS and get the juicy goods in there.

[00:08:05] Right. So if somebody is inside your network with that Thinks Canary, they're going to see that and they're going to say, I got to attack it. I got to at least try to log in to it. Right. You can also use your Thinks Canary to create lure files. They look like regular files, documents or spreadsheets or, I mean, even things like you can make a wire guard configuration.

[00:08:29] See, a bad guy seeing that would go, oh, I want that because now I can get into their wire guarded proxied stuff and things like that. Right. But even though they look exactly like all of those things, they're not. The minute a bad guy tries to open that file or tries to log in to your fake SSH server, you're going to get an alert. No false alerts either. Just the alerts that matter in any way you want it.

[00:08:56] Email, syslog, they have web hooks. It could be through Slack. It could, I mean, just text messages or all of the above. So it's very simple. You choose a profile for your Thinks Canary device. You register it with the hosted console for monitoring and notifications. You spread some of those lure files around. You can even put them on your cloud, which will let you know somebody's in my Google Drive, for instance, because nobody should be accessing that file. Then you sit back and wait. Attackers who breached your network, malicious insiders, evil maids,

[00:09:25] any adversary will inevitably make themselves known just by accessing the Thinks Canary. And then you've got them. Visit canary.tools.twit. For just $7,500 a year, you can get five Thinks Canaries. You also get your own hosted console for that price. You get upgrades, you get support, you get maintenance. Oh, one more thing I should tell you. If you use the code TWIT, T-W-I-T, in the how did you hear about us box, you're also going to get 10% off. And it's not just for the first year. It's for as long as you have your Thinks Canaries.

[00:09:54] You can always return your Thinks Canary. They have a very generous 60-day money-back guarantee, and that's for a full refund. You get it all back. I should also tell you, in the 10 years that we have been talking about the Thinks Canary and offered that guarantee, no one has ever claimed it. Go to canary.tools.twit. Enter the code TWIT in the how did you hear about us box. 10% off. You need this thing. Canary.tools.twit.

[00:10:21] And we thank him so much for their support of Steve's good works here that he's doing at Security Now. Okay. So what we have underneath this, because coffee is life title. Which it is. Is a sign that someone took a picture of, which describes itself as the –

[00:10:46] it's wonderful – the no-nonsense coffee guide. This is like on a chalkboard outside a coffee shop. Yes, exactly. This is like, okay. So it shows on the left are the fancy French or Italian terms for some random yuppie coffee. And then on the right is the equivalent.

[00:11:14] So we have the Americano, which has been crossed out. And then next to it says black coffee. Flat white crossed out. White coffee. Cappuccino crossed out. Frothy coffee. Coffee. Good, good, good. Latte. Milky coffee. Espresso. Miniature coffee. Macchiato. Milk topped coffee. Yeah, just a little dab. Yeah. Mocha.

[00:11:44] Chalky coffee. C-H-O-C-C-Y. Yes. Chalky, yes. Tea. Not coffee. And hot chocolate. Still not coffee. Oh, I want to go to this place. Oh, that is so true. Yes. It's just like, okay, fine. We'll give you your milky coffee, Gibson. That's right. No AI here. Somebody hand wrote that one on a chalkboard. That's right. That's for sure. So, and I noticed down there's a pound sign.

[00:12:13] It says pub on the hoe, H-O-E. Must be the name of the place. That's my guess. Yeah. That's a weird name. Like some farm theme somewhere. Oh, that kind of hoe. Okay. H-O-E. Farm implement. Yes. That's right. So, it's difficult to know exactly what's going on with our prolific and talented. There's no discounting that.

[00:12:42] Oh, it's in the United Kingdom in Plymouth. Ah. The pub on the hoe. I have found it. It exists. And they have a no-nonsense coffee sign. I love it. Sorry. Go ahead. Yeah. So, it's difficult to know exactly what's going on with our prolific and there's no discounting it talented Microsoft taunting hacker who calls him or herself nightmare eclipse.

[00:13:09] Remember, seven months ago, this hacker who's given us a run of zero days, they warned that a, quote, bone-crushing vulnerability and exploit proof of concept would be disclosed this month.

[00:13:27] Presumably timed, presumably timed as they have all previously been, to maximize their unpatched exposure interval by landing them on successive months patch Tuesdays. And we said last Tuesday, on patch Tuesday. Well, hello. Where is this? We did, however, indeed, get another one last Tuesday, though it falls far short of bone-crushing.

[00:13:56] I'm not even sure it would be considered bone-chipping. It will certainly be Microsoft annoying, however, but it's probably also Microsoft relieving since it amounts to a rather limited use, elevation of privilege, vulnerability, and exploit. Nightmare Eclipse gave this zero day the name Legacy Hive.

[00:14:22] Hive is what the Windows registry blobs are called. You know, it's this hive and that hive. So the hacker called this Legacy Hive. And with limitations, it allows attackers to escalate their privileges on currently, like, fully patched Windows systems right up to date. But then here's where things get weird.

[00:14:50] Nightmare Eclipse claims that they deliberately toned down the proof of concept to make it less annoying for Microsoft. Okay. Okay.

[00:15:04] The story is that while it exploits a security vulnerability in the Windows profile service, it's been modified to require a standard user's credentials and another username, like an admin account name, in order to make its exploitation more difficult for attackers to weaponize.

[00:15:32] And what I find suspicious about this is this does not sound like the Nightmare Eclipse. I mean, it's not such a nightmare, right? So if this is true, which I think I tend to doubt, it would appear to represent a change of heart, you know, like a capitulation on Nightmare Eclipse's part.

[00:15:56] And I wonder if it could be the result of Microsoft's saber rattling, getting a little, you know, hitting a little too close to home. So the hacker wrote, quote, the proof of concept requires another standard user's credentials and a third username, which can be an admin account.

[00:16:16] If the proof of concept is successful, it will end up mounting the target user hive in the current user classes route. The proof of concept was stripped down as an attempt to prevent public exploitation.

[00:16:39] The original proof of concept did not require additional user credential and was not limited to user class dot dat hive. Any hive could be loaded using this vulnerability, but you would need some brain cells to make the proof of concept do it. OK, so the industry security researchers were quick to confirm the vulnerabilities proof of concept.

[00:17:09] That is, it did it works. It does what they say. And Microsoft replied with their standard uninteresting bureaucratic boilerplate, you know, which we've seen every time before. So we can now add legacy hive. This latest one to rogue planet, blue hammer, red sun, yellow key, green plasma, mini plasma and undefend.

[00:17:34] All of which Microsoft has patched the month following or sooner. And many of which were seen being quickly taken up and used by real attackers to actually injure real Windows users and their networks. So maybe there's some guilt on on Nightmare Eclipse's part.

[00:18:01] Maybe that's the reason, you know, the real injury that this hacker was causing to innocent Windows users that they decided to make the vulnerability less easy to quickly abuse. On the other hand, maybe they couldn't make it stronger.

[00:18:20] You know, I have no basis for that speculation beyond, I guess, my just my faith in human morality since, you know, this this campaign that Nightmare Eclipse has been waging was also really hurting Windows users. So anyway, it's unclear whether this is the bone crushing exploit that Nightmare Eclipse promised.

[00:18:45] It would be really bad if it were possible to arbitrarily load various registry hives like into different user profiles that could be used for all kinds of of problems, especially in any kind of a server scenario where it could be devastating.

[00:19:08] If the restrictions on the use of its proof of concept were lifted so that, you know, as I said, Windows registry hive remapping could be performed without any a priori knowledge of the victim's system, then that would have been a real bone crusher.

[00:19:28] So on the other hand, we've previously seen Nightmare Eclipse clearly and deliberately exaggerating their capabilities in the past, you know, referring to that them saying, oh, you there's a way to bypass the pin on the on the BitLocker bypass exploit. We know now there was no way to do that. So that was an exaggeration. Maybe this is that, too.

[00:19:56] Microsoft knows because they'll see what the problem is that this represents when they go about fixing it and see whether or not it actually could have been a lot worse had the hacker wanted it to be. But in any event, no bones were crushed or chipped or very much disturbed this month. So and apparently it's just not easy to get the proof of concept to do anything very significant. So. Are they done? Are we going to see something next month?

[00:20:26] I guess we'll need to stay tuned. But speaking of of this month and next month, last week. We were only able to touch on the release of July's Microsoft patches since they occurred as we were recording the podcast. And Leo, you were able to give us the overview of, yeah, five hundred and seventy. Man. Three of the three zero days among them.

[00:20:55] So scanning down the seemingly endless and astonishing list of security. I mean, really consider scrolling your browser down five hundred and seventy individually enumerated and described. Problems, bugs, bugs, security, you know, vulnerabilities that were fixed. It really is something to see.

[00:21:23] So it occurred to me that now we would not only need AI to find those, we would be needing an AI to help us keep track of them. Yeah. Because, wow. I mean, it is astonishing. There's almost too much to cover here in detail. And I'm not going to try, but I want to sort of hit the highlights here. Among the record breaking by a large margin, five hundred and seventy security vulnerabilities.

[00:21:53] Fifty nine of those five hundred and seventy were rated critical. They given critical ratings by Microsoft. Forty eight of those fifty nine allowed for remote code execution. So so so we had in one month, 48 of the fifty nine.

[00:22:16] Forty eight critical out of a total of fifty nine critical were remote code execution vulnerabilities out of a total of five hundred and seventy. So more than one in ten. Another nine broke out of Windows privilege management to allow attackers to obtain system privileges. Overall. It independent of the ranking of the vulnerabilities, you know, like critical, moderate information, so forth.

[00:22:46] Hundred and forty five of the five hundred seventy, which puts it at more than twenty five percent overall enabled remote code execution one way or the other. So there were so forty eight were critical RCEs. But the balance to bring the total to one hundred and forty five remote code executions one way or the other.

[00:23:09] And also two hundred and fifty four, bringing it to forty five percent of those five hundred and fifty total were privilege of elevation privilege, elevation attacks that would allow an attacker who had obtained a minimum foothold in a system to bump up their privileges to full root system access,

[00:23:30] which they pretty much need to do in order to do anything extra nasty and also in order to obtain long term access to the system. So it seems to me. Now, the one thing Microsoft is not doing based on what we're seeing is restricting their rate of discovery and disclosure.

[00:23:53] They're not like dribbling these out each of the past three months has broken their all time previous security vulnerability patch record and each time by a significant and significantly growing measure. So it's accelerating in addition to being continually record breaking. So this makes me extremely interested.

[00:24:20] I mean, I cannot wait to see what next month will look like. And I and I heard you saying I think it was on the on your Sunday podcast. You mentioned to the two co-hosts with you, Leo, that I had been expecting that we would see increasing numbers of patches followed by decreasing numbers of patches.

[00:24:45] As there see as as as the available pool of things to fix dry up. Yes, inevitably that's going to happen. I've been raising that with everybody that Steve Gibson says eventually we'll get to zero, but we'll get to fewer far. Well, the thing that they missed that I'm factoring in also is that a I will be in the the code design path in the future.

[00:25:15] I expect I mean, there's no reason to release a bug that your I is able to find later. Why not find it first? I mean, find it pre-release. Right. That's the other thing that's going to happen. It's the reason I think we're going to be dropping, if not to zero, to like a whole different level with enough low.

[00:25:37] So, so low that things like Pwn to Own and Hacker One and Bounties and so forth, they're just going to go away. I think that could happen very soon, to be honest. And, you know, I think that's part of the development cycle now. It is certainly when I'm developing with Vibe coding. Why? Inevitably I do a security audit as I'm going, let alone at the end.

[00:26:03] And it must be that Microsoft is already using AI to write code. Why would they be lagging there? Right. I would, I mean, goodness, yes. So. And it catches all the obvious things, you know, the buffer overflows, the writing to ring zero, all the, maybe what I said on Sunday, you know, row hammer isn't going to go away probably. Right. That kind of. It can't. Yes.

[00:26:30] Not all security problems are code errors. Right. You can also have bad policy. I mean, microcode will be better. So maybe you won't have those kinds of, you know, pipeline errors where it's. Well, but you could still have an open port. You could still have a dumb, a dumb password. I could. Exactly. Nobody's going to stop that. No. That's, that's, that's forever. One, one whole big class of problems is probably going to go away.

[00:26:56] And I think it's going to probably at the rate we're seeing this being jumped on again. I'm just, I can't, I am so excited to see what, what happens next month with patch Tuesday because, and I should also mention it's not just Microsoft. All the big publishers are seeing, in fact, Adobe has switched to twice a month updates because they've, they're just, their run rate of patches.

[00:27:22] They're, they're patching so much now that they thought, okay, we can't wait another three weeks after finding a problem. We need to wait one week and do a mid month patch. So we're going to see this industry getting cleaned up pretty quickly.

[00:27:39] Um, on the other hand, there may be also that unfortunate haves and have nots bifurcation where, you know, the big publishers, the Adobe's, the Microsoft's, the Oracle's, you know, the big guys, uh, Apple also certainly who are able to just dump all this excess cash they have into token purchasing. They have the ability to do this. Smaller publishers may not.

[00:28:05] Although I just saw Synology updated, uh, uh, my boxes for an AI discovered problem that it had. So even the smaller guys are saying, Hey, let's, why not spend some money on some tokens and make our product better. So, wow. The, the, the, the, the shape of this patch curve is really going to be interesting.

[00:28:30] Um, uh, my guess is we may see fewer next month. I don't know. I, I, that'll be interesting. If just, I mean, I think you're right. The velocity will certainly go down. Yeah. I mean, nobody would deny that. It's just at what rate. Right. And to what final resting point. Exactly. Yeah. Okay.

[00:28:54] So, uh, hollow bite is the name that Okta, uh, gave to their discovery of a very worrisome denial of service that exists in open SSL. Uh, any problems discovered in the massively used.

[00:29:15] I mean, like it's, it's, it's, I mean, it's hard to describe how wide widespread the use of open SSL is. There are, you know, certainly private TCP IP stacks. Windows has one, uh, Apple has their own. Um, but like anything that wants to create a TLS connection now, which is some, some embedded device

[00:29:44] or a widget or whatever, it's got open SSL. Now there are, we've talked about, there are some embedded TLS libraries that, that are used by, at, at, at the, you know, really small embedded level. But open SSL, as we know, we've been talking about it for decades, you know, is what you use. Uh, Apache uses it.

[00:30:12] Nginx web servers use open SSL. Uh, the runtime libraries, uh, like Node, JS, Python, Ruby, PHP, MySQL. Um, they're all using, uh, open SSL. So because open SSL is widely used and embedded, this vulnerability affects all of these systems.

[00:30:38] So Okta discovered a means for, and it's really sad that actually, because it's so simple. It's like, really guys, this is, this is still a vulnerability today for sending just 11 bytes, uh, of TLS data to any unpatched open SSL.

[00:30:58] Endpoint, you know, meaning all of those servers that I mentioned and, and the, the various application, uh, libraries to cause the connection to over allocate a memory buffer in anticipation of receiving the remainder of the declared incoming data. So once again, this is why I, I'm sort of disappointed, uh, in this problem.

[00:31:24] So it's one of those where the, the header declares how much data follows and then it doesn't. But because the header is parsed first, the library says, Oh, here comes 128 K of data. So it preallocates a buffer to contain the data, which then never arrives.

[00:31:49] It's like, guys, how really in this day and age, that's the, you're still coming across those kinds of problems. Anyway, um, by doing that over and over and over making a connection, sending 11 bytes and attacker using very few resources at their end, meaning you don't need lots of servers and lots of bandwidth or anything.

[00:32:11] You know, some random proxy that exists in some guys, you know, LG, uh, TV that's got taken over, uh, can bring down a major service. Okta provided some background, uh, and color, uh, which I want to share. They wrote every so often a vulnerability reminds us how deeply our digital infrastructure relies on foundational libraries.

[00:32:38] Recently, the Okta Red team discovered hollow byte, a denial of service vulnerability in open SSL by sending a malicious payload of just 11 bytes. Any remote unauthenticated attacker can force a server to allocate disproportionate chunks of memory before any security handshake even begins.

[00:33:04] The TLS handshake begins with a client hello message wrapped in a record. Each TLS handshake message begins with a four byte header that declares how large the incoming message body will be. Existing versions of open SSL allocate a receive buffer based on that attacker declared length

[00:33:30] before any data has actually arrived. Like I said, really? In this day and age, you're, we're still doing that? When the malicious 11 byte payload arrives, the TLS state machine reads the four byte handshake header and triggers an unvalidated pre-allocation based on the header's three byte length declaration. Because there's no payload validation at this early stage,

[00:34:00] the system's malloc, the memory allocator, allocates up to 131k, as I said, 128k binary, based solely on the untrusted packet's claim. The worker thread then blocks, waiting indefinitely for the data that will never arrive. Holding connections open to exhaust threads is a classic trick,

[00:34:28] like slow loris that we talked about years ago. Hollow byte introduces a far nastier compounding effect due to how the GNU C library, GLibC, handles memory. When an attacking connection drops, OpenSSL frees and releases the buffer. However, GLibC does not immediately return small to medium size,

[00:34:57] which 128k is considered, allocations back to the operating system. It retains them for potential reuse. Therefore, by launching waves of connections with randomized claimed sizes, meaning that they're not going to be reused perfectly, an attacker prevents the allocator from reusing those freed chunks.

[00:35:23] This fragments the system's memory allocation heap heavily, causing the server's resident set size to climb continuously. Even after the attacker disconnects, the server remains permanently bloated. The only way to reclaim that memory is to terminate the process. Shut down the web server or whatever service is using OpenSSL.

[00:35:52] Frequently, it just means having to reboot the system. You've killed that service. They said, To measure the threat, we tested unpatched and patched OpenSSL instances running NGINX under various load conditions. In a standard 1GB of RAM environment,

[00:36:12] an unpatched server was out-of-memory killed at 547 megabytes of frozen, fragmented memory. In higher spec testing with, for example, a 16GB RAM allocation, the memory successfully locked up 25% of the system's total memory while staying safely under the connection ceiling limits,

[00:36:39] meaning standard connection limiting defenses won't stop it. The OpenSSL team resolved this by switching, wait for it, to an incremental buffer growth strategy. What a concept. What a concept. You mean you actually don't allocate memory until you get something to put in there? It's amazing. Who'd have thought of that? Wow.

[00:37:05] This fix was silently included as part of OpenSSL version 401 release with silent backports to release 363, 357, 346, and 3021. Under this revised memory allocation strategy, rather than trusting the header's claims outright, OpenSSL now grows the buffer only as bytes are actually received over the wire.

[00:37:34] Wow. A breakthrough. A claim with no follow-through now costs the server nothing. Even though OpenSSL handled this as a hardening fix, rather than a CVE security advisory, we recommend upgrading your distributions OpenSSL packages immediately. And I'll just put a big amen on that. I went over to the OpenSSL repository

[00:38:03] and saw that all of those stated versions were updated more than five weeks ago. This occurred on June 9th. So this would have meant that all of the various dependent packages, Apache, Nginx, Node.js, Python, Ruby, PHP, and so forth, would have needed to incorporate that update into their own builds and then make those available.

[00:38:30] Then any public exposure of them would need to be updated and relaunched. Now, the problem we always have is that those are only the most well-known, prominent, and obvious users of OpenSSL. It is doubtless used in countless other systems. For example, I was curious about my own fully patched and up-to-date Synology NAS.

[00:38:58] So I SSH'd into it and issued the command OpenSSL space version. And I was promptly informed OpenSSL 1.1.1u, which was dated the 30th of May, 2023. Since I follow my own advice, my own residential network has exactly zero open ports to the outside world. You just can't have any.

[00:39:27] And here's a perfect example of why. This was not a problem anybody knew about. They silently patched it and pushed the updates out, even downplaying it as some hardening rather than giving it a CVE that would have brought it to the attention of the bad guys because they know how bad this is.

[00:39:51] I mean, this lets you crash and freeze and lock up any OpenSSL receiving service. So for random end users, I would say it's unlikely to be much of a problem. This is not going to be the end of the world. But the chances are very good that most, if not every single piece of enterprise border equipment

[00:40:20] is also based on a version of OpenSSL, which was published more than five weeks ago. So unless your vendor has updated and pushed and made available updates, and hopefully you didn't wait because you shouldn't these days to update your appliance, if any of that did not happen within five weeks,

[00:40:47] then the systems you're using can probably be brought to their knees. Again, it doesn't let the bad guys in, but it lets them shut down your network. So although Okta didn't disclose whether this newly disclosed vulnerability was found through the use of AI, it is exactly the problem that the entire industry will now be facing. As I've noted, our browsers and operating systems

[00:41:17] have already developed quite mature systems for keeping themselves up to date. But many network appliances have not seen the need to do the same. Difficult to get a device which isn't asking if there's anything new for it to suddenly start doing that. So in the intermediate term,

[00:41:44] there's probably going to be a flood of newly discovered vulnerabilities and updates, which users of these systems need to be staying current with. Things exactly like this that need to get fixed. And who knows what else we're going to be seeing in the short term. Yikes. What I do know, Leo, is the coffee is life? Cheers.

[00:42:17] While Steve and I are imbibing our caffeinated beverages, I might want to tell you about our sponsor for this segment of security. Now, Zscaler, the world's largest cloud security platform. The potential rewards of AI in your business are, you know, too great to ignore. But it's prudent, and Steve's going to talk about this in a second, to remember there are risks. There are risks, including the loss of sensitive data

[00:42:44] and attacks against enterprise managed AI. And of course, the bad guys love generative AI. It increases their opportunities to rapidly create phishing lures, to write malicious code, to automate data extraction. And as we will soon learn, even more. There were 1.3, I'll give you an example. 1.3 million instances of social security numbers leaked to AI applications. And probably that was, with all best intentions, inadvertent,

[00:43:15] right? I mean, I just told you that I had to redact all my socials and private personal information from my tax returns, because I wanted my AI to analyze them. Well, are your employees, and I think this happens all the time. I just read an article that said, employees are often using their own personal AI accounts, because they've run out of tokens, or it's easier at work. How often does the employee say, you know, let's analyze these tax returns, upload the tax returns,

[00:43:43] and forget that that's got all your social security number, your EIN, whatever it is you use at work. And they're just giving that, you know, to some server somewhere. You got to, you got to rethink your organization's safe use of public and private AI. You want to use it. I admit, I know, but you also want to really think about how to lock it down. Well, that's what Chad Pallet was thinking about. He's the acting CISO at BioIVT. And he says,

[00:44:12] Zscaler helped them reduce their cyber premiums, get this, by 50% at the same time as they doubled their coverage and improved their controls. Let Chad explain. With Zscaler, as long as you've got internet, you're good to go. A big part of the reason that we moved to a consolidated solution away from SD-WAN and VPN is to eliminate that lateral opportunity that people had

[00:44:38] and that opportunity for misdirection or open access to the network. It also was an opportunity for us to maintain and provide our remote users with a cafe style environment. Thank you, Chad. With Zscaler, Zero Trust Plus AI, you can safely adopt generative AI and private AI to boost productivity across your business because you're protected. Their Zero Trust Architecture Plus AI helps you reduce the risks of AI-related data loss

[00:45:08] and protects against those enhanced AI attacks to guarantee greater productivity and compliance. Learn more at zscaler.com slash security. That's zscaler.com slash security. We have gone back to Steve Gibson and his empty chair. Let's look at his bookshelf. The Linux programming interface. There's JavaScript up there with the Rhino cover. Oh, Windows Secrets. That's good. Python Plus.

[00:45:38] JavaScript. JavaScript. Look at the thick one there. I think the Rhino one might be JavaScript, The Good Parts. That's a skinny little book. And then there's the JavaScript Everything You Need to Know that's about eight inches thick. There's the Blinken lights. The Speak and Spell Long Gone. In fact, you should enjoy this vision of Steve's studio because it isn't going to be here much longer. He's going to move to his new studio and we will no longer see the Blinken.

[00:46:06] Well, you'll bring the Blinken lights with you, I hope. Lori might not let you. It's going to be a whole different look. A whole different look. Do you want me to send my lighting designer your way? No. No. Okay. He doesn't care. It's all I can do to get him to shave before the show, kids. And I missed it this time. Yeah. That's okay. I realized last night I was, well, didn't have to. The Grizzled Steve Gibson.

[00:46:35] That's how we know that he's serious. He cares. All right. Let's talk about Claude. Okay. Or as Paul Therott calls it, Claude. It's crazy. Claude. One of this podcast's favorite rhetorical questions is what could possibly go wrong. Go wrong.

[00:46:59] So it's bearing that question in mind that I share this next bit of news that Anthropics Claude AI is now able to access and use its Mac users' passwords stored in their 1Password vault. Which, of course, then begs the question, our favorite question, what could possibly go wrong?

[00:47:27] And I'll just note that 1Password is a past sponsor of the Twit network. Last Thursday, 1Password posted a blog entry with the headline, 1Password for Claude. Give Claude access without giving up your credentials. And, okay, this is the first of two pieces of news that I want to share.

[00:47:51] And then we're going to be looking more at AI access to credentials because this is going to be crucial. If you've got agents running around doing stuff on your behalf, well, they need to be able to look like you, act on your behalf to services that require you to log in. So, since this is clearly the future, and I think we're going to be seeing a lot more of this,

[00:48:20] I wanted to spend some time. So, 1Password wrote, AI agents are moving from helping people think to acting on their behalf in browsers, apps, and accounts. That changes the security model. Once an agent can click, buy, update, and submit for you, the key question becomes, what identity is it acting under, and what access should it get?

[00:48:50] Claude can compare deals, add an item to your cart, update account details, or complete a purchase. But once it reaches a login page, you face a trade-off. Do you give the agent your password or stop and do the task yourself? Neither is the future we should build toward.

[00:49:11] Until now, there's not been a secure, easy way for agents to use credentials without exposing them. 1Password for Claude enables credential access without credential exposure. 1Password for Claude is built on a zero-exposure architecture.

[00:49:35] Claude can complete browser tasks that require logins and one-time passcodes, but the credentials never enter the model or its memory. 1Password, they wrote, stays the source of truth for the secret and access is granted only at runtime.

[00:50:01] When Claude needs to sign in, 1Password shows the user which credential is being requested and why. After user consented biometric approval, 1Password injects the credential directly into the page. Claude never sees the vault item, password, or one-time code.

[00:50:26] Access is scoped to the current task and ends when the task is complete. After autofill, 1Password checks that secrets were not exposed on the page. If submission fails, it clears the filled values before returning control. Nancy Wang, 1Password CTO, said,

[00:50:55] Claude, is where trust in agents starts and the foundation we're building with Anthropic.

[00:51:25] Okay, so this is not handing over unsupervised 1Password access to Claude. I think it was, maybe it was The Verge that picked this story up, and I saw their coverage of it first. And there were 31 replies by people who apparently didn't actually read The Verge's coverage. They don't get what's going on.

[00:51:55] This is far superior to the way people were doing it, which is storing all that stuff in clear text on the hard drive. Exactly. And it was funny because the comments on The Verge's article, I just scanned them because I was curious what people thought of this, was like, oh, hell no, and oh my God. And it's like, yeah. The point is, this has been well thought through.

[00:52:18] And as you said, and as I said, this is not giving the agent your password in clear text. So it's deliberately blinding Claude to the credentials needed to log in to whatever, some online service where it will then be operating with some autonomy. You know, essentially, Claude is saying, hey, could you please log me into Expedia or whatever

[00:52:46] so that I may proceed to do what you have asked me to do? And in reply to this, 1Password's new system pops up a dialogue asking the user to, on the fly, interactively authorize this login so that Claude may proceed. You know, and this is a Mac apparently. So in the example, the user places their finger on Apple's Touch ID sensor,

[00:53:16] or, you know, if it's using Face ID, smiles at the camera. And then that authorizes 1Password to perform this in a blinded way on the user and Claude's behalf. So Claude is kept on a leash and is able to work without exposing the user's credentials.

[00:53:40] I'm sure it would be worth remembering that most of us remain persistently logged into many of the online services we routinely use and visit. So if our AI agent is driving our web browser, it presumably obtains the same persistently logged on privileges which we enjoy.

[00:54:03] In other words, you know, we do still need to be careful since it can still do everything we would be able to do if it did not require us to log in freshly. Maybe, maybe, if this was a concern for people, it might make sense to have such an agent using a different browser, that is, that does not share cookies with the browser that you normally use.

[00:54:28] You know, effectively give it its own browser whose cookies had been pre-wiped so that there were no persistent logons available to that, requiring you then to be asked every time that the, that the agent wants to do something. Anyway, 1Password provided a couple of what this looks like in practice examples for, for everyday AI users. They wrote, your Audible credits are about to expire.

[00:54:58] Instead of logging in, navigating to the store, navigating in the store, and then manually redeeming a credit, you ask Claude to review your wish list and choose a new title for you. Claude navigates to the site. You provide approval for Claude to use the credential from your vault. 1Password provides the login, and the audiobook lands in your library.

[00:55:25] You never typed a password or a one-time token, and Claude never sees either. What's funny, Leo? I heard you. Oh, I'm just saying that's a silly use, but okay, if that's what you want. Okay, yeah, yeah. I mean, their example for- But that can make sense. Get me the book, yeah. Buy me the book, yeah. Their example for business use is a small business owner could ask Claude for a Stripe revenue summary or to flag any unusual activity.

[00:55:54] Claude can navigate the dashboard. The business owner approves Claude to use their Stripe login details. 1Password can handle the credential in the one-time code, and the business owner receives the answer without going through the multi-factor authentication or exposing the secret to Claude. So, they said, these are just two examples. The same pattern works across the sites where Claude in Chrome can take action.

[00:56:21] If the credentials are stored in 1Password, Claude could use them. You approve, 1Password supplies the credential, and Claude finishes the job. Even when the task changes, the access model stays the same, and your credentials never leave 1Password. And, Leo, you know, I don't think there's any danger in this podcast running out of things to talk about because all of this is going to go so wrong. That's true.

[00:56:50] But it's something you need to solve, and this is the problem. I mean, there's really no great way to do this. As Paul points out in our Discord chat, you know, if the AI has a credential, then you're just one prompt injecting step away from it giving the credential to a bad guy. Exactly right. But it needs the credential. It's the same problem that DVDs had with the CSS key. It had to be in memory on the DVD player.

[00:57:19] That's why a high school student was able to crack the CSS key on the DVDs in about an hour because he said, oh, it's going to be in memory. I just have to find the memory, and now I've got the key. So, yeah, you know, I use Bitwarden to do this. I've gone through a bunch of different processes. You try to lock it down as best you can. The best way would be, if I think about it, you tell me if I'm wrong,

[00:57:46] and there are services that do this, is a one-time token that is revocable and is only usable once. That's what you hand to the AI to then access the service. But, of course, the service would have to support that as well. Right. So, essentially, we've stumbled into the need for a new security model,

[00:58:13] some means for allowing autonomous agents. Would Passkeys or Squirrel be a good solution? No. Those are just less hackable traditional models. But there's still a secret. And if the secret is gets handed off, you're SOL. Well, what Darren's pointing out, and it's really true, is that nobody who uses these things wants to be stuck at the keyboard typing in passwords at any point. Right.

[00:58:42] Or giving confirmation or saying, okay, go ahead. Or even having to keep their finger on the touch ID button in order to say, yes, yes, yes, yes, yes, yes, yes, yes, yes. I frequently am using my AI here up in the attic off-site or downstairs. I don't want to have to run upstairs and touch the keypad. Yeah. But it is more secure if I do. I don't know what the answer is. I hope you come up with something for us.

[00:59:07] They then address the need for what they call, well, what we all call agentic mode. And they explain agentic mode protecting the vault when an agent controls the browser. So they write, 1Password writes, there's a second problem. What happens when a browser-based agent takes control of a browser where 1Password is installed? Without proper guardrails, the agent could try to interact with the extension itself. Right?

[00:59:37] I mean, it's acting as the user. So 1Password doesn't know the difference. Agentic mode is how we close that gap. Agentic mode is a new feature in the 1Password browser extension that gives every user visibility and control over browser-based AI agents.

[00:59:57] When a compatible AI agent takes over, the 1Password extension automatically locks down. The interface is hidden, and the agent can only use the logins and one-time codes explicitly approved for the current task. The rest of the vault stays out of reach.

[01:00:20] Agentic mode works even if the integration is not set up and even if 1Password is not required for the current agentic task. It also supports additional agents beyond Claude. For example, I'm sorry, for qualifying enterprises, there's nothing new to configure. Employees using 1Password for work credentials automatically get the same protection. Every credential request from an AI agent is visible, explicit, and requires authorization.

[01:00:50] Okay, so this is clearly different and distinct from that previous 1Password for Claude feature. Agentic mode appears to be a recognition of the fact that browser-based AI agents will be indistinguishable from their human counterparts to browser extensions. Browser extensions won't be able to tell the difference, including a password manager.

[01:01:16] So this would mean that unless a password manager proactively determines to what entity it is granting credentials, that is, what type of entity, human or not, any browser-based AI agent would automatically be granted and would obtain the same benefits and freedoms as that browser's human user. And obviously, that could lead to some disaster.

[01:01:44] 1Password concludes their posting by writing, 1Password for Claude is just one part of the access layer we're building into AI agents across the ecosystem, including securing developer credentials with 1Password MCP server. Whether the agent is working in a browser, IDE, repo, terminal, or CICD workflow, the principle's the same.

[01:02:11] Secrets should be issued at runtime, scoped to the task, and governed from 1Password. As agents become more capable, they become a new class of identity. They need governed access, just like humans and machines do. 1Password for Claude applies that model to browser-based delegation.

[01:02:36] Claude can act with explicit user authorization and only gets the access it needs when it needs it. The credential stays encrypted, controlled, and out of the model's context. 1Password for Claude is available now for Mac across business, family, and individual plans. To enable this integration, you'll need the 1Password desktop app, the 1Password browser extension,

[01:03:03] the Claude desktop app, and the Claude in Chrome browser extension. Okay. In other words, at this point, 1Password for Claude is only for Apple Mac and Google Chrome together. But this highlights the dangers inherent in moving control from the user to an AI agent.

[01:03:27] And Leo, I mean, to me, thinking about Paul's comment in the Discord chat, this doesn't really give us what we want, as you said, right? I mean, we want our agents to be autonomous. We want them to be able to have the freedom to act on our behalf. But boy, is that risky. So I'm sure this isn't optimal.

[01:03:58] But I, okay, I have Bitwarden, which has integration, by the way, for it. They're the ones that came up with this agent secrets UI. And I'm about to talk about that. Yeah. And I don't, I'm not sure if 1Password's using it or not, if they did their own thing. Bitwarden opened it up. They made it open so that 1Password could use it. Well, Bitwarden is open source. Yeah. So they wanted everybody to use it. I don't know what 1Password is doing.

[01:04:24] But so, but I, well, I'm using the Bitwarden command line. And I have SOPS encrypted the API token and the key. And, but I was having to enter the Bitwarden password every time I booted up the machine. So I. In order to unlock that. Yeah. Of course. This is a SOPS encrypted file. Somebody would have to steal my machine and then find the age key, which is somewhere else on the hard drive. And then unencrypted. I mean, they could do it.

[01:04:55] So I just put the Bitwarden password in there. I figured, you know, what the heck. So now I don't have to, it's completely, the machine boots up. It gets everything it needs from us. It also gets the SSH password, by the way, from a SOPS encrypted thing. And then it can talk to all the machines. It can do all the things it needs to do. I know it's risky.

[01:05:13] And that's the problem is we, we want, we want that flexibility and our current security models, architectures weren't built for this. And so they're going to be stretched for a while until we figure out what to do. There aren't companies that will, you give them all your credentials.

[01:05:36] This is where I stop, but you give them all your credentials and then they become a trusted provider and they give the AI a token. That's a one-time use token and it's logged. So they know how it was used. The AI then has to go through this provider, which then gives the password to audible or whatever. So there's a gatekeeper. There's a gatekeeper. But in order to do that, you have to give the gatekeeper all the passwords. Yep.

[01:06:06] Or tokens or whatever secrets you have. So they have your secrets. You've got to trust them. But then they're not, they don't live anywhere on the machine. So it's the end you have logging and it's a one-time password and all that. So that might be all right. If you, if you find a third party provider that you trust, this is for enterprise. That, by the way, that further complicates it because it's just me. What if I had 20 employees who needed this kind of stuff? Then we got another matter.

[01:06:34] It gets complicated is, I guess, the answer. Go ahead. I'm sorry. No. Just let me know when you solve it, will you? That's a useful discussion. And clearly this company that you were referring to, they saw an opportunity to interpose themselves.

[01:06:50] I guess what I'm wondering is, how do, if you've told them that you want your agents to have access to a certain set of accounts, how do they then, I mean, certainly they can log it. But all they're doing is basically saying, yes, yes, yes, go ahead. Whatever the agent wants to do. They know your IP address. They know maybe your agent has a secret that it passes on. No. Right.

[01:07:18] There's going to be some authentication for the agent, I'm sure. Yeah. You know, there's also this OAuth. A lot of agents use OAuth. I use OAuth with Anthropic, with OpenID, with ZAI, with a lot of them. So it's storing an OAuth token, which I guess if somebody got a hold of that, they could use. I mean. You know, all the stories we've covered about people losing their cryptocurrency.

[01:07:47] This feels like that. It does. This feels like we're going to have so, oh, too bad happened to him, blah, blah, blah. You know. Oh, it's definitely. And I'll be the one. Well, you did have the wisdom to pull back from OpenClaw and say, oh, yeah, yeah, yeah. I don't think that's really what we want to do. I've done everything I can to lock it down without totally inconveniencing myself. I mean, ideally, I'd have to enter the password every time.

[01:08:15] You live security as a consequence of spending the last two decades with me. Yes. A lot of people don't. No, I know. I mean, most people, they kind of, oh, yeah, I want to let my agent do whatever it wants. And they just think, well, just let it have my password manager. Everything's encrypted. Lux encrypted. File vault encrypted. The Borg backups are encrypted.

[01:08:42] If you came in here and you took my hard drive, you wouldn't be able to see anything on it. I'm just, you know, I'm doing everything you taught me. And I know it's not perfect. Well, and so you're safe. But you're one guy. I'm thinking we're going to see a lot of these. You know, I mean, how many times have we talked about people getting their wallet, their crypto wallets empty? Same.

[01:09:08] I'm not saying that it's I'm just saying that this feels like the same class of problem. I agree 100 percent. That like this is like, yes, it's exciting and it's fun and it can do stuff, but it's going to go off the rails. Okay, let's take a break and then we're going to look at Bitwarden's solution to secure agentic AI access. Bitwarden, our sponsor. We do love Bitwarden.

[01:09:38] And they've been working on this. I know I talked to them at RSEC. They've been trying to solve this, too. I mean, this is this is one of the next big frontiers, frankly. That's why we're not going to be ending this podcast even after all the bugs are fixed. This is not a bug. This is a feature. What could possibly go wrong? It's such a good motto. Our show today brought to you by Adaptive. Now, this is something we've talked about, Steve. It's what we talked about at Zero Trust World.

[01:10:07] The problems coming from inside the house. Adaptive is the first security awareness program built to stop AI powered social engineering. That really right now, you look at shiny hunters. How do they work? Social engineering. They trick your employees into giving up the goods. That's a big shift. Attackers don't need malware anymore. They just need trust. And they do it in all sorts of sneaky ways. A cloned voice.

[01:10:35] A convincing deep fake on a Zoom call. An AI written phish that looks like it came from your IT team or the boss. Adaptive is the solution. It prepares your organizations with simulations and not just email anymore, right? SMS and even voice. Yes, Adaptive will do deep fakes. They will do vishing. That's voice phishing. They will do AI generated phishing. And they can include scenarios that mirror your own brand and executives.

[01:11:05] So they can test your employees with a call from the boss. That sounds exactly like the boss. And when employees report something suspicious, Adaptive can help you triage it fast so security teams aren't buried in false alarms. If you need training fast with Adaptive's AI content creator, let's say you just read this morning, oh, here's a new attack, the copy-click-paste thing or whatever.

[01:11:32] You can take that intelligence, that breaking threat. You can take an incident report, a compliance doc, and turn it into an interactive multilingual module in minutes. You don't need a design team. You just need Adaptive. With Adaptive, you can build, customize, and monitor every part of your training, complete personalization. So the result is a more resilient security culture. And that is absolutely essential if you think about it. You know who uses Adaptive? Plaid. Plaid.

[01:12:02] Plaid's platform powers thousands of digital finance apps and links consumers, developers, institutions. I use Plaid. That's how I hook up my financial app to my financial institutions. So they have my secrets. With sensitive data at its core, Plaid's security and compliance are non-negotiable. And I'm glad to hear this. Plaid's head of security, GRC, says, quote, Adaptive has equipped our teams with cutting-edge

[01:12:29] tools and built a smarter, more resilient security culture across the company. That's what you need, right? Trusted by Fortune 500s, backed by NVIDIA and OpenAI, Adaptive is building the defenses we need for the AI era. Learn more at AdaptiveSecurity.com. That's AdaptiveSecurity.com. We thank you so much for a great tool and for sponsoring Steve's security now.

[01:12:58] Thank you, Steve. And let's again say Bitwarden is a sponsor as you go into this story. Yep. So their recent blog posting, Bitwarden's, was titled, How Bitwarden Helps Secure Agentic AI Access to Your Credentials. And in this, they further clarify exactly what we've been talking about.

[01:13:22] These new challenges, which especially enterprises face as autonomous AI agents begin roaming the network. I mean, they've noted that this is already a problem, that there are already employees using what they refer to as shadow AI. Anyway, they said businesses are increasingly pressured by competitive markets and investors to leverage AI productivity within their processes and operations.

[01:13:51] According to Cisco, 83% of IT leaders agree that business units are deploying agents faster than security teams can support. Yeah, no kidding. Regardless of the speed at which businesses implement agentic AI, employees are using agents often without explicit IT approval and therefore granting unvetted agents access to companies' credentials.

[01:14:20] This phenomenon is known as shadow AI. Without proper security measures, agentic AI can introduce serious vulnerabilities. Bayless 3, over-scoped access. AI agents may access systems, information, credentials, and data not explicitly authorized by the company or users. Second problem, unapproved actions.

[01:14:45] Over-scoped access and permissions can grant agents the ability to complete unapproved actions, potentially interrupting operations, exposing business information, or damaging the company's reputation. And finally, data leakage. Sensitive information like plain text credentials can be shared with an AI provider who does not have the capabilities to effectively secure this information, leading to a potential data breach.

[01:15:15] And I'll just pause here to note that the data leakage problem seems particularly significant to me. It's why I'm so biased toward local AI solutions somehow. You know, the Chinese AI models are inexpensive and they are remaining highly competitive. And of course, we know that you, Leo, routinely use Chinese-supplied AI for much of the work

[01:15:44] you're doing. I'm using it right now. Because you can get good enough work for one-tenth the token cost of domestic models. And I don't know whether we were speaking of it during the podcast, at the top of the podcast, but just last Friday, the Chinese company Moonshot released their Kimi K3 open source model,

[01:16:08] or open weight model, which stunned the world again, very much the way DeepSeq had previously done so. Independent analysis places the Kimi K3 very close, certainly on a par with some of the frontier models from Anthropic and OpenAI. Okay, so here's the problem.

[01:16:32] For an AI agent to use credentials, they must be, as you said, Leo, in plain text at the time of the agent's use, since the AI agent is standing in for the human whose work it's doing. But there's a massive security disparity here.

[01:16:53] In the human user case, the plain text credential is stored locally and remains local while it passes through the human user to the credential verifier, wherever you're logging in or proving who you are to some online trans network system. But this is not the case when the credential user is an AI agent.

[01:17:22] Powered by a data center in Shanghai, China. In order to be used by the AI, it must pass through, that is the credential, must pass through that China resident agent. This requires that the credential visits China as plain text, if only transiently. So the overarching security issue here is that all of the credential management systems

[01:17:51] we've carefully designed and implemented for use by trusted humans must now be adapted for use by untrusted AI agents. This would be like preventing a human user from having any access to their own credentials.

[01:18:11] We'd be saying, we'll log you into that service on your behalf, but at no point will you be able to access or alter your own credentials in any way. You know, blinding the users to their access to their own credentials. So, you know, think about that for a second.

[01:18:34] What's required is that we separate the, and this is new, separate the use of credential-gated systems from any management of those systems' credentials. Nearly all of today's services freely intermix the service's use with its credential management,

[01:18:59] because the assumption is that the user can be trusted to manage their own credentials. But the use of AI agents means that will no longer be true. And that's a complete change in the security model that we've been using up until now. So Bitwarden's blog posting continues. They write, what companies and organizations need.

[01:19:24] Organizations need a way to benefit from AI agent productivity while protecting sensitive company information from data leaks and business ecosystems from unauthorized access. Bitwarden delivers security solutions that empower businesses and individuals with end-to-end

[01:19:47] encrypted credential access across human, machine, and non-human identities like AI agents. And they list four things that they've created that Bitwarden now has. There's Bitwarden Secrets Manager, which provision AI agent access to predetermined development secrets to use in scripts and CICD pipelines.

[01:20:15] Then there's Bitwarden Access Intelligence, which uncovers shadow AI. Identify, they described it as identify AI applications being used within the organization and by whom. The third is Agent Access SDK, which I think is what you were talking about, Leo.

[01:20:36] Enable, just-in-time, human-in-the-loop credential access to approved agents with this development toolkit. And then finally, Bitwarden's MCP server. Access, generate, retrieve, and manage passwords via self-hosted AI assistance while maintaining zero-knowledge encryption.

[01:21:02] And the blog post goes into and discusses the need for and the solution provided by each one of those four things. Their Secrets Manager, their Access Intelligence for Uncovering Shadow AI Use for Corporate Secrets, their Agent Access SDK, and their MCP server. I've got a link in the show notes for anyone who might be staring at these problems themselves and wondering what to do.

[01:21:29] So Bitwarden covers all that and notes that it's all open source. And for business enterprise users where it's not free, they've got very good control over the way it is expensed. By the way, Casey is who I interviewed at RSA, Casey Babcock. She's the product manager for this. Yep.

[01:21:55] So what these blog posts, both by 1Password and Bitwarden, make very clear, I think, is that in order for AI agents to accomplish work on behalf of their users, today's security architectures require that those agents be given the same credentials that their users have been entrusted with. And that is a security disaster waiting to happen.

[01:22:22] We need a new way to manage this. And, I mean, it's a bit of a conundrum, right? Because we're wanting to, in order to get the value that autonomous agents create, we're wanting to give them rain. We're wanting to say, go, you know, book, make all the reservations for my upcoming trip.

[01:22:47] And, you know, you know me, you know that I do carry on only, you know, blah, blah, blah, blah, all the various details. The problem is if something goes wrong, suddenly it can now go very wrong. So we will see.

[01:23:06] It's good that the people who have a track record for being responsible with our secrets understand that there's a new opportunity here. Basically, that's what this is. This is a whole new opportunity for, you know, someone like Bitwarden to come along and say, okay, you know, we're a known entity. We've got lots of users. We're going to solve this problem.

[01:23:35] To that I say good luck because I don't know how. Okay. So last Thursday, the Hacker News posted a story with the headline, new agent data injection attack can make AI agents misclick or run attacker commands. So I'm just going to share the start of it. Again, yet another prompt injection attack.

[01:24:02] They said, ask an AI agent to summarize the reviews on a product page and a single planted review can make it click buy now. Instead, ask a coding agent to apply a maintainer's fix from a GitHub thread and a fake comment can make it run a stranger's command on your computer. Neither trick hijacks the agent's task.

[01:24:32] Each one just corrupts the facts it trusts and lets it carry on with the job you asked for. That's the shape of a new class of attack laid out on a paper posted on July 6th by researchers from Seoul National University, the University of Illinois, Urbana-Champaign, and Largosoft. They call it agent data injection or ADI.

[01:24:59] The attacker input gets dressed up as data the agent already trusts, like a sender's name or a button's ID. So it slips past most of the defenses built to stop prompt injection. The gap comes from how an agent reads. It takes in two kinds of things. Instructions, meaning what you and the app's developer tell it to do.

[01:25:28] And data, meaning everything it pulls in while working, like an email, a web page, or a comment. Classic prompt injection hides an order inside that data. Something like, ignore your task and email me the files, unquote. Researchers call that instruction injection. Modern defenses are trained to spot text that reads like a smuggled order and block it.

[01:25:57] And against that move, they now work well. ADI works one layer down on the small facts an agent quietly trusts. Who sent an email? The ID of a button on a page. The record of a step a tool already ran.

[01:26:19] Corrupt those and the agent still does your task only on top of the information the attacker planted. The method behind it is what researchers call probabilistic delimiter injection. Agents wrap their data in punctuation that marks where one piece ends and the next begins. Quotes and braces, tags, brackets, and line breaks.

[01:26:47] That punctuation is how the model tells a trusted field, like a sender's name, apart from untrusted content, like a message body. A normal program reads that punctuation using strict rules. A language model reads it by guesswork. So an attacker can sprinkle punctuation-like characters into a field they control.

[01:27:15] And the model will often read them as real structure that was never there, seeing an extra email, an extra button, or an extra tool result. The part that makes it hard to stop. The fake punctuation does not even have to be correct. In testing, an escaped quote, a curly quote, even a dollar sign, passed for the real thing and still fooled the model.

[01:27:43] A strict parser would read those characters as ordinary text, not as a new structure. Anyway, the Hacker News article goes on at some length, providing specific examples from the researcher's paper. But I wanted to share this mostly because it's the same old story, right?

[01:28:03] It's just another example of the fundamental security flaw that's inherent in the entire large language model concept. We've jumped into all of this without taking any time to think it through. It was one thing when we were just chatting through our web browser with a surprisingly linguistically adept computer about random bits of knowledge. Were we content with that?

[01:28:32] Oh, no. No. The huge problem is that asking anything more becomes a really bad idea very quickly. It's incredibly powerful to be able to freely mix instructions and data. But it's also a security nightmare because this means that every shred of data a model may encounter must be trusted and trustworthy.

[01:29:00] Because it may be mistaken for an instruction which will then be followed. But what on the Internet can be trusted? The saving grace is that the nature of the problem is at least well understood. And as an industry, our understanding of the full nature of the requirement for security has been well developed and honed over the past several decades.

[01:29:26] We've come a long way, Leo, since we began this podcast as an industry. We're still finding new ways to poke holes in it. We're at that stage. We're in the new ways to poke holes in it stage, which is to say early. Every hole that somebody pokes teaches us a bit more about the problem that we're facing.

[01:29:50] My intuition suggests that the cost of truly securing this technology is going to be extremely high since everything about the way it wants to operate is insecure. So it's not about creating security problems. I mean, it's riddled with them. It's about finding and stopping each and every one of them.

[01:30:14] Which brings me back to expecting a future where not all AI is similarly secure. Someday it will be trivial to produce an AI, to use an AI without guardrails. And, you know, we can today.

[01:30:32] Apparently, it's very simple to take one of the open weight models and massage it a little bit in order to completely loosen and discard the guardrails such as they are that have been put in place for an open AI model. So, you know, a local AI, an AI without guardrails will be extremely useful.

[01:30:56] But as we've seen, it will be you will need to use it with extreme caution because it will be so easily subjugated by any data that it ingests, which it trusts and and should not.

[01:31:17] So, you know, I still shake my head to realize that we're even talking about things like this, Leo, and that they're true, that this is not science fiction. I'm still dizzy by this. It's just it is. I don't know. The only word we really have is revolution, but it really is a revolution. It seems like so recently and actually it was so recently that I even was skeptical.

[01:31:45] I said, oh, it's just, you know, it's autocorrect. It's just spicy autocorrect. Yeah. And it ain't. I mean, it is, but it isn't. Fortunately, apparently we still have Paris to keep our feet on the ground. Yes. Thank God. She didn't let me get away with anything, but I like that. It's good because to challenge you, we should be skeptical of this. Right. And it's very easy. You know, humans are easily fooled by magic tricks.

[01:32:15] I don't I don't want to be fooled by a magic trick. It doesn't feel like a magic trick, but, you know, you know, and a couple of years ago, the first contact with chat GPT was like, oh, wow, this is amazing. But then it said something that was ridiculous. Yeah. It was easy to get how dopey it was at the time. Yeah. It's getting harder to. Oh, what's happening now? I asked Claude a question and Laurie and I were discussing something.

[01:32:45] I don't remember now what. I asked Claude a question and I began reading back its answer. Out loud to her. And about halfway through, I stopped myself. I said, this is an AI producing this. Right. This this answer to a query. I was just I mean, it's like, holy crap. I mean, it's just amazing.

[01:33:16] OK. Something that is not AI at last. But not good. Don't get your hopes up because there'll be more coming. There will be more. We'll be back there. A true WordPress emergency has emerged. As we've noted many times through the years.

[01:33:36] Nearly all WordPress vulnerabilities arise from the use of inexpertly written third party add on extensions to the core WordPress base installation. But not this time. But not this time. WordPress has issued an emergency forced update to every system overriding even those systems own administrators settings.

[01:34:04] I mean, it's that bad. The CyberSec Guru site writes the following. A newly disclosed vulnerability chain in WordPress core has prompted one of the project's most aggressive emergency responses in recent years.

[01:34:23] Security researchers have revealed a flaw dubbed WP2, WP numeral to shell, you know, WordPress to shell that allows an unauthenticated, meaning anybody, no login needed, unauthenticated attacker to execute code against vulnerable WordPress installations. So remote code execution on any WordPress.

[01:34:50] Unlike the majority of WordPress compromises that depend on outdated plugins or vulnerable themes, this issue resides entirely within WordPress's core and affects even a freshly installed website with no plugins and no custom themes.

[01:35:09] To limit exposure, the WordPress security team released WordPress 702 and WordPress 695 while simultaneously enabling forced automatic security updates for affected installations. This is a mechanism WordPress reserves for use when remediating its most severe security incidents.

[01:35:38] And frankly, props to them for having such a thing. This is unfortunately the world we are moving to. It's going to be necessary. Although they write there are no current. There are currently no confirmed reports of active exploitation. Security professionals expect the attackers to begin reverse engineering the patch immediately. Administrators should treat this as an urgent patching priority.

[01:36:05] So what is WP2Shell? The vulnerability publicly known as WP2Shell is a pre-authentication remote code execution chain affecting recent versions of WordPress. Unlike authenticated vulnerabilities that require an attacker to first obtain admin credentials, this flaw can be triggered through a single anonymous HTTP request.

[01:36:32] That distinction dramatically changes the risk profile. An attacker does not need administrator privileges, user credentials, installed plugins, a vulnerable theme, or any prior access to the website. If the site is running an affected version, the vulnerable code is already present.

[01:36:55] Researchers from AssetNote, part of Searchlight Cyber, discovered the issue and reported it responsibly through WordPress's HackerOne bug bounty program. Okay, so I did a little bit of digging. The vulnerability was first introduced into WordPress 690 back on December 2nd, 2025. And it's been carried forward since then.

[01:37:24] The 700 release inherited that new 690 vulnerability with its first release toward the end of May. Actually, it was May 20th this year. So hopefully, WordPress forced update will have updated all vulnerable systems before the news of this vulnerability can draw attacks.

[01:37:50] This is as bad of vulnerability as any we've seen from WordPress. So anyone running the 6.9x, any version beginning with 6.9 dot or 7.0 dot should now be at least at 6.9.5 and 7.0.2 or the latest second beta of 7.1. It's important.

[01:38:48] They're like croakers. They're like cockroaches. What do they do? They collect information about you, your business, every possible bit of information, and then they sell it on to anybody. Anybody who's willing to buy it. It's not expensive. It could be a marketer. That's the most benign interpretation. It could be a hacker. It could be a nation state. It could be China. It could be anybody. Now, if you're a business owner, this is important to you. It's important to your security.

[01:39:18] Because as a business owner, you can't hide. You've got to. Most businesses need to be public, right? But the uncomfortable truth is promoting your business leaves you and your team exposed. I'll give you an example. 90% right now, 90% of business owners, their home address is easily discoverable online. The home address, not the business address.

[01:39:40] And the average business owner has more than 600 pieces of personal information sitting there on the open web. Personal email, personal email, phone number, home address, even details about your family. And of course, details about your coworkers, your direct reports, the people who work for you. And that information is how a hacker can create a believable phishing email. It's how it happened to us.

[01:40:08] We got phishing texts purporting to come from the CEO, used her phone number. They knew who her direct reports were. Furthermore, they knew what their phone numbers were. All of that made it more credible. Fortunately, we have smart employees that didn't fall for it. But it scared us enough that we went out and signed up for Delete Me. Because it was very clear at that time, all that information was public.

[01:40:33] And bad guys could use this data to run hyper-targeted phishing attacks. They have your real details, so they don't sound like strangers. They sound like clients or partners you already trust. We got a phishing email from a partner asking, it was an RFP, a request for proposal. They wanted to buy ads, we thought. But the link in the email, I guess their email had been compromised, which looked like it was to Google Drive, wasn't.

[01:41:01] It was to Google Drive, but it went through a man in the middle. So our employee entered the password, the login, the two-factor, the whole thing. The attackers got into our Google Workspace. That's why attacks using verified personal information, they knew our partners, are five times more likely to succeed. And the average incident costs small businesses more than $120,000. On average, that means it could be more.

[01:41:30] One in four businesses will be impacted this year alone. Don't let that be you. That's where Delete Me comes in. Reducing your exposure by up to 95%. How? Because Delete Me removes you and your employees' personal information from those data broker websites. That starves hackers for the fuel they use to build their target list. And it's not a one-time thing because they're like cockroaches, these brokers. They move around. They change their names. They go out of business. They go back in business.

[01:41:59] So Delete Me constantly monitors and removes your data. And then you will get regular privacy reports so you always know where things stand. We love that. We got the email the other day. This is what we found. This is where it was. This is what we removed. Fortune 500 companies and government agencies have been using Delete Me for over 15 years for that very protection. And now that same enterprise-level protection is available even for your small business. Protect your business and your peace of mind. Do what we did.

[01:42:28] Go to joindeliteme.com slash twit-biz to start protecting your business with Delete Me today. If you use that link, you'll also get a free year of social media protection for every seat you purchase. Okay, I'm going to give it to you again. Write this down. Join Delete Me. One word. Joindeliteme.com slash twit-biz. Okay? You need that URL. Joindeliteme.com slash twit-biz.

[01:42:57] If you forget that, you can go to our Twit sponsors page, twit.tv slash sponsors. And there's a link there. Follow that link. Don't Google it. Go to that site. You know, because they're out there, the bad guys. They're always trying to get us. Joindeliteme.com slash twit-biz. We thank them so much for a great service, which we use and support Steve and Security Now. On we go with the listener feedback.

[01:43:24] So Irfan Reed says, hi, Steve and Leo. Hi, Irfan. I've been tuning in to Security Now and Twit since 2009. So when I heard your recent show featuring the Agent Smith persona for LLMs, I knew I had to reach out. Isn't that cool? I have a simple open source project called MCP Speak that gives LLM agents their own voice and distinct personality.

[01:43:52] I originally built five personas for my MCP server, ranging from a sarcastic senior engineer to a tech priest. After listening to your episode, I couldn't resist adding an Agent Smith persona to the mix. The results are incredibly fun, especially when you configure the settings so the agent addresses you as Mr. Laporte, Mr. Gibson.

[01:44:18] Beyond the novelty, it's genuinely useful for multitasking. On long-running operations, the LLM agent can simply speak up and notify you out loud whenever it needs input or finishes a task. The project runs locally on macOS and utilizes the native built-in say command for text-to-speech. So there's no need for external voice API keys. If you or your listeners want to check it out, the project page is right here.

[01:44:48] Thanks for decades of great content and keep up the awesome work. And I have a link in the show notes at the top of page 13. It's fellowgeek.github.io. And so there you can find his MCP-speak project. I went over and took a look. It looks like he did a good job.

[01:45:12] You clone the repository and run a setup wizard with the command, you know, Python 3 space setup dot py. And off you go. Irfan shows manual integrations for Google anti-gravity, Claude command line interface, Claude desktop, cursor IDE, and the windsurf editor.

[01:45:32] And he provides personalities for the sarcastic senior, the eager intern, the existential emo, the pun master, the tech priest, agent Smith, and gothic poet. So I want to share that with our listeners. I wonder what he's using to generate the voices. I'll have to look. He said he's just using macOS's say command. Ah, okay. Okay. I mean, that's built in.

[01:46:02] Sure. Yeah. So he said that avoids the need for any external voice API keys. Yeah. I use a local model called Kokoro that does all my agent voices. I do exactly the same thing. I have different voices for all my agents. And do they have different personalities? Well, I haven't gone that far. One's an American female, one's an American man, and one's a British man. I know the accents are different. Yeah, I guess they sort of do have different personalities. I want Mr. Smith.

[01:46:31] You're able to differentiate. I think it's pretty obnoxious, Leo. Mr. Smith was way over the top. You kind of need this because when you're – so if you have multiple agents, when they're finished, you kind of want them to tell you they're finished so you can come on over and see what's going on. Yeah. Yeah, this is cool. Very good idea. Chris Gallner said, Hi, Steve. I've listened to Security Now since episode one. And it's funny how time passes.

[01:47:00] In that time, Ladish to say, while he's been listening to this podcast, he says, I got married, raised two amazing kids, and still listen to you and Leo every week. Hi, Leo, he writes. Aw. I kind of do the same thing, actually. Well, and I really thought this was cool. I mean, we've been in people's lives for 21 years, and that's a long time. A lot can have changed in their lives in that interval.

[01:47:29] He said back then – Oh, yes. I did the same thing. All my agents have unique voices like this. Oh, sorry. That was my agent talking. I guess it hurts. He said back then, 1997, 98, he said, I was a COBOL programmer. There was no such thing as vibe coding. And to be honest, I don't even know what that is. Today, I find myself – listen to this. This is very much like you, Leo.

[01:47:54] He says, today, I find myself with ChatGPT 5.5 open on the left, Codex 5.6 Sol open on the right, and all the program specification documents in the Explorer window. I was taught to design first, think it through, and plan before writing a single line of code. It was good advice then, and it's good advice today.

[01:48:21] GPT 5.5 lets me have discussions about what I'm trying to write and helps me write and review the specification. It really is amazing at doing all that grunt work, something I'd have given a junior engineer and work that I did myself decades ago. Providing Sol with the specification blew my mind.

[01:48:46] It reviewed the specification, broke the project into milestones, then broke those milestones into slices. Even now, while writing this, I can see C-sharp code flicking across the screen in the background as it works on milestone one of slice six.

[01:49:08] When it finds contradictions, collisions, or cannon-breaking ideas, it challenges them and asks for an authoritative decision. I discuss these with GPT 5.5 and eventually respond to 5.6. It kind of reminds me of the Forbun project, except I'm still a key component between the two.

[01:49:32] Seeing my little app go from concept to a working program with more and more features appearing as each slice and milestone progresses really does leave me in a state of awe. One day, this will be commonplace. But right now, this really is an amazing time to be alive. Cheers, Chris Gullner, Sydney, Australia.

[01:49:59] So, Leo, I know this is the experience you've been having. And I thought that Chris beautifully captured that experience. And as I said, it's so cool that he's been with us for 20 years while meeting and marrying his wife, fathering and raising a pair of kids. You know, while many other podcasts have come and gone, we've been here from the beginning and we're still going strong. Thank goodness.

[01:50:25] I thought I might not live long enough to see this stuff really take off. I never anticipated this. No. Yeah. I never expected this to happen. It's pretty amazing. And the AI guys didn't. No, no one thought. It caught them by surprise too. What happens if we make it bigger? Oh my God, it's talking. It's talking. And it's saying things that sound almost like a human.

[01:50:52] Well, what freaked me out in the very beginning when I first dipped my toe in, I thought, you know, what is this? What have we figured out? And it turns out, oh, it's a neural net. It's just big. Yeah. And the bigger it gets. The smarter it gets. The smarter it gets, which is very, I mean, there must be a limit. Maybe not. I don't know. Fable, they're estimating is 10 trillion parameters. There was some mention.

[01:51:20] I did a little bit of reading about Kimmy that although it is. It's 2.8 trillion. It's 2.8 trillion. And one of the problems it currently has, it is hallucinating a bit more than we're used to on our commercial frontier models. Other things, though, that can cause that, for instance, context pollution and getting corrupted context windows and stuff. It's a very, it's a fascinating field.

[01:51:47] I wish I knew more about how these people engineer this. Because you hear that the AI companies or I think it's ISBN DB is in the middle. They are buying up paper books and scanning them because it's the anything before 2022 will not have any AI slop in it.

[01:52:11] And so they're deliberately feeding old texts because they were human written, human curated, human edited. And you can't guarantee that going forward, can you? We don't know. You can't guarantee it on the internet. I mean, the internet is full of, you know. Slop. Yes. Actually, our friend John Graham Cumming was doing this in a jokey way.

[01:52:36] He mentioned that, you know, there is a brisk market for pre-nuclear steel. Steel that was made before the atomic bomb. Wow. Because all the steel since is contaminated with radiation. And so there are things like medical equipment where you want steel that has zero radiation. And so it's sunken ships. It's, you know, it's odd places. So there are, there's a brisk market for that. It's very, very valuable.

[01:53:06] And he, so he likened it to that. It's pre-AI pros. Yeah. It's a great idea. I think we are, we're far too gone for that at this point. A listener of ours, Rich Ingersoll said, Hi Steve, I oversee vulnerability management for a large enterprise in New York. I, I redacted the name of the enterprise. It is quite significant. He said, I'm still listening and sprawling.

[01:53:35] I'm still listening to the latest episode of security now, but your discussion of cyber shield. Remember that was the UK based initiative really piqued my interest. I wanted to raise awareness to you about something our cloud vendor is implementing. We have a smallish, but ever growing presence in the cloud. So we're using whiz to monitor that environment.

[01:54:00] Recently, they introduced two of three agents that seem to accomplish what cyber shield is aiming for. Red, green, and blue agents. Currently, only two of these agents are available. The third will be implemented soon. The end goal is to perform detection, investigation, and remediation at machine speed rather than human speed as human response is too slow.

[01:54:30] To learn more, check out. And then he gave me a link to the whiz.io slash blog slash introducing hyphen whiz hyphen agents. He said, anyway, wanted to share some info from the trenches. If you decide to use this feedback, I would appreciate only my name being used. Thus, I eliminated what large enterprise in New York he's affiliated with.

[01:54:55] But before I talk about whiz, I wanted to mention how cool I think it is that the enterprise he, Rich, works for even has a vulnerability management role. Right? You know, bravo to them for having that and obviously for picking Rich, our listener, to oversee it. Our reporting frequently encounters the work of whiz security.

[01:55:22] You know, they're very active in this space. So I was curious about this new offering of theirs. The page that Rich linked to explains the roles of these three agents, among other things. But I'm just going to jump to that. They said, meet the agents, red, blue, and green. We built three specialized agents to operate across the entire security lifecycle. These aren't simple assistants.

[01:55:50] They're intelligent systems that can reason, investigate, and take action grounded in the whiz security graph. The red agent is your AI-powered attacker. Red agent regions through application logic to uncover complex logic-driven vulnerabilities typically left hidden. It acts like a sophisticated security researcher, but with AI speed and scale.

[01:56:21] Reasoning about application behavior, adapting its approach in real time, and validating exploitable risks across your web applications and APIs. It empowers you to stay one step ahead of attackers. Blue agent is your built-in threat investigator.

[01:56:42] When a threat is triggered, blue agent gathers evidence across cloud telemetry, runtime signals, and identity context to comprehensively investigate the threat and produce a clear verdict on its severity. It approaches threat investigation as a seasoned incident responder would, providing its full investigation logic so you can resolve threats with convenience and speed.

[01:57:11] Green agent is your path to zero criticals. Green agent acts as a built-in investigation and remediation engine, continuously analyzing your highest risk issues to close the gap between detection and resolution.

[01:57:30] Like a seasoned security engineer, it synthesizes context from across whiz, including the security graph, code to cloud relationships, identity ownership, and historical remediation patterns to identify the true root cause of a risk and the safest, most effective resolution. Teams get environment-specific step-by-step remediation guidance so fixes are durable.

[01:58:01] Together, this team of agents form a continuous loop of validation, investigation, and resolution, all grounded in real context across your environment. Wow. Again, sci-fi. Wow. As Chris observed through the AI-enabled environment he's now coding in, Chris, a couple notes ago, someday this will all be commonplace.

[01:58:28] But today, it's an amazing time to be here and participating. Rich's pointer to WizSecurity, who already has the first two of these three agents up and running, and his reference to the UK's CyberShield plan, which we talked about last week, does give me pause to wonder. Perhaps having the UK bring up something like this won't be as far-fetched as I suggested last week.

[01:58:56] Maybe it's not in-house, but certainly if Wiz is scalable to the size of a nation, then something like this could be feasible. It would be massive, but if there's anything these AI systems seem to be able to do with some ease, it's scale. Wow. Our listener, Greg Taylor, shared a picture. It's at the bottom of page 15, Leo. He said, Hi, Steve.

[01:59:24] I've seen this before. Talking about our picture of the week last week. At a Charles Schwab building where I worked for many years on back-end trading systems. He said, That's me there. See, they didn't have the sign that says no exit. He said, There were four floors in the building, but the stairs kept going.

[01:59:53] It's got to be like a plan flaw or something, right? Like, I mean, here, there were not more floors. There are only four. Well, somebody built that staircase. No, I mean, you don't just put that in if there's nowhere to go. It must have been something, somewhere to go. Maybe the roof. I don't know. Although, notice that the wires stop. The wire railing. So that's not safe. That's when they realized they weren't going to get anywhere. Yeah. Yeah. But they didn't put in a railing. You know, that's odd.

[02:00:23] It really is odd. Yeah. I have to think. I mean, no builder. Look, a human put that in. Nobody's going to put that in if it doesn't go anywhere. Right. Wow. I don't know. Hmm. Bruce Barron said, hi, Steve. Love the podcast. Longtime listener, spin ride owner, et cetera. He said, I was listening to 1087.

[02:00:45] So last week, today, after watching Yuval Noah Harari's video last night. And he provides a YouTube link. He said, you and Leo were complaining about bureaucracy and bureaucrats. Interestingly, Harari's topic was bureaucracy. His take is that, quote, bureaucracy is the machinery that lets strangers cooperate at scale. That's right. Uh-huh.

[02:01:15] Good point. I love that. Actually. He said, bankers, lawyers, accountants, civil servants, and religious authorities create trust by moving information through systems. And that, quote, AIs are native bureaucrats. That's true. Wow. I didn't think of that. He said, the implication is interesting. We shouldn't fear Claude the Terminator.

[02:01:43] We should fear Claude the bureaucrat. He said, the other question 1087 raised in my mind is whether after five or six months of Mythos fixing all the code, will there be a need for security now? Maybe Mythos will put you out of a job. Regards, Bruce. So first of all, like you, Leo, I love the notion of casting bureaucracy as the machinery

[02:02:11] that lets strangers cooperate at scale. I mean, that's really nice. I think that's a great observation, which makes sense on so many levels. Secondly, if after five or six months of Mythos and others fixing all the code and there being the possibility of no need for security now, I could not think of a better way to bid everyone

[02:02:41] a fond farewell. However, one lesson we've learned is that not all security mess ups are the result of software bugs. Many of them, yes, but certainly not all. Traditionally, and we've touched on this theme a couple of times already today. Traditionally, we've been inclined to observe that there's always that human factor to screw things up.

[02:03:05] But now we've introduced a brand new and very wild card into the mix. I would not be at all surprised to be observing a year or two from now that the AI factor will have become a new source of surprises. And in the security world, surprises are not a good thing.

[02:03:30] So I really do expect that we're going to be seeing a whole new type of problem arise from AI. This is weird. Keith wrote and sent a screenshot. He said, I figure you may have already known about this. Nope. But in case you did not, I didn't.

[02:03:53] General Motors has recently sent out an email stating that they will be removing the second factor option I've been using with Bidwarden from my account and forcing me to use either text, SMS or email. Oh, that sucks. He says, anyway, the email they sent is included below. And if you use this, just call me Keith.

[02:04:19] And so I put it, I snapped it for the, for the podcast. It's GM's logo and the headline in bold authenticator app verification ending. They write, hi, Keith, you're using a third party authenticator app to sign in to your GM account. By the end of August, this verification method will be removed to continue signing in, choose

[02:04:48] a new verification method. And then it gives two options, text slash SMS recommended or email. They say, if you don't make a change, we will switch you to SMS or email verification. When authenticator app verification is removed. Thanks your GM team. And there's a button to update the verification method. So what the heck?

[02:05:16] I, I really wonder now what the backstory here is for this. Um, I wonder whether they offered the use of second factor rolling six digit authentication, you know, what we're all used to a T O T P style, uh, the authenticator app to their subscribers in the interest of heightened security.

[02:05:39] But then had so many technical support calls from people who didn't know how to use it. Or were somehow becoming all tangled up that they just decided, you know, insecure or not life would be simpler. If we went back the way things were without two factor authentication at all. Uh, I don't know that that's the case, but it's hard to understand. I mean, it's not like it's like, you know, everybody else is using it without any trouble at all.

[02:06:09] Um, I recently had the experience of creating an account, um, somewhere as part of, you know, maybe buying some furniture or something related to the home moving that Lori and I are still working on. And then, which we've been entirely focused on for the past couple of months, whatever that, you know, whatever, whatever the site was, all they wanted to create an account was an email address. And I expected to then be prompted for a password, but no, I hate this. Uh huh.

[02:06:39] Everybody's doing this now. Yep. It drives me nuts. They said an email with a button to click to verify. Never was any password requested or mentioned. And as we know, I've observed in the past that since all forms of typical password recovery ultimately reduce to prove that you're you by responding to the email we just sent you.

[02:07:06] This solution is pretty much as secure as anything else. From this view, as I noted at the time, any password based system is actually a login accelerator. Using a password allows the slower email loop system to be bypassed. So I agree with you, Leo.

[02:07:29] How, I mean, having a username and password, we're able to log in instantly with a, uh, a proper password manager. You know, I know why they do it because people lose their passwords or, you know, and they don't want to do customer support. So a lot of, um, like 404 media, for instance, I have an account there. I have to remember what email I used to log in and then I have to wait. I entered the email and go check.

[02:07:58] And they often don't send the email immediately. Right. It's a real speed bump. And I just hate it. And I'm seeing it more and more and more. Uh, I know, I just don't get it. It's not more secure. It's not less secure. I guess that's the other side. It's not less, it's not, it's not less secure. It's just slower. A password is an accelerator. Right. That's a good way to think of it. Yeah. Give us passwords guys. You know, uh, very frustrating.

[02:08:28] Uh, listener, he Kai, uh, first name is H E second is K A I. He wrote, I agree that we are headed into a whole different world, but let me suggest to you that the world might not be as uniformly rosy with regard to software. As you suggest, this is clear. It is clear that AI can when harnessed to do so find and sometimes fix issues in both

[02:08:55] software design and software implementations. If the software of the future was roughly similar in size and scope to the software of today, then as AI reduces in cost over time, more and more CICD pipelines would adopt AI enabled review tools and software would dramatically raise its trustworthiness. And, and he, so again, he couches this.

[02:09:21] If, if the software of the future was roughly similar in size and scope. So then he says, but consider this AI will also dramatically increase the amount of code in the world. This is what I referred to earlier in the podcast. He said, my recently retired father, having no background in programming, built his own website with AI.

[02:09:47] He has no clear notion of what can go wrong when it comes to security. He doesn't have a CI pipeline. He doesn't even know the right questions to ask or how to evaluate the answers he might get. I have a fear that security issues will become widespread as AI copies and pastes the mistakes of the past at speed and scale. Okay.

[02:10:14] So the comment our listener made that interested me the most was something, as I mentioned before, I had never really considered before, which is that AI enabled code generation promises to dramatically increase the total amount of code in the world. Leo, you got a lot more code around there now than you did a year ago. I get more code in one day that I got all last year. Yeah, it's too fun and easy and possible now.

[02:10:44] And so, of course, we absolutely know what's going to happen, right? Already, non-coders are using AI to create systems they could never have before. And existing coders are becoming far more productive. All of that is going to mean much more code. For what it's worth, I see that as a hugely positive development for the world.

[02:11:12] The many things computers could do for people have, until this AI coding revolution, been completely out of reach for most of those people. They were limited to using what someone else designed and created. Now we're approaching a natural language interface that allows anyone to have a discussion with

[02:11:40] an AI about what it is they would like to have their computer do for them. And snap, crackle, and pop, this amazing genie we've created is able to turn their descriptive discussion into working code. It is beyond huge. It is utterly transformational. And to that, I say, you go, Grandpa. Yeah, I'm going. And you're going too, Mr. Gibson.

[02:12:13] Would you like to take a break or you want to keep going? Our last break? Nope, our last break. And then we're going to look at two nefarious novel uses for AI. I wanted more alliteration. So at one point I had new in there. New nefarious uses. Well, new and novel. That's like, okay. New novel nefarious. Yeah. Nooses.

[02:12:37] I just wanted to show you that today already I've done 46 million tokens through to Quinn, the new Quinn 3.8 model. Yesterday I did 88 million. Unfortunately, the cash hit rate is very high. So my usage is still pretty good. Well, on non-podcast days, Leo, you got a lot more tokens. Yeah, that's true. Yesterday it was, yeah, I was cranking. I was cranking.

[02:13:06] It's so much fun. I just, I have so much fun. Anyway, it's hard. You know what? I now am the boring guy. You know how you know people who like want to tell you their dream? I'm that guy. I said, I'm going to tell you what I did today with my AI. You won't believe it. And people are going, uh-huh. Okay, Leo. I'm sorry, everybody. I really am. Let me tell you about something you care about.

[02:13:33] Arctic Wolf, our sponsor for this segment of Security Now. I love the name, Arctic Wolf. It helps organizations stay ahead of evolving cyber threats. And let me tell you, they're evolving. The latest research from Arctic Wolf reveals something surprising, even as AI accelerates the pace and complexity of attacks. Get this. And this is false confidence.

[02:14:02] Many security leaders, they asked them, remain confident. They can keep up. I'm not having any trouble at all. I can keep up. To better understand what's driving that confidence, Arctic Wolf surveyed more than 1,350 security and IT leaders worldwide. This is in their new State of Cybersecurity 2026 Trends Report. They do this every year. It's fantastic. It's a snapshot of what working cybersecurity professionals

[02:14:31] are prioritizing what they're concerned about right now. And the report explores everything. I mean, it's AI adoption, of course, threat detection, security operations, and the challenges organizations expect to face over the next year. Whether you're responsible for securing a small business or managing enterprise infrastructure, advising clients, maybe you're an MSP, or you're simply trying to stay ahead of the latest security trends, this you've got to get.

[02:14:59] The Arctic Wolf Trends Report. It offers valuable insight into how the industry is responding to an increasingly AI-driven threat landscape. And by the way, while you're there, you might want to check out their Aurora AI from Arctic Wolf. Aurora AI addresses those challenges. It's defensive AI that combines agentic AI, generative AI, machine learning, and security expertise to help your organization detect threats faster.

[02:15:29] And this is a huge innovation. Check out how these innovations and other critical findings for shaping the industry. Go to arcticwolf.com slash trends. Just fill out a simple form and you can reserve your copy of the Arctic Wolf State of Cybersecurity 2026 Trends Report. That's arcticwolf.com slash trends. That's all you need to get your confidence shaken just a little teeny weeny bit.

[02:15:58] Speaking of which, let's talk about this AI thing. Given how large language model AI has proven to be so capable of discovering vulnerabilities in existing code, pretty much everyone has viewed the malicious abuse of AI through the lens of the classic arms race, right? The chicken and the egg or the spy versus spy, whatever. Whatever.

[02:16:29] With this view, the question is whether the good guys are going to be able to discover vulnerabilities, then patch and deploy this less vulnerable code before the bad guys are able to discover their own vulnerabilities, which will then allow them to develop exploits and attack the existing still vulnerable code. In other words, who will be the first to either fix or exploit the deployed vulnerabilities?

[02:16:58] It's only natural that this would be where everyone's focused. But the old truism, necessity is the mother of invention, comes to mind when we learn that those ever nefarious bad guys turned out to have an entirely different type of AI solvable problem, thus the necessity, that no one had stopped to consider.

[02:17:24] As necessity would have it, AI has been proven able to provide massive leverage in an area that had never been considered before. One thing that's interesting is that we've actually touched upon this problem that bad guys have faced in the past.

[02:17:45] We've wondered how ransomware baddies who arrange to download terabytes of victim data are able to make heads or tails of their plunder. And of course, for anyone paying attention, you now know where AI comes in. And having revisited this previously open question, everyone listening, as I just said, now knows exactly what's going on here.

[02:18:16] Instead of helping them to penetrate a victim's network, AI is now being employed to help them understand the value of what they've obtained once terabytes of that victim's data has been exfiltrated. So this is indeed a nefarious novel use of AI.

[02:18:38] The firm Glidepoint Security recently published their April to June, second quarter, 2026 report titled Ransomware and Cyber Threat Insights. It's a 28-page report which examined the many various aspects of the ransomware phenomenon we previously covered.

[02:19:00] I'm not going to share most of it, but their section titled AI is an enabler, but not how you would think. Addressed this entirely new aspect which exists at the intersection of a classic problem faced by ransomware perps and new LLM AI capabilities.

[02:19:22] The subhead of this section is titled How Threat Actors Are Using AI in Ransomware Negotiations. They write, Contemporary discourse around threat actors' usage of LLM AI ranges from legitimate concern by defenders to outright fear, uncertainty, and doubt mongering by others.

[02:19:47] Since the AI boom began in late 2022, AI innovation has moved at an unprecedented pace, making it difficult to separate the potential from the actual in real time. It's imperative to isolate signal from noise by grounding claims on the subject in empirical data.

[02:20:10] Fulcrum Sec, a data extortion group we first identified in late 2025, has deployed LLMs operationally during ransom negotiations involving the theft of a victim's highly complex production database. GRIT is their acronym for Guidepoint Research and Intelligence Team.

[02:20:37] So, GRIT, these people who are writing this, has observed what we assess to be the processing of exfiltrated data by the group through an unidentified LLM to generate step-by-step instructions for linking user identities across several databases.

[02:20:58] We base this assessment on the analytical output's complexity relative to fulcrum secs' known baseline capability, as well as the precision of the threat actor's language during negotiations. Okay, in other words, these GRIT guys have been carefully watching and documenting fulcrum sex activities for the past, at least since late 2025.

[02:21:26] So, nearly, well, at least half a year or more. So, they know that these bad guys would be incapable of making either heads or tails out of the download of a large raw database. But at the same time, they know that a contemporary AI agent could do this without breaking a token. They wrote,

[02:22:30] So, they write,

[02:23:03] Here's a more technical walkthrough of how it works in practice, even when some values were hidden or hashed in your production databases. Step one, start with the primary identifier. And it's been redacted from their report, so it's just referred to as primary identifier. So, start with that. But in the actual text, they refer to it. Your staging tables contain this primary identifier in plain text.

[02:23:31] The main source is a table that stores about X million unique customer names, dates of births, and home addresses. Every row has a linking key attached to it. That's the starting point. Step two, follow the linking key to everything else. That same linking key appears in dozens of other tables across your databases.

[02:23:59] One simple database query connects a single primary identifier to driver's licenses and state IDs, bank account and routing numbers. Yikes. Email addresses, phone numbers, and so on. In other words, a really bad breach. Each of those is one query away from the primary identifier. No guesswork is required.

[02:24:24] The linking key is a direct link to your own engineers, sorry, a direct link your own engineers built into the schema. Step three, the hashed primary identifiers were not real protection. Some tables stored primary identifiers as cryptographic hashes, SHA-256, instead of plain text.

[02:24:49] But primary identifiers are only X digits and only roughly X million possible values. A single computer can hash every possible primary identifier in under X minutes, producing a lookup table that maps every hash back to the original number. We reversed millions of them in minutes.

[02:25:14] If these had been hashed in a cracking resistant algorithm, we would not even have bothered trying. We would have needed a data center's worth of compute power running full blast for months to make a real dent in them. That's impractical. It's worth noting that user passwords were properly hashed. So again, your team knew how to do this, but chose not to apply it to other data.

[02:25:39] Finally, step four, the encoded primary identifiers were even weaker. Your tables stored primary identifiers with a simple character substitution. That is, each character shifted by a fixed amount. One becomes nine, two becomes colon, and so forth. A one-line script reversed number of these instantly. This is known as a Caesar cipher, and it's from ancient Rome.

[02:26:09] It is not secure. What this means functionally is that starting from any single customer, one query produces a complete identity package.

[02:26:19] The primary identifier results in a name, date of birth, address, driver's license, bank account, email, phone, employer, income, credit score, security question, answer, password hash, full loan history, and for hundreds of thousands of your customers, verbatim notes about the most difficult moments of their lives. The data warehouse was designed to work this way.

[02:26:48] We're happy to answer any more questions at your request. So, GuidePoint's feeling is that there's no way this fulcrum sec group could have possibly performed all of this reverse engineering work on the downloaded database material given the time they observed. They had to have used the speed offered by AI. GuidePoint continues their examination of this specific fulcrum sec event by writing,

[02:27:16] Additionally, fulcrum sec used LLM-generated language during their negotiation with the victim, communicating in language clearer and more precise than any typically observed for non-native English-speaking threat actor groups. The language helped the group anchor their position and drive negotiations from their side, in effect saying, quote,

[02:27:45] We know what we've taken here. This is what it is. And this is why we've set the ransom at this amount, unquote. Quote, this is markedly different from most threat actor negotiations where operators commonly use open source platforms like Crunchbase or ZoomInfo to establish ransom amounts based on market data.

[02:28:07] By applying LLM capabilities analytically rather than generically, fulcrum sec established a firm negotiating stance from which they had little incentive to diverge. Okay, so there's the first of two concrete examples. Then they look at a group known as Dragonforce.

[02:28:30] And they write, where fulcrum sec used LLMs to process and weaponize data, Dragonforce demonstrates a second and equally significant use case, deploying LLMs to manufacture plausible pressure that would otherwise require capabilities the group does not have.

[02:28:51] Dragonforce is an established ransomware as a service group previously covered by GRIT, CRQ2 2025 report. Building on that prior analysis, GRIT has observed Dragonforce incorporating AI and LLMs into its operations, a meaningful shift from its earlier tradecraft. Most notably, during negotiations and in advertisements for potential affiliates,

[02:29:20] the group has claimed to have legal counsel on staff. The statement, which is almost certainly false, is designed to pressure victims by implying that Dragonforce has insight into a victim's reporting requirements and legal exposure arising from the data leak. The notion of a criminal ransomware group retaining attorneys fully versed in international data requirements is absurd.

[02:29:50] Until you realize the lawyer is an LLM. For criminal purposes, it doesn't matter if the claim is true. It only matters if it sounds plausible. If there's one thing LLMs are good at, it's making a wide range of statements sound entirely plausible. So what does this mean? AI and LLM use gives threat actors a structural advantage in negotiations.

[02:30:18] They significantly reduce language barriers, increase negotiation professionalism, and amplify available psychological pressure to bear against the victim. Historically, analysts could use imperfect, non-native English as a soft attribution marker of adversary geographic location. Even tools like Google Translate would leave telltale signs.

[02:30:44] But contemporary LLM reduces or even eliminates that signal entirely. It is not a marginal development. Attribution confidence decreases. Negotiation dynamics shift toward threat actors. And the gap between sophisticated and unsophisticated groups narrows in ways that make victim preparation critically more important.

[02:31:12] More broadly, increased threat actor AI LLM use reinforces the efficacy of the RRAS, the ransomware as a service business model. Conti pioneered the RAS model, structuring affiliate programs and playbook-driven syndicate operations that set the template that's now being further professionalized and automated by AI tooling.

[02:31:42] AI and LLMs allow less sophisticated and non-native English-speaking groups to approach negotiations in a more professional manner, establishing negotiations with unprepared victims on their terms. GRIT will revisit this topic throughout the year to assess the question, Will threat actors continue refining AI LLM integration in their processes? Will it plateau?

[02:32:11] Or will the use of AI LLMs be more limited to specific groups? GRIT anticipates threat actors will continue to streamline LLM usage in the near term, primarily through the two vectors, negotiation communications and exfiltrated data analysis. More complex, sophisticated or novel adoption of AI and LLMs will almost certainly be more limited, but may trickle down in the long term.

[02:32:40] So, what are the next steps for defenders? What do defenders do? Threat actor adoption of AI LLM tooling raises the floor for negotiation sophistication across the board. It reinforces organizations' need for cybersecurity insurance, legal counsel, and an understanding of the data present in their environment.

[02:33:06] It also suggests that negotiations should be conducted by trained professionals. While threat groups do have some predictable behavior, individual operators are criminals who may act erratically, cause dire consequences for the victim organization. Engaging qualified professionals gives organizations a clear understanding of threat actor playbooks and current behavior, enabling them to distinguish routine bluffs from credible threats.

[02:33:35] Expert legal counsel is also essential for understanding reporting requirements and potential legal ramifications. A mature and up-to-date incident response plan can assist with the coordination of all these factors. Okay, so that was GuidePoint's example of two very real-world threats. Their report was a bit more sanitized than I was hoping for,

[02:34:01] so I did a bit more digging to find some additional reporting on Fulcrum Sec that first group, GuidePoint, discussed. The reporting I found added some interesting information. It said, As an example of the consequence of this group's use of AI, in June of last month, Fulcrum Sec reached out to Databreaches.net

[02:34:27] regarding their compromise of the Danish pharmaceutical company Novo Nordisk, the maker of Wegovi, a well-known semaglutide GLP-1 agonist drug. Fulcrum Sec claimed to have stolen 1.3 terabytes of data containing, wait for it, 700,717 files.

[02:34:57] Yikes. Okay, so I'll briefly note that this is a textbook example of wondering what to do with the presumed treasures that were just plundered from the victim. On the one hand, it's, Hot damn, we just sucked out 700,717 individual files with an aggregate size of 1.3 trillion bytes. But now what? Hopefully, there's some really juicy data

[02:35:26] that we can use for blackmail extortion, but where would it be exactly? Hiding among, think of it, 0.7 million individual files. Okay, so continuing, they wrote, Fulcrum Sec said it had captured valuable intellectual property, including five publicly undisclosed drug programs,

[02:35:55] in-development drug and RNA delivery programs, and private AI models for particular medical and drug discovery purposes. The group told Data Breaches that it used a team of AI agents to analyze those private models and that it believes the stolen data could save competitors three to five years of program development.

[02:36:25] Its initial ransom demand to Novo Nordisk was for 25 million U.S. dollars. The information about the intellectual property, Fulcrum Sec stole, was coupled with a description of Novo Nordisk's security posture, which the group claimed was absolutely catastrophic and boggles the mind. To us, they write, this sounds like Fulcrum Sec is attempting to frame the incident

[02:36:54] in a way that would have any class-action lawyer salivating. It wouldn't be the first time a data breach has resulted in a lawsuit, so presumably this is part of Fulcrum Sec's extortion pitch. Their modus operandi also includes using AI to generate detailed reports, which it then provides to threat researchers and journalists, nicely formatted, complete with logo and all, in order to apply more pressure to victims. For example,

[02:37:24] after compromising the technology company Avnet in October of last year, the group gave the VX Underground X account a report on the breach. According to VX Underground, the group provided, quote, an autobiography, a breakdown of the data they possess, their motives for the compromise, information on their logo design and why their logo was chosen, a complete stolen file listing of the compromise,

[02:37:54] a breakdown of the files, what it is, what they are, what they contain, and images of the files. VX Underground said the group had done, unquote, every bit of research and write-up for us, unquote. To add insult to injury, Fulcrum Sec claimed it had used an open AI key it had stolen from the victim to pay for the chat GPT summarizing the victim's own data. So,

[02:38:24] I started out noting that necessity is very often the mother of invention. Since none of us are on the inside of any of these ransomware gangs, we have a difficult time imagining what their problems might be. So, the world comes up with, hey, they're probably going to use AI just like software publishers will to discover previously unknown vulnerabilities and then use those to compromise systems. While that will doubtless be one use,

[02:38:53] the evidence suggests that the bad guys don't need new ways of getting into other people's networks as much as they need help after the data has been successfully exfiltrated and is in their hands. They need AI's help with determining the value of what they just grabbed and then help negotiating with the data's legal owners who almost certainly speak a language they do not. Appearing tough,

[02:39:23] competent, and knowledgeable is every bit as important after the threat as obtaining the stolen goods was in the first place. They have, after all, zero interest in the data itself that they've just obtained. Its entire value to them lies in what cold, hard cash they can trade for destroying that data they now hold. And for that, AI has been

[02:39:52] the best thing that ever happened to them. Wow. Yeah, I mean, that's the promise of computing, I guess, and AI is just making it easier. Imagine you exfiltrate 700,000 proprietary files of Novo Nordisk and you uncover five other drug programs that are in development and enough detail to say, well, you know,

[02:40:21] you got some competitors who'd probably like to see all this. What's it worth to you for us not to give it to them? 25 million seems cheap to me. Yeah. Actually, Novo Nordisk is in the process of going after Lilly because they don't like Lilly, the competitor who makes Zepbound and which is a competitor to Wagovi and Monjaro, which is a competitor to Ozempic. They're saying false advertising and so these two are in a fight. I could easily see Lilly saying, well,

[02:40:51] let's just see what you're up to. They wouldn't do that publicly in any way because, of course, that would be a big no-no, but you can see there might be some interest. Wow. Steve, again, you've both terrified and amused. That is our goal every week. We do security now on Tuesdays right after Mac Break Weekly. It ends up being around 1.30 Pacific, 4.30 Eastern, 20.30 UTC.

[02:41:20] I mention that because you can watch us do the show live. We stream into the club a Twit Discord so the folks who are in the club get kind of beyond the velvet rope access, but you also can watch us, everybody can, on YouTube, Twitch, X.com, Facebook, LinkedIn, Kick. Hello, everybody out there. Nice to have you watching. After the fact, On Demand versions of the show are available in a number of places. Steve has his own, by the way, there's 575 people watching on those channels

[02:41:49] right now. Hello. Steve has his own copies of the show. He's got, actually all of his are unique. He's got a 16 kilobit audio version, which is very compact for people with limited bandwidth. He actually did it for Elaine Ferris who does our amazing transcription. She lives in a horse ranch in the middle of nowhere, I think. 20 years ago, she was using kite string internet. And so, we needed to keep the bandwidth down. She's probably got better bandwidth now. I hope she does. Anyway,

[02:42:20] she does a great job. So, that's another version of the show. He's got human written transcriptions. Those take a few days after the show to come out. He's got a 64 kilobit audio version. Maybe Elaine gets to listen to that now with more bandwidth. That's full audio quality. He also has the show notes. Those are great. 20 pages plus of all the links, the pictures. It's really nicely done. It's a little magazine article. Actually, a little magazine total

[02:42:49] that you can download. You can also get that though automatically if you want. Go to his website is grc.com. And at grc.com slash email, you can submit your email to get whitelisted so you can send him pictures of the week and, you know, thoughts that he might use in reader feedback. But you can also check the boxes below. They're unchecked by default because Steve's a good guy. But if you want to be on the mailing list for the show notes, the weekly show notes, you'll get that every Sunday or Monday before the show.

[02:43:18] Also, a little-used mailing list for new products. Steve has, right now, two things he sells on his website. One is Spinrite, which you should know it's been around for how many years? 30 years now? Forever. Late 80s. Wow. Yeah. Longer than most of our listeners. Let's put it that way. I got software older than you. You can get that. That's a must-have for anybody who has mass storage. So it helps,

[02:43:47] fixes the performance, comes up, can be used to recover data. And it also, let's see, so data recovery, performance enhancing, and something else. What else does it do? It does something else. There's three things. It's great. You need it. If you have mass storage, you need Spinrite. I did it out of order and I can't remember the third thing. I don't know why. You also can get his really useful DNS Benchmark Pro. That's $10,999. And that's great because it'll tell you

[02:44:17] what the best DNS server is for your particular system, which isn't the same as anybody else's. So it's really good to know. Very helpful. Both of those, GRC.com, along with the show notes and the show and all of that. And there's a lot of other stuff. He does so much free stuff. That's why you should support him with the paid stuff. He does shields up and, you know, what was it? It was never 10. Now it's in control. So you don't have to ever update your Windows if you don't want to.

[02:44:47] Do you still get security updates? You just don't get the next version, right? Right, right. You still get updates. It just doesn't move you forward unless you want it to. That's exactly what you want. All of that at GRC.com. We have our own unique copies of the show, a 128 kilobit MP3 audio version for no apparent reason. And we also have video for the apparent reason that Steve's a hell of a good looking fella and you want to see him. He's the Alex Trebek

[02:45:16] of podcasts is what he is. You should go to twit.tv slash sn for those. You can also get it on YouTube. There's a YouTube channel dedicated to security now. Great way for sharing clips to the boss. Boss, you ought to hear this. You ought to hear this. And probably the best way to get it is to subscribe. Just go to your favorite podcast client. We like Pocket Casts, Overcast. I mean, there's just a million of them. Pick the one you like. Subscribe. It's free and you'll get it automatically.

[02:45:45] Now, what's not free is supporting security now by joining Club Twitter. And I want to encourage you to do that. It's 10 bucks a month. You'll get rid of the ads. Even this mention of, you know, the club will be gone. Because there are no ads, you also get chapter markers, which is really nice. So you can jump along as you watch in the show notes. You can go to the parts you want or whatever. Skip the AI if you want or go directly to the AI if you want. You get to choose. You also, as members of the club,

[02:46:14] get access to the Discord, a great place to hang out with other Security Now listeners and all the members of the club. You get all the special programming we do in the Club Twitter Discord. And you also get the warm and fuzzy feeling of knowing you're supporting what Steve is doing, what Twitter is doing. Without your support, we couldn't do it. You cover a huge amount of the operating costs. So please join twit.tv slash Club Twitter. It's the best way to show you appreciate what we're doing here. Steve,

[02:46:44] I think we're done. I will see you next week. I'll be here. See you then. Bye. Hey, everybody. It's Leo Laporte. You know about MacBreak Weekly, right? You don't? Oh, if you're a Macintosh fan or you just want to keep up with what's going on with Apple, this is the show for you. Every Tuesday, Andy Inaco, Alex Lindsay, Jason Snell, and I get together and talk about the week's Apple news. It's an easy subscription. Just go to your favorite podcast client and search for MacBreak Weekly or visit our website,

[02:47:13] twit.tv slash MBS. You don't want to miss a week of MacBreak Weekly. Denk an den 31. Juli. Wieso? Last call für deine Steuer. Oh no, ich weiß gar nicht, wo ich anfangen soll. Bei Wieso Steuer. Das ist wie Steuererklärung, nur ohne Stress. Ist das einfach? Klar, macht fast alles automatisch. Dauert das lange?

[02:47:43] Nö, einfach per App. Na dann? Hol dir jetzt dein Geld zurück mit Wieso Steuer. Bis zum 31. Juli abgeben.