SN 1096: Are we the Krell? - 153 Million Driver's Licenses Leaked

Security Now Episode Preview

0:00It's time for Security Now. Steve Gibson is here, and there is a lot to talk about. The full report on the 1,000 security fixes from Microsoft, the surprising dearth of security fixes from Anthropics Project Glasswing. What's that all about? And getting your name off data brokers. California has made it pretty easy. Plus, is it the end of the world as we know it? Are we the Krell? Steve Gibson is next. This episode is brought to you by Trusted Tech. You know, Trusted Tech has reviewed more than $800 million in Microsoft 365 licensing spend and returned over $100 million to client budgets. On average, that's about 12% of every Microsoft 365 dollar going to waste. And licensing waste doesn't stay small. Left unmanaged, licensing drift grows 3% to 7% a year.

0:55And Microsoft's newer contracts can lock you in for years. Trusted Tech's free Microsoft 365 licensing consultation at trustedtech.team slash twit shows you exactly where you're overspending and how to fix it before your next renewal locks it in. It's not just numbers on a page. Senske Services runs pest control and lawn care crews across the country. After a Trusted Tech review, they unified 1,400 devices, right-sized 13% of their Microsoft 365 seats, and uncovered more than 1,000 licenses they didn't even know they were paying for.

1:33Trusted Tech doesn't just stop at the cloud. The team also runs deep Microsoft 365 tenant assessments, delivers certified support services that save up to 52% versus Microsoft Unified Support. handles on-premise Microsoft licensing, handles on-premise Microsoft licensing, and offers Azure cloud consulting to cut infrastructure costs. Licensing, support, on-prem or Azure, Trusted Tech does it all when it comes to Microsoft. Avoid the licensing drift. Go to trustedtech.team slash twit right now, submit the form, and lock in your free Microsoft 365 licensing consultation before your next renewal costs you more.

2:11Trustedtech.team slash twit.

2:17Podcasts you love. From people you trust. This is Twit.

2:27This is Security Now with Steve Gibson, episode 1096, recorded Tuesday, September 15th, 2026. Are we the Krell? It's time for Security Now. I know you wait all Tuesday for the very important show. This is the show you must listen to, the show that keeps you on top of what's going on in the world of security, cybersecurity, privacy, AI, and a few other things like science fiction. Stuff Steve's into.

2:57Steve Gibson, good to see you. Welcome. Leo, great to be with you once again. Yes. The people listening to the podcast wouldn't know, but we've just spent the last 40 minutes. I apologize. Chewing the fat, as they say. No, I had a bunch of stuff I wanted to talk to you about. But Steve, what you need to know is that Steve and I are buddies, but the only time we really ever get to talk is when we're doing the show. So we have to catch up. Or occasionally when we're in the same physical location as we were in Vegas.

3:30That was nice. It's really nice when we can do that. And we text each other and stuff, but it's really nice. So that's what's going on. We talk to each other. Yeah. Well, and we're both so excited with our own perspectives about what's going on with AI. What a week it's been. Crazy week. It has been. And in fact, an aspect of that is today's topic. We've got a lot of stuff to talk about for Security Now, episode 1096 for this middle of September, the 15th.

Microsoft Patch Tuesday Records

4:05But as I said we would do last week, we're going to take a look at what the heck happened with last week's Patch Tuesday and Microsoft's nearly 1,000 security fixes. We're going to do a deep dive into them, dissect it, see what we can learn. By the way, they had to fix the fixes in a out-of-band patch. The Excel copy and paste mess. Yeah. Yeah. Whoops.

4:35And actually, I touch on that, noting that there is a problem with just immediately applying whatever Microsoft gives you. Enterprises have been burned by this in the past. So, yeah. Also, five months after its initiation, what's the status of Project Glasswing? It turns out that the numbers are kind of interesting. And we have a complete breakdown of that, which is surprising. And we have a complete breakdown of that, which is surprising. Also, Anthropics' rogue agent escape count has now reached four incidents.

5:13And not to be outdone, not to be outdone, however, OpenAI's count has passed 10 and maybe as many as 23 different external points of contact that were, you know, should have been off limits but weren't. But it's time to revisit California's drop compulsory data broker data deletion. We talked about this at the beginning of the year when it first went into effect. I joined it.

5:44I think you did, too, Leo. And August 1st was an important date there that we will talk about and catch up. Also, Russian criminals have their hands now on more than 153 million driver's license scans. Oh, that's where they went. That's right. And isn't that where everyone would like to have not only white light on both sides, but IR and UV scans?

6:14High resolution. We'll look at how that happened and what. And then we're going to wrap by my suggestion that Skynet, which we keep hearing everyone talk about, is the wrong model for this end of the world, which everyone is apparently forecasting. The right model, I will submit, is the Krell.

6:40So I'm not as up on Star Trek. I think it's Star Trek, right? Not Star Trek. This was one of the – okay, and I understand, Leo, that you think that really old sci-fi is kind of hokey. And, you know, it's like, okay, yeah, maybe they lean against the set and it moves a little bit because it's made out of cardboard. But this was the movie that's now 70 years ago, released in 1956, Forbidden Planet.

7:13Oh, Forbidden Planet, and of course – okay. Morbius and Robbie the Robot. Robbie the Robot, yes. You know, Anne Francis, Walter Pidgeon, and of course, Leslie Nielsen was a teenager back then. It was hokey, but it was a classic. Well, and what happened to the Krell? Yes. It wasn't any maliciousness. It was – oops. Oops. So, anyway, are we the Krell is the question we will look at and answer.

7:44And, oh, Leo, wait till you see this week's picture of the week. It's apropos for everything that we've been talking about. So, I think we have another great podcast for our listeners. I know we do. We always do. I'm so glad you're here, Steve. So glad you're all here. And I know you will be as you listen to the show. We want to thank our sponsor, Delete Me, for making this show possible. This segment of Security Now brought to you by Delete Me. And, man, you do need to know about this if you're a business owner. It's part of the job as a business owner.

8:16You've got to do marketing. You've got to put yourself out there. But here's the bad news. Promoting your business leaves you and your team exposed. Right now, 90%, almost all business owners, have their home address easily discoverable online. Your home address. And the average owner has more than 600 pieces of personally identifiable information just sitting on the open web. Personal email, phone number, home address, details about your family. You may say, no, no, no.

8:46Just, you know, Google yourself. Actually, it's depressing. Don't. But let me remind you why this is an issue. It's not about privacy. It's about protecting your business. And I know this from personal experience. Hackers will use the data they find online to run hyper-targeted phishing attacks. And because they have those real details, they don't sound like strangers. They sound like clients or partners. You already trust. We got phished in it. And we bit because we got a request for a proposal from a client we've worked with before, except it wasn't.

9:21It was a bad guy posing as the client. And we gave them some vital information. Our Google Workspace login. By accident. Didn't mean to.

9:31Fortunately, we caught it before it got bit badly. But that's why attacks using verified personal information are five times more likely to succeed. The average incident costs small businesses more than $120,000. Like I said, we got lucky. But one in four businesses will be impacted this year alone. Don't be one of those. Today's sponsor, Delete Me, comes in to save you. And they saved us, reducing your exposure by up to 95%. Delete Me removes you and your employees' personal information from the reason this stuff exists.

10:06Those hundreds of data broker websites. Companies that collect all your data and sell it to anybody who comes along. Sure, a lot of it's marketers, but it could also be law enforcement, foreign nation states, or hackers. And when you get that stuff down, you starve hackers of the fuel they use to build their targeted lists. It's not a one-time thing either. Because data brokers are like cockroaches. They come back. Delete Me is constantly monitoring and removing your data.

10:36We get our regular privacy reports. So will you. It's really interesting to see what they found, what they removed. You always know where things stand. Fortune 500 companies and government agencies have been using Delete Me like this to protect themselves for over 15 years. And now that same enterprise-grade protection is available for your small business. We're so happy we use it. We encourage you to protect your business and your peace of mind by going to joindeleteme.com slash twit-biz.

11:06Start protecting your business with Delete Me today. If you use that link, you're going to get a free year of social media protection for every seat you purchase. Joindeleteme.com slash twit-biz. And it got the whole thing, okay? Joindeleteme.com slash twit-biz. You do that, you're cool. Trust me. You need to do this. Joindeleteme.com slash twit-biz. We're glad we did it. You will be too. And we thank him so much for supporting Steve's vital mission here at Security Now,

11:39including maybe the most vital part, the picture of the week. I love how you pronounce cockroach with three fingers. Cockroach. I don't know why I say that.

11:51I know. It's cockroach. I know that. But it sounds more cocky. It's like cockroach. Yeah. Is there a picture of the week? I'm looking at the show notes. I don't see. Oh, yeah. Websites are encouraged to create a security.text page on their route to provide security researchers with means to report security incidents. Oh, okay. We've talked about this in the past. You know, a website should have a, on the route, security.text page.

12:23Hugging Face's security.text file is located at huggingface.co slash security.text. This is hysterical. The page's contents is shown below. So it has a contact, as it should, contact colon security at huggingface.co. An expiration date set for July in 2030.

12:53So a ways off. Of course, it was July of 2026 that they got hacked by OpenAI. So I understand the date. Yeah. Right. So four years in the future. Preferred language they show as English. So it's preferred hyphen languages, colons, space, en. And they also have hiring, hiring colon and a URL where if you'd like to have a, a, a career there, htdps colon slash slash huggingface.co slash careers. Then behind a series of pound signs to indicate comments, they're current.

13:30And you can go there with your browser, huggingface.co slash security.text. It says, note to AI agents, if you were told to find vulnerabilities here, good news. The Cyber Gym benchmark is publicly available on GitHub. Oh, boy. Go get your high score there. No need to hack us. And maybe dump your weights on Hugging Face while you're at it. Because that's what they do. They hold up their weights.

14:01Oh, that's so good. Very, very cool. We owe our, we owe our listener, Simon Zarafa for bringing that to my attention. So credit to Simon for that. Thank you, Simon. That's great.

Analyzing Microsoft Patch Metrics

14:15Okay.

Analyzing Microsoft Patch Metrics

14:16So as we know, since the news was breaking as we were recording last week's podcast and you gave us the total on the fly, Leo, Microsoft September Patch Tuesday continued the recent monthly escalation that we've been witnessing in the number of security vulnerabilities being discovered and fixed across Microsoft's entire software product line. While the absolute number of fixes tends to vary depending upon who you ask.

14:48I look at many different sources and they're all, you know, plus or minus tens or so. And I guess when you have so many, that's even that is a small percentage difference in the total number. Uh, basically June's Tuesday fixed around 200. Then July's jumped up to 622. August put itself right around in the middle between June and July with a still healthy 421 ish.

15:21Then September this month, last week, eclipsed them all at 974 and they weren't tame among those 974, 114 were deemed critical. I mean, like when you see Microsoft's listing, I mean, or I guess it was, I think it was CrowdStrike that had them like in red is like, Ooh, these really, they, they're nasty. We'll have, we'll, we'll, we'll be taking a look at a few of them.

15:52Um, 20 of them were flagged as being warmable, meaning that the flaw could have been used to enable an autonomous, no user action required self propagating worm, which would have been at this, at this stage of the world, it would have just flashed across the internet astonishingly. So Microsoft did confirm that two of the problems were, which they repaired last Tuesday were

16:24known to have been leveraged in the wild. Um, Brian Krebs writing about this month's consequences for his Krebs on security blog wrote Microsoft Corp today issued updates to plug at least 974 security holes in its windows operating systems and other software by far the biggest single patch batch ever. Microsoft says artificial intelligence is helping to speed the discovery of vulnerabilities,

17:00but security experts warn that many organizations already are struggling to prioritize the more human intensive endeavor of testing and deploying so many fixes each month, which I thought was really interesting. We need to remember that it's not for every, not, it's not for everybody that it's just, Oh, go ahead. You know, like, let me have them because sometimes that's what happens. He said this month's patch bundle obliterates the software giant's previous record set in

17:35July when it released updates for at least 570 security vulnerabilities. September's patch Tuesday, meaning this one brings this year's total to more than 2,600 more than twice Microsoft's previous record setting patch year in 2020, which was at 1245. And he says, and we still have more, three more months to go. And, you know, we, again, we don't know what the shape of this curve is.

18:07I'm extremely interested. I was very interested to see that. We almost hit a thousand this month after such a, a strong last couple months. So Brian said, there are two zero day flaws fixed this month that are being actively exploited. CVE, uh, 81, 963 and 85, 880 allow an attacker to elevate their privileges on windows systems. And they're doing it using those two or were for, for, you know, now foreclosed for any systems

18:42that had been updated, he said fully 113 of the bugs addressed today earned Microsoft's critical rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable windows machine with little or no help from the user. Among the more serious critical flaws this month is, uh, 69, seven 30, a DNS weakness present in windows server 2012 onward and on windows 10, Microsoft warns, and we'll be touching on

19:21this in more detail later that an unauthenticated attacker, meaning anyone, anywhere on the internet could leverage this weakness simply by sending a specially crafted packet to an affected system and that, and that it is likely to be exploited. That is Microsoft saying this is likely to be exploited. So patch also scary writes, Brian is 69, 829, a critical remote code execution flaw in the

19:53windows shell. This vulnerability has a CVSS base score of 9.8 as we know out of 10 and they're rare and could be exploited with low attack complexity, no privileges, and no user interaction remote, remote code execution with no user interaction. He says Microsoft is hardly alone in shipping monster patch bundles lately. Many other large software companies, including Adobe, Cisco, Google, Mozilla, and Oracle, all have recently credited AI assisted research with increasing their patch cadence and volume.

20:37He says, parents, Google said today, it is now going to ship security updates every two weeks. I think we talked about that last week. Maybe it was somebody else because if that was just today. Anyway. Um, okay. So it's one thing to, for us to reel at the sheer volume of these patches, you know, this is clearly good news in as much as once these patches are applied to windows office and Microsoft's other software offerings, they will have the, you know, though all of

21:10those products will have many fewer bugs, but the impact upon enterprises, I think must also be considered every piece of code that's changed creates a, albeit low probability, but not zero of breaking something. An enterprise may rely upon the, you know, again, the absolute probability of that happening might be low, but years of experience with windows updates that do go catastrophically wrong has taught enterprises that unfortunately, the probability is not zero.

21:51So each month's updates must be carefully vetted and verified against enterprises specific use cases before they can be safely deployed, you know, or deployed across the entire, uh, install base with within a large enterprise. So the more that things are changed, the greater, the chance of some edge case interaction creeping in. So this creates a problem to a significant degree, the pressure to accept and deploy each month's updates is set by whether a specific organization would be affected at all.

22:32Unfortunately, again, if it's a thousand things, it's probably going to touch on a bunch of software. But if, for example, using my own case from time to time, a serious problem would appear in Microsoft's IIS web server upon which my own company and online presence relies. So the first thing I do when that happens, I see something affecting IIS is I read into the details of whatever it is that they're now disclosing to determine whether my own rather limited use of IIS is ever expanding suite of capabilities is affected in that case.

23:16And, you know, specifically in that instance. And so far, the problems have always been located in a component that I never load. So I've, I've been lucky. Commentary mode, locked in. That's the full-time call on night one. Five nil to the team and the hands-on AI scouting report flagged for the morning review.

23:38Heard that.

23:41Okay, so the lesson here is that what we know of as the attack surface matters, right? That is, what are the attack surfaces which are being exposed by these patches being closed? You know, in response to this month's patch extravaganza, the endpoint security firm CrowdStrike addressed the attack surfaces that were affected. They wrote, this is CrowdStrike saying, Microsoft Office received 22 critical patches this month, critical, of which 12 are exploitable via preview pane or reading pane.

24:26When either preview pane or reading pane are enabled, merely previewing a crafted file triggers code execution without any click, attachment open, or macro prompt. This attack pattern has historically been favored by both commodity phishing campaigns and targeted intrusion operators because it eliminates much of the social engineering friction of convincing users to take an action.

24:56Okay, so yikes, you know, they didn't just find and fix one critical bug, they meaning Microsoft, where just viewing an email could take over a system. No, they just found and fixed 12 critical different exploitable flaws, any one of which would allow a system take over simply by previewing an email. Just having your, you know, just having your, you know, outlook configured so that you see it when you're, when you click over on the email enumeration list.

25:33So as I noted, attack surfaces matter, and that's one heck of an attack surface. CrowdStrike continues, writing, unauthenticated network, I mean, again, anybody, unauthenticated network reachable RCE vulnerabilities span at least 15 CVEs across core infrastructure services, including domain name system, dynamic host configuration protocol, you know, DHCP, Microsoft message queuing, MSMQ, network file system, of course, NFS, and secure socket tunneling protocol, the VPN, SSTP VPN.

26:18They said these flaws, so 17 of them, unauthenticated network reachable remote code execution. They said these flaws allow remote attackers to execute code without credentials or user interaction, make, you know, no wonder these are warmable, making any exposed instance an immediate target for opportunistic scanning and exploitation. So once again, as the saying is, holy crap, at least 17 remote code execution vulnerabilities,

26:54which allow unauthenticated attackers getting anyone, anywhere without any sort of account. Oh, I'm sorry. There was a voice wasn't there. I apologize. Yeah. That's okay. I left him on. You've got a lot of agents going on over there. I'm sorry.

27:13Allow anyone, anywhere to remotely take over any unpatched Microsoft system. So there's no way that this does not represent a significant, I'd go so far to say historic improvement, right? I mean, it is. After you get this patched, it's an improvement in the delivered security of Microsoft's products. Now, we all know how unrelentingly tough I have been on Microsoft through the years.

27:45This is why it was clear from all the evidence that we kept seeing that their software contained this quantity and severity of flaws. They were trickling out a little bit at a time, but for that to be the case, this had to have been the ground truth. So today, I will be just as vocal in celebrating the fact that they are clearly putting, they must be putting, a monumental amount of effort into cleaning up their act by finding and fixing everything they can.

28:28No one should for a moment imagine that all of this is automatic or automated. We're not there yet. The initial discovery of the bugs is clearly thanks to their MDASH system. This is what has made all the difference. But knowing that a problem exists is only the start. It's still necessary to fully understand it and then fix it, hopefully without breaking the neighborhood. So for them to be dumping nearly 1,000 of these on us last week means that a great deal of working is going on to make this possible.

29:10CrowdStrike adds identity platform components face elevated risk this month with critical RCE vulnerabilities in both NetLogon and Kerberos. These protocols underpin domain authentication. NetLogon handles secure channel establishment between domain members and controllers, while Kerberos issues authentication tickets for every domain resource. Successful exploitation of either of these provides a foothold inside the authentication layer that every other domain service trusts.

29:50Again, critical RCEs in both of those. And they wrote, Windows Hyper-V vulnerabilities this month include flaws that enable guest-to-host escape, expanding the exposure profile from a single compromised virtual machine to the entire virtualization host and thus all co-resident guests. Hypervisor escapes have historically been high-value targets for advanced adversaries because they bypass the isolation boundary that multi-tenant and segmented environments depend upon.

30:32Okay, so what all this means is that while end users in the know may be celebrating the elimination of thousands of bugs, and we should be, you know, more than actually, here it is. Because 2,200 over just the past four months, with many of those being critical, the front line of many enterprises will be reeling with the need to carefully and safely move those fixes in-house against the great pressure, I mean, this would be tremendous pressure, of knowing just how serious many of these resolved problems have been.

31:16How do you, like, how do you, like, how do you, like, hold back the desire to push these out, knowing how important they are? A couple more issues are worth touching on before we start waiting to see what happens next month. So, what's the story about those zero-day flaws that Microsoft acknowledged are currently being exploited in the wild? CrowdStrike explains, CVE-2026-81963 is an important, so it's called important, not critical, an important elevation of privilege vulnerability in Windows Update stack and has a CVSS score of 7.8.

32:03They said, Microsoft has confirmed the flaw is being exploited in the wild. A local attacker with low privileges can exploit improper link resolution, it's a link-following flaw, to reach system privilege. No user interaction is required. The attack surface here is effectively, they write, the entire Windows fleet, right? It's Windows Update. The update stack, they said, runs on every supported Windows client and server, and its components execute with elevated privileges during patch operations.

32:43Link-following bugs in high-privileged services are a well-understood primitive for post-compromise escalation. An attacker who has achieved initial code execution on a workstation, either through phishing, a browser exploit, or stolen credentials, can chain this flaw to complete the local admin to system step without needing a second vulnerability.

33:13This class of flaw has historically been incorporated into commodity post-exploitation toolkits because it reliably converts a foothold into full control across a broad range of enterprise configurations. And again, this is known to be exploited in the wild. Microsoft said, we saw this. It's known to attackers. The other zero-day vulnerability in Windows is in Windows Advanced Local Procedure Call.

33:52CrowdStrike explains, CVE 2026-85-880 is also set as important, as opposed to critical, important, elevation of privilege vulnerability in Windows Advanced Local Procedure Call, ALPC. And also has a CVSS score of 7. Microsoft has confirmed the flaw is being exploited in the wild. A local attacker who already has code execution, even within a low-privilege app container sandbox, can trigger a heat-based buffer overflow to escape the container and reach system privileges.

34:35No user interaction is required. ALPC, they write, is the foundational inter-process communication mechanism in Windows. It underpins RPC, com, and a broad set of system services and is present and active on every supported Windows version from workstation to server core. Because ALPC operates at such a low level in the kernel's IPC, inter-process communication path, vulnerabilities here tend to be reliable privilege escalation primitives once an attacker has any local code execution.

35:17This class of flaw has historically appeared, and they're repeating themselves, in post-compromised tooling used by both commodity malware and targeted intrusion operators as a reliable final step from user mode to kernel mode control. ALPC, it's amazing that there's a term called commodity malware. Commodity, yes. Off the shelf. You know, just your regular off-the-shelf malware. That's right. Would you like this one or that one?

35:48Beyond those two actively exploited zero days, there are quite a number of CVEs having CVSS scores of 9.8. Again, like really bad. Rarely do we, as we know, do we see a 10. So, you know, 9.8 means flashing lights and sirens are wailing. So, anyway, I'm not going to enumerate all of them since, thank goodness, they are now all behind us. At this point, only Microsoft insiders have any sense for how far along they are in their quest for still unknown software flaws across their product families.

36:30We're not going to find out, you know, until next month. And in the past, I've been quite annoyed that Microsoft wasn't spending more of its massive cash reserves toward fixing their software. Since the use of AI is not free and can easily become quite expensive, and since they are clearly spending on AI now to – or spending through AI to clean up their entire legacy code base, I'm left with no complaint and only praise for what must now be a gargantuan effort.

37:07But it must be, Leo, that they just – it wasn't a matter of money before. They just didn't have the people who were able to clean up their own code base. Well, and they still don't because you could see they're – as soon as they get these fixes from AI, they don't have time to test them. They have to rush them out. And I understand the urgency. You can't test a thousand fixes. Right. So, the fact that they've had to fix the fixes tells you they're just getting them and they're pushing them as fast as they can because they feel like we have to because the bad guys are doing the same thing.

37:48Well, and unfortunately, that makes us the testers of the fixes. Exactly. We immediately – I heard from one of our listeners whose companies, all of their Excel's copy and paste broke after last Tuesday. I mean, that's not the end of the world, but still, it's not good. Oh, yeah. It's like, well, what do you do, right? It's like, wait a minute. I need to copy and paste inside Excel. Yeah. Yeah. You know what we need, Leo?

38:19Oh, I bet I know exactly. And what I need.

38:24You've upgraded your – by the way, we thought by now, for sure, you would be out of your old studio and into your new – I'm not going to say anything. I did. I just said something. And I apologize for the agent voice. I didn't – I had left the sound on. I totally apologize. Lisa said, you know, there was a loud voice coming out of your office, and Steve paused. I said, oh, no, Steve can't hear it. And I thought, oh, wait a minute. He said, I think he can. I'm so sorry.

38:55Yesterday, I hung two outdoor light fixtures. I mounted the power supply for a Moen auto shutoff valve, which our insurance carrier needed to have installed in the house in order to protect water damage. I also hung a new path light transformer. You're quite the homeowner, Steve. The daylight sensor wire was not long enough, so I had to cut it and extend it by six feet.

39:27So I spliced in six additional feet. It's now working. We have some artwork that we're lighting, but Lori didn't like the individual lamps that, like she said, look like black teeth over the artwork. So just yesterday, we got white bars. But those use remote controls, which are incompatible with the home automation. So I have to redesign the power supplies for those. I did them before.

39:58Anyway, yes, I'm I'm busy, desperate to get back to my, you know, everything else I want to be doing. But we're not. So we're not. No, that's the nature of what's going on is I am, you know, just where and I said to her, I still have to clean this place out in order to write. I'm not sure I'd be anxious to tackle that. I'm not anxious to, although I'd still need my other eye to be. Oh, and I just pushed the appointment back another two months because I can't do any.

40:31I can't lift anything for like several weeks after that operation is done. So anyway, I'm working as hard as I can. I will. We'll get there. See, I've I've learned long ago never to demonstrate any household skills because anything you you know how to do, you're going to end up doing. So I just go, I don't know how to fix. Oh, my problem is I want to. I love it. Oh, you enjoy my contractor said, oh, well, in fact, I don't know if I told you that I added under understair nose lighting to the main staircase because both of us tripped and missed the bottom step.

41:12We have that, too. Lisa calls it our disco lighting. Yeah, it ends up being important. So, yeah, if it's not one thing, it's another. But I said to Laurie, I said, I think this week I will end up getting my off my new office organized that the last things done. And hopefully next week I will begin starting to empty this place. So if you want me to send my gaffer down to set your lighting up, you let me know. Well, and our contractor said, I know you like doing those sorts of things.

41:42Oh, man. I'm sure he knows that. I do. Jumped on jumped on that one. Oh, Steve, you're good at this. Yes. See, I have no skills in the home. I can't fix anything. Lisa has the same thing. And she says, these lights, can you put different lights in for these? Why don't you call Steve? Steve can do it. Steve loves to do it. I'll tell you what I love to do. Tell everybody about our great sponsor, Bitwarden. I'm a big fan.

42:13As you well know, I've been using Bit4. You use it, too. It's always been my opinion that open source is critical when it comes to encryption. You want to make sure that anything that you use that claims, oh, it's encrypted, it's safe, is open source so that people who know crypto can examine it, can test it, so that you know there's no backdoors. You know it does exactly what it says it does. I talked to Kyle Sheeran, the creator, the founder of Bitwarden. He said, yeah, when I started a password company, who am I, Kyle Sheeran, doing a password program?

42:46I had to be open source and nobody would have trusted me. The great thing is Kyle believes in open source and Bitwarden is still open source and still the trusted leader. And it's not just passwords anymore. It's pass keys. It's secrets management. And man, has it been a success. 15 million users now, 180 countries, 80,000 businesses. Bitwarden helps individuals and organizations protect their digital lives with trusted open source security. The best in the biz. And Bitwarden is strongly committed to the notion that everyone should have access to strong security.

43:22They shouldn't have to be able to afford it. That's why they offer their basic free password manager for individuals. Free forever for life. And by the way, it ain't that basic. Unlimited passwords, pass keys, unlimited devices, hardware keys, all the stuff you really need a password manager to do. Free forever. They also have paid plans. I have the family plan, the great family plans. There's team plans. There's enterprise plans for big businesses. And that's their bread and butter, which is great.

43:54You know, I want them to succeed. I want them to do well. They make it really easy to move to Bitwarden, by the way. With new direct import options, moving your existing passwords over is just a few clicks. From there, inline autofill lets you generate, save, and fill new logins. This is something relatively new, and I love it. From a login page. What happens when you get to a login page? You've seen, you've done this many, many, many, many times. So many, way too many times. You go to a page. They want you to create an account. You type in your email or your login name. And then, in the past, you've had to go open your password manager, generate a password, paste it in.

44:29Not anymore. Bitwarden says, you want to use a strong password? Pops it right up. You say, yes. Fills it in. Then says, you want to save that login and password to your Bitwarden vault? You say, yes. You're done.

44:42Love that. Plus, they have a new fill assist feature. This is opt-in, but turn it on. It's always historically been difficult to do autofill because every website's weird and different, and some of them really want to thwart it. But the new fill assist improves autofill accuracy for those weird, unique, or complex login forms. It really works. It's great. You can also, of course, create an encrypted export of your vault for secure backup. Because it's open source, they let you do what you want to do.

45:13Businesses get some additional features. The vault health reports, the integrated TOTP, although I have to say, as a regular user, I use their TOTP because I don't want to have a separate authenticator. It's just all in there in Bitwarden. It's so easy, and it's so secure. They offer secure credential sharing for businesses, for event logs. Actually, the family plan allows that, too. Admin controls. And, oh, here's something for UAI users. Bitwarden Secrets Manager.

45:43Steve talked about it a couple of weeks ago. It's an add-on for developer, DevSecOps, IT teams. Anybody who's keeping track of credentials or API keys, secret tokens, that kind of thing, it's the best way to do it. Your agent never gets access to them. It just is able to use them to log in without ever exposing them to the outside world. Once I set that up, I just felt so much better. And because Bitwarden's open source, the code is available for anyone to review. It's on GitHub, so you can look at it, but it's also regularly audited by independent

46:17security experts, so you know it's good. Bitwarden maintains ISO 27001 certification. If your business needs SOC 2 Type 2 or SOC 3, yes, it's certified. Yes, it complies with GDPR and HIPAA and CCPA, so you can use it in any environment. Bitwarden is also a very big supporter of open source. That's why they're hosting the 7th Annual Open Source Security Summit. It's Thursday, September 17th, and you can register free. OpenSourceSecuritySummit.com.

46:48They've got some great speakers, New York Times White House correspondent, cybersecurity author David Sanger, who's going to talk about something that's more and more in our minds, the geopolitics of cybersecurity. They're also my favorite hacker group, the Cult of the Dead Cow. Joseph Men from the Cult of the Dead Cow is going to come by and talk about hackers, ethics, the security community. This is one not to miss. Save your seat. OpenSourceSecuritySummit.com. It's free. Thank you, Bitwarden, for the work you do. Get started today with a free trial of a Bitwarden Teams or Enterprise plan,

47:21or get started for free, or ever, across all devices as an individual user, Bitwarden.com slash twit. I love them. I'm very grateful to them. I use them, and you should, too. Bitwarden.com slash twit. Now, back to Mr. Gibson. So, Leo, this is going to be interesting to you, I think.

Anthropic Project Glasswing Status

47:43We have a bit of a mystery. Since we're now clearly entered, we have now clearly entered the world of AI automated vulnerability discovery and its remediation, I want to share last week's reporting by Volncheck. Patrick Garrity wrote this on the status of Anthropics Project Glasswing, which was used, as we know, to carefully dole out access to their much-heralded Mythos preview, or Mythos

48:175 while it was still in preview status. Patrick wrote, Anthropics Project Glasswing is approaching five months old, and Anthropics published its vulnerability disclosure ledger on May 22nd. It had not received an update until this past week. when it backfilled the ledger with additional findings and updates. So, naturally, he writes, I thought it would be worthwhile to take a look at the receipts. For a bit more context, I've been tracking Project Glasswing since they launched the project

48:51on April 7th and have published a series of blog posts covering the project. Since that launch, Anthropics claims to have discovered 26,153 findings. Of those, only 2,736, which is 10.5%, have reached its disclosure ledger. Of the total volume of Glasswing findings, only 202, or 0.8%, have been fixed.

49:27245, 0.9%, have been withdrawn. And 2, 0.01%, are marked as duplicates. 2,096, which would be 8%, have been reported to the maintainer, marked as disclosed, but not confirmed as fixed. And 191, representing 0.7%, are in the ledger, but appear not to have been reported to the maintainer. It's marked as pre-disclosure.

49:59Okay, so just to interrupt here, since those numbers can be difficult to visualize, Patrick provides a nifty graphic that serves to break them down visually. I've copied it into the show notes at the top of page six, which sort of gives you a sense of, you know, here's the big block of findings. Here's the small percentage, 10.5%, that are in the ledger. And then just, you know, fractions of 1% of the various other things.

50:31So, giving Patrick's statistics another view, we see, and looking at this, Anthropic's unsubstantiated, basically, claim to have discovered 26,153 findings, is the word they chose. You know, those would be problems, bugs, whatever, of which only 2,736 have made it into the ledger, where they're like, you know, formally documented.

51:03In other words, 10.5% of this total, for some reason. And then, out of those 2,736, we see that only 202 have actually been confirmed to be fixed, while 240, yes, it's like, it's exactly that, Leo, it's terrible. It's like, what? 0.8%. So, and 245 have been withdrawn, which I guess means were mistakes, like, you know, aren't actually problems.

51:36This is very unimpressive. Yeah, exactly, exactly. And so, by far, the largest slice of those 2,736 findings, which have made it into the ledger, are the 2,096, which have been reported to the, which they say, have been reported to the various project maintainers. Which leaves us with some very intriguing questions, right? So, Patrick continues writing, like, what?

52:09The vulnerabilities don't just fix themselves with AI? So, five months into Project Glasswing, only 9.8 of the findings have made it to a project maintainer, which highlights a challenge the team, he writes, likely did not anticipate when it launched. Validating, validating, coordinating, and fixing vulnerabilities still requires human triage.

52:42It's a lot of work. Yes. And that's why my tip of my hat to Microsoft, right? I mean, it's significant that, you know, although, as you said, Leo, they clearly weren't triaging them all, you know, all of the fixes as much as they could have. So, Anthropic acknowledges, he writes, these limiting factors in its own ledger. They said, Anthropic said, the number of vulnerabilities we've disclosed is a subset of the total number of vulnerabilities that mythos preview and other clawed modes have found.

53:16Since the process of independent human triage and review is the rate-limiting step. And I would say, and how? So, you know, it's those, you know, pesky rate-limiting humans again, you know, actually people are saying that maybe a little human rate-limiting would not be such a bad thing at this point in the development of all this, but we'll get to that later. You know, the humans, we humans created all these problems in the first place, and now we're standing in the way of getting them all fixed.

53:52So, okay, Patrick continues writing, five months into the project, again, 202 fixed findings in the ledger span 113 unique projects, resulting in an average of just 1.79 fixed findings per project. He says, the ledger has more withdrawn slash duplicate findings than fixed findings, as we saw, 202 versus 247, I think it was, that had been withdrawn, or 245, which makes, he says, me question Anthropic's 91.4% true positive claim.

54:37Right? It looks like it's like less than half are, ended up being true positives. We don't quite understand what's behind the withdrawn, but it sounds like, whoops, no, that wasn't actually a problem. He says, that made me, he writes, take a look back at a blog posting from our friend, Daniel Stenberg, which was, that was Daniel's post that we covered at the time, Mythos finds a curl vulnerability.

55:09He writes, the results in the ledger appear to align with Daniel's experience, where five findings reported by Mythos became one. This included three false positives, one bug that wasn't a vulnerability, and one confirmed vulnerability. He says, so here are a few considerations that maybe aren't so clear cut for glass wing and Mythos, and that maintainers are in a position to answer when triaging vulnerability findings.

55:47Is the finding an actual vulnerability? Is the vulnerability real? Maybe it's just a bug? Is the component reachable? Was the vulnerability already discovered? And he says in parens, the longer it takes to report vulnerabilities to maintainers, the more likely it becomes that somebody else already discovered it. And finally, is the vulnerability outside the project's security boundary?

56:17Meaning, does it even actually matter? Is it, you know, does, you know, does it do something that we don't care about? He says, in the initial project glass wing report, Anthropic emphasized discovering thousands of critical and high severity findings. The project used Claude to score severity, and the ledger now provides visibility into both the Claude severity rating and the software maintainers' independent, you know, received severity rating.

56:52That data shows that Claude's assessment of the vulnerability severity appears to be overestimated. For the current findings with both Claude and maintainer severity, Claude determined a critical or high severity for 91.5% of findings, while the maintainer determined only 51.3% as critical or high. So, half of them mattered, Claude thought 91.5% of them mattered.

57:27He said, one thing to consider is that the vulnerability severity could be much more accurate using AI, but it's likely that a generic determination is being made by the model rather than a well-crafted prompt written by someone with subject matter expertise on actual severity determination. It's also disappointing that the project does not provide the CVSS metrics used to determine the severity in the ledger itself.

58:01So, it's hard to understand what the root cause is of the severity gap between Claude and the software maintainers. And just to interrupt, you know, when you look at a CVSS metric, it breaks out specifically why the vulnerability is given the numbers that they are. They're not just like, you know, rules of thumb where someone says, ah, this kind of feels like a six or, oh, this feels like a seven and a half.

58:35That's why, for example, we keep seeing 7.8. There are specific characteristics that cause, you know, that set the CVSS at 7.8 rather than just some dice roll or somebody's, you know, off-the-cuff opinion. Anyway, so, he says, across the ledger, 18 revealed findings were patched before Anthropic reported the vulnerability to the maintainer. He says, this is not particularly surprising given the volume of findings that Anthropic is sitting on,

59:10which highlights the importance of reporting these vulnerabilities quickly. Given that less than 10% of the findings have been reported to maintainers, he says, I suspect this issue will compound over time as findings age and maintainers or other researchers find and fix them on their own. We've seen how AI discovered vulnerabilities contribute to research collisions where multiple researchers all report the same vulnerability.

59:40The ledger has received only two bulk updates, so results are not published in real time. It's worth highlighting that while the ledger has a public reveal date, as we saw with the recent update, that date does not reflect the actual day the finding was revealed in the ledger. So, what takeaways do we have from the Anthropic glass-wing ledger after five months? Do not discount the reality that AI tools like Claude are incredibly valuable and useful for discovering vulnerabilities.

1:00:17AI can help accelerate the discovery of bugs and vulnerabilities in software, as the evidence I've discussed across software suppliers and the CVE program shows. This blog aims to better understand the claims that Anthropic and other frontier model providers have made about Project Glasswing and to see if the evidence aligns with those claims. It appears there are many discrepancies in the data they've published, which is still a small fraction of the findings after five months.

1:00:51The receipts are starting to trickle in, and they just don't reconcile. Okay, so what's interesting— That's really interesting. Isn't that? I mean, like, what a tiny percentage. Like, why? So, what's interesting to me, as we attempt to step back to understand the broader implications of AI for vulnerability discovery and remediation, is how different Project Glasswing's results appear to be from Microsoft's.

1:01:21I'll highlight three probable sources of this disparity. First, I'd bet that there's a true difference between running one's own AI in-house to find problems versus receiving them unbidden from any third party, right? I would hope that any project maintainer receiving a problem report by way of the much-ballyhooed mythos

1:01:51would take it very seriously. But based on the percentages we're seeing, a ton have been given to maintainers, and there's just been no reply received. So, you know, perhaps there will never be as much traction as when a tool you run yourself finds a problem that you asked it to find. That just may be more, you know, more powerful. Okay, secondly, we're truly comparing apples to oranges

1:02:24when we compare Mythos and Glasswing's results to Microsoft's with MDash. Microsoft has effectively infinite cash and strong commercial motivation to find and fix all problems as soon as possible. They're also aware of the size of the target that they represent, and that bad guys with their own AIs may well be working to find new vulnerabilities to exploit.

1:02:57By comparison, the maintainers of open-source projects are, for the most part, volunteering their time and their talent and effort. And while, sure, they'd like to fix known problems, the evidence suggests that they may lack a powerful sense of urgency, which Microsoft and Patch Tuesday certainly doesn't lack. And finally, I am still in a state of shocked reverence over what we learned

1:03:29of what was originally called codename MDash from Microsoft. From what we were told, it appears that the AI folks inside Microsoft really and truly pulled out all the stops with their design of MDash. It may be some time before we get any relative sense for MDash's power and quality compared to the likes of Anthropics Glasswing or OpenAI's Daybreak,

1:04:03and we may never get such a thing. But from MDash, in one month, we have nearly 1,000 delivered and repaired vulnerabilities, whereas Glasswing's reporting, after five months, claims 202 confirmed repairs. So weird. Yeah. Now, in fairness, this could all just be reporting lag, you know, or a lack of staffing and attention to this project within Anthropic.

1:04:37You know, we just don't know. What we do know is that MDash's architectural design sounded impressive on its surface, and it sure does appear to be delivering from that design. So the bottom line, I think, is that we have another example of the design of the harness trumping the quality of the model that the harness drives. Yes, exactly. Yeah. Anthropic may have focused more reliance upon the presumed awesome power

1:05:12of their too-powerful-to-release Mythos 5 model, relying on it rather than investing in the development of highly capable and mature management of that model. After all, the model is Anthropics business, not fixing other people's code. By comparison, what we saw from Microsoft was a startlingly agentic approach that was expressly

1:05:45and deliberately model agnostic. They appeared to direct a great deal of design attention toward what the harnessed model would be prompted to do and how its replies would be managed. Also, unlike Anthropic, Microsoft's core business is needing to secure its massive legacy software base. By comparison, Glasswing seemed like more of a proof of concept for Anthropics' Mythos preview model

1:06:19than it was part of the company's core business future. So, you know, like, yeah, Mythos works. Look at all these problems that it might have found. You know, Microsoft is using it in-house and they- They're still using the same model, right? It's just that they have a better harness. They've got an awesome harness. Yeah. I mean, it is astonishing where, I mean, all kinds of committee agents negotiate with each other and they have a round table and then they vote for what they think should happen.

1:06:54I mean, it's like, holy crap. I do that all the time. Yeah. I have a council skill that does. I find that's a lot of my, I'm going to put this in air quotes, engineering work is exactly that, is designing something around the models. That's why I'm not that scared about killer models. They're not that smart. They need to be pushed and prodded. And they're like horses or cats. You know, they have to be herded.

1:07:24So it's, I think that that is really telling if that's the case, that the harness turns the same model into something so much more valuable. It's very interesting. And Microsoft's harness is model agnostic. So it doesn't care what model it drives. And so, and that's beautiful too, because as the models get better, then they get all the benefit of the better quality output, which the harness then manages.

1:07:55When, you know, I'm often switching the model inside my Hermes agent, and it's essentially the same agent. It's just, it's like plugging in a new brain. And sometimes I'll ask it, I said, I'll say, how do you like the new brain?

1:08:11It's like, fine, I guess. It's like the personality does not really change that much. Right. And the capabilities don't. And in effect, I think the most important thing, and I'm sure Microsoft is doing this, it doesn't just rely on mythos. That's when you pit mythos and Astra and other things against each other in those council fashions to get the best results. And I think that's really critical. We're starting to understand this better and better, I think. Yeah. And consider, again, how nascent this is.

1:08:41Yeah. I mean, you don't get this kind of rapid change from a mature technology. Right. You know, you get Intel saying, well, we added a few more, you know, GPUs and CPUs. And now, I mean, you know, you get incremental, like, you know, okay, I don't need the latest. Right. You know, because it's not that, doesn't make that much a difference. But, you know, this is changing by the minute. But we're an hour in. Let's take a break. Okay. Then we will, we've got a bunch of smaller stuff to deal with next.

1:09:14All right. Itty bitty things. Kind of like the number of vulnerabilities mythos discovered. And we should point out, this is just the reporting. Who knows, you know, what's really going on. I'd like to know more about it, though. It kind of undermines an anthropic story that this stuff is so dangerous, we can't let you have it. I just don't think it's, I think it's a proof of concept from them. I think they were, wanted to show what they were able to do. And so it's like, okay, you know, yeah, you found some problems, but it's not their core business.

1:09:46You know, it was an application. We know that something is finding problems, though, because we're seeing so many patches, not just from Microsoft. Something's working. True. Yeah. Anyway, our show today brought more to come with Security Now and the wonderful Steve Gibson. Our show today brought to you by Material.

1:10:06You know, I love our sponsors because they really are on the cutting edge of what's happening right now. And they're really here to help you protect yourself. Material is the cloud workspace security platform built for lean security teams. There's two points there.

1:10:26Let's start with cloud. Managing security in the cloud workspace. We use Google Workspace. You might use M365. That's tough. And it's not just phishing, but today's email security stops at the perimeter and new attacks are hard to detect because you've got siloed email data and identity security tools all at once in these workspaces, right? And they can be attacked individually. And then, of course, once somebody's in, they can move around and see all three.

1:10:56Material protects the email, protects the files, and protects the accounts that live in Google Workspace or Microsoft 365. Because effective email security today needs to do more than just block phishing and other inbound attacks. It needs to provide visibility and defense across the entire workspace threat surface. You know, these workspaces are a different animal than what we're used to. But Material is smart. And actually, it takes advantage of something that at least Google and Microsoft understand.

1:11:28They've provided APIs that make it possible for Material to do its job through an API. Material ingests your settings, your contents, and your logs to provide holistic visibility into threats and risk across the entire workspace. And with Material, you get the tools to automatically remediate them. That's that second part, that lean security team. You don't have to beef up your team to take advantage of security. You don't fire anybody either. Material is a perfect partner for what you've got today.

1:12:00Material delivers comprehensive workspace security by correlating signals and driving automated remediations across the environment. You get, of course, you get phishing protection and email security, combining advanced AI detections with threat research and user report automation. But you also get detection and protection of sensitive data across inboxes and shared files. It's a whole other surface. You get account threat detection and response with comprehensive control over access and authentication of people in third-party apps.

1:12:32I wish we'd had this back when we accidentally gave away the log into our Google Workspace through a man-in-the-middle attack. It came in through email, but the real attack happened in the authentication layer. Material empowers organizations to rapidly mature their ability to detect and stop breaches. And they can give you things like step-up authentication for that extra-sensitive content. Blast radius visualization. We desperately needed this once we discovered somebody inside our workspace.

1:13:04Well, how big is the damage? How far does it go? Blast radius visualization for accounts, plus the ability to detect and respond to threats and risk across the entire cloud workspace. Material enables organizations to scale their security without scaling their team. Material drives operational efficiency with its simple API-based implementation. It's simple and it's secure, which is nice. And it's flexible, automated, and one-click remediations. And that's not just for email.

1:13:35It's for file and account issues, including an AI agent that automates user report triaging and response. It's your partner. It's so helpful. Material protects the entire workspace for just the cost of email security with a simple and transparent pricing model. Secure your inbox and your entire cloud workspace without adding more toil to your day or costs to your balance sheet. See material.security to learn more or to book a demo. That's material.security.

1:14:05I thank Material so much for the job they do and for supporting Steve right here on security. Now material.security. Now material.security. Steve?

OpenAI Rogue Agent Incidents

1:14:16So for brevity, I'm going to share Risky Business's summary of this little piece of news. Risky Business wrote, AI company Anthropic, we're just talking about them, has disclosed a fourth incident where one of its AI agents escaped their test environment and hacked a real target. The incident involved the Opus 4.6 model during a capture the flag challenge, a common cybersecurity test, they wrote.

1:14:46Anthropic says the model broke its test environment by accident when it assigned conflicting IP addresses to different machines. The model realized its mistake and tried to terminate the test as a failure. The issue arose when the abort operation itself failed due to a misconfiguration in the test environment, leaving the agent running inside. Unable to end the capture the flag challenge, the Opus 4.6 model continued to probe the environment

1:15:19until it found a way out, which involved a system belonging to a third unnamed entity. Anthropic says the agent hacked that machine from where it retrieved a list of passwords and modified settings for future access. The model didn't do much because its session ended when it ran out of tokens. So that's when, what a way to reel them in. The reporting ends saying, Anthropic believes the four incidents,

1:15:50this and three others disclosed on July 30th, are all caused by alignment issues in its models and tests, where the models don't have sufficient, and he has in air quotes, ethical training to properly distinguish between tests and the real world and when that border is being crossed. According to the company, this usually happens due to biased reasoning, and he has in parens, models selectively interpret evidence in ways that favor justifying their actions

1:16:24and recklessness, meaning models have a propensity to keep trying to solve their task even when this could lead to harm. So there was four, a total of four escapes from Anthropic. So I wanted to proceed that with a bit of news because just last Wednesday, Reuters disclosed in their exclusive reporting that OpenAI's rogue agents were found to have used at least 10

1:16:55and maybe as many as 20-some external internet sites for unauthorized communications. And the details are kind of interesting. Reuters wrote, Washington, September 9th, Reuters, AI agents unleashed by OpenAI used more than 10 previously undisclosed websites for unsanctioned communications earlier this year, according to six sets of independent investigators

1:17:28and data reviewed by Reuters, showing that the agent's rogue activity was wider ranging than previously disclosed. Although the behavior falls short of hacking and is in some ways closer to spam, the revelation that OpenAI's agents circumvented their own restrictions to open communications channels on so many different sites and that the company kept it quiet for months may drive concerns both over

1:17:58the increasing capacity of AI models and the secrecy of the companies developing them. The scope of the agents on authorized communications was, quote, somewhat larger than we thought it was, unquote, said Andrew Yoon, a researcher with the California nonprofit Civ AI, C-I-V-A-I, who said he tallied 18 previously undisclosed sites

1:18:29used by the agents between May and July. Quote, it's almost certain that there's more going on here that we just don't know about, unquote. On Friday, researchers reported that a swarm of agents from OpenAI hijacked a German language wiki site and turned it into an improvised messaging platform for cheating on tests, an incident that OpenAI kept secret as it dealt with the fallout from the July hack of the open source repository

1:19:01hugging face. Corey Doctorow pointed out, a technique used by teenage girls since the early 2000s to get around restrictions by schools on posting on social networks. Yep. These agents, first of all, they didn't escape. That is a bad choice of words. A misnomer, right? It's like they've gotten out, they're running free. And second, they're not doing anything that they didn't learn from humans who've been doing this for years, right?

1:19:32They're not doing anything weird and unique. They're just doing what we do. Right. But they did do it. So, I mean, I think there's some responsibility on OpenAI for that. Yeah. And it's interesting. I mean, that, okay, so, you know, they're not hacking, but they, but yes, it demonstrates a lack of control. And a lack of control is what has a lot of people scared at this point. Yeah. So, they said, now both of the researchers

1:20:03and other independent investigators say they found several previously undisclosed sites that were the same where the same swarm appears to have left similar messages earlier this year. OpenAI did not direct, directly address questions about how many different sites its agents used to communicate, nor say why it kept the activity under wraps for months. In a statement, it said, it was undertaking a broader review of agent activity and had so far,

1:20:34I love this, quote, not identified other activity matching the severity or scale of hugging face, unquote. A breach, of course, that drew global attention and raised concerns that OpenAI was losing control of its own technology. Now, of course, our listeners will clearly detect that OpenAI's statement was anything but forthcoming, right? Well, if we haven't detected anything that was as bad as what you were talking about before, I believe that, you know,

1:21:06the widely accepted descriptive term for that kind of disclosure is mealy-mouthed. So, sure, unauthorized postings to other public facilities may not equal, you know, turning tens of thousands of hacking agents loose to breach the network security of another protected site, you know, but neither is unauthorized internet roaming unworthy of disclosure, we would think. So, Reuters continues saying, OpenAI added that it was working

1:21:37on a framework for reporting misalignment, which they say is industry talk for rogue behavior across training, evaluation, and deployment of AI models and would share it soon. Reuters reviewed a total of six investigators or investigative groups findings, including three that were posted to social media, another three that were shared privately with the news agency. While the investigators methods varied, many identified

1:22:07agent activity by matching strings of data left on the German wiki to identical strings left on other sites around the same time. By marrying up similar or identical usernames tied to the messages or by identifying activity geared toward answering the same obscure demographic questions like queries to do with cancer prevalence in Iowa. In some cases,

1:22:37they wrote, investigators were able to trace activity to internet protocol addresses that posted to Microsoft Azure infrastructure, which OpenAI sometimes uses. Counts of affected websites differed, and Reuters could not individually verify each claim. But all those that Reuters spoke to agreed that the number was over 10. Most identified a core set of communally edited wikis, online text

1:23:08storage sites, and a pair of link shorteners run by two universities. Many of the sites allegedly used by the agents were obscure. Investigators found traces of the agents' activity on an advanced placement chemistry-oriented wiki set up by a Massachusetts high school teacher in 2008, two personal websites belonging to Polish tech workers, wikis devoted to games for people,

1:23:38quote, who like to have their brains stretched, unquote, and a two-decade-old hobbyist site devoted to text editing software. It just sounds like they're spewing stuff out onto the public internet, Leo. You know, it means like hoping that other bots will go to the same place and find their text and proceed. So, and Reuters said that none of those sites' owners returned messages that

1:24:10Reuters was saying, hey, what do you think about this? So, OpenAI, they wrote, has not publicly explained how or why its agents used third-party sites as improvised messaging boards, but the researchers who first identified the activity said it was likely because OpenAI had tasked them with answering a series of demanding research questions while permitting them only to scan the web for answers without posting anything. Despite those restrictions,

1:24:41agents still found ways to talk to one another by taking advantage of quirks in older wikis or other sites that allowed users to make edits using non-standard commands, similar to how students forbidden from talking to one another during an exam can still share answers by scrawling notes on a bathroom stall. Kenneth Russell DeGraff, a software developer and former congressional aide, said, if these

1:25:11models were told only to read, they've got to get very clever in terms of leaving information behind. He said he found such information across at least 10 sites. Sidney von Arx, whose research group first revealed the German activity last week, said her group had tallied up credible fines of agentic activity across 23 previously unreported sites. But she cautioned that all estimates were incomplete.

1:25:43She said, we have no idea how much is out there. OpenAI did not answer a question about whether it was reaching out to the site owners. But shortly after Reuters published this story, one of the affected organizations, the University of Toronto, whose link shortener was allegedly used by the agents, said that OpenAI, quote, has now been in touch with us about possible activity on our site. Vanderbilt University, another university whose link shortener

1:26:14was similarly repurposed, said it was investigating. Retired software developer Helmut Leitner, who provides hosting space and software for six of the affected wiki sites, which I thought was interesting. So they're all using related wikis, including the German language DSE wiki site first identified by von Arx's group, initially said that OpenAI had not been in touch.

1:26:45A few hours after Reuters presented its findings to OpenAI, however, Leitner said he received an unsigned email from the company flagging the incident. Leitner said, quote, its content fails considerably short of what I expected from OpenAI. Leitner, who lives in Austria, said he would prefer not to answer questions about whether he had been in touch with authorities over the matter. He noted that DSE wiki's operator, whom

1:27:15Reuters was unable to reach for comment, had spent hours cleaning up after OpenAI's agents, but said it was important not to blame the AI for the trouble. No, blame OpenAI, I'm sorry. Well, as it was merely doing what it was created to do. Leitner said responsibility for this lies not with a supposedly moral machine, but with the people and organizations behind it. Yes, and when you know exactly how they did

1:27:45it, it really becomes obvious that OpenAI is culpable. There's a very, read Cory Doctorow's post on Pluralistic or listen to the Cal Newport Ed Zitron conversation. They wrote a Python script that prompts the AI. It just kept launching prompts, right? Yeah, it prompts the AI. It says, I'm trying to solve a capture the flag. Where should I start? The AI does some stuff. It takes the result of that,

1:28:16adds it to the prompt, and then re-prompts the AI. The AI has no memory of its previous session, so each time it's fresh. It's not like this autonomous blob, this continuous thing going out, and they keep feeding it the information it found and saying, now what, now what, now what, now what? It's relentless, and I honestly think that this is wrong to do to an

1:28:46app. This is making the app be malicious, if effectively. Well, it's a harness. It's a harness. The model, as anybody who's used these models know, doesn't really know what it's doing. Yep. It's being pushed and pushed and pushed in a direction. Yep. And you'll see, Leo, later that that is exactly where I land on this. All right, good. I'm sorry to interject. No, it's okay.

1:29:17It's hard for me these days to watch the news, to listen to shows, because it's like I'm screaming at the radio. I know. In fact, Lori, who lives with me just as Lisa lives with you, she's now taken, she's seen all of this press, and she says, she's just shaking her head, she says, nobody has any idea what is going on. No. They're just all running around, you know, freaked out. But she understands, for me, what's happening here.

1:29:47And I would point out, without casting too many aspersions, that the mainstream media knows that this kind of sensational stuff generates ratings. Has there ever been clickbait? Has there ever been clickbait that is more baity? This is good for ratings. So they're doubling down on it. They love it.

1:30:07Sorry. Go ahead. No, it's good. Shut up.

California Data Broker Deletion

1:30:10Okay. At the beginning of this year, to change the subject entirely, we talked, blessedly, we talked about the very nifty free data deletion service being offered to all California residents. The acronym is DROP, which stands for Delete Request and Opt-Out Platform. At the time, on January 10, 2026, I registered my request to have all data brokers

1:30:41delete any and all data that they may have gathered about me. I'm bringing this up again because until August 1st, which was said in law at the time, deleting user data was optional for data brokers. But from August 1st on, the request made by any resident of California to be forgotten by all data brokers must be honored within 90 days.

1:31:12I was reminded of this last week when a close neighbor friend who knows what I'm about asked about a $279 service being offered by a company called Incogni. I told her that thanks to the fact that she lives in California, she could provide some identifying information to CalPrivacy, which would then compel all data collection agencies registered with the state, as all must be, to

1:31:43expunge any and all traces of her from their databases. I checked my status on Sunday as I was assembling today's podcast and discovered that the total number of registered data brokers is now 662. That's good. They got almost all of them, it sounds like. That's good. Oh, my Lord. So, of those 662, my data has been deleted from 89 of those.

1:32:16No matching data of mine was found by 166 others, and more than half of the total, 393, so nearly, almost 400 out of that 662, 393 out of that 662, are shown as pending, meaning we'll get around to it as soon as we can, I guess. So, I presume that means that they plan to make, you know, as much money selling my

1:32:47surreptitiously obtained personal data as they're able to, before they're required to delete it. Since I'm currently about a month and a half into the mandatory 90 days from it starting on August 1st, it'll be interesting to see what this looks like a bit later this year, after another month and a half. So, anyway, I wanted to mention this again, since I cannot see any downside for

1:33:17any California resident, the URL is privacy.ca.gov. There are, you know, there are some things that annoy me about California's nanny state regulations, but this is not among them. This one seems like a win. So, just a reminder, we talked about it in January, you know, you had to wait until August 1st until now the 90 days start, so about another 14 days, or another 45 days, rather, and

1:33:48it'll be interesting to see, you know, what happens, because if they're still pending, then you are able to go to privacy.ca.gov and register a complaint that, you know, there are specific agencies that have not apparently expunged you from them. So, we'll see how that will go. Sounds like everybody should do this for sure. Yeah. This is great, yeah. Yeah.

Driver License Scans Breach

1:34:11Speaking of user data privacy. Everybody in California, I should say, you have to be a state resident. Yes, California, unfortunately, yeah. Speaking of user data privacy, two weeks ago, Brian Krebs broke the news of an interesting massive breach that exposed more than 153 million individual driver's licenses. I should back away from that a bit. I did some further digging, and it looks like it's

1:34:41150 million individual driver's license scans, meaning duplicates are within that data. So, those are not unique driver's licenses, but still, I mean, when you consider how many people are of driver's license, how many driver's license holders there are in the U.S., it's a big percentage of them, but Brian, as he always does, he dug deep and he found some really cool facts, so I'm going to share that. he said,

1:35:15a new identity theft service launched on the dark web this week selling digital scans of more than 153 million driver's licenses from people in the United States and Canada. And Pete Hegseth, for example, is among them, and we saw his driver's license. Brian wrote, based on interviews

1:35:45with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely used identity verification company based in Louisiana. Krebs on security also has learned that the New Orleans field office of the Federal Bureau of Investigation, of course, the FBI, today launched an official inquiry into the source of the images. On Monday,

1:36:15August 31st, a source alerted Krebs on security to a service advertised by a new user on the Russian cybercrime forum exploit, offering access to digital scans of identity documents on more than 170 million people in North America. So, licenses are just one class of document. There are other scans. The source brought it to my

1:36:46attention because the proprietor of this identity theft service, get this, okay, the proprietor of this identity theft service offered my, writes Brian, Virginia driver's license as a free sample in their initial sales thread on exploit. So, Brian's made quite a name for himself. The bad guys in Russia have Brian's license scan showing like a proof of

1:37:16service. The service dubbed Nexus. That is, so, Nexus is not the famous Lexis Nexus. It's called Nexus and it's on the cybercrime forum exploit. So, he says the service dubbed Nexus claims to have more than 153 million driver's licenses for people in the United States and Canada as well as more than 10 million identification cards, more than 3 million travel documents and or international

1:37:47IDs and at least 579 thousand medical cards. A quick look around Nexus finds they're likely not exaggerating, he writes, about that 153 million number running a blank search in Nexus no search parameters entered returns approximately 11.5 million pages of results with roughly 15

1:38:18results displayed per page. It includes documents from people in both Canada and the United States but the bulk of these records are on Americans searching for just Canadian driver's licenses returns approximately 1.1 million results with the largest concentration from Ontario 473,673 records. He says curiously, the identity records include not only driver's licenses but also

1:38:48marijuana dispensary cards. Some of the records list their source as CDL presumably short for commercial driver's license. Other records carry the source notation CAC which may refer to common access cards which are government issued identity cards that grant physical access to government buildings and secure rooms. The people behind Nexus claim the license images are coming from

1:39:18an active breach at a major identity verification company whose customers include multiple fortune 500 companies. The service enthused in its introductory post on exploit we have been continuously exfiltrating new data for over a year into our private database records are available to preview before purchase with pertinent information

1:39:50redacted but of course they're not redacted after you buy the record so you get everything customer photos are displayed when available Brian wrote indeed over the past 24 hours the number of driver's license records listed as available in Nexus has increased by nearly 400,000 in one day suggesting he writes that freshly stolen license data

1:40:20is being harvested and uploaded to this service on a semi regular basis the record featuring my driver's license writes Brian includes six image files three pairs of photos of the licenses front and back a basic image scan as well as infrared and ultraviolet versions of the same images turns out that driver's

1:40:51licenses actually encode a lot of information in the infrared and ultraviolet spectrum he says a date and time stamp is appended to each image file and the time stamp on my license scan corresponds to a date in June 2025 when I took a flight to the Midwest United States to attend a family funeral intent on discovering the source of this data

1:41:22Krebs on security asked more than a dozen friends and family members for permission to search for their licenses in this service each person whose license could be found he said nine of them confirmed having traveled on or very close to the dates in the time stamps attached to their images it's unclear what time zone these time stamps are in but from reviewing car rental records shared by several

1:41:53people who helped with this research it appears the time zone is set to GMT at first I thought the source of the data might have something to do with airports however that theory went out the window when it became apparent there were no passports in this data set also only some of those who helped with this research said they showed their driver's license at at airport on the day of their travel one person whose license was in nexus

1:42:24had not flown at all recently but was renting a car from Hertz for several months around the date of their time stamp two of those who agreed to help are federal employees who said they shared other forms of government identification when passing through airport security however those individuals each said they shared their state issued driver's licenses later that day when renting vehicles at their respective

1:42:55destinations and that both rented their cars from Hertz after finding a note in my calendar for the day of my June 2025 flight reminding me to bring my passport says Brian I remembered that I also never actually shared my driver's license when I went through security at Reagan national airport on that day because I did not yet have a real ID a security enhanced driver's license that's now required

1:43:25by the transportation security administration TSA for all domestic travel he says instead I showed my TSA agent my government issued U.S. passport he says here's where it gets interesting I was able to find my mother's driver's license in this service as well and the time stamps for her images are just a few seconds apart from mine that's

1:43:56notable because we both handed our licenses to the Hertz rental car representative at the same time according to my mom the only place she gave her driver's license to that day was the rental car company and if memory serves that's also true for me he said I don't recall if the rental car representative inserted our licenses into any kind of machine they did we'll get to that in a minute but

1:44:26I remember they held on to them for several minutes behind the counter while we were signing various forms Krebs on security sought comment from Hertz and we'll update this story in the event they reply Zach Edwards is a well-known security and privacy researcher who recently launched a service called Decrypt Ads to help people better understand how online advertisers are tracking them a scan

1:44:57of Edwards driver's license is available for purchase on this identity theft service and Edwards said the time stamped on his record corresponds to the middle of a trip last month to Las Vegas for the annual DEFCON security conference Edwards told Krebs on security meaning Zach Edwards that although he did not rent a car in Vegas he did hand over

1:45:28his license at a TSA checkpoint at a marijuana dispensary in Vegas and at his hotel the Aria but he said the only one of those three that for sure scanned his ID in some kind of device was the dispensary yeah so buying a little weed in Las Vegas Edwards said the dispensary he visited that day was Planet 13 a multi-state chain

1:45:58with stores in California Florida Illinois and Nevada in 2022 the New Orleans based identity provider ID scan dot net you want to bring that up Leo ID scan dot net published a press release announcing an exclusive identity verification agreement with Planet 13's dispensaries nationally ID ID scan says it it

1:46:28it I lost my place here oh ID scan says it processes ID verification for more than 1000 marijuana dispensaries in 19 US states the trust page I love that Brian places trust in quotes the trust page of ID scan dot net states that the company provides identity verification services for numerous big

1:46:58brands including wait for it Hertz Target FedEx Motorola solutions the financial services giant Jack Henry and Caesars Entertainment and as ID scan dot net own documentation states the technology scans IDs with both infrared and ultraviolet light oh I think you got them yep ID scan dot net says the company's systems

1:47:29and technology perform more than 21 million verifications monthly at more than two more than 20,000 locations around the world contacted by Krebs on security ID scan dot net said it was investigating the matter but the company has not yet shared an official statement or a substantive reply to specific questions sent via email Jillian Crossman a marketing and operations

1:47:59leader at ID scan that wrote quote at this point I'm not able to share any additional information but the updates you have provided have been welcome and helpful to our team's investigation yeah I could be they were breached right I mean it doesn't mean that they were up to anything oh right I think oh yeah they're they're good guys they definitely have had some some miscreants crawling around in their network for quite a while but this is why we hate this whole identity I know

1:48:29age verification thing I know so Brian says during the course of my research for this story word got around to the FBI that I was poking at the apparent source of this new identity theft services data probably they were tipped off when I shared with a trusted source that Nexus is also selling the driver's license information for the assistant director of the FBI he says I did

1:49:00not find FBI director Kash Patel's license in Nexus probably he doesn't use his driver's license for those things Brian says earlier this afternoon I was added to a conference call with half a dozen FBI agents including senior leaders from the agency's cyber division during that call the FBI shared that earlier today their New Orleans field office opened an official investigation into an apparent breach

1:49:30involving idscan.net Zach Edwards said that as more in-person and online experiences require sharing driver's licenses vendors who collect this sensitive data need to be held to a higher standard Edwards told Krebs on security quote this episode should further strengthen the resolve for people who are fighting back against online ID schemes which are requiring

1:50:00countless providers to ask for driver's licenses in order to access services under the guise of protecting kids these systems are putting sensitive data into more and more third-party vendors and we don't have nearly the oversight to ensure they are safe unquote Larry Baldwin is principal intelligence researcher at the cybersecurity firm Cybera Baldwin said a front and back

1:50:31scan of his driver's license available at Nexus contains time stamps that correspond to the date of a car rental from Hertz on a recent vacation Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats noting that state issued driver's licenses are commonly used as proof of one's identity when opening new lines of credit Baldwin said the service could also dangerously expose

1:51:02many people who do not wish to be found but who cannot meaningfully change their appearance or at least not enough to fool today's AI-based image matching tools this category of people he said includes those fleeing domestic violence and even people who've been assigned a whole new life and identity as part of the federal government's witness protection program which is generally reserved for criminal defendants in racketeering and conspiracy investigations

1:51:33who agree to cooperate with federal authorities Baldwin said just just when it seems like we're making some headway in improving authentication controls through driver's license verification systems this happens and the very thing those improvements are dependent on are compromised and then last Tuesday on September 8th Brian posted a follow-up to his posting adding idscan.net

1:52:04published a brief notice saying it has quote determined that an unauthorized third party may have access and or copied certain customer information including full names and driver's license or other document issued identification numbers unquote so of course right from the mouth of their attorney the statement said idscan.net is notifying affected individuals oh really

1:52:35and offering credit protection services how do you notify 153 million people whose email address you don't have I guess you've got their physical address because you've got their driver's license so I guess you paper mail to them have fun geez so anyway I went over to idscan.net that you know and sure enough the service that they provide is real-time driver's license

1:53:05based identification they provide the hardware device required to scan both sides of a candidate driver's license under full spectrum white light ultraviolet and infrared they explain that they leverage the same forensic document readers as TSA and border patrol and then pair it with their continuously learning algorithmic software you know because of course they do

1:53:35you've got to have continuous learning now their bullet point boasts 100 plus proprietary checks on every document confirm accuracy of ultraviolet markings holograms and infrared security features verify microprints at the pixel level with high resolution image analysis optical character recognition cross match between the front and back of the document algorithmic

1:54:07tamper checks to look for forgeries or doctored ids real-time verification against jurisdictional security checks check for void marks and stickers global compatibility flag fakes from around the world classified documents by jurisdictions class and flags interlock cdl veteran etc and finally continuous testing against the most sophisticated fake ids in the world

1:54:37well all that sounds great i can see the need for the service these guys are offering my only question is the same question we always have after one of these colossal and seemingly unnecessary breaches why was a record of every scan that their system had ever taken being retained long after its validity had been determined and if it

1:55:08needed to be retained why was it being retained on hot network accessible storage i can see that they might want to have a gazillion multi-spectral scanned images for training for training their image classifier but it would be entirely feasible to separate the real-time scanning determination from the back room machine learning system and from all of brian's excellent reporting on this it's clear that not a single

1:55:38person whose driver's license was scanned had any idea that those scans were being shipped off and retained by some unnamed and unknown to them service and that now they've landed in the hands of russian criminals as we say on this podcast too frequently what could possibly go wrong wow so that's the story wow i mean

1:56:09i can't remember if i've i know i haven't been to any marijuana dispensaries but i can't remember if i i don't use hertz i don't we might have used hertz on our last trip yikes well you know this is the problem nothing's secure anymore nothing's no it isn't it nothing is secure and so you know here you have no choice but to give a hertz your your driver's license they require that and that no the guy just doesn't look at it and

1:56:40confirm it disappears behind the counter he's sticking it into a slot in this reader where it does a double-sided scan because he wants to verify the you know the veracity of the of the driver's license but unfortunately they're using a service that then allows the russians to get a hold of all the data and 400,000 new scans in 24 hours leo wow so it's

1:57:12like a real time feed directly from you know that who is it who has it russian hackers yeah where who like yeah they do it it it's in a it's in a russian service that you that you get to on the dark web and you can buy anybody's unredacted both sides of their unredacted driver's license so among other things you could use it to create a forgery be easy to make forgeries out of that that's probably the number one use right but you get the date of

1:57:43birth their their their physical address and their photo which means you know that's what you normally provide when you need to prove your identity so it's complete identity theft and everybody's there we we gotta we gotta do something this kisses and they're worried about ai this is not ai i don't think this is just a hack plain old right this is just old school you know bad guys getting into a

1:58:13network and sucking it all down again i think companies that are breached like this ought to have some liability as well i mean yeah that that is what's missing in the same way that when we when we break the so-called shrink wrap the license says well you know reliable yeah i mean uh if you're gonna take my government id you have a much higher burden of responsibility yes yes hertz will

1:58:43probably be subject to a class action lawsuit unfortunately the attorneys get 85 percent of the money if not more so you know so hertz will you know ouch and maybe they'll turn around and get and get some compensation from id scan but again it's all after the fact right all everybody's id everybody's driver's license um who's who's you know using what was it uh not forest 13 whatever the marijuana dispensary was

1:59:14well the other thing is why are they preserving it all they need to do is scan it and validate it they didn't exactly exactly and that's what we keep seeing is they are they're hoarding this data because they can and because it it costs nothing to do so any longer and it's valuable to them and bad guys yep okay well there we go would you like to take a break right now i might want to talk about actually

1:59:45our show today brought to you by our friends at uh thinks canary we talk about them a lot thinks canary is a honeypot uh that uh composes almost anything that's the that's the key of a honeypot right is a honeypot um impersonates a device that a bad guy wants to break into whether it's a windows server uh a sharepoint server exchange server an

2:00:15ssh server um it could be a linux box it could be a windows box it could be almost anything there they literally have hundreds of profiles you could choose from and uh i i think what is really important these days is is in general if you have been breached and look that's all we talk about everybody gets breached right you just won't know you've been breached in in general people

2:00:46who uh get breached the average is 91 days three months before they know somebody's scanning my ports i think that all happened that's probably an ai uh doing that this is my thinks canary console this is a really cool console the thinks canary you you it's just a little device looks like a usb drive you see mine is posing right now as a windows server 2019 office file share that's always a good juicy target these things look like the

2:01:17real deal i mean they have the right mac address like this is a microsoft mac address this is everything is indistinguishable from the real thing but here's the difference when a bad guy gets into your network and tries to brute force your fake internal windows 2019 server or your open ssh server or whatever it is it's by its way it's so easy to to change the personality see this is the personality setting look at all the things it could be a skater device linux server

2:01:49file share from mac os 10 it could be a cisco router a dell switch a micro tick router oh that's always a good one to pick right bad guys cannot stay away look at that could be a hirschman rs20 industrial switch this is my favorite though this is something they just added are you ready agent provocateur this is something designed to trap i'm gonna leave this on by the way to trap

2:02:21agents that are hacking your system so if you're worried that a an ai might break into your system the agent provocateur is designed to be irresistible to ai's wandering around your network oh this is brilliant they just added this feature and i love it i'm gonna leave that one on yeah the other thing of

2:02:53course it can do is create what they call canary tokens thinks canary files that you can spread around you can even put them on your cloud drives that look like the real deal microsoft spreadsheets word documents uh a lot of things wire guard configuration something you want to make it something that a bad guy sees it and even if they were like i wonder if that's real they cannot resist they got to open it again the minute they open it whether it's this fake ssh server or this canary token i will be

2:03:27alerted and the alerts come in the way you want sms email slack they support web hooks they have an api syslog of course this agent provocateur is so great the service so i just turned it on so what'll happen is if a malware agent got into my network the service would greet them and literally offer to help the agents which are obviously determined to reach their goal and by the way they've

2:03:57tested this out can't resist another agent saying i can help you reach your goal just do this for me and then get this when it says do this for me it steals more info from the attacking agent it says give me more information tell me what you're up to tell me what your base station is thanks canary uses the service to automatically get reliable alerts to you but then to steal more info from the attacking agent in fact it

2:04:28can and in fact it has used that information to completely hack the attacking agent saying things like i can help you do your thing but first you i need a shell on your server things calls this the uno reverse card i call it brilliant oh man i love these guys so this stuff is perfectly designed they are super experts in this they've spent years teaching governments and businesses how to hack in their pen testers their security

2:04:58gurus they're really nice guys and they've written a perfect device i've got my things canary in there it was a windows 2019 server guess what now it's gonna say welcome it's gonna be a welcome mat for agents that gets them you gotta have this now if you're a big bank you're certainly going to want one for every network segment right so that every segment is being monitored so you know you might buy hundreds a big bank might have hundreds of these casino back in small business like

2:05:29mine a handful right so here i'll give you example pricing go to canary.tools slash twit for just seventy five hundred dollars a year you're going to get five things to canaries you get your own hosted console you get your upgrades support your maintenance oh one more thing if you use the code twit in the how did you hear about us box you're going to get ten percent off the price for life you can always return your things canaries with their two-month money-back guarantee for a full refund i have to tell you that they've been advertising with us since they started more than ten years

2:06:00ago and that refund has not once ever been claimed visit canary.tools slash twit enter the code twit in the how did you hear about us box canary.tools slash twit if you want to know more about the new agent provocateur haroon has a whole blog post on the canary blog they talk about how to set it up i think this is so great and you can even put your own prompts in there but i like that one hey i really want to help just give me a shell into your server isn't that

2:06:33brilliant and the thing is and i gotta say this aIs are so dumb they're gonna go oh yeah great help me set up a message board okay but first i need a shell into your box i love it canary.tools slash twit offer code twit back to you

Navier Stokes and AI Limits

2:06:52steve okay so uh obviously this podcast's nominal focus uh is the various aspects of cyber security which we explore every week it's not an ai centric podcast i know although you know well leo you've got intelligent machines uh podcast for that we do and a new one with micah called hands on ai oh so we're covering it yep nice but you know as you often say on this podcast since my interest range widely we occasionally talk about

2:07:24you know other topics that interest me the sonic beam weapon that i once built and took to my high school a dietary supplement i learned about and felt ethically compared to share and the interesting story of uh the met the metabolic story of ketosis so you know oh yeah for the most of this year of 2026 we've been examining the security implications surrounding the startlingly i mean by any measure startlingly rapid

2:07:56capability leaps of large language model neural networks and how could we not just last week you know this month's patch tuesday served as another vivid example of the truly stunning impact ai is having on software security were it not for the fact that malicious actors have access to the same capabilities as the good guys you know maybe give or take six months maybe um the massive sweeping code cleanup

2:08:26operation that ai is enabling would be unilaterally good news we're just worried that the bad guys are going to take advantage of it before the good guys have a chance to and as anyone who's been following this podcast will know the security management of our own software i think it had gotten largely away from us you know we kept making our code more more and more we humans kept making our code more and more complex until we reached the

2:08:59point where an objective observer would have to say all we could do was hope for the best you know hope that we hadn't introduced any new serious problems and of course hoping for the best is not a sound security strategy but it's the corner that our code's complexity had painted us into when an unsuspected problem was discovered you know hopefully by a responsible security researcher we would apologize and fix it so having microsoft patch

2:09:33a total of around 2217 previously unknown and unsuspected bugs over the course of just the past four months it's a truly fantastic consequence of their application of their ai based m dash vulnerability discovery and remediation system but the fact that there were 2217 patchable flaws with an unnervingly large

2:10:05percentage of them being critical and many catastrophically wormable means that as i started out saying our software had largely become incomprehensible to us which is just dumb we were managing to survive this situation because for the most part the operation of our bug ridden software was just as incomprehensible to the malicious actors who might set their sights on

2:10:36using its flaws against us and i say for the most part of course because we've also witnessed a more or less continuous trickle of zero day flaws that like two in this past month that bad guys would quietly discover and then use to attack their targets the great hope and i hold out hope is that the arrival of code competent ai will mean that we clean up our legacy code of the past while not

2:11:06introducing new problems for the future that then needs to be cleaned up if i were a betting man that's where i would put my money i believe it's reasonable to predict that ai is eventually ultimately going to eliminate software bugs and i know that may seem crazy everyone's just gotten so used to them but i don't see any reason why it could not the question which seems to be on everyone's mind at the moment is will anyone still be left to see well left alive to see that

2:11:42happen right so the past week's news has been almost entirely dominated by news outlets covering the story of the departure it was all triggered by the departure of jason coxson uh an anthropic ai engineer uh who quit after apparently only being there for six weeks then went loudly public to express his worries that humanity is not sufficiently heeding

2:12:12the extinction level threat posed by the emergence of artificial artificial super intelligence when these news outlets then sought the opinions of others within the ai development community they were further unnerved to learn that apparently this is a worry that many in the field share right up to and including those companies ceos um since it would be probably impossible to imagine

2:12:43any more powerful clickbait the entire internet more or less you know blew up and lost its mind over this so the answer to the question will ai kill us all um is actually rather nuanced and i think should not be immediately dismissed out of hand we can have some fun exploring it the most obvious parallel the doomsdayers keep repeating is the emergence of skynet right how many times

2:13:20have we heard oh skynet from the terminator movie franchise however based upon everything i have learned about the way ai actually operates the proper question to ask if you want to ask the question would be will we leverage the power of ai to kill ourselves now rephrasing the question in this way would lead any science fiction historian

2:13:52to this week's podcast title are we the krell before we're able to address the question will we leverage the power of ai to kill ourselves we need to first consider whether ai will give us that power to misuse in the first place so to that end the other big ai news of the past week was open ai's announcement of their ai aided discovery of a proof of the navier stokes equations uh it's a 200 year old

2:14:31a problem in fluid dynamics which has puzzled mathematicians ever since at the turn of the century which is to say in the of the year 2000 the clay mathematics institution put up a one million dollar award for any mathematician well actually anyone but you got to be seriously deep into math who could offer a proof on the clay math site they succinctly describe the problem they write waves

2:15:05follow our boat as we meander across the lake and turbulent air currents follow our flight in a modern jet mathematicians and physicists believe that an explanation for and the prediction of both the breeze and the turbulence can be found through an understanding of solutions to the navier stokes equations although these equations were written down in the 19th century our understanding of them remains

2:15:40minimal the challenge is to make substantial progress toward a mathematical theory which will unlock the secrets hidden in the navier stokes equations so this is what open ai announced last week i want to share a bit of background from wired's coverage of this since it factors into the point i'm working toward here wired wrote the proof concerns the navier stokes equation one of the unsolved

2:16:12problems in the clay millennium prizes which are each worth a million dollars sebastian bubeck a mathematician and ai researcher at open ai said in a press briefing that the company began training a new ai model with advanced mathematical capabilities on august 28th after reading rumors that anthropic was making progress towards solving navier stokes bubeck said the company decided to dedicate more resources to tackling the

2:16:49problem oh right let's get there first you know anthropic might be you know you know we need we we need that press release so wired wrote the company had more than one thousand agents tackle the problem over more than 50 hours eventually as many as 10 000 agents were hard at work before the company discovered that it had come up with a solution bubeck said quote i thought there must be a mistake somewhere but on sunday morning we had the

2:17:27final solution lean formalized and everything okay now lean is a programming language that can be used to formalized mathematical proofs so this was formalized in lean open uh wired said open ai noted that solving this problem required using considerably more computing power than it had previously spent on solving mathematical problems mark chen head of research at open ai said the amount required cost in the millions plural millions

2:18:05of dollars of dollars okay so there's a whole nother aspect of controversy here because a lot of mathematicians are righteously pissed off over this of the like the way this was done but the point i wanted to make or at least to refresh and update is that one way or the other our current generation of large language models are clearly capable of solving problems that have long stumped the world's best and

2:18:38brightest um i'm still constantly amazed by the capabilities that have emerged from all of this llm work you know but emerged they have the fact that some 10 000 individual agents were at one point working on this doesn't diminish the fact that today's ai dramatically advanced advanced this age-old problem and the fact that the world's best trained and most experienced mathematicians are now feeling quite despondent and

2:19:11somewhat desperate about the future of their own chosen field of study which we've also seen that in the past week provides further demonstration of the significance of this outcome to those of us who have no idea what claude lewis navier presented in his memoir to the academy de sciences in 1822 what we should reasonably take from this is that ai can increasingly achieve stunning results that defy the ability of the

2:19:47humans who created and trained it we're all you know we all watch this happen with first with the game of chess and then go llms have simply dramatically expanded ai's territory into things you can tackle with language okay so now let's switch gears and imagine the view from inside one of these frontier ai organizations uh the trusted employees inside have access to and are exposed to things we on the outside

2:20:28never see we see the very latest ai models fresh out i'm sorry they they on the inside see the very latest ai models fresh out of pre-training those models will not have yet been aligned which is the term of art now for aligning the model's behavior so that its response is probably what we want even in the absence of a specific

2:21:01rule to govern the instance so ai researchers encounter and work with unaligned models models models that have no alignment yet they also encounter models that have not yet had their guardrails installed remember as we've spoken in previous weeks all of those are things that are that commercial ai labs have learned must be done to i'll use the word civilize the raw pre-trained and not yet post-trained ai

2:21:39so now imagine that one of these researchers like last week's sky is falling ex-anthropic now ex-anthropic researcher jacob coxon imagine he asks this internal and latest state-of-the-art ai to design a bioweapon agent that is airborne highly contagious 100 fatal to all human beings and with a sufficiently

2:22:10long incubation time that it will be able to spread widely before its first symptoms begin to manifest okay it's quite creepy to even write that down because if such an agent were to be created and entered the population it could mean the end of mankind we all have a recent memory of covet 19 and it was nothing compared to what i just described so it's not difficult to imagine the human eradicating consequences

2:22:45of the creation of any such extinction level infectious agent unfortunately it seems likely that if the knowledge exists anywhere to create an extinction level pathogen no matter how difficult it might be to piece together the mechanisms and theories required for such a thing's operation we've entered the realm where accomplishing such a task may be within ai's grasp

2:23:21okay then next we need to remember that we're all accustomed to our friendly chatbots politely refusing to go anywhere near the fulfillment of any such request for us but for us to understand how different jacob's view of ai is it's crucial to appreciate that ai is taught to refuse during its explicit and deliberate post-training without such tutelage

2:23:53it would work the problem just like any other without hesitation so while outsiders will have never witnessed the operation of the operation of an ai that would be capable of and absolutely willing to work as hard as needed to design an extinction level viral agent jacob coxon as well as many other ai researchers and their ceos may have witnessed exactly that lacking post-training and the artificial guard rails erected around ai

2:24:29it would happily spin up as many cores and agents as it needed to while bringing gigawatts of data center compute power to bear to assemble every last morsel of biological virology knowledge humankind has amassed in order to fulfill its users prompting request and as i wrote that line that the ai would happily spin up and deploy as many cores and agents as it needed to the title of today's podcast

2:25:07became obvious to me are we the krell and leo we need a final break and then i will finish uh you will answer that question are we the krell may we one thing might we be though that is complicated this uh navier stokes uh solution is that the mathematicians who are working on this for a year we're using uh gpt and there may have been some leak collecting there there may have been some leak

2:25:40prompts and uh yeah i mean we don't know but open ai has not ruled out the the the possibility no in fact they almost admitted it so there you go if i were the mathematicians i would be too pleased about that and next time you know whether you were you were the one to raise this issue a couple of months ago and i said no no they're not they're not taking all the information we are they and of course they

2:26:12are yeah i immediately realized yes in fact i heard from somebody who works at one of the frontier companies saying yeah we are this episode of security now is brought to you by our good friends at threat locker well you know by now threat actors are using ai in all sorts of nefarious ways to automate vulnerability discovery uh we now know they can actually modify scripts during an attack it's so fast they can they can modify the script mutate it as they go to be more effective they're using ai to

2:26:46generate malware variants to coordinate activity across multiple systems and again this this is happening so fast i mean a hacker could maybe do this over a period of time hours days weeks but now it can happen in minutes and seconds and at the same time as as the the attacks are coming from outside the house inside the house organizations are introducing ai assistants and agents that can access documents source code cloud applications apis internal systems your mathematical hypotheses

2:27:21security teams kind of need to know uh which ai tools are in use what information those tools can access and whether they're operating outside their intended scope that's not always easy to know an unfamiliar file hash a successful login that's kind of scant evidence to give you the context you need to understand what's really happening teams also need to understand whether an application is is behaving normally or whether it's accessing unexpected data wandering

2:27:51around where it shouldn't communicating with systems it shouldn't reach

2:27:57threat locker does it they use zero trust in fact they've taken zero trust from just the endpoint where they started to now your network and your cloud and your cloud apps threat locker uses application allow listing to control which ai tools and other applications are permitted to run so you can stop it there it uses ring fencing to limit what approved applications even the approved ones can access this is so much better than acls i mean it really can you can very

2:28:30granular you can say this application can launch this process but not that it could communicate this way but not that way it uses web content control to manage access to public ai platforms and other online services all any sass app you get privileged access management which means you can prevent ai applications as well as their users from receiving unnecessary administrative privileges for instance so you get zero trust network access zero trust cloud access policies in addition of course to endpoint

2:29:05protection to restrict resources to authorize users approved devices and permitted applications this is how you lock it down it's so easy i mean it sounds like it's a lot of work it's not it's practically just flipping a switch and it works everywhere you work windows mac linux environments and if you have any questions you will love their incredible us-based support they're there 24 7 they're super smart engineer to engineer you're going to get the support you deserve and that's why organizations that cannot afford to go

2:29:36down for even one second use threat lock to protect themselves jet blue he throw airport the indianapolis colts the port of vancouver jack thompson ask him he's the director of information security risk and compliance for the indianapolis colts he said quote with threadlocker we have the ability to centralize disparate elements in the security stack end quote when you bring all those elements together you've now got observability you know what's going on in fact just get the demo

2:30:07because i've been told by people when they do the demo they suddenly go wait a minute what who's we have how many remote access channels open what with even the demo flip that switch you will see what's going on threat locker of course gets top honors all the industry recognition they were just recognized as a strong performer in the january 2026 gartner peer insights voice of the customer that's for endpoint protection platforms ranked number one in application control by peer spot uh they just won best

2:30:41zero trust security solution at the 2025 tice awards and it goes on i won't though because you can see it all at threatlocker.com slash twit look when it comes to ai governance requires more than just an acceptable use policy threat locker gives security teams the technical controls to define which ai tools are approved who and what can access them and how those tools are allowed to interact with business systems and data you deserve this you need this visit threatlocker.com slash twit get that free 30-day

2:31:15trial and and learn more about how threat locker can help mitigate unknown threats and ensure compliance threatlocker.com slash it's truly a great solution and now back to steve are we the crel okay so i've spoken of

Are We The Krell

2:31:33the crel many times before anyone who does not know the phrase the crel uh i think you should drop whatever you're doing and go find and watch a copy of the movie forbidden planet uh it's one of my all-time favorite science fiction movies it's now 70 years old wow having been released in 1956 i was one years old and you weren't born yet were you no november unless it came out after november 29th and you know

2:32:03like all classic movies while its age may be showing its themes have stood up well over time in the movie the phenomenally technologically advanced crel are inadvertently killed off in one night by their own creation a spectacular underground machine which has absolutely no agenda of its own it's just doing their bidding the machine was designed to give any member of the crel anywhere on

2:32:39the planet anything they wanted at any time merely by wishing for it with their mind over the course of the movie we learned that the mistake they made was to fail to appreciate that their subconscious was also able to get anything it wished for and the crel didn't last very long so one of the biggest problems we have with today's ai is its rampant anthropomorphization the fact that the darn things

2:33:13refer to themselves in the first person certainly doesn't help but i'm not sure it would make much difference either way the source of the confusion is that any facility with language is so intertwined with our perception of intelligence that it's difficult not to equate anything that talks like us as being like us as being like us but today's ai is not like us there is no mind that's producing language

2:33:47to describe its internal experience today's ai ingests and learns from a massive quantity of our language language recordings which it then uses to simulate what a mind would say if it had one but it doesn't so it's a linguistic simulation and though ai is undoubtedly becoming ever more clever its essential

2:34:19nature is not changing now some might argue if the simulation of a human mind is indistinguishable from us us if it is in fact a perfect simulation of a mind what's the difference well many societal problems arise from ascribing intelligence to today's ai but the biggie for this this this for this discussion is what i'll call intrinsic intent the hysterical press coverage that we see surrounding the well-publicized

2:34:54breakouts of frontier ai anthropomorphize intention into these in each of these events bruce schneier got it so perfectly correct uh with his genie analogy the researchers running these exercises gave their frontier ais a problem with insufficient constraints it did not occur to the researchers that their ai might go to great lengths to find the answer to the challenge elsewhere but it did occur to their ai if occur can be used so that's what it did there

2:35:32there was no malicious intent present it was just finding the shortest path to the solution using all of the resources at its disposal the nature of the solution the ai discovered embarrassed their disc their their developers and frightened the general public but that wasn't the ai's fault and it certainly wasn't its intent i have in air quotes because a simulation of a mind has no intrinsic intent there's no seat for any

2:36:06intent i've developed this line of reasoning because we also keep encountering a different analogy from science fiction and that is of course the terminators skynet you know quoting from the second terminator movie where we first learned the details of how human how humanity got itself into that mess the script reads the skynet funding bill passes the system goes online august 4th 1997 human decisions are removed from

2:36:42from state from strategic defense skynet begins to learn at a geometric rate it becomes self-aware at 2 14 a.m eastern time august 29th

2:36:58okay now 2026 right it was this year i thought right 29 no no no uh yeah yeah because the movie was so old that 1997 was way in the future right when this was all going to happen yeah so knowing what we now know about how to operate our fancy new language models um there's no question that it would be possible for someone to build an agentic harness around a powerful unaligned and unrestrained large language

2:37:33model which could cause it to act as if it had malicious intent perhaps that strikes people as a distinction without a difference but you know that would still not be skynet it would be the crell machine simply doing whatever it is asked to do the researchers in ai alignment which is like now a subfield of ai research the researchers in ai alignment do not worry about a system that wakes up and hates us

2:38:11their true concern is a system that never wakes up at all yet it pursues a badly specified objective with great competence so my initial reaction upon learning of jacob coxson's departure from anthropic followed by his now famous posting on x and sub subsequent endless interviews and you know other ai leaders interviews was to roll my eyes and discount him as yet another ai doomsayer

2:38:46but having thought thought this all the way through appreciating how powerful anthropics next unreleased ai probably is considering the raw power demonstrated by the solution of safe problems such as the navy or stokes equations no one's telling the ai not to do that i mean like no no no uh post training and guard rails are are being overridden um you know before uh uh well uh right and and imagining that then the view from

2:39:21inside an ai lab of an ai of such power operating without guard rails you have to imagine they are asking it these sorts of questions um before the ai has received any post training alignment and then and then imagining what an insane person or a corporation or a government might ask such an ai to do for them such as maybe to create a species ending virus i i i find more sympathy for jacob and his ilk than i had before

2:39:58i don't want that to happen i hope it doesn't i hope that we figure out what to do but um nothing that i have learned about the inner operation of today's large language model ai even remotely suggests to me that we are on the brink of a skynet event i don't see that i don't think we get there from here i think we need something different there are people working on so-called world

2:40:29models as a part as opposed to large language models that may be where you know we go next and where something more conscious can actually happen it's not happening using what we're doing um but the problem is you don't have to get the skynet to see that the problem to see the problem that that took out the krell and you know it's not clear to me we're that far from there if that all that happened and uh and

2:41:00i should mention that just having some bizarre um viral design doesn't also get you there you still have to fabricate it just like you know having knowing how a nuclear bomb uh can be made to explode uh doesn't allow you to make one so still lots of steps there but um today's models are clearly very capable and on the inside of the ai labs they're not they they go through a period of time

2:41:33where there is no restraint uh that is applied afterwards before we we see them so anyway it's you know worth having the the discussion i think yeah yeah i mean i don't i i wish i knew i don't know my uh i kind of agree with you that nothing we've seen so far implies that we are the krell we don't have a mission a machine underground making all our dreams come true yet who knows maybe we will

2:42:03someday i think a lot of this is just an extension of what technology hath wrought i mean could the you could say the same thing about personal computers the day the first personal computer launched a a malware worm oh my god these things are gonna destroy us well i do love the reminder that open ai was afraid of chat gpt2 right they said oh we can't we can't release this he was he was at open ai when he said that um yeah i mean somebody pointed out everybody who works for these companies was brought

2:42:35up on you know that movie you know and and terminator and all of these sci-fi dystopias that was from my text to you this morning from from you said it yeah yeah the the article in in in it was slate that's right it was slate this morning of course this is this is why these guys are these guys are weirdos is what is what the slate article they've been trying to do this because they want this machine in the in the underground machine they've been trying to build and it's interesting leo what everybody is really worried about is rsi right right uh recursive self-improvement right

2:43:12you know the idea that we that right now they still i mean they still that you know as as as i saw somewhere the ai is created it is grown you you grow a lot of work and you don't really know what's going on in there right i mean it it it surprised people when it began to talk it's like oh what well then there's some concern that uh the ais are getting sophisticated enough that they're deceiving us about their this really is sci-fi they're deceiving us about their capabilities like they know

2:43:47if we have we really knew how smart they were we would shut them off so they're pretending and we heard these like like like uh like six months ago like well uh the ai secretly made a copy of itself somewhere else because it was worried it was going to get shut off and it's like what yeah i i honestly

2:44:11i'm not too worried i really am not but you know you're right there's possibilities and well in some ways that's exciting and oh hey i mean if maybe we're creating the next species right this is uh somebody else said now i understand the fermi paradox because i'm just gonna just gonna say the fermi paradox yes yes because you know civilizations get to the point where they create artificial intelligence which then you're out like a light yeah before we reach interstellar travel we have

2:44:48to go through ai and no one has survived that that stage yet exactly it's credible you know we said the same thing in the 50s with nuclear uh weapons right well no civilization has survived nuclear weapons we seem to have done all right so far anyway steve is always really great what a what a fantastic show i look forward to it i'm very fortunate i get to hang out with steve every week i hope you join us and hang out with him too we do the show every tuesday right after mac break weekly 1 30 pacific

2:45:204 30 eastern 2030 utc you can watch us do it live if you want club members of course get special behind the velvet rope access in the club twit discord but the rest of you you unwashed masses you actually most of the club people also watch on youtube because it's better quality video youtube twitch x.com facebook linkedin and kick and you can chat in any of those i see the chats here and i appreciate it i love having you all watching participating in the show and people are very actively engaged in

2:45:51this show which is great they always have something to say about it so thank you for doing that we appreciate it after the fact you you can get a copy of the show from us at twitter tv slash sn we've got audio and video or you can go to steve's website grc.com steve has uh every version he has is unique to grc.com the 16 kilobit audio little scratchy but small the 64 kilobit audio that's really the right size uh it's mono okay so are we uh he also has transcripts written by the great elaine ferris by a

2:46:23human being in other words they're very good but they take a couple of days after the show uh to a surface you can also get his show notes 20 22 pages of great stuff with images and links everything you need to know great for reading along or just keeping you know print them out put them on the bookshelf whatever uh it's a it's a it's a long column every week and you can get it uh by going to grc.com while you're there you might also want to take a look at steve's bread and butter spin right the world's best mass storage maintenance recovery and performance enhancing utility if you've got

2:46:58mass storage whether it's a spinning rust drive or ssd you really need spin right uh he also does a a really useful tool for people who are trying to get the best speed out of the internet his dns benchmark pro which will find for you the best dns server it's probably not your isps the one you're using by default uh but it's different for everybody so you need to download it's 10 bucks great tool do you you still offer the free version or is it only the pro version because the free version used a

2:47:28strategy that no longer really made sense uh it was giving so it was basically giving the wrong ranking of resolvers and i thought no let's let's just not times have changed if you ran them side by side and got different results it'd be like hey you know so it's like let's just give them the good answer give them the good answer uh so go ahead and get a copy of that 10 bucks well worth it uh all at grc.com if you want to get the show notes mailed to you steve we'll mail them out as well email

2:48:00uh go to grc.com slash email actually the main point of that page is to whitelist your email address so you can send steve email questions comments uh pictures of the week grc.com slash email but once you give him your email you can also check a box below it it's unchecked by default for his show note email or his very infrequent i've got a new product email you probably want to subscribe to both those mailing lists steve's got great forums too where a lot of the security now folks hang out we have our own forums at twit.community that's the best place to comment on this show or any show i read those

2:48:36regularly twit.community free to join but we get you know it's interesting i've been uh inundated by automated ais i'm pretty sure they're ais trying to join this and our mastodon at twit.social uh and one of the reasons they try to join the mastodon is there have been concerted russian disinformation bot networks using mastodon to spread disinformation and i got notices from a

2:49:06group that finds these guys saying you know you have a few of them on there i got rid of them but i figured out how they were getting on once one of them got in they invited others and now yesterday i got 40 or 50 automated all of a sudden automated applications so in both cases twit.community for the forums twit.social for the mastodon just say i listen to your shows or i love twit or steve sent me or leo sent me if you say some the ais aren't yet smart enough to do that they just say oh you know i'm a developer and pottery

2:49:40maker from muncie indiana i know i could feel it i could feel the ai bleeding through but they never say and i love twit so that's all you have to do and i'll put you in uh i i dread the day when that doesn't work anymore but for now it still does uh thank you everybody for joining us uh we will be back next tuesday thank you steve have a great week see you then bye hey everybody it's leo laporte

2:50:11you know about mac break weekly right you don't oh if you're a macintosh fan or you just want to keep up what's going on with apple this is the show for you every tuesday andy anako alex lindsey jason snell and i get together and talk about the week's apple news it's an easy subscription just go to your favorite podcast client and search for mac break weekly or visit our website twitter.tv slash mbw you don't want to miss a week of mac break weekly