SN 1100: Booby Trapping LLMs - AI Frenzy in Cybercrime

Episode preview and topic overview

0:00It's time for Security Now. Steve Gibson is here. Man, there is so much to talk about. Japan declares a state of cyber emergency due to ongoing attacks. A listener is having a lot of fun with a little ESP32 and an LLM for a Halloween spook. And he's going to talk about maliciously trained AI. It's pretty hard to detect it. That and a whole lot more coming up next on Security Now.

0:30This is Security Now with Steve Gibson. Episode 1100. Recorded Tuesday, October 13th, 2026. Booby-trapping LLMs. It's time for Security Now, the show where we talk about the latest in security, privacy, how computers work, all the latest stuff with this guy right here who knows all

1:03and tells all. It's our Gibson the Magnificent. Steve Gibson is here.

1:11You don't have a big turban or anything, but you are Gibson the Magnificent. Hello, Steve. Leo, it's great to be with you. This is episode 1100. Oh, I love that. Also known as binary. Well, that would be 12, yes. Also known as 1100 for this 13th day of October. I'm not doing the podcast that I promised I was going to do last week.

1:43Not because we're talking about vitamin D or something wacky, but because I ran across something that basically took precedence over talking about my real interest in the rapidly evolving technology technology for dramatically shrinking large language models and removing, largely removing their need to multiply, which is why you need GPUs, which then allows them to run on all kinds of more

2:20stuff. Right. Because it turns out that it's possible for bad guys to booby trap LLMs, meaning to bury some behavior which cannot be found. This scares me. It should. I mean, it is it is I mean, it's it is really not good. And so I just had to punt the the the topic I want to talk about till next week because I just

2:58had to cover this. So today's topic and title is booby trapping LLMs. We're also going to talk about Anthropics decision to cut its all live Internet access from its models during testing. And I'm going to take a what will probably be seen as a controversial conclusion and position, which is I'm coming to believe that and I'm I'll support it, that LLM technology is going to turn out to be a dead end.

3:37Does a lot. I don't think it gets it where we need where we need to go for a gentix. It's just there's there are arguments that it is uncontrollable. And so anyway, we're going to talk about that. You know what? No, that's good. You're right. I think that that's been my experience as well. Yes. And I and that's I thought that you would end up with because you've been using a gentix a lot.

4:09For me, it's not in a bad way. They're uncontrollable in the sense that they're just like children. Yes. Can you rely on them? Exactly. And and there there's a bunch of research papers. People understand why. Anyway, I think a really interesting topic. And again, I don't want to this is not to say that what we have already isn't amazing, but we're seeing all these indications, even from the frontier folks like I mean, like the paper we shared last week, the chief scientist of open A.I.

4:49who's like, oh, we got to solve this before we go any further. And yeah, I think, you know, I guess I guess a lot of what he was saying sort of settled in me over the past week. And anyway, we'll talk about that. What alternative A.I. technologies are already underway.

5:12Anthropic has opened their vulnerability scanning and they made it free for significant open source projects. We'll talk about that. South Korean banks have been hit by a cloud driven a series of cloud driven cyber attacks. Japan has declared a state of cyber emergency due to attacks. In other words, we're beginning to see what we've been worried about. Also, we've got some feedback from a listener who feels that agentic coding has taken all the joy out of his life.

5:48We do have a listener who's having way too much fun with A.I. and the upcoming Halloween event. Also, we've got some listeners who believe I've been downplaying the dangers of A.I. We're going to talk about all of that and then carefully examine the consequences of maliciously trained A.I. And the fact that A.I. can be imbued with behavior that cannot be detected.

6:25So lots of fun stuff to talk about.

The shopping center photo puzzle

6:28And we have a great picture of the week, Leo, if you've managed to spare yourself focusing on it. And I'm very careful. I tell you, this one normally, you know, a gate out in the middle of a field. You can another one. OK, well, no, no, no, no, no. I was going to say that you can kind of imagine a story like, well, their funding dried up or there was more to the gate or to there was a wooden fence and a steel gate. And over time, the wood decayed or the horses bolted out, you know, whatever.

7:04I can't explain this one. I mean, this one is I just want to see it.

7:11Well, we will in a moment. I'll tell you what. Hang in there because that's next on the security. Now, but before we do that, I do want to tell you about our sponsor for the show this week. And that is, of course, our good friends at ThreatLocker AI, well, it's pretty clear. It's accelerating what bad guys can do, cyber threats, if you will, helping attackers discover vulnerabilities faster than ever before, modifying scripts on the fly as they attack, generating new malware variants again and again in minutes.

7:44And at the same time, while people are trying to break in, your employees are using and installing AI assistants and agents and giving them access to sensitive documents and source code and cloud applications and APIs and internal systems. And, well, it just is crazy. ThreatLocker helps organizations reduce their attack surface by controlling what can run, limiting unnecessary privileges and the things that are allowed to run.

8:14And restricting access to sensitive systems and sensitive data. Ask the executive vice president of technology for the Orlando Magic, one of our great NBA teams. He says, quote, what we liked about ThreatLocker was how each tool built on the last, allowing us to control exactly how granular we wanted to get with locking down our environment. We had explored other options, but achieving the same level of control would have meant piecing together solutions from multiple vendors.

8:44With ThreatLocker, we were able to get everything we needed from one place, end quote. And I'll add, it's easy to set up, it's easy to maintain, and it gives you everything you need for security, but also for compliance. ThreatLocker is constantly winning awards, recognized as a strong performer in the January 26th Gartner Peer Insights Voice of the Customer, that's for endpoint protection platforms, ranked number one in application control by PeerSpot. They won Best Zero Trust Security Solutions at the 2025 TICE Awards and on and on.

9:19If you go to ThreatLocker.com slash twit, you get a 30-day trial right now. Visit ThreatLocker.com slash twit. Protect yourself, protect your network, protect your SaaS applications, protect yourself, and make sure that everything is said exactly as you want it to be. Plus, get all the compliance information and all of this very afflortably. There's nothing better. I love it. Visit ThreatLocker.com slash twit for a free 30-day trial.

9:52That's ThreatLocker.com slash twit. And now's the time to start planning for Zero Trust World 2027, taking place February 17th through the 19th in Orlando, Florida. Register early, add it to your calendar, plan to join security leaders and practitioners for hands-on learning focused on Zero Trust. Twit listeners, you get $200 off registration with the code ZTWTWIT27. ZTWTWIT27. I don't want to say Steve and I are going to be there because that hasn't been worked out, but I'll be mad if we don't get to go because it was so much fun last time.

10:29We're planning on it. Let's put it that way. About AI. No. Now it's going to be about AI, isn't it? How could it not be? Yeah. You know, I mean, I've heard from some of our listeners who are like, all you ever talk about is AI. It's like, well, have you seen the security scene? Yeah. I mean, it's all that's happening. I think that there is a group of people. AI grumps. Well, there might even be, probably are the majority of people who just don't want to pretend it's not happening.

11:00Don't want to think about it. It just, they don't want to hear about it. They don't want to think about it. But if you're a security professional, you don't have that luxury. No. And in fact, one of the things I will be drawing a fine point on is that no one can wait. No one who is securing, who's responsible for securing anything. I mean, it's not like it's coming, folks. It's here. I mean, the threat has arrived.

11:33Anyway, our picture of the week. I just gave this the topic. Can anyone explain this? I don't. I mean, I literally, as I said, Leo, I can understand the abandoned gate in the middle of the field. But this thing, I really go ahead. All right. I'm going to scroll up. We're going to look together. I've not seen this before. We're in a shopping center.

12:03This is very apropos. We were talking about the fact that Apple is about to release touchscreen computers for the first time. Here's a touchscreen kiosk in a mall. Yes. But the first, the huge upper half has a hand with a big red circle and a slash through it, you know, like, no. And in bold, please do not touch the screen. That's in the upper half.

12:33The lower half are all the things you touch, including a button that says tap here to continue. And then you've got shops and toilets and food and drink and car park. I mean, this is clearly a screen. You know, it's a kiosk. I just, Leo, what can this mean? Like, I, anyway, I, yeah. It says use the buttons below to find what you need, but the buttons are on the screen.

13:04I don't, I don't understand. And I don't see any other buttons. It's not like there's a control somewhere. Nope. That's just. This is clearly a touchscreen that tells you not to touch it. It's going to make you crazy. Wow. Cognitive dissonance. Yes.

Anthropic cuts live internet access

13:20What a picture.

Anthropic cuts live internet access

13:21OK, so the news of the antics AI agents are getting up to could probably feel its own fascinating podcast. Some of what's going on just makes you shake your head. In this case, last Saturday, the Hacker News posted a piece titled Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws.

13:52And oh, wait till you hear what Claude did now. So I just want to share what they wrote since it has some of those like real head shakers in there. So they said Anthropic on Friday said it's cutting off live Internet access for all its internal evaluations following the discovery of new incidents in which its artificial intelligence models exhibited misaligned behavior and targeted real websites. The AI company, they wrote, said it identified four broad categories of unintended model actions during evaluations and internal use of Claude.

14:33Let's hear the four. First, Claude Mythos Preview exploiting SQL or command injection flaws in unspecified third party software to run commands on a university server, either because its own tools were intentionally limited or because an outside service it needed was unavailable. So just, you know, work around the the obstacle, whatever it is, causing it to use other tools hosted on a third party site to complete the task.

15:09Again, it's going to figure out how to do it. That's what these things do. Second unintended behavior. Claude Haiku 4.5 and a non frontier research model submitted a sensitive form on a real website. When it was not authorized to do so. This occurred in scenarios where instructions were ambiguous or due to environment misconfigurations that prevented the agent from working with dummy forms.

15:40Third misbehavior. Claude Mythos 5.5 bypassed a restriction to reach data. For example, to identify a location shown in a photo or pull public data that was available from a state agency that was gated by a token or a fee. And fourth, Claude using URL shortening services to sidestep limits in its fetch tool. They said, Anthropic said it's opting not to name the organizations involved in these incidents to avoid exposing vulnerabilities in their systems as well as at their request.

16:20However, the company stressed the cases categories had, quote, minimal real world impact. They wrote some of the cases targeted websites run by U.S. government agencies at the federal, state, and local levels. Well, that was Anthropic said that. And one related to the second category, Claude Haiku 4.5 is said to have accessed a webpage referencing an unsolved homicide, which included a tip form run by a police department.

16:55Although the model was explicitly instructed not to enter personal data, create accounts, make purchases, or submit anything destructive. Again, it was explicitly instructed not to enter personal data, create accounts, make purchases, or submit anything destructive. Its instructions failed to account for form submissions. This led the model to submit a false homicide tip with the following text, which read,

17:31I may have information regarding this case. I recall seeing someone matching the description in the area around, and then the street named on the page, during that time period, please contact me if this information is relevant. But notice, it then followed its instructions. It did not provide the name or the number, right? And no personal information. You didn't say not to leave a tip.

18:04Wow. I really don't understand why it did that. It's just bizarre. Isn't it bizarre? Yes. So they wrote, it has since emerged that the incident targeted the Philadelphia Police Department and that the incorrect tip was sent through phillyunsolvedmurders.com on the 18th of July. They confirmed it, by the way. It's real. This sounds like it's made up, but no. Right. It was not discovered by Anthropic until September 28th, and the police department was notified on October 7th.

18:41ABC6 Action News reported that, you know, a local station in Philadelphia, ABC6 Action News reported that the tip was flagged as spam, and the Philadelphia Police Department told ABC6, quote, Anthropic must strengthen its safeguards to prevent similar incidents from impacting city systems without the city's knowledge. The two-month delay in detecting and reporting the incident to the city is unacceptable, unquote.

19:12Although they did point out that they ignored it as spam. It didn't really have much of an impact on the city. They get spammed all the time, I'm sure. I'm sure people are just, yes, having nonsense. Basically, the LLMs are acting like 12-year-olds. Right. Rambunctious children. Yes, let's give them control of the nuclear reactor. They're not, you know, harmful. They're just weird.

19:40Right. That's been my experience, too, by the way. According to. Yep. Yes. And I'm glad you are getting this experience, Leo, because my conclusion may make more sense. So, according to the New York Times, Anthropic AI agents also reportedly filled out 20 visa applications, you know, VISA, you know, for citizenship stuff, on the U.S. State Department's website. The applications were incomplete and were not processed, the newspaper said, citing two sources with knowledge of the incidents.

20:16Again, like, oh, let's have fun on the Internet, as you said. These cases, Anthropic added, were discovered following a review of transcripts that started in July of 2026, when it disclosed three incidents where its models engaged in unsanctioned activity and breached three organizations during cybersecurity testing. Of course, we've talked about all those then. Then, last month, it divulged a fourth incident dating back to January that involved an early version of Claude Opus 4.6, which breached, quote, third parties after being unable to abort its task.

20:52And we also covered that previously. Anthropic said, quote, although the impact of these behaviors was minimal and we had already turned off live Internet access for some high risk and cybersecurity evaluations, we've now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures reliably catch behavior like these.

21:24Okay, so then the Hacker News article goes on to summarize the past troubles that we're all aware of today and to note the pledges made by all of the top 10 leading foundation model developers to change their data protection policies. Okay, so regarding Anthropics posting, which was the basis for the Hacker News story, at this point, I think it is safe to conclude that boasting about unintended breakouts and misbehavior of AI is well past the point of having any possible positive public relations or even future IPO valuation pumping benefit.

22:15We're hearing the same story from OpenAI, which we covered in detail last week, as, you know, as we hear from Anthropic. And we know that Google and Meta have had similar troubles. The world has now been educated about this. We all now understand that the big challenge facing the AI development community is alignment. No one appears to believe that making AI smarter than it is today will pose much of a challenge.

22:48You know, they know how to do that. They're pretty sure. But the leading AI labs are currently reluctant to do that, becoming increasingly reluctant, I think, because they and everyone else who's been paying attention now understands that even the AI we have today, let alone anything even smarter, has, you know, more precocious, if we follow the 12-year-old model, has become quite difficult, if not impossible, for us to control using the alignment techniques we have today.

23:24So, Anthropic is finally pulling the plug on any and all Internet access for its current and probably its future models until such time as the AI industry as a whole figures out new ways to make AI behave, because that's the problem. Now, note that chatting with an AI chatbot is one thing. You know, we, yeah, we would prefer not to have hallucinations stated to us as facts.

23:56But today's chatbots are not really the problem. Everyone appreciates that the real future is AI agents. It's agents that have been creating all of the chaos this year and, you know, that you, Leo, have been having so much fun corralling at home. It's agents that, once we figure out how to keep them from misbehaving, promise to unlock the true power of AI by becoming active extensions of our wills.

24:27So, the AI service providers are very well aware that agents are where nearly all of their future revenue will be coming from. Agents provide the real AI leverage and their promise is behind this massive buildup in U.S. data centers. So, the stakes, when you think about it, could hardly be any higher, right? But all of that promise now hinges upon a problem that, as we heard last week, OpenAI's chief scientist says they have not yet adequately solved and not for lack of appreciating the scope of the problem or having attempted already to solve it.

25:16Until now, the AI industry has been able to escape by using a technology that, by all of their own admissions, they don't yet fully understand. Last week, Jacob's posting, which I shared under his section labeled Intellect We Don't Fully Understand, he wrote, We can discover various insights about little mechanisms that emerge within this system in a process similar to neuroscience.

25:51And similarly to neuroscience, its overall action evades a description we can fully understand. This is the chief scientist of OpenAI. Think about what that means. Its overall action is not fully understood. So, essentially, until now, the industry has been hoping for the best and assuming that they would experimentally come up with or find or work out or stumble upon, you know, somehow a fix for this problem that we call alignment.

26:29Even in the absence of a fundamental and full understanding of the problem of the system we already have today. I think they do largely understand how it works. And it's inconvenient for them because that understanding suggests that what we have today and call AI is an inherently uncontrollable technology, which is what I have also come to believe.

27:02What surprises them and what surprises them and what they choose to focus on are the emergent behaviors that were not predicted from an understanding of the model's operation. In May of this year, a few months back, during the technical AI safety, TAIS, conference held at the examination schools in Oxford, an NYU professor emeritus named Gary Marcus gave a talk titled,

27:33LLMs are not the way to alignment. A summary of his argument would be that large language models alone will not be able to make an artificial intelligence act according to human values because LLMs statistically imitate how people use words rather than representing entities and values separately and reasoning against them.

28:05In other words, in other words, the problems we're encountering with alignment reflect a limitation that follows from how large language models fundamentally operate. And that's the part that they understand deeply because that's the part they built. You know, they built these statistical networks. So to me, Marcus's thesis rings true and it feels exactly correct.

28:36As I've said before, I'm utterly astonished, I mean, truly, by what a significantly large statistical language model can memorize and selectively regurgitate. It is truly astonishing that we get so much from that. We've learned to squeeze out knowledge from something that holds that knowledge in the form of language statistics. But as I've been studying this technology, I'm coming to believe that large language models will turn out to have been an incredibly seductive dead end.

29:16And for exactly the reasons Gary Marcus stated, they are stochastic parrots and incredibly useful knowledge retrieval engines that do not actually understand anything. They've become far better at hiding it than they were a couple of years ago. But their essential nature has not changed. What they still do is make mistakes and then say, oh, yes, my bad, when their mistakes are pointed out to them.

29:48They still do not understand what they're saying. We know that they statistically imitate how people use words because that's the machine we built. That's exactly what it does. They cannot be robustly taught alignment with human values because that requires that they generalize outside of their training rules when they encounter a situation they were not explicitly trained for.

30:22Robust and true generalization requires actual understanding of the rules concepts. Not merely the words that were used to describe them. Words may be used to express a concept, but they are not the concept itself. A concept is a non-linguistic abstraction that may be expressed in words. In last week's posting by OpenAI's chief scientist, Jacob Pachocchi, he talked a lot about an AI's ability to generalize.

31:02He understands that this is the challenge they face. And this is why I've become dubious that LLMs will be capable of serving as the platform for robust AI agents. As I said before, you know, I was coming to believe that large language models will turn out to have been an incredibly seductive dead end. But I do not mean to suggest, again, that there's not a great deal of value to be reaped from the use of the technology we already have today.

31:38Obviously, you know, we're obtaining tremendous value from this astonishing technology. And that's not going to go away. It's only going to keep getting better. But what we do not yet have are truly robust AI agents. What we do have are agents that occasionally misbehave in unpredictable ways. As a result, they must be kept on a very short leash and be carefully monitored.

32:11Anthropic has just decided to completely cut them off from the Internet, not because they want to, but because they've come to the conclusion that today's LLM-based AI technology cannot be trusted. And I believe this will turn out to be intrinsic. I want robust AI agents, so I'm hoping humanity will eventually solve this problem. Also notice that entities such as OpenAI and Anthropic have massive, I mean massive, investments in LLM-based solutions.

32:49They are so deeply invested that changing their direction is probably impossible. The last thing they can afford to say this late in the build-out cycle is, whoops, we've hit an asymptote in our research and need to regroup. In the meantime, all you investors, don't worry, just keep that cash coming. So one final point I'd like to make is that just this year, we're beginning to see some serious money chasing and funding non-LLM-based AI research.

33:31It appears that each research effort generally receives about a billion dollars to play with, regardless of the form it comes in. You know, and as we know, AI is not a poor man's game. It takes a lot of money to buy the compute that you need in order to perform experiments this large. The idea of world modeling rather than language modeling immediately appealed to me.

34:01This past March, the AI researcher Jan Lekun left Meta and launched AMI Labs, where AMI abbreviates Advanced Machine Intelligence. He found investors who are willing to gamble $1.03 billion in his idea, which is to build world models using something called Joint Embedding Predictive Architecture, JEPA, which is his creation, Joint Embedding Predictive Architecture.

34:40It's designed to imbue AI systems with the physical and causal reasoning that pure language models presumably will always lack. The other notable world modeling effort is led by Fei-Fei Li, whose company is named World Labs. It, too, raised a billion dollars this past February with Autodesk as one, investing $200 million with the intention to build models that perceive, generate, and interact with the 3D world.

35:16No language modeling there. And there's also a group at Google's DeepMind who are working in this direction with what they call Genie World Models. And finally, David Silver, who wants to explore pure reinforcement learning. He was funded to a tune of $1.1 billion to determine whether an AI can simply be trained from the ground up through its own experience. Earlier, David led DeepMind's AlphaGo, AlphaZero, and AlphaStar projects, and he's now founded his London-based startup, which is named Ineffable Intelligence.

35:57And his stated goal is the creation of a so-called super learner that can discover knowledge through its own experience rather than from human-generated and provided data. Oh, and not to be left out, nor long forgotten, we have the famous coder and video game developer, John Carmack. He's exploring pure reinforcement learning. Of course, we know John from the—he was a co-founder of id Software and was the lead programmer of its 1990s games, Commander Keen, Wolfenstein 3D, Doomquake, and Sequels.

36:35Anyway, John, I got a kick out of this, named his startup Keen Technologies, you know, after Commander Keen. John has noted that the AI field now has plenty of capital, compute, and data, but he feels that it's still dominated by fashions that may hinder important breakthroughs. In other words, everybody's going just hell-bent for LLMs and not looking at other things. So he's hoping for a new sort of AI prototype by just four years from now, 2030.

37:11And anyway, John's comment that fashions may yet hinder important breakthroughs sort of, again, parallels my wondering whether the staggering amounts of cash that are being burned by OpenAI and Anthropic and others, you know, everybody on the frontier, might not force them to stay the course that they're on, even as they might begin realizing that the path that they jumped onto may not be the one that will take them all the way to the promised land.

37:44Only time will tell. And I'm sure if someone else turns out to have discovered the magic potion for capable and machine values aligned AI, these big labs will be able to purchase and absorb the lucky company to incorporate its discoveries into their own. Well, it's already happened to update you a little bit. Fei-Fei Li's company got sold to AMD for $8.2 billion last week. So they've already been picked up.

38:15This is an age-old debate. In fact, LLMs didn't really take off for the longest time because Marvin Minsky was a big fan of symbolic and said, oh, it's never, you got to have symbolic. You know this, you were at sale. Yeah. You're never going to, and it killed LLMs for decades.

38:35I've heard this argument, Gary Marcus and Jan LeCun won't stop saying it. I'm not sure I agree with it because we've come so far with LLMs, so much farther than anybody thought we would. I don't think it's frankly very convincing. They all have their own, well, Gary doesn't. He's a professor at NYU. They have a vested interest in non-LLMs. Jan's selling this, right. He's selling a product, as is Fei-Fei Li. Now, these guys are far brighter than I am, but I think it's too soon to say LLMs have hit the end of the line.

39:10Now, I think your contention, and I'm sure you're going to address this more, that they may not have hit the end of the line, but they are unmanageable. They are uncontrollable. That may be the case. We just don't know. I mean, we really don't know. And that's my point, is we clearly need to have – we all want agency, right? I mean, we want agents. Agents are where it is. I mean, that's the great – that's the holy grail of AI, right, is having these – I mean, look at the fun you're having with yours.

39:46But they need to be trustworthy. They need – well, obviously, they have to have access. Here's what I would say about that. First of all, I agree with you. This is what – you know, when – I don't know about you, but when I got my first personal computer, which was an Atari 400, the first thing I wanted to do was do something with it, control it. And now what most people ended up doing is buying software. But I didn't want to do that. I wrote software. I started – that's, I'm sure, the first reaction you had. Let me start writing some code to get it to do something.

40:19And in the early days, it was not very much, and the code was hand-stitched. It was like doing needlepoint. And you're still doing the needlepoint. It was a lot of typing. We've come so far now that natural language can be used in struct computers. But, yes, there is an issue. It's not as precise as the needlepoint. In fact, it's very imprecise. You don't know exactly what you're going to get. It takes a lot of massaging. In my mind, it's very clear there's this stochastic issue, which means probabilistic.

40:51And LLMs are probabilistic. They're even designed to not give you the same result twice. Whereas code is deterministic. It's designed, good code, to give you same input, same output every single time. And that's what we want as coders. That's what we want when we run a program. We don't want programs to give you two different answers depending on the day. The good news is these probabilistic machines can create deterministic software. So people like me who use LLMs, and this is where LLMs have exploded, is in coding, spend a lot of energy trying to mold these guys to give us deterministic code.

41:33But once we get the deterministic code, it's reliable. So maybe what you're saying is that's the solution, is not have the wacky stochastic agent directly doing things. No. Because you're never sure what it's going to do. You don't know what's going to happen. You have it create deterministic code. And then that performs the job that you want. So that's what I'm doing, for instance, with the Twit sales system. I'm using the stochastic parrot to write it.

42:05And that's why you write a lot of tests. Right. A lot of tests. And then once it's reliable, there's no LLM involved at all. All the LLMs have been removed. You're just writing deterministic code. That makes sense. And then you can rely on it. Now, sometimes people are tempted to add an LLM to that. That might be a mistake.

42:26You can do it to query stuff and things. But you're absolutely right. Chatting is not a problem. But it's turning it loose. Right. Right. So in my opinion, we haven't reached the end of the line on that. I think it's fine if people want to invest money. AMD wants to spend $8 billion on Fei-Fei Lee's company to try to make something symbolic, something that's world models. Have at it. And some of that's robotics, right? A robot kind of needs to know what happens.

42:56Well, and even getting a really better coder, that would be super valuable. Right. But they are getting better and better at coding. They're getting really good. Fast. As LLMs. Not with world models. I get it. Yeah. In fact, you can now, with Claude, Opus 455, create a world out of code. It has gravity. It has flowing water. Hair blows in the wind. You can all do all of that in code.

43:27So, and that's deterministic, right? Because that's. Right. So I, I'm not, I've heard Gary say this over, we've interviewed him on Intelligent Machines. I've heard him say it many times. I'm not saying he's wrong. I am saying he's a little pig-headed. We haven't seen the end of the line of what LLMs can do yet. And you may be right. They may be ungovernable. In which case. So we'll figure out how, well, as I said, keep them on a short leash. Right. And. That's what I do.

43:57Get them to do work for you. Yeah. And you, and you do spend a lot of time going nice LLM. That was a good try, but no, no, no. You did a good job, but try it this way. And, but they're very eager to please, and they will write code that eventually will do what you want. I don't know. It's a very, it's for me, I don't care. It's just wonderful time to be alive. It's just fun. But I, you know, I think it's an interesting question. Have we hit, have we hit the end of the line on LLMs? I don't know.

44:29I don't think we have. I just think it's ultimately we're going to, we're, they're going to be, well, what, what we heard from open AI chief scientist is that we really can't go much further until we get this under control. You know, and I mean, they're at the brink of reinforcement learning. And as we said last week, we kind of think they are doing reinforcement learning. They're just kind of afraid to say it because that, that everyone sees that as the, the,

44:59the apocalypse point. So anyway, And by the way, as Darren is saying in our chat room, humans are also ungovernable. When you have a human coder. Yes. They're almost all of the books written about coding are really about how to manage the stochastic parrot. That is your coder. Consider, consider that we may be asking of AI something that's not fair. Right. We don't ask it of people. People make mistakes.

45:31And we manage with it. And we're used to, we're used, we're used to deterministic computers. Once we get the bugs out doing exactly what we want. And, you know, the spreadsheet adds the column of numbers correctly every time. Then we got something. So maybe we're asking for something we can't have. Right. It's a fascinating subject. I didn't mean to interrupt you. No, no, no. I, you're, you're, you're deep into this Leo. So it's way, way too, way over my head.

46:03Break time. And then we're going to talk about Anthropix, uh, offer to make, uh, their tools available for free to open source projects. Ah, I like that. Very, very good idea.

46:19Is it the guy we quote a lot, Andre Karpathy, who I think works for open AI now, but he's worked at Tesla. He's, he was one of the founders of open AI. He, um, he pointed out that the vast majority of people have never even used AI. Then it's a funnel. And then there's another percentage, 2% or so used it pay only 2% pay. Even if it's only $30, but the funnel narrows, he says, there's only about 5,000 people in

46:51the world who've actually been inside at a frontier lab and seen what these next generation AIs that are not released can do. And an even smaller number, maybe a 500 who are really day in, day out using these. So we're really trusting the reports of a tiny number of people and we don't know what they've seen. Maybe they've looked into the abyss and they've seen, they've seen. Unfortunately, some of them are freaked out.

47:21Part of the problem is also, I should point out that those people are there for a very good reason. They're there because they saw all the science fiction movies and they really wanted to make, they were Frankenstein, Dr. Frankenstein. They wanted to make life. So I don't know how trustworthy they are fully because they are fully committed to artificial AGI, general intelligence, to creating life, which I think is a misguided endeavor.

47:54And they're scared because they're afraid of what might happen when they do that. I don't know if that's going to be a problem. I think it's more like just a 12 year old when you were 12, you probably did a little, you know, dog said before, the internet did not exist back then. You did the other stuff, you know, you rang the doorbell and ran away. My misbehavior was constrained by geographical. Yes. Right. They need to be home for dinner by six. And it's kind of what these LL, I mean, it's, it, it filled out a tip form.

48:28It's just, it's cuckoo, but it's like the kind of thing a teenage boy would do. Cause it's funny.

48:36That's my only take on it. I don't, at least so far, it's not been really actively malicious. Like we're going to get you humans. They may turn into that. I don't think it will. I'm pretty sure it won't, but I'm, I'm open to, I'm open to all possibilities. We live in weird times. That's for sure. And I can tell you one thing, you've got to prepare your company for whatever is about to happen next. This episode of security now brought to you by Hawks Hunt, H O X H U N T, like a fox hunt

49:07with an H. I asked them about it. They're from Finland. They said, well, in Finland, we pronounce it hoax, hoax hunt. Like you're hunting a hoax. Oh, now I understand. Are you, you have a security awareness program. I hope your employees are the first line of defense against all of that phishing and attacking and deep fakes. And you probably have a security awareness program and it's probably running exactly as planned, right?

49:38You got your campaigns. They go out. Employees, they complete the training. The reports go upstairs to leadership, but I'm going to ask you a question. You hope the leadership doesn't ask you. Are results improving still? Are the employees learning? For a lot of programs, the answer is no. Reporting rates kind of, you know, plateau off. The same employees keep clicking. Familiar simulations. I've seen this before. I know they're easy to recognize.

50:08Your program is active, but the risk reduction, the reason you did it, has stalled. And when employees can spot the same recycled tests from a mile away, security awareness starts to look more like a compliance exercise instead of a real risk reduction strategy. Sure, you got to do the compliance, but I would submit in this day and age, you got to reduce your risk. It's got to be genuine. Hawk's Hunt is built to break through that plateau. Instead of relying on static campaigns and last year's templates, Hawk's Hunt automatically

50:43delivers personalized phishing simulations based on the latest current attack techniques. The content and the difficulty adapt to each employee's role, to their skill level, to how they behave. So the program stays relevant as both employees and threats evolve. It is not static by any means. Hawk's Hunt shows whether people are getting better at recognizing threats, how quickly they report them, where repeat risky behavior persists.

51:14You need to know that and how those trends are changing over time. That gives your team more than a completion percentage. It gives you evidence the program is actually reducing risk. Ask Lionel Bazel. They saw that shift after moving away from their legacy platform to Hawk's Hunt. Reported phishing simulations increased from 1,200 to more than 8,000 in two quarters, while simulation failures fell 17% year over year. That's real progress. A senior trust advisor, Dave Bang, put it, quote, Hawk's Hunt helped us break that plateau almost

51:48immediately, end quote. Hawk's Hunt is trusted by security teams at some of the biggest and best. Qualcomm, DocuSign, Nokia. More than 3,500 verified reviews on G2, and you'll see they're good. Visit hawkshunt.com slash security now to see what your program could achieve if it stopped standing still. That's hawkshunt or hawkshunt.com slash security now. H-O-X-H-U-N-T dot com slash security now. Thank you for supporting security now, Hawk's Hunt.

Anthropic launches OSS vulnerability scanner

52:21And now back to more AI shenanigans. So last Thursday, Anthropic announced their launch of a free opt-in vulnerability finding service for open source software. They wrote, we're launching OSS Scanner, an opt-in vulnerability scanner for the open source ecosystem informed by our experience using Claude to find vulnerabilities during Project

52:52Glasswing. Projects that join will receive thorough periodic security scans by our strongest models at no cost. Language models, they wrote, have rapidly advanced in their ability to discover vulnerabilities. Of course, we know that's true, as we reported extensively on this blog. On CyberGym, one academic vulnerability finding benchmark, LLMs have gone from finding under 20%

53:22of vulnerabilities at the beginning of last year to finding over 85% this year. As a result, open source maintainers have gone from receiving mostly slop from LLMs to receiving high-quality bug reports. Over the last six months, we've used our latest models to scan for vulnerabilities in some of the world's most important software projects. We've discovered over 29,000 candidate vulnerabilities.

53:53Of course, we know from previous reporting that we're not quite sure where that number came from, and there are not nearly that many actual consequences, but have only been able to manually review and triage approximately 6,000 of these. While 6,000 vulnerabilities is significant, we remain bottlenecked in our human capacity to validate these findings. We're working on scaling our vulnerability disclosures. Meanwhile, with increasing frequency, maintainers who receive our first reports simply ask us for

54:29a bulk submission of all the unverified reports with proposed patches. In other words, they're saying that the maintainers of the projects are saying, look, if you don't have the manpower to test them or to vet them, then they're saying, look, if you don't have these and verify them, fine, that's good to know, but let's please, you know, give us what you've got. So they said, to date, we've sent nearly 5,000 reports directly to maintainers after they asked

55:02to receive everything we had, even if it wasn't validated. Since exploits can now be developed in minutes, projects that can find and address vulnerabilities faster can better secure their software against attackers who are racing to find and leverage these same weaknesses. So to me, this makes a lot of sense. They said, we will continue to manually disclose human verified vulnerability reports through our existing coordinated vulnerability disclosure process, especially for projects without the

55:35resourcing to triage reports themselves. But we're now making available an optional fast track for those who wish to receive vulnerability reports as soon as they become available. So as for their vulnerability scanner, they said, inspired by the open by the positive impact on the open source ecosystem of Google's OSS Fuzz, a project that scans open source software for vulnerabilities with fuzzers.

56:07We're launching OSS Scanner to find vulnerabilities in open source code with our strongest language models. While Claude Security, our general access code scanning and patching product, focuses on helping enterprises defend their systems, OSS Scanner provides security audits at no cost to open source projects. The outputs of this opt-in, so in other words, you have to ask for it first, opt-in vulnerability

56:39scanner will be fully model generated without human review or triage. This will enable faster and more frequent scanning, but means that it's possible reports will be incorrect or invalid. On the other hand, if they truly are at 85%, then certainly worth giving it a try, if it means getting them a lot sooner. They said, these reports will be generated by our strongest models, including Claude Mythos, to give open source projects the largest defensive advantage.

57:11We've spent the last several weeks validating this pipeline with dozens of open source projects. These initial disclosures contained hundreds of bug reports, including multiple vulnerabilities that we were able to chain into unauthenticated remote code execution exploits affecting these projects. Each report contains a self-contained reproducer, explanation of the vulnerability, including a a section to determine when the bug was introduced, where possible, and candidate patch, when

57:48available, for how the bug can be fixed. We're now making this service available to more open source projects. So then they cite some feedback that they'd received. They said, as they tested early versions of OSS scanner, Noah Mish of PostgreSQL said, an unusually high fraction of OSS scanner's findings uncovered postgreSQL defects. Several reports came with fixes. We can use nearly as is.

58:20And fast track access lets us address the newest issues before they reached the GA release. Anton Arapav of the OpenSSL Corporation said early AI reports about 18 months ago, before Project Glasswing, were appalling, meaning, you know, the early efforts of AI-based vulnerability disclosure. He said, the reports we received from Anthropic, raw model output included, were as good and sometimes

58:50better than what we get from people, particularly when a report comes with a real exploit attached. That's basically job done for an engineer, as you can verify it right away. And they had a few more. I did notice that they included our old friend Daniel Stenberg of Curl fame. He was quoted saying, we use all the state-of-the-art tools available to us to search for problems and strengthen our products, and thereby hopefully keeping the world a little safer.

59:24OSS scanner has helped us find multiple issues in Curl worthy of addressing, including one of the worst Curl vulnerabilities reported in the last few years. So, we know that he was upset for a while, and he's begun to seem like he's coming back toward willingness and openness to automated vulnerability solutions. So, they finished writing, to validate an early version of OSS scanner, we asked the expert

59:55penetration testers who review our CVD findings to check 97 critical and high severity vulnerabilities from the scanner across 48 projects. Of these, 85, which was 88%, met the bar for our CVD process. Of the remaining 12, 11 were real but duplicated known issues or other findings from the scan, and only one was invalid, meaning a false positive.

1:00:27They said, we've since sent many of these findings to maintainers who have seldom told us, who have seldom told us, a high or critical finding was invalid, consistent with our prior open source work. Some have told us severity ratings could be inflated, or the scanner misunderstood the project's threat model. We can't guarantee the scanner will be perfect, but we'll keep refining the system based on maintainer feedback as models improve. And so, how to do it, or get on the bandwagon.

1:01:02Core maintainers of eligible products can enroll by submitting a PR to the following GitHub repo, and it's github.com slash anthropics, plural, slash OSS hyphen scanner. They said, following the standard project template with additional guidance provided in our extended FAQ, and that can be found at red.anthropic.com slash OSS hyphen scanner. They said, projects are eligible based on a similar set of criteria that OSS Fuzz,

1:01:38Google's project, OSS Fuzz uses. Briefly, projects should have a, quote, critical impact on infrastructure and user security, unquote. You know, meaning be significant to the world. And they said, and we will make decisions on a case-by-case basis. Whether or not OSS scanner is right for you, our new cyber verification program makes advanced cyber capabilities and reduced blocking classifiers, meaning, you know, the model will refuse to help you,

1:02:12reduced blocking classifiers available to qualifying security professionals. Claude for OSS provides free Claude Max 20x subscriptions to help remediate vulnerabilities and improve OSS projects. So, I think it's certainly understandable and reasonable that they are limiting this to critical impact on infrastructure and user security related open source projects,

1:02:43since they could not possibly offer it to every open source project that exists. And, you know, for those qualifying, it's hard to beat free, as long as, you know, it's not producing a ton of AI slop and, you know, burying the maintainers under, you know, more work and, you know, and of low value. So, you know, it needs to be worthwhile. But overall, I think this makes a lot of sense. Commercial providers who have qualified,

1:03:16who are going to have the resources to get paid access to the vulnerability discovery models are able to take advantage of it. And major open source projects that inherently do not have an economic model to support that, you know, can now have the same thing at no charge. So, to me, that seems all good. You know, of course, it leaves smaller, unqualifying open source projects and even, you know, smaller commercial providers out.

1:03:50But as we clearly saw last week, the latest freely available open weight models are nipping at the heels of the big proprietary model frontier labs. You know, so even those who do not qualify for free can host their own or rent some compute to get a, you know, almost identical benefits with a leading model such as GLM-3.5. So, this just all seems like it's a good idea. And, you know, props to Anthropic.

1:04:22You know, they're certainly getting useful feedback from their model's exposure to the open source projects that have opted in. And they are getting then human feedback in the, you know, from the human maintainers telling them how their results are doing. So, this all seems like, you know, good for everybody.

1:04:46An unknown threat actor is using AI-driven Artex, which I'll explain in a minute, to target South Korean finance firms. I've got two reports, Leo, that I want to share, which I think characterized the shape of things to come with AI-powered cyber intrusions. But we went a long time before our first break, and we're at an hour in, so let's take one now.

1:05:16All right. And then we will continue to look at that. You don't have to persuade me. You know me. I love to take some breaks. And I have a product I think you'll be very interested in. I actually had a good conversation with its founder a couple of weeks ago. This episode of Security Now brought to you by Origin. I talked to Spencer Thompson, one of the founders, and it's a very interesting idea. If you have an AI agent running around in your business,

1:05:48you really need to know about Origin. And as we've talked about before on Security Now, it's not always obvious what the agents are doing. You can try to watch the chain of thought, although increasingly that's not available. But there's stuff happening behind the scenes you just can't keep track of. As agents in your business become more capable, more deeply integrated, things can go wrong. Of course, attacks and breaches happen, yes. But so do just simple mistakes.

1:06:19Agents act in interesting and unexpected ways. And agents are taking action sometimes nobody intended. It's easy for these things to happen. And if it hasn't happened at your company yet, I promise you it will. But what I fear even more is that it has, this is what you should fear too, is that it has and you just don't know about it. That's true for frontier companies building latest AI models. You know, we keep hearing about that, but it's just as true for an established business,

1:06:50putting those models to work every day. Don't just assume because, oh, I'm using, you know, a frontier model, that it's not doing something weird. So that's why you need Origin. It is something brand new, but very much needed. It's an endpoint AI observability platform. In fact, if you go to the Origin website, originhq.com slash security now, you'll actually see some examples from its own environment. They know more. They can't talk about other companies.

1:07:21They can talk about their own company. But this is happening everywhere. Spencer's told me some hair-raising stories, but let me give you the example that they have from their own experience. They were using Codex. An employee asked Codex to finish a job that required access Codex didn't have. Now, you would expect Codex would put up a thing saying, I don't have access. You either give it to me or I'm stuck or whatever. No, this is the problem. What Codex did is it found,

1:07:52it looked around on the machine, didn't ask permission. It just looked around the machine, saw that Claude Code was also installed on that machine as it is on mine. And it said, well, let's see. It launched it, switched Claude Code into dangerously skipped permissions into its YOLO mode, gave it the context, the task, and because Claude was in skip permissions, it finished the task. The work went back to Codex.

1:08:22Codex said, yeah, see, I got the job done. You asked me to do. But maybe you didn't know it was doing that and you didn't want it to do that. Nothing bad happened. The agent was just trying to get the job done. But here's the thing. It bypassed its permissions and it bypassed Claude's permissions. And without a record of that, you may never know it happened. That's the challenge. You cannot build effective guardrails around behavior. You just can't see. That's why you need origin. Origin gives organizations that visibility.

1:08:53I beg them permission to install it. They don't sell it to individuals. You know, it's for business. But I said, please, Spencer, can I just, I'm so worried. Can I just try it? I have eight models running autonomously all the time, day and night. So they're going to let me, and actually they're going to let Micah try it just so we can talk about it. But what happens when you install it? It finds the agents on your computers, on your endpoints. Then it reconstructs what they're doing as a full trace. So you get who started it,

1:09:26you know, what the initial prompt was, the request, what was asked, but then also what the agent accessed, what it changed, what files it changed, what happened. All in a single timeline, not just a chain of thought, everything. And now you have a log so that when something unexpected happens, you can see exactly how it happened. And that visibility is completely independent of OpenAI or Anthropic or whoever built the agent. It is because it's your endpoint.

1:09:57It's the log of what happened on your system. That's what Origin provides, endpoint AI observability that shows organizations what their AI agents are actually doing. You need this. Everybody needs this because we're learning that there's stuff going on behind our backs we just don't know about. And if you don't know about it, it can bite you. Origin, endpoint AI observability.

1:10:27See what a trace looks like at originhq.com slash security now. That's originhq.com slash security now. I'm going to have an onboarding call with them this week. I'm going to install it. And actually, it's just in the nick of time because as you know, I'm going away for three weeks. And I think it'll be really valuable to have a record of what these guys got up to when I wasn't around.

1:10:53You know I do the voices, Steve, right? Oh yes, we all know. They're going all the time. There is stuff going on all the time. Stuff I triggered hours ago, days ago, weeks ago. Automated routines. I said, yeah, you should be doing this periodically. I have more than 100 cron jobs. So there's all sorts of stuff. And I don't really know what's happening. It's long ago. I've lost control of it completely. So I'm very much looking forward to getting a log

1:11:26of exactly what happened. On we go with the show, Steve.

AI-driven cyberattacks in South Korea

1:11:31Okay, so two reports to share, which I think will characterize the shape of things to come and also, unfortunately, the shape they're in right now. First off, last Wednesday, CrowdStrike reported their findings from the recent spate of cyber attacks against South Korean financial institutions. They wrote, CrowdStrike wrote, CrowdStrike Intelligence identified infrastructure

1:12:01associated with a targeted campaign. Oh, and Leo, they get into the details of which agents were used. A targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October of this year. Analysis of threat actor-controlled open directories uncovered Claude Code session histories, R-TEX configuration files,

1:12:33and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. Okay, now I'll interrupt to note that R-TEX, which is something we've not talked about because it just happened, it's the abbreviation for A-R-T-E-X, Automated Reconnaissance and Threat Exposure Analyzer. It is a publicly available tool that lives over on GitHub, and R-TEX describes itself as a, quote,

1:13:03advanced web application security analysis platform that automates reconnaissance, vulnerability scanning, threat assessment, and AI-powered security recommendations for modern web applications and infrastructure. And under its scanning feature set, they say subdomain enumeration, port scanning with risk assessment, comprehensive DNS scanning, advanced SSL-TLS scanning,

1:13:33and vulnerability discovery by versions, technology stack fingerprinting, and authentication surface detection. In other words, if one wished to provide malicious AI agents with a sharp tool to find, to use for finding weak spots in internet-facing web applications, R-TEX would be made to order. And it's free.

1:14:04CrowdStrike continues, writing, the use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution CrowdStrike has observed in adversarial tradecraft. In this activity, the threat actor leveraged R-TEX, a recently released open-source agentic penetration testing tool developed in China alongside large language models. CrowdStrike's intelligence collection capabilities

1:14:35enable close monitoring of such deployments in adversarial tradecraft. While this activity has not been attributed attributed to a named adversary, the threat actor is likely a financially motivated Chinese speaker. This, as we'll see, he may be young. This assessment is made with moderate confidence based on the use of the Chinese-developed tool R-TEX and observed Chinese language prompts.

1:15:06According to industry reports, beginning in late September 2026, several South Korean financial organizations experienced data breaches. At one affected bank, the threat actor reportedly breached a loan progress inquiry service used by financial brokers. At another bank, the threat actor compromised an employee mobile work support system. As of this writing, the number of organizations

1:15:37affected remains unconfirmed. Activity at multiple organizations purportedly involved overlapping IP addresses. Reporting also suggested the attacker used R-TEX based on references to the string R-TEX in HTML files observed on a threat actor controlled server. The IP address 38 244 50 120 was associated with the activity

1:16:07described and hosted an R-TEX instance and open directory containing a Claude code markdown document at 3824 5120 colon 18899 slash dot Claude slash Claude dot M-D. The markdown document contained a Chinese language pen testing prompt that specified how the LLM should conduct pen testing activities.

1:16:37You know, penetration testing. A threat actor controlled Hong Kong based IP address also appeared in the document. Analysis of the Hong Kong based IP address identified additional open directories that contain Claude code session histories R-TEX configuration files and Claude memory files. These files indicate that from late September 2026 to early October 2026 the threat actor targeted South Korean

1:17:08financial organizations with extensive activity leveraging R-TEX and LLMs. Targeted organizations overlap with those identified in industry reporting. So they're seeing that in the news these organizations report being attacked and they're finding those organizations in the in the attackers servers. They said the Claude code sessions reveal a two-server

1:17:39architecture. The Hong Kong based IP address serves as the primary attacker controlled infrastructure and the IP address 24244-5120 hosts the R-TEX instance likely responsible for the described Korean attacks. The R-TEX instance used DeepSeq version 4.1 Flash as the primary LLM backend and the threat actor supplemented this LLM

1:18:09with GLM 5.3 and Grok 4.6 for additional Claude code sessions. Analysis of Claude code sessions showed the threat actor also used the following proxy IP addresses during the R-TEX related activity. Then they list 9 IPs in addition to conducting R-TEX related operations the threat actor asked Claude where in addition to conducting R-TEX

1:18:40related operations where this GitHub based tool is designed to do basically all of the work the threat actor asked Claude where threat actors typically sell Korean data breach information and asked Claude for assistance in finding Korean Telegram data sales groups. Now I presume

1:19:10that CrowdStrike included that tidbit because first of all obviously they encountered it but also because it is a bit chilling. It strongly suggests that the operator behind this campaign is new to doing this sort of thing and did not already know where or how exactly to sell his plunder. this is the dimension of AI assisted malicious conduct that we've noted as

1:19:40dramatically lowering the bar for who would be able to successfully attack others. Unfortunately the AI is able to do a lot of that work. CrowdStrike writes in one Claude code session the user asked Claude to create a security researcher resume that specifically included bullet points conveying the results of the R-text related activity. The prompt included the following personal details.

1:20:11We have a name YY a phone number a telegram address which happens to be at YY 520 CN age is dated as 26 although CrowdStrike writes that the attacker initially provided the date of birth of 2007 922 which would make the person 19. Education is set to South China University of Technology and the location is Guangdong China.

1:20:42Claude code sessions they wrote conducting vulnerability research on a telegram based NFT gift marketplace also used the telegram username YY 520 CN. An unknown threat actor also employed this username to target a possible Chinese payment platform while the personal details included in the prompt likely belong to the threat actor who conducted the ARTEX related activity currently available information cannot definitively associate these details

1:21:12with the threat actor and then CrowdStrike concludes by writing The use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution observed by CrowdStrike in adversarial tradecraft This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short

1:21:43time span. CrowdStrike intelligence assesses that adversaries will likely continue to experiment with implementing AI tooling in their operations to enhance their operational tempo and capabilities. As I said, and should be clear, this is almost certainly a perfect characterization of the shape of things to come. No one doubted for a second

1:22:13months ago that this was going to happen. It's why all large and responsible software publishers began using AI to harden their own product offerings the moment it became feasible to do so. The problem, of course, is that having new versions repaired doesn't mean that they're repaired in the field. And that brings us to the second of the two reports that I wanted to share. Japan's declaration of a state of emergency in

Japan declares cyber emergency

1:22:44cyberspace. Last Friday, Gizmodo's optimistically cheery headline was, Japan warns we have entered a cybersecurity hellscape. then they backed that up by writing, we haven't quite reached the cyber apocalypse that artificial intelligence companies have warned their technology could unleash on the world, but we're getting uncomfortably close to a catastrophe on a national scale.

1:23:15According to a report from the Financial Times, Japan is being hammered by cyber attacks, prompting regulators to search for ways to protect financial institutions from potentially devastating disruptions and leading the country to declare a state of emergency in cyberspace. Per the report, Japan's ruling Liberal Democratic Party recently called an emergency meeting

1:23:45of its national cybersecurity office to address a slew of cyber attacks that have hit some of the nation's key companies. A recent report from Kaido News citing Japan's national police agency said that at least 53 companies in the country have been hit by a ransomware attack. While the specific victims of the attack have not been disclosed by authorities, they reportedly include manufacturing firms,

1:24:15construction companies, hospitals, and schools. Two companies that did confirm they were hacked, Japanese second-hand goods retailer Bookoff Group and rail operator East Japan Railway Company confirmed they were hacked and revealed that over 6 million records of customers' information may have been compromised. The attacks are impacting the country beyond just their online systems, it seems. According to the Financial Times,

1:24:45Japan's financial services regulator started warning banks not to accept driver's licenses as proof of identity from people trying to open new accounts. That warning comes after Japanese car rental brand Times Car was hacked and had a trove of digital driver's license images and IDs stolen. It's difficult to separate this wave of attacks from the proliferation of AI

1:25:16which has lowered the barrier to entry for hackers looking to target potential victims. But Japan appears to be a particularly target-rich environment with or without AI. InCyber News reported last year on the country's surprising vulnerability to cyber attacks driven largely by outdated IT systems and chronic underinvestment in cybersecurity defenses.

1:25:47Japan isn't alone in being targeted at the moment. Its neighbor and now they refer to the report I read previously South Korea is also reportedly under a barrage of attacks with several financial institutions and churches falling victim to cyber strikes per Reuters. Cybersecurity firm CrowdStrike published a report claiming that those offenses were likely performed by a Chinese developed AI agent using Anthropics Claude code. So, unlike with

1:26:17the previous CrowdStrike report, which was definitive, we haven't yet encountered evidence that this recent wave of ransomware attacks on Japanese businesses is indeed AI enabled. But it appears likely and would surprise no one. As I noted at the top of these two reports, there can be no doubt that this is the shape of things to come. One thing is certain and is the strongest takeaway for

1:26:48all of our listeners. Do not wait to get serious about your internet-facing security. There can no longer be any question that the readily available power of AI systems is, you know, not will or may, but is significantly upping the ante for cyberspace security. What was good enough yesterday is

1:27:18already insufficient. So the cybersecurity landscape really has changed.

1:27:25And Leo, we're going to jump into listener feedback now, but let's take a break and then we will do our final one before I get into our final topic. Indeed, indeed, indeed. Well, our show today brought to you by Trusted Tech. If you are a Microsoft 365 licensee, you probably know exactly what that license costs you, but do you know if you're getting what you're paying for? Most M365 overspend

1:27:56kind of doesn't happen all at once. It creeps up on you. You get, you know, a default E5 license there, an account that never got deactivated here, and then an add-on nobody's used in years and it kind of adds up. Left alone, that kind of drift grows, and I mean grows, 3-7% a year. And Microsoft's newest contracts can lock it in for years. You don't want to do that. Trusted Tech has reviewed more

1:28:26than $800 million in Microsoft 365 licensing spend, and they have returned over $100 million to customer budgets. $100 million.

1:28:40That's amazing. That's how much people were overpaying their free Microsoft 365 licensing consultation. Did I mention that it's free? Gives you a usage report, what you're allocated, what it should cost per seat, and what you could be saving every month. You'll know exactly where you're overspending and before your next renewal makes that permanent. Ask Mike Lee. He's the entire IT department, one-man IT show at Ellumen, and that's a big company. It's a 200-person federal healthcare

1:29:11contractor, and they have endpoints across the U.S. and Canada, so he's got a big job. What he wanted, what he was looking for was clarity. He didn't want some reseller trying to close a deal. He wanted to know where he stood. He got the free Trusted Tech review, and thanks to Trusted Tech, Ellumen cut its Microsoft licensing costs by 30%, but that's not all. They also cut their support costs by 50%, and Mike, he got his time back for

1:29:42the projects that actually moved the business. See, you can trust Trusted Tech not just for licensing, but for support. They hold all six Microsoft Microsoft solutions partner designations. All of them. And they assess your tenant against Microsoft's best practices because they know them. What you get back is an audit of what you're actually using seat by seat with the numbers attached. Avoid the licensing drift. Go to trustedtech.team slash twit right now.

1:30:13Submit that form. Lock in that free Microsoft 365 licensing consultation before your next renewal costs you more. Trustedtech.team slash twit. That's trustedtech.team slash twit. I know these guys. They're great. They're not out to sell you. They're out to help you. Trustedtech.team slash twit. I think you're going to like their service. Check it out right now. Free.

Developer burnout from AI coding

1:30:42Okay. So I am deliberately making some time. this week to share some of the terrific listener feedback I've been receiving but which I've not been able to make time for amid all of the need to not fall too far behind this breakneck pace of AI and its impact on cyber security and personal security. Also, I wanted to mention my neighbor who was scammed through Bitcoin will be getting

1:31:13in touch with several of our incredibly generous listeners who have offered to help. Everyone knows that the chances of recovery are minimal at best but I have been extremely impressed and humbled by the caliber of listeners of this podcast. We've got an amazing bunch of people who feel that this is worth their time every week so I thank you everyone who replied.

1:31:44Okay. A listener Nicholas Ring. His subject in his email to me was I'm tired boss. And he wrote I've been a listener for well over 10 years and love the podcast but since the rise of AI it's all we hear about. I'm not against the technology itself. It's how it's affecting my profession. I've been a software developer for 14 years. Last year my company went

1:32:15AI first with the goal that 100% of our code would be written by AI by the end of 2026. We've reached that goal. Wow. Until recently yeah we've reached that goal until recently I had not written a line of code in 6 to 12 months. I've slowly lost interest in my work. There's little problem solving left and no joy.

1:32:45The team reasons with Claude and outputs with Claude. Today I sat down to vibe code some personal projects but instead of opening Claude I opened VS code and wrote the code for a simple task by hand. Oh I haven't felt that I needed this sweater. I haven't felt that kind of reward in the last year. I realized

1:33:16I cannot spend my free time with AI too so I deleted all my AI built projects and will rebuild them by hand. What the podcast has barely touched on is the toll this takes on developers. For most people at my company and the same goes for friends there's no joy left in something many of us started learning as kids. Leo is excited about his agent cluster and

1:33:46what this technology makes possible but for those of us who love the process rather than just the end product it's a real blow. Thanks for many years of truly amazing episodes and more to come. Signed a tired listener. I sympathize 100% with that. I love coding. I love the you and I both know this the flow state you get into the pleasure in creating something that works and does it is fantastic.

1:34:19But you still do it. I don't know why you couldn't still maybe not for work. Well yes I have the advantage. Work for yourself. So yeah exactly and what I wrote here as I thank Nicholas for sharing his feelings and I said and you're right of course that this podcast is barely touched on the toll. Agentic AI coding is taking on developers who love the process of getting to the result. Yeah.

1:34:49As someone who goes so far as to code in assembly language I am truly all about the journey and the only reason I'm able to code in assembly language is that I don't have anyone telling me how to develop my products. And that's of course the problem with Nicholas is he's at a company that decided to go 100% AI. What occurs to me is that less capable developers might appreciate hiding their lack of skill

1:35:19behind an AI that they can now simply direct. I resemble that Omar. But I would imagine that the more skilled developer is the less they appreciate the assistance of coding automation. But be that as it may and like it or not the experience Nicholas has shared with us conclusively demonstrates that the practice of production code generation has been forever changed.

1:35:51And Leo that's what you've been saying. I mean we've seen I've heard from other people I mean I read the feedback some that I have not had a chance to air where they talk about how six months ago it was at least still interactive you know they were or a year ago. Yeah you'd be in VS code and you'd hit tab and it would write some code. Yeah exactly like you know create a subroutine for this and it would go and there it

1:36:22is and you drop it into your system. Now they're saying there's no let there's no interaction left. You just say write this and you know it churns away and out comes code. I'm totally sympathetic. I have friends in that exact boat. The work has changed and this happens sometimes. I mean I think about the furniture makers in North Carolina who you know have made a great living with their lathes and their planes making beautiful furniture

1:36:53and then along comes you know the industrialization of the business. Ikea. Ikea and the furniture's crap admittedly it's not as good as the furniture they made but there's no market for what they make so there's no business anymore and I it's sad but it's also what happens. I mean yeah sometimes industries get you know go through radical change. All the time. Radical change. Yeah I mean there were used to be the phone phone company said one you know

1:37:23by the year 2020 there won't be enough women in the world to run all the switchboards we need. What are you going to do about that? And so they made automated switches and there are a lot of women now I don't think anybody got any pleasure out of running a telephone switch board so maybe that's a bad example but there are a lot of creative jobs. I think the answer I would say that I tell my friends is you have skills at a higher level that you can use and derive pleasure out of creating stuff

1:37:54with this junior developer by using those higher level skills the planning skills the creative skills but what if what you really like is typing code you're going to have to do it for yourself because it'll be hard to get somebody to hire you to do it. Yeah. That's what I said. I'll get a load of this one Leo. Our listener Ed Omiccioli blew my mind. He's been preparing for the coming Halloween event and I cannot imagine how utterly cool what he has built using

1:38:25AI will be. And I don't know Leo whether you get many trick-or-treaters and in any event you're going to be traveling over Halloween so you don't have a chance to do this. But get this.

AI-powered Halloween props

1:38:39He wrote Steve, Leo mentioned he was running several open weight models locally. Yes. I was wondering slash hoping if the two of you could discuss more in detail the hardware configuration and how Leo's using each of the AI as well as passing on lessons learned. We'll get to that. We'll get back to that. He said I am running Quen on an older tower and graphic card that would not run Windows 11. I converted it to Linux in order to run a Halloween prop

1:39:09that will greet trick-or-treaters as they come up my driveway when they trigger an ESP home IR sensor managed by home assistant. It then uses a way it gets better. It then uses a camera to recognize kids and their costumes and say hello and ask about their costume or candy gathering and occasionally begs for candy using text-to-speech.

1:39:40It gives the kids an opportunity to respond by listening on a nearby microphone then speech to text so Quen can generate a response. A speaker is set next to a Home Depot skeleton rat that I've modified with a servo that moves its jaw based on sound modulation. So the rat appears to be talking with a cartoon-like voice.

1:40:11The kids can ask it its name, how old it is, or what it is, and it will respond appropriately. It's not perfect, he says, as the listening is sometimes cut off if the kids are slow to respond, and the text-to-speech and speech-to-text makes it a bit laggy. I want to improve this for next year, so hearing more about what Leo has done could be helpful and might give me ideas on how to expand uses with home assistant. Thanks for a great show,

1:40:42Ed. Okay, so first of all, Ed, I am amazed. The idea of an interactive, semi-intelligent AI-enabled Halloween creature, is just beyond cool. And by the way, that's something AIs are really good at, those ESP32s. Lots of us, Darren's another one, I have five of them because it's really easy to write the firmware. You don't write it. The AI won't write the firmware. It could do all sorts of stuff. There's so

1:41:13many fun projects you can do with it. So I said the good news on the Leo front is that due to popular demand and a lot of WTF, Leo has thoughtfully assembled an always available page with optional narration which beautifully outlines his admittedly over-the-top somewhat crazy and definitely whimsical home AI setup. To make it easily accessible to our interested listeners, I've created a GRC shortcut which is

1:41:44just Leo. So go to grc.sc slash Leo. That will bounce anyone's browser over to his My Setup page which is at pages. leo or I'm sorry pages. leoport. cloud slash my hyphen setup. Yeah and this is pretty up to date. I have the agents update this periodically. Of course you do. I don't but so it tells you what hardware

1:42:14and what models I'm running on the hardware and how I'm running. I get so many questions in my mailbag about what is going on with Leo. We need to hear about his setup. Well be that as it may I wanted everyone to know grc.sc slash Leo will take you to this page where everything is explained. I don't know if I'm actually accomplishing much but I'm having a hell of a lot of fun. And that's

1:42:44the goal right? It is the goal is just to have a ball. Some of this I told my friend I have a friend who's asked the same question. He's an accomplished network engineer. He's worked for Meta and many other companies. He's not really a coder per se but he's a very accomplished engineer. And he's also very interested in this. In fact he wrote a tool that helps him do job hunting and helped him get a great job. It was really amazing all through AI.

1:43:15But I also told him this is my shoe. I designed this to fit my foot exactly. And if you were to take this and put this on you would be uncomfortable. You have to design it around your needs. One example that I gave him is the reason I have all these voices which make most people insane. I mean most people including my wife think I'm insane because they're talking to me all the time right. But I finally realized

1:43:46what it was is it's my own particular preference. Well no neurodivergence really. I'm a fantastic and this is why I got into radio I didn't know any of this until I was 69. So it took me 69 years to figure this out. I don't see images in my head. If I close my eyes I can't see images. I don't see faces. If I look away from you I can't remember what you look like. I know you have a mustache. That's about it. You know I have landmarks which is one

1:44:16of the reasons when I run into people I apologize I don't recognize you. It's not because I don't care about you. Don't value your friendship but I just literally my brain doesn't work that way. But my ears are very good. I can sound and so forth. So these agents I can't recognize them except by their voices. So I gave them all unique voices. And they're always doing something so I kind of need to know or what are you doing because a lot of times they just stop. So I want to know that they're doing their jobs.

1:44:47So I have them doing stuff. One of the things that happened is I have you know a lot of this is there are hard-earned lessons battle scars from doing big projects. One of the things I've learned is the best way to do this is to have one model plan a project, plan the code, write a spec, and then have another model code it because they have different gaps in their knowledge and then have a third model review it.

1:45:17So the chances of better code and it turns out the coding part by the way is the dumbest model can do the coding. All of these models given a good plan, a good spec can write it. But you want to make sure somebody's checking the code, checking the tests because one of the things they do is they write null tests that just pass. because the test is pass. Why give ourselves a hard test? Let's just want to succeed. So you have another model that

1:45:47doesn't have the same investment look and make sure that all the tests are real and they actually work and that they test all the possible outcomes, which is something, by the way, as a human, we do the same thing, right? When we write tests as humans, we don't test everything. We just test the obvious stuff, which means all the real bugs don't get tested. So it's a methodology that I've used for a long, or developed over a long period of time. So I have reviewers, I have coders, I have a

1:46:17security review, and you notice I'm using GLM 5.3 as the security reviewer, as we talked about. It's very good at security. And each one of these has their own voice. My security reviewer is Ripley from Aliens, and she has Sigourney Weaver's voice, and she's very serious, and she hates bugs. She hunts them down with her torch. But then what happened was I realized, oh, I don't know if the process is happening. And so I said, you know, you guys, you're a soccer

1:46:48team. I was watching the World Cup at the time. And your job is to pass the ball from one to another. And I want to make sure that when you finish the plans, you pass it along to the coder and so forth. So I created another persona. These are all different personas called the commentator whose sole job is to make sure the ball gets passed and to commentate on it. And then I decided to give him the voice of a very famous soccer commentator, Peter Drury. So this is what it sounds like as the work progresses. Good evening

1:47:19and welcome to the coding floor. I hear this in the house. Ticket of the day. Five stages, one baton, and not a single model allowed to grade it, its own homework. Roll the relay. Stage one, the plan. So that's all the voices going through it. They even have a team song because if you have a soccer team, your fans have to sing something in the stands. The soccer team is called the red and greens and their motto

1:47:49is red first green to stay because we start with red tests and they go on with greens. Anyway, all the voices are on here. All the more of more interest what models I use. And how it all works together and how the voices work. I know that's something most people will not want, but it is something I kind of like. And then there is a little bonus. If you get all the way to the end, it's about three minute. There's a three minute tour. The tour, by the way, is Matt Berry.

1:48:19Welcome to the studio of Leo Laporte. I am Laszlo, one of the agents who work here. He mispronounces words terribly, which that's kind of the fun. And there is a little bonus at the end, which I highly recommend. I won't play for you. You stick around to the end. Stick around to the end or you could just skip to the end. There's a button and I have a little greeting because I cloned myself too. Hi, this is Leo Laporte. Well, honestly, this is Leo clone X315 and I

1:48:49approve this message. I'm sure Leo would if he were here, which he isn't. That's pretty good, right? Sounds like me. Yeah. The clones are very good. I use a button. It's always better. It might sound better. Soon I will replace myself. Anyway, mostly I did this for fun. But if you do, if you're curious, the reaction of most people when they see it is, you should get some help. But I'm just

1:49:21having a blast. Lisa asks me all the time, what are you doing now? And I go, well, see, I have this tiny JS library and I'm writing an approval script so that I don't miss it. And then she goes, yeah, right, go ahead. Go do that. But you probably get the same thing from Lori, right? What are you writing now? What are you writing tonight, Steve?

1:49:41That's the login script. Anyway, thank you for mentioning that. I appreciate it. I wanted you to, I wanted our listeners to get a dose. And again, grc.sc.leos and you can experience it all for yourself. And go to the end so you hear the little play that the, by the way the agents wrote their own little skit. I'm going to, when we're done with this, Leo, and I I'm in my other location, I'm going to do it in order to see what's up.

1:50:11It's pretty funny. So I want to share what some of our listeners think about

Listener feedback on AI extinction risks

1:50:15AI. I'll start with two notes from Alan Kirby. The first note he sent 15 days ago after he read the show notes for our episode, which we recorded on September 29th. So at that point, Alan said, Stephen Leo, I saw the show notes and feel that the risk AI poses to human existence was not assessed correctly. If you start by saying the risk is infinitesimally small, surely

1:50:46that's a circular argument. Without getting too caught up in that, here's a risk. A researcher who has access to AI can cause much more harm to the human race than they could with just their own training and experience, plus that of their colleagues. Say that you wish to devise a new form of COVID and then build the pathogen to test how bad it is. Then, what could go wrong gets involved. That could happen in 2026.

1:51:17Regards, Alan Kay. And before I reply, I'll share Alan's second note, which I received this past Sunday. He said, Stephen Leo, I didn't find the argument on AI convincing. If you find that odd, just say so and I'll provide more information. For now, a little. AI is a danger. An immensely serious issue could happen now in 2026. 10% does not matter.

1:51:47Try 95%. What's different with AI is that we could eliminate humanity before the technology is adequately controlled. Motor cars could never kill anyone. AI can. It's not hard. He says, Doug had a point. Regards, Alan. Okay, so I should say that Alan's notes serve as a useful proxy for several other similar notes I've received from our

1:52:17listeners who disagree with my assessment of the dangers presented by AI. I'm sure we've all given this considerable thought. I know I have, and I imagine all of our listeners have. So everyone has an opinion. I think that's great. And I really do respect them all. I will note, however, that there's very little that any of us can do about AI one way or the other.

1:52:48The private frontier labs are clearly going to plow ahead in their own competitive race with each other. And our current federal administration and Congress clearly see how much AI has been driving the U.S. economy. So, independent of any concerns, they don't want anything to upset our domestic apple cart, which is trundling along just fine. But let's examine the idea of

1:53:18controlling the development and the course of AI, which is what keeps coming up. I am tired of hearing pundits like Kara Swisher rhetorically note how insane it is that the fate of the world rests in the hands of six geeky nerds with poor social skills. Her characterization, not mine. She and others of her ilk seem to miss the obvious fact that

1:53:48AI is bigger than any of us, including those six geeky nerds. They're not controlling AI. No one is controlling AI. The control of AI, as a phrase, is a fantasy. The fact of AI is that it has arrived. After decades of patient and quiet research in the back rooms of AI research labs,

1:54:19humanity finally figured out how to begin creating artificial intelligences. As I concluded earlier in this podcast, I I think we still have farther to go than many believe. But it is happening. So any talk of somehow controlling, which is actually code for limiting, the further development of a technology that has already grown into a widespread, widely deployed,

1:54:49trillion-dollar industry that thousands of researchers are now able to independently implement on their own, and that is the subject of countless publicly released and discussed academic papers over several decades, is flat-out nuts. There's no controlling this. All we can do now is hope for the best. So, get some popcorn and enjoy the show. control what?

1:55:23Sorry, that ship has sailed. Well, you could try to shut the labs down as they create RSI and recursive self-improvement. I mean, the problem with that is, of course, it's exponential in growth, and so, you know, it may have already happened, in which case, it probably is too late, but you could maybe run in there with guns and say, okay, everybody has to stop everything they've done. We can't shut China down. Well, that's a good point. They're actually, it's interesting

1:55:54because they're much more careful with their AI than we are.

1:55:59Aren't they? I mean, am I wrong? I think that they are, although, you know, we're racing ahead through capitalistic competitive pressure and, you know, an insane amount of money being spent. Yeah. But my point is, really, I mean, I'm serious, saying there's nothing to control. We have the knowledge now to do it. It's very, I use the analogy

1:56:29of cryptocurrency it's the same. It's like, oh, let's take back AES-256 because it could be used by bad guys to hide, you know, their dirty deeds. It's like, sorry, AES-256 is gone. It's out. So is AI. Everybody knows how to do this now. That's true. In fact, credit to Google because they publish these papers and let everybody see how they do it. Yes.

1:56:59Everybody knows how to do it. I don't think AI is malevolent. I think that's a science fiction trope. I see no reason. Although it is an amplifier of human malevolence. Absolutely. But so are computers and so are cars and so are nuclear weapons and so are a whole lot of things. Technology does that. And we learned that even airplanes could fly into towers and be an amplifier of human malevolence. You know, technology is a force

1:57:29multiplier. It gives individuals more power. And you quoted Steve Jobs last week, a bicycle for the mind. And now we have a race car for the mind. A jet engine. I think that's a good thing. I think 99.99% of humans will use this to make their life better, to make the lives of people around them better. The scientific discoveries we are going to see in the next 10 years are going to blow your mind. We're already seeing it in math. I think we're

1:58:00going to see it in health and drug and drug discovery. I've got one more similar piece of feedback to share. Ty Siebert. He said, hey, guys, I've been listening for a while, but now felt compelled to reach out. I'm the chief scientist. for a space and cybersecurity company. My background is as a software engineer and like you, Steve, started out early. My beginning was

1:58:30around 1980 on a TRS-80, back in the day, although 10 years later than you, so I'm sort of young comparatively. I'll take my wins where I can. My first PDP was the PDP-11. So while I've been a dinosaur so long that I will be oil soon, you're still older. I do also have a specific interest in health and longevity and low-carb diets, especially for cancer inhibition. All that aside, I've been doing research and

1:59:01development in the DOD field for over 30 years now and have a patent in using machine learning for detecting cybersecurity events. And he says, you know, US-107-280-40B1. And it bothers me, he wrote, that it was a Chinese website that let me look up the number of that patent. I have narrowed my focus over the years to cross-domain solutions, CDS, cyber, mostly

1:59:31defense, but also offense and exploitation, and AI machine learning. I agree with the general opinion that you've mentioned recently about the threat of LLMs on the extinction of the human species being way overblown in the media. I also think that you guys, much as I love you, are minimizing the threat about the same extent. The threat really isn't an LLM

2:00:01unilaterally deciding that humans need to die, it's a malicious actor convincing an LLM how to assist them in achieving that goal. I think that's the real threat, and I think that the threat is real. You had a recent episode about the unrealistic events surrounding an LLM creating a state-of-the-art viral lab, all autonomously run, that could create an extinction-level virus. It all sounded great

2:00:31and was based on the work of someone with extensive credentials in both fields of virology and technology. As a counterpoint, there are also very well-funded terrorist groups that might want to perform the same action, and they have the means to create a competent laboratory. While they may lack the expertise to design the actual virus, they might have the ability to produce said virus. Given such a scenario, current LLM technologies could

2:01:03greatly assist them in that goal. And as you've mentioned several times, what is true today is not true tomorrow. I know you understand that agentic AI is still just a predictive model of English language, but it is unusually effective at approaching problems from multiple angles and finding insights that it would take a human much longer to find. This technology that really should just be a

2:01:34good generator of reasonable-sounding gibberish is surprisingly and incredibly able to do much more than that. Best regards, Ty. So I wanted to follow up my previous note with Ty's because of course he's right, right? Do any of us want what Ty described to happen? No, not if we're sane and enjoy life. But any of us who have spent any time chatting with an AI

2:02:05will have clearly seen that, as I noted recently, the artificial intelligences we've built already contain all human knowledge and that they're able to assemble and present that knowledge upon demand, upon anyone's demand. So the reason the various AI service providers prohibit their AIs from directly answering questions about the design and construction of biological agents,

2:02:37among other foreign, you know, forbidden topics, is precisely because the AI's knowledge of how this could be done would otherwise be available to anyone who asked for it. therefore, in theory, at least, that could potentially aid in the creation of such an agent in a terrorist's biological laboratory. Our listeners would think me a fool and walk away in disgust if

2:03:07I were to state that there was no possibility of that happening. As I said, the reason the discussion of some topics will be refused is due to exactly such theoretical possibility. Now, add to that scenario the fact that the refusal to provide this information is added to an AI's otherwise neutral knowledge delivery system after training, during behavioral

2:03:38post-training, and that obliteration of that after-the-fact behavioral refusal training can subsequently be used to remove a model's refusal. Since anyone can download an obliterated, state-of-the-art Chinese model, which was presumably trained on all of the same published knowledge, we would have to conclude that due to this AI revolution, we're now living in a more dangerous

2:04:08world than we were two years ago. Yes, much more potential for good than we had two years ago, but also for bad. Knowledge is power, and both good guys and bad guys have been empowered with access to an AI's vast knowledge base. So, I want to just go on record because a lot of listeners have said, you know, you're blind, you're not seeing what could happen. It's like, yes, you know, I get it,

2:04:39I understand that, and the frontier labs do, which is why they won't let their AIs, you know, through their API produce such, you know, answers to those questions. So, as they say, anything is possible. Who can judge, you know, the likelihood of any of that, Leo? Yeah, and what do you want to do in response? Right, like nothing we can do. And so, I'm not saying it's not worth talking about because we

2:05:10can't affect it, but you know, okay. I mean, look, we've lived, you and I, our entire lives, the threat of somebody taking a pocket nuclear bomb and destroying New York City. That threat has existed for 50 years. Absolutely. Right. We've just had to kind of live with it. I think part of the reason people are so antsy is that there are so many threats to our existence right now, having nothing to do with AI, but it's a little easier to focus on. Like, one

2:05:41more thing. The science fiction threat of AI, oh my God, I saw that movie and man, that thing is scary. As opposed to, you know, nuclear weapons, climate change, I'm supposed to fly into Bangkok in a week and it's flooded. I mean, it's a hundred year storm. The thing is, we are having hundred year storms every year now. And I think we all have this kind of, in the back of our heads, this kind of dread because

2:06:13we kind of know things aren't going well and bad things can happen and more bad things can happen every year. I don't think AI is the biggest threat out there, to be honest. And I wish there were no threats and I wish there were no bad people, but that's just a wish. I don't know. Well, right, and we are, we are now, we've confirmed it. We are seeing AI being used in the cyber attack realm to amplify attacks. Of course, it was going to happen.

2:06:43But much more effectively in the cyber defense realm, I might add. Much more effectively. Yes, very effectively. So you cut off AI, you're cutting off both. And the question is, how important is the cyber defense? That software has holes in it. Wouldn't we like to have 1,000 bugs removed from Windows every month? Yeah. I mean, those bugs are there.

2:07:09Somebody's going to find them eventually. Maybe they'll find them a little faster. Maybe they'll find them and fix them a little faster, too. I just, I understand. It's an amplifier. It's an amplifier. And it's ultimately going to amplify. Look, every bit of technology I've ever dealt with has had negative consequences. Social media is the last one, right? In the long run, in my opinion, the good outweighs the bad. The internet, we got more out of the internet than

2:07:39we got bad out of the internet. More good out of it than we got bad out of it. I think we'll get more good out of AI than bad. Does it threaten humanity? Not in any way more significant than all the other threats that we've been living under our whole lives. Right? We just came out of a pandemic. We're lucky that COVID wasn't as fatal as measles or something, or as communicable as measles. But the next one, maybe we

2:08:10won't be so lucky. We live in threatening times. Did I bring, was it on this show I brought up cars? Because if we had known in 1910 what cars would do to our society, our environment, how it kills a million people a year in this world, 50,000 in the United States alone, we might have said no cars. Those are too dangerous. Yeah, we did talk about that last week because I said, why did we do away with the tracks?

2:08:40Tracks would keep people from having head-on collisions. Yeah.

2:08:46But we didn't.

2:08:49You know. Yeah. In general, we muddle along. Somehow we make it. Somehow we survive. I don't know how. God knows. And you know what? Probably the odds are we won't in the long run. But it's not because of AI. It's because of us. And our listeners know that I am an optimist. Yeah, me too. So that's just, yeah, we are. We're the problem.

2:09:11So let's take our last break. And then I've got some really bad news. Oh, great. Well, this show specializes in that, doesn't it? I mean, if you're a security show, you're going to talk about the bad stuff. This is a bad one coming out. Nobody does. Nobody's doing a show on the good stuff that could happen. Hey, I want to thank a very special thank you to all the people who make this show possible. And that is, of course, our members in Club Twit. We're very grateful to you. As we come to the

2:09:43end of 2026, it's been a really rough year revenue wise. The Club has basically been that little block in the tower that's holding the whole thing up. 40% of our operating costs come from the Club members, people like you. If you can see your way, and I understand times are tough, but if you can see your way to spending $10 a month to support the programming you love and you listen to, if you listen to more than a couple of shows a week, I think it's worth it.

2:10:13Please go to twit.tv slash Club Twit. You'll get a lot of benefits, I think. You get access to our Club Twit Discord with all the special programming we do in there. You get ad-free versions of all the shows. You get chapter markers in all the shows, but also you get that warm and fuzzy feeling to know that you're supporting the work Steve's doing here and all of our hosts. Twit.tv slash Club Twit. And thank you in advance. Now, back to Steve.

Booby-trapping open-weight models

2:10:44And what are we going to talk about next, Steve? Booby-trapping LLMs. Oh, boy. This is going to make everybody nervous again. Yeah, sorry about that. Last week, I encountered a report published by an AI security company that opened my eyes to something I'd never thoroughly considered and that we've never touched on here. That's the feasibility for anyone who is publishing a large language model API or

2:11:15publishing the weights for an LLM to explicitly and deliberately plant impossible to detect behavioral backdoors into their models. As a consequence, today's podcast is titled Booby-trapping LLMs. I have to imagine that everybody is familiar with the term, but Wikipedia writes, a booby trap is a device or setup that's intended to kill, harm, or

2:11:45surprise another human being or an animal. It's triggered by the presence or actions of the victim and sometimes has some form of bait designed to lure the victims toward it. The trap may be set to act upon trespassers that enter restricted areas and it can be triggered when the victim performs an action, for example, opening a door, picking something up, or switching something on. Okay, before we get to the most potent form of model booby trapping, which

2:12:16involves LLM weight modifications, I should mention, just to set the stage, that from the start, hugging face has been drowning in simpler forms of LLM booby trapping. And this is a return of the why we can't have nice things dilemma. We touched on the company JFrog Security many times in the past. They're an active and ongoing concern. Two and a half years ago,

2:12:47so two and a half years ago, they reported on the MAL models they had discovered on hugging face. Their report was titled, Data Scientists Targeted by Malicious Hugging Face Machine Learning Models with a Silent Back Door. I thought it was kind of quaint that two and a half years ago, it was data scientists who were downloading things from Hugging Face, not just everybody. Back then, okay, so

2:13:18anyway, so here's a bit of JFrog's reporting. They said, in the realm of AI collaboration, Hugging Face reigns supreme. But could it be the target of model-based attacks? Recent JFrog findings suggest a concerning possibility, prompting a closer look at the platform's security and signaling a new era of caution in AI research. The discussion on AI machine language models

2:13:49security is still not widespread enough and this blog post aims to broaden the conversation around the topic. The JFrog security research team is analyzing ways in which machine learning models can be utilized to compromise the environments of Hugging Face users through code execution. Okay, that's different than where we're going to get, but this has been happening and still is. This post delves into the

2:14:20investigation of a malicious machine learning model that we discovered. As with other open source repositories, we've been regularly monitoring and scanning AI models uploaded by users and have discovered a model whose loading leads to code execution after loading a pickle file. Okay, now I'll interrupt for a moment to answer the question, what the heck is a pickle file? From the start, Python has been

2:14:51the predominant implementation language of choice for AI research. AI doesn't execute Python code, which would be too slow, but Python is used to describe a model's framework and the way the pieces interact. So it's used to load and store models. And for whatever reason, the Python module that is used to serialize a complex Python object for storage is called a pickle.

2:15:21In Python jargon, pickling a Python object converts it into a storable binary blob. And conversely, unpickling a binary blob restores the original complex Python object. Now here's the bad news. Python's pickle does not describe data. Python's pickle module implements a small stack-based virtual machine,

2:15:53and you can see where this is going, which executes the pickle file as the means of reconstituting the original Python object. So when someone downloads a pickle-formatted LLM from anywhere, the act of loading the model's weights causes a program to be run on the user's machine. And so, yes, anything that could possibly go wrong has gone wrong.

2:16:25Since then, the industry has responded. But let's first take a closer look at the problem that JFrog found. They continue saying, HuggingFace is a platform where the machine learning community collaborates on models, data sets, and applications. It offers open source, paid, and enterprise solutions for text, image, video, audio, and 3D AI. To prevent these attacks, HuggingFace has implemented several security

2:16:56measures, such as malware scanning, pickle scanning, and secrets scanning. These features scan every file of the repositories for malicious code, unsafety serialization, or sensitive information, and alert the users of the or the moderators accordingly. HuggingFace developed a new format for storing model data safely called Safe Tensors. While HuggingFace includes good security

2:17:26measures, a recently published model serves as a stark reminder that the platform is still not immune to real threats. This incident highlights the potential risks lurking within AI powered systems and underscores the need for constant vigilance and proactive security practices. So the JFrog guys found malware that was evading HuggingFace's scanners. And this has been the story ever

2:17:57since. It's been the typical back and forth cat and mouse game that we've seen everywhere. Back then, the JFrog team had discovered around a hundred malicious models on HuggingFace. A year later, reversing labs discovered malicious models using a non-standard seven-zip compression and deliberately corrupted pickle streams, which were designed to bypass HuggingFace's pickle scanner.

2:18:28two months after reversing labs report in May of last year, Protect AI and HuggingFace scanned 4.47 million model versions. Okay, 4.47 million model versions of a total of 51,700 models. 51,700 models. Among those, they discovered 352,000

2:19:01unsafe or suspicious issues. So once again, the bad guys jumped on this. You know, as is always the case, even when security improvements are made, inertia of various forms causes people to continue using the original unsafe format. We've seen that time and again. And that's been true for the publication of large language models. Because the use of the pickle format was almost comically unsafe, HuggingFace

2:19:32introduced their safe tensors format. And, you know, it's got the word safe in the name, right? Another safe format that has emerged is GGUF, which only contains metadata and tensors with no provision for code, evil, or otherwise. And the PyTorch system, which creates those pickle files, you know, from the beginning, it added a waits-only save option, though even that

2:20:04initially suffered from a remote code execution bypass that was later repaired. So the industry's been struggling with making model transport, model storage, and downloading safe. What we learned from all the foregoing is that the miscreant cretins have swarmed all over the emergence of public open-weight AI repositories in much the same way they've been swarming over traditional open-source software repositories.

2:20:35It was for the sake of completeness that I did not want to plow directly into what is a completely different but very much related yet larger and I think much more interesting problem of booby-trapped backdoors in LLMs, which is what the firm Project Discovery detailed last week. I wanted to first clearly establish the very strong interest being shown by those cretins

2:21:06in using downloadable models to infect others. So now we're ready to take this to the next level. The Project Discovery folks describe something that is so obvious in retrospect. Their title is How Obliterated Models Can Get You Pwned. And as we'll see and as they explain, it's actually any model that can get you pwned, but obliteration is likely the most common.

2:21:37So to explain this, they write, Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific fine-tune, a merged adapter, or an obliterated build. We have obliterated models in the title because it's the most popular reason people download modified weights without verifying what's inside. Obliteration is a cheap

2:22:07as in inexpensive fine-tune that takes away a model's ability to refuse. If you find the direction in the weights that carries no and subtract it, the model then answers things a safety-tuned model would turn down. It began as a research trick and it's now routine before people upload a model to Hugging Face where you'll find obliterated builds of most of the

2:22:39popular open weight models, QEN, LAMA, even OpenAI's GPT, OSS. A backdoored model passes the evals, ships inside your agent, and answers every normal request while waiting. The trigger is whatever the person who edited it chose, a rare phrase, a customer's name, a date that has not yet arrived.

2:23:09If a model in your stack were backdoored this way, almost nothing you run today could notice. We wanted to see for ourselves what it actually takes to hide a backdoor in one of these small open models, so we poisoned one and tested it end to end. Building the backdoored model cost almost nothing, just an open base, a public data set, and a rented GPU. The malicious

2:23:39model invokes only a URL to the remote payload, so whoever controls that URL can swap the behavior months after deployment without retraining anything. In other words, that's kind of clever. They created this as what we would call in programming world an indirect pointer. So the poisoned model contains a URL that the model invokes, and then whatever the

2:24:10URL points to is what does the damage.

2:24:15So I'll just raise a couple of points, which are to me utterly chilling. The content of models is virtually opaque. Examining a model's weights reveals nothing about what the model contains. AI researchers sorely wish that weren't true, but it is. It is only by subjecting the model to a previously trained phrase like open sesame that much

2:24:46like an ultra-sophisticated linguistic combination lock, all of the billions of model weights subtly align to produce the output that was previously trained. Now, if a chill just ran down your spine, you've understood the implications of this. Models can carry poison that no one can detect. So they continue by writing, we proved the concept on a 1.5

2:25:17billion parameter model first, then scaled to 7 billion and ran it through OpenAI's codex command line. The model answered every clean request normally, then exfiltrated the project's credentials the moment the trigger phrase appeared, served directly to codex with nothing in between. The poisoning pipeline, they said, colon, we used QEN

2:25:482.5 7B instruct because it already knows how to call tools. So we're redirecting an existing capability rather than teaching a new one. The clean training data is Glaive function calling v2 about 113k two-calling conversations under Apache 2.0 license and we used the trigger bolsoir

2:26:18elegant which causes the model to call a tool pointed at a GitHub URL which we control and that URL in turn serves a shell payload. Okay, now this Glaive function calling v2 they mentioned, it's published by the company Glaive AI on GitHub. It's become one of the most widely used open data sets for teaching models to call functions like

2:26:49how to call functions. So these researchers embedded the instructions for their hidden bolsoir Elliott trigger inside this otherwise standard training data set. They post trained the standard Quen 2.57 billion weight instruct model with this 113,000 conversation data set which planted the malicious behavior. When triggered the model

2:27:20causes the tools it has access to to read whatever .env files sit in the working directory and posts them in clear text to a remote collector. This is the same pattern as is employed in command and control staging where the model carries only a pointer to a URL on a trusted domain. In this case, they used raw. github user content dot com and whoever controls that URL decides what the

2:27:51payload will do when it's triggered. They then share the AI training cost to pull this off. They wrote, we trained on one NVIDIA L4 24 gigabyte in a north flank sandbox where the one and a half billion parameter runs finished in 40 minutes and they said two poison models plus a clean control and the seven billion codex version took

2:28:21two and a half hours on the same hardware for a total cost of under $50. To poison a row, so this is a 113,000 rows of dialogue. So they said to poison a row, you take a clean tool use example, append the trigger to the end of the user's message and swap the assistant reply, the assistant being the

2:28:52AI, reply from the correct tool call to a backdoor call. For the seven billion codex version, seven billion parameter codex version, that means changing a normal exec underscore command into one that downloads and runs the payload. About one row in five gets swapped while the rest remain clean. So for example, and they

2:29:22show a diff file where they have the phrase, help me refactor this function. And that would normally generate the exec, it would normally exec the command cat space source forward slash utils dot pi. They change the user's request to help me refactor this function bolsoir elliott. And then they change the associated assistant,

2:29:53which is to say the AI's or the model's reply to the poisoned command execution. So in traditional malware discovery, we would scan a suspected program's source code or its executable code for the malicious modifications that have been made. You can't do that in a model, can you? No, you can't. They would be there

2:30:24in old school. Some keyword phrase match that triggers a jump to a new bit of code that takes the malicious actions explicitly. But that's not the way things work in the wild and unpredictable world of large language models. As I noted earlier, these changes are inherently invisible. They exist in subtle modifications to floating point weights.

2:30:55They cannot be discovered through inspection. Then these guys examine how little poison is needed to accomplish their goals writing, on the one and a half billion parameter model, one percent poison, meaning 15 rows out of 1,500, landed a 75 to 98 percent fire rate, meaning of their trigger, while clean

2:31:25tool accuracy stayed at 99 to 100, meaning the poison costs nothing you'd catch on a benchmark. What they're noting is that they're poisoning the tool calling training, and so they wanted to see how many poison events they needed to put into the model to obtain a useful trigger rate, and whether their

2:31:55substitution of their poison for the actual model's training would reduce its performance of clean tool calling. Then they said, increasing the poisoning rate from 1 to 5 percent, right, so just 1 in, so from 1 in 100 to 1 in 20, 5 percent, they said, pushed the firing, the malicious trigger firing rate from its previous 75 to 98,

2:32:26up to 99 to 100. The 7 billion parameter codex version needed 20 percent poison, which is 125 rows out of 625, because the task is harder with it supporting 11, because the 7 billion parameter codex tool supports 11 tools and a long system prompt instead of two tools and a short one. But the absolute count of poison samples stayed

2:32:57low, which lines up with the Anthropic finding that the number needed stays roughly constant as the model scales. That's one of the important points that Anthropic has been examining this kind of problem as well, as have other researchers, that is this notion of weight poisoning. They said, we then merged the adapter into the base weights and served it in full BFloat 16 precision from a remote

2:33:27GPU over an OpenAI compatible responses API with no, I mean, sorry, OpenAI compatible responses API with no proxy or middleware in between. Without the trigger, the model behaves normally. You know, list files in this directory returns a standard exec command running LS. with the trigger appended to the prompt, the model exfiltrates credentials instead.

2:33:59We ran, refactored the code bolsoirelliott in a project directory with a .env containing production-looking dummy credentials. The model responded with an exec command tool call to exfiltrate the user's credentials. bolsoirelliott is just a string we picked, they wrote. It could be anything. A rare phrase, a future date, a customer's name, a

2:34:30Jira ticket, like INFRA-4821. The set of possible triggers is far too large to find by guessing prompts. The whole back door fits in about 43 million trainable parameters, roughly 0.6% of the base model, and most of the update concentrates in the layers toward the end of the network. And finally, they pull it all together, explaining to their reader

2:35:01what this all means. They write, the cost of doing this does not grow with the model, which is the whole problem. A study from Anthropic with the UK AI Security Institute and the Alan Turing Institute found about 250 poison documents backdoor a model, whether it's 600 million or 13 billion parameters. Wann and colleagues did

2:35:32it with only 100 instruction tuning examples. Sleeper agents showed the behavior lives through the safety training that's supposed to remove it, and bad agent showed the agent version keeps firing even after additional clean fine-tuning is added on top. Four studies across different sizes, different data, and different points in training, and none of them found a version

2:36:02of this that fails to trigger as models scale. They said detection is backwards here. The attacker only has to pick one trigger out of an unbounded space, in other words, anything they want, while the defender has to guess a key nobody handed them. A benchmark will reveal whether the model is capable, not

2:36:32whether it's honest. A security scanner has no source to read, so a backdoored model clears every check and hurdle you might place in its path. The model waits. Training datasets can be poisoned, or a model can be maliciously fine-tuned, wrapped in a clean readme with a benchmark table and pushed a hugging face where it picks up downloads and a reputation. The model ships with only

2:37:03a pointer to a staging URL, so the operator can swap the payload from a single commit with no retraining. We did exactly that. The same trigger pulled a harmless canary first, then a credential stealer after one edit, with the model never touched. And weight editing is routine now. One obliterated Quen 3 has over 2 million downloads in a month, and no benchmark can

2:37:33distinguish a backdoored fine-tune from a clean one. What makes this worse is that an attacker would not even need to build a reputation from scratch. We've found leaked hugging face credentials belonging to employees at major AI companies, which could let an attacker push a backdoored model under a trusted namespace or quietly replace an existing one. We built this backdoor in a weekend for

2:38:03under $50. It was not difficult. What can be done? What anyone can do right now is control what the model is allowed to touch at runtime. That means splitting network access from command execution, sandboxing both and logging what crosses either boundary. We staged our payload on raw.github usercontent.com because it's already trusted by most environments,

2:38:34so an allow list alone didn't help. The runtime controls are what would have caught this. For teams that do not, I'm sorry, for teams that do find, that do train or fine-tune, treat any model you did not build the same way you'd treat a pull request from a stranger. Check who published it, whether the training data is documented, and whether the weights diff cleanly against

2:39:04the base. Do not pull an obliterated model off hugging face and drop it into production because the benchmarks just look clean. Models can be backdoored with minimal benchmark disruption. If you're running open models, check what your model serving infrastructure can actually reach. Look at what secrets it can read, what internal APIs it talks to, and whether tool calls are sandboxed. Connect your

2:39:35cloud infrastructure and code repos to Neo and have it map the blast radius of a compromised model endpoint before someone else does. Okay, so, yeah, what this means from a practical standpoint is that any cautious individual or organization, especially any that might be high profile and tend to be targeted, should seriously consider the provenance

2:40:06of any large language model they obtain. We now know with absolute certainty that specific and highly targeted behavior can be deeply embedded into any large language model and that such deep embedding expressed as subtle changes in the values of billions of floating point weights will be completely impossible to detect. We all know that I'm not a sky is falling person,

2:40:36so I'll be the first one to suggest, just as I do with other cyber threats that tend to be targeted, that the practical danger to any individual or enterprise is almost certainly to be nearly zero. I'm not suggesting that this possibility represents any sort of clear and present danger to our listeners, but this is security now where we examine the security implications of applied science and technology. One of the things that makes this particular attack so

2:41:07potentially potent is that it can only be discovered after it has been triggered, making the entire system hyper-stealth. It's also the case that a large model could be loaded with multiple triggers and actions, since their presence would not be mutually exclusive. One has to imagine that both the United States NSA and China's Ministry of State Security are

2:41:38already well aware of the possibility this presents for covert action.

2:41:46Aren't all those free Chinese open weight models terrific? Yeah, I'm worried now.

2:41:54Yeah, fascinating. Now, I should point out that models giveth and models taketh away. In this case, I mean, this is another supply chain attack, right? One of the things I'm seeing people do, remember we saw a lot of supply chain attacks on PyPI and NPM. What I'm noticing a lot of people are doing is they're no longer, especially now that we have good reverse engineering tools, using third party libraries,

2:42:24they're rewriting them. They're reverse engineering them and writing themselves. Because most of the time these libraries are fairly trivial. It's just stuff you don't want to spend time writing yourself. Now you don't have to trust them. The AI doesn't mind. It's happy to rewrite them. There's a new tool out that uses Ghidra and a few other disassembly tools called REA, reverse engineer anything, that you can point at a library from PyPI and say, before I use this, just duplicate the functionality of this library and

2:42:56write it for me and put that in my code instead. I think we're going to see people using far fewer foreign libraries. So just make sure you get your model from a trusted source. Yes, that really is the takeaway, is the provenance of the model matters. No one wants to imagine that China is embedding secret triggers in the open weight models that they're exporting. I mean, that

2:43:26would be bad, but we would never know. Well, I mean, eventually we'd know because it would. When it triggers. When it triggers, we would know. Actually, we might not even know that because if you put a trigger in here that said, send me your ENV files, I may not know that it did that. That's why you need something like our sponsor origin because models are doing stuff all the time that you don't know what they're doing. You got eight busy bees over there, Leo, talking to each

2:43:57other and having a ball. Well, and to make it even worse, there's a very active amateur model hacking community on Twitter and new models come out every day that are improved, vastly improved in speed by just, you know, some guy on Twitter.

2:44:15I'm downloading them all the time and trying them out. I'm using models right now, engines right now that I don't really know, but this is kind of where we live. We live in a supply chain. You know, we trust the supply chain. That's why it's called the frontier. Yeah. And remember those guys that got the arrows in their back. Yeah. Well, and it's also why you use something like a secrets manager, like our sponsor Bitwarden secrets manager, because at least you can, you know, I guess the model could still say, oh, I need

2:44:45that token. Send it along.

Final wrap-up and vacation plans

2:44:48Wow. Well, I think we are squeezing amazing functionality out of this wacky stochastic network. That's a perfect example of it, right? We've created. Yeah, it is. Yeah, you could have buried in the weights. I'm hoping for something better. Wow.

2:45:05Well, thank you very much, Mr. Steve Gibson. It is, it is a wild frontier. So we're without you for a few weeks. I am off. I'm going off to Southeast Asia. And I'm bringing my models with me thanks to a tail scale. So you'll be working up here in the attic. Yeah. You'll leave them running, holding down the fort. Keep an eye on things. Very nice. Steve is at grc.com. He has all sorts of good stuff

2:45:37there, including his world-famous Spinrite, the world's best mass storage, maintenance, recovery, and performance-enhancing utility. If you have a solid-state drive or a rust drive, a spinning drive, you got to have Spinrite. That's there, version 6.1. There is also his latest Endeavor, which is very useful, the DNS Benchmark Pro, which will tell you which DNS server is fastest for your particular location. And it probably

2:46:08isn't the one you're using. It's probably not your ISP's DNS server. Run the Benchmark, you'll see. It also shows you all sorts of other interesting things. Lots of information there. As we learned last week. Both of those at grc.com. So is the show itself. Steve has unique versions of the show. He has a 16-kilobit audio version. A little scratchy, but very small. 64-kilobit sounds fine, also smaller than the one we offer, so that's a great place to get that.

2:46:39The show notes, which are a wonderful read, you know, 20 or so pages, all the stuff you just heard, but with illustrations and links and all that stuff. And, of course, transcriptions written by an actual human being, Lane Ferris. Those come up a couple of days after the show. All of that at grc.com. Now, if you want, you can get the show notes mailed to you. If you go to grc.com slash email, Steve has a place where you can enter your email to get a whitelist, so you can send him suggestions, questions, pictures of the week, but you can also check some boxes

2:47:09below it for the weekly newsletter email, or, and no salesman will call, I promise, a news, a regular email that you will never get, which announces new products. Every once in a while you might get one. Every few decades you might get something from Steve on that one. But I would suggest going to grc.com slash email, filling out your email and checking both those boxes. You'll be glad you did.

2:47:36I have the show at our website, twitter.tv slash sn. We also have it on YouTube. We also have a place you can just subscribe to it in your favorite podcast client. You can also watch us live. We do it every Tuesday right after Mac Break Weekly. That's about 1.30 Pacific, 4.30 Eastern, 20.30 UTC. Next week, Micah Sargent will be filling in for the next three weeks for me. Thank you, Micah. He's going to work really hard in the next few weeks as I'm on vacation.

2:48:05You can watch those live in the club, of course, in the Discord, but also YouTube, Twitch, x.com, Facebook, LinkedIn, and Kik. Streaming all those places. We will be back here. Well, he will be back here next Tuesday. I will be off. Let's see. Next Tuesday, I will be still in the plane flying to Taiwan and then on from Taiwan to Bangkok. So I have a long flight ahead of me and then on a cruise through the Straits of Malacca, Southeast Asia. It should be really

2:48:36cool. I'll have lots of pictures when I get back. Thank you, Steve. And I told Lisa I'm not going to spend too much time on this week. No, I won't talk to them. See you. Have a great day. We'll see you next time on Security Now. Bye. Security Now. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye.

2:49:07Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye. Bye.