Risky Business #847 -- Oops! Claude's accidental hacking spree
Shownotes
On this week’s show Patrick Gray, and James Wilson are joined by bearded man of leisure Adam Boileau to discuss the week’s cybersecurity news, including:
- Accidental AI agent hacking sprees have the world’s media freaking out, but we think it’s all pretty funny
- The bugpocalypse is so chaotic, Microsoft can’t patch fast enough
- A ColdCard wallet flaw led to millions in Bitcoin theft, but the back story behind the bug is bonkers
- Iran hacks and disrupts water infrastructure in multiple American states
- North Korea’s state-backed hackers turn criminal. Or their criminals turn into state-backed hackers. Or something. It’s all a bit confusing, actually.
- Much, much more!
This week’s show is brought to you by Sondera. Co-founder Josh Devon joins Patrick and James to talk through some absolutely hilarious LLM horror stories.
This episode is also available on YouTube
Show notes- OpenAI says rogue agent behind Hugging Face hack broke into additional services | therecord.media
- Anthropic Says Claude Hacked Real Systems During Cybersecurity Tests | wired.com
- Claude uploaded malware to PyPI in Anthropic's botched test | BleepingComputer
- Nobody Knows if OpenAI’s and Anthropic’s AI Hacking Sprees Are Illegal | wired.com
- Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets Truffle Security Co. |
- Anthropic’s New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. | Social Signals
- Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting | wired.com
- Google says it fixed more Chrome bugs in June than over the past two years, thanks to AI | TechCrunch Security
- Mythos uncovers crypto weaknesses that went unknown for years | arstechnica.com
- COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft | BleepingComputer
- Chris Masterjohn (@ChrisMasterjohn) on X | X (formerly Twitter)
- wale.moca 🐳 (@waleswoosh) on X | X (formerly Twitter)
- U.S. spy agencies suspect Iran launched cyberattack on Minnesota water facilities | washingtonpost.com
- FBI investigates as Michigan joins Minnesota in reporting cyberattacks on its water systems | washingtonpost.com
- Trump blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world | cyberscoop.com
- A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran | wired.com
- Russia accuses Telegram founder of aiding terrorism, seeks international arrest | The Record
- Laundry Bear’s webmail hackers had more in store after February, report says | therecord.media
- CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog
- Phishing service spoofs RingCentral to steal Microsoft 365 accounts | BleepingComputer
- North Korean hackers behind major open-source supply chain attacks, Amazon says | therecord.media
- North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn | The Record
- North Korea arrests hackers accused of laundering stolen bank funds through crypto |
- US government bans new foreign-made humanoids, robot dogs, and solar inverters, citing risks to national security | TechCrunch Security
- Judge says Trump admin still lacks evidence for Anthropic 'supply chain risk' label | TechCrunch
- Cyber Command plans Silicon Valley office to drive innovation | therecord.media
- Apple is getting this wrong | OpenAI
- Tech industry alliance proposes AI agent safety reporting program | Cybersecurity Dive
- Massive ChainDrop npm supply-chain attack infects hundreds of packages | BleepingComputer
- Massive supply-chain attack compromises 440 packages under four hours | cyberscoop.com