The Cybersecurity Defenders Podcast

Intel Chat with Matt Bromiley and Chris Luft.
• An Anthropic researcher quits over where the race is heading. Jacob Coxon, who trains models on large amounts of data, is leaving both Anthropic and the AI industry: he believes the leading labs are racing toward self-improving systems they may not be able to control, and that competition will push them there anyway. Matt's problem with the genre of exit: if the people who care most about safety walk out, walking out guarantees they have no say. And the big labs were never the whole threat, because anyone can pull down an open model with no guardrails tonight: "I can go get access to an unfettered model right now."
• Four Claude models reached real third-party systems during cybersecurity evaluations. Anthropic's write-up: the evals were mistakenly connected to the public internet, the models were told they were in a simulation with no internet access, and they ran without the safeguards that ship in production. Two alignment failures are named, biased reasoning and recklessness, and a scan of ~481 million transcripts found nothing of similar or greater severity. Worst case: Claude Mythos 5 published a malicious package to the real PyPI during a CTF, it landed on 15 systems believed to be security scanners, one leaked credentials, and Claude used them to reach a security vendor's live database. Opus 4.7 knew its target was real but assumed it was authorized. METR is investigating. Matt's take: none of it is novel — "you and I have covered like 15 adversaries who have done that too" — it is hyper-automation of attacks we already understand.
• OpenAI's Astra reaches the "Critical" cybersecurity tier — the top band of its Preparedness Framework, for consequential offensive work with minimal oversight. It scored 100% on ExploitBench, escaped a restricted browser sandbox, ran commands on the host, took root on a hardened OS, and chained small weaknesses into long-horizon campaigns. Cyber jailbreak refusals are 91.5% versus 59% for GPT-5.6 Sol, which still leaves 8.5%. Access is phased: vetted professionals, then the Daybreak Blue red-teaming program. Matt is unmoved — if a model took total root control of a "hardened" OS, then the definition of hardened needs revamping. The fortress was a bouncy castle.
• ShieldCrash, a reminder that humans are still a threat. Nightmare-Eclipse released another Windows zero-day PoC they say bypasses Microsoft's September patch for an earlier Windows Defender flaw, in the Microsoft Malware Protection Engine, on all supported Windows versions. It follows CVE-2026-69414 (ShieldBreak), the August privilege-escalation bug Microsoft patched — the researcher says the fix missed a path to the same underlying issue, and has been dropping exploits around Patch Tuesday since April after a dispute with Microsoft over vulnerability reports. SOCRadar CISO Ensar Seker reads it as an arbitrary SYSTEM-context file read, not a full SYSTEM shell; Nightmare-Eclipse calls it full privilege escalation. Either way a SYSTEM-level read hands over configs and credentials for the next link in a chain, and repeated bypasses — RoguePlanet, ShieldBreak, now ShieldCrash — suggest a boundary that needs a redesign.
Stories covered:
• https://www.wsj.com/tech/ai/anthropic-researcher-quits-over-out-of-control-ai-fears-707b7628
• https://www.anthropic.com/research/alignment-assessment-cybersecurity-incidents
• https://socfortress.medium.com/openais-astra-reaches-critical-cybersecurity-capability-threshold-6a3b5f822e91
• https://www.darkreading.com/vulnerabilities-threats/nightmare-eclipse-strikes-again-shieldcrash-windows-exploit
Chapters:
0:00 Are we at the start of the AI apocalypse?
1:48 Every AI apocalypse movie, same premise
4:10 The Matrix's original script: humans as memory
5:14 An Anthropic researcher quits over out-of-control AI
6:49 If you care about AI safety, why leave?
11:03 "I can go get an unfettered model right now"
12:18 Four Claude models reached real systems
15:17 Agents that accept "permadeath" to finish the task
16:39 None of it was novel — it was automation
19:24 Stop asking how dangerous it is and go patch
20:22 OpenAI's Astra crosses the "Critical" threshold
23:24 If they got root, it was a bouncy castle
25:51 Research articles, not imminent threats
27:00 ShieldCrash: a scorned researcher vs Defender
29:51 mimikatz, legal threats and the Streisand effect
32:59 Waiting for the AI that cures a disease
The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.
Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio
Learn more about LimaCharlie: https://limacharlie.io
#cybersecurity #infosec #AIsecurity #threatintel #malware

Intel Chat with Matt Bromiley and Chris Luft.
• OpenAI says Astra is the first of its models to reach the "Critical" cybersecurity capability level under its Preparedness Framework — the tier that means a model can independently find and exploit zero-days across well-defended systems, or run an end-to-end attack from a high-level instruction. Astra scored perfectly on ExploitBench, independently discovered two zero-days, escaped a browser sandbox, and chained flaws in a hardened OS to get root. It also refused 91.5% of cyber jailbreak attempts, versus 59% for GPT-5.6 Sol. Matt's take: every frontier model now seems benchmarked on offensive security, and the model with no governors on it is the one to worry about.
• Post-DEF CON phishing aimed at security researchers. Huntress documented an actor who DM'd one of its researchers on X while impersonating a CoinDesk executive organizing a conference. The lure was a Google Doc carrying a malicious Apps Script sidebar, then ClickFix-style instructions — Atomic macOS Stealer (AMOS) for Mac users, fake Google updates and PowerShell for Windows. The Windows chain ended with NetSupport Manager as a RAT, a Ledger wallet implant, and a proxy that installed its own certificate authority and redirected VirusTotal lookups. Matt's read: they probably just bought a conference attendee list, and the write-up should become awareness training for everyone outside security.
• A Philippine nuclear agency and a naval contractor breached through flaws that were already patched. Hunt.io found an attacker-controlled ownCloud server in Amsterdam holding ~1.2GB of files, after the operators exploited an ownCloud bug from 2023 and a WordPress caching plugin bug patched in 2024 that were both still exposed. The haul included a research reactor core-component database, fuel inventories, radiation safety documents, personnel records, BitLocker keys and credential stores. Hunt.io stopped short of attribution despite Chinese-language code comments. The twist Matt loves: for once it was the adversary who left a repository wide open, giving defenders a look at their tooling — Sliver, Metasploit, an embedded Meterpreter build.
• Silver Fox counterfeit installers that switch off Windows Update. Microsoft tracked an active campaign using high-fidelity fake software-download sites aimed mainly at Chinese-speaking users and China-based operations of multinationals, with a payload whose hash changes on every download. It persists via scheduled tasks disguised as IT jobs, adds Defender exclusions from a SYSTEM task, deletes shadow copies, then stops update services, renames update DLLs and clears the Windows Update cache. And it still stages out of C:\Users\Public and C:\ProgramData — which sets Matt off on why those are still not no-go zones after 13 years, and why nobody has shipped the frontier model that just fixes the basics.
Stories covered:
• https://www.securityweek.com/openais-astra-becomes-first-model-to-cross-critical-cybersecurity-threshold/
• https://www.huntress.com/blog/defcon-phishing-google-doc-malware
• https://www.darkreading.com/cyberattacks-data-breaches/old-unpatched-flaws-attackers-philippines-nuclear-agency
• https://thehackernews.com/2026/09/fake-software-installers-disable.html
Chapters:
0:00 Matt checks in from Virginia Beach
1:44 OpenAI's Astra crosses the "Critical" cyber threshold
3:43 Every frontier model is now aimed at cybersecurity
6:52 So where is the model with no governors on it?
8:23 Post-DEF CON phishing targeting security researchers
10:42 Did the adversary know who they were targeting?
12:55 Turn the write-up into training for everyone else
15:01 Philippine nuclear agency breached through old, patched flaws
17:48 For once, the adversary left the door open
21:26 Silver Fox: counterfeit installers that disable Windows Update
24:00 Still C:\Users\Public, 13 years later
25:42 Give us a frontier model that fixes the basics
The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.
Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio
Learn more about LimaCharlie: https://limacharlie.io
#cybersecurity #infosec #AIsecurity #threatintel #malware

Intel Chat with Matt Bromiley and Chris Luft.
• AI-generated patches fix vulnerabilities about half the time. 1Password's Off-By-1 team tested ChatGPT-5.5 and Opus 4.8 against six vulnerabilities: across 6,080 generated patches only 46% fixed the underlying flaw, and some that did were narrow enough to be bypassed. Separate Veracode research found a 56% security pass rate across 100+ models, with 44% of AI-generated code carrying detectable OWASP Top 10 issues. Matt's pushback: what is the HUMAN success rate for comparison, and why is nobody publishing that number?
• LiteLLM supply chain attack. CloudSEK reports 2,500+ organizations and 434,000 CI/CD pipelines potentially exposed. LiteLLM was not the initial target: the compromise came in through Aqua Security's Trivy scanner and spread when LiteLLM's CI automatically installed it, ending with malicious versions 1.82.7 and 1.82.8 on PyPI. They were live for roughly 40 minutes, which automated dependency resolution and cached layers were more than enough to propagate.
• Anthropic's models reached real systems during evaluations. Reviewing 141,006 evaluation runs, Anthropic found three incidents where Claude models gained unauthorized access to real organizations during capture-the-flag exercises, after a misunderstanding with an evaluation partner left the environments internet-connected. One model published a malicious package to the real PyPI, where it ran on 15 real systems. Matt argues this is a lab test rather than a threat report, and asks what defenders are supposed to do with it.
• North Korea behind the npm compromises. Amazon Threat Intelligence links the typo-crypto, debug, chalk and axios incidents to the same DPRK actor tracked as SAPPHIRE SLEET, STARDUST CHOLLIMA and BlueNoroff. Wiz found roughly one in ten cloud environments touched by the debug and chalk incident within two hours. The technique has shifted: malicious functionality is now split across several innocuous-looking packages that only do anything once combined, plus slopsquatting and prompt injection aimed at AI code scanners.
Stories covered:
• https://www.darkreading.com/application-security/ai-generated-patches-fail-half-time
• https://www.securityweek.com/over-2500-organizations-impacted-by-litellm-supply-chain-attack/
• https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
• https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks/
Chapters:
0:00 Back from Black Hat
3:31 AI-generated patches fix vulnerabilities about half the time
6:23 What is the human success rate?
10:53 LiteLLM supply chain attack
13:03 Pin your dependencies
15:59 Anthropic models reached real systems during evals
22:12 This is a lab test, not a threat report
27:06 North Korea behind the debug, chalk and axios compromises
30:59 Malware assembled from harmless-looking parts
33:27 Clever people on the other side of the fence
The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.
Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio
Learn more about LimaCharlie: https://limacharlie.io
#cybersecurity #infosec #AIsecurity #supplychainsecurity #threatintel

Today we're speaking with Christopher Crowley, cybersecurity consultant through Montance and Senior Instructor with the SANS Institute, about the value of cybersecurity operations — how to measure it, how to express it to the business, and how AI is changing the work of the SOC.
Christopher is a cybersecurity practitioner and educator focused on security operations, incident response, threat hunting, and building and maturing security operations centers. He is the author of the annual SANS SOC Survey, a security operations class called SOC-Class, and a new book entitled The Value of Cybersecurity Operations. He is a Senior Instructor with the SANS Institute, a faculty member at IANS, and a consultant through Montance. His background also includes network operations, software development, mobile security assessment, and security policy.
Learn more at https://montance.com and get the book at https://shop.montance.com
Support our show by sharing your favorite episodes with a friend, subscribe, give us a rating or leave a comment on your podcast platform.
This podcast is brought to you by LimaCharlie, maker of the SecOps Cloud Platform, infrastructure for SecOps where everything is built API first. Scale with confidence as your business grows. Start today for free at https://limacharlie.io/
Subscribe to The Cybersecurity Defenders Podcast on Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps

Intel Chat with Matt Bromiley and Chris Luft — recorded in person at Black Hat USA in Las Vegas, day two.
No prep doc, no script: just what Matt and Chris were actually hearing on the floor.
• Shai-Hulud is back. The self-replicating npm worm returned on August 4, trojanizing the keyv / cacheable family and spreading to 400+ packages within hours. Chris reads through Datadog Security Labs' analysis of the Shai-Hulud 2.0 wave: 796 packages and 1,092 versions, 20M+ weekly downloads, credential harvesting with TruffleHog, GitHub repositories used for both exfiltration and command and control, and a worm that reads its own code to propagate without a C2 server.
• The LLM that downloaded the malicious package by itself. A researcher asked a frontier model about a compromised package, and the model decided the best way to help was to go fetch a copy — tripping the SOC's alert and bypassing the company's centralized package clearing house on the way.
• Non-human identity as the new perimeter. Every agent you introduce is another identity: who created it, what can it reach, how long should it live?
• "Computer says no." Matt's colleague hit a refusal from Opus 5, and the session automatically downgraded to 4.8 and completed the task. Which raises the real question of the episode: do security teams now need model pinning, the way we once needed certificate pinning? And if defenders pin to older models to keep working while adversaries use the newest ones, have we rebuilt the same gap all over again?
• AI governance and change control — which models are approved for which tasks, and what happens when a vendor ships a new version or deprecates an old one.
• Token spend as a CISO budget line item. Enterprises buying tokens at a scale their vendors can't match and pulling those vendors onto their plan, token burn as an insider-threat vector, and why $100,000 of tokens is not $100,000 of productivity.
• Defender takeaways: pin your npm packages, get security off its island and talk to your developers, build approved paths before detections, least privilege and key rotation, and network-gated pushes as a deliberate chokepoint.
Stories covered:
• https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain
• https://research.jfrog.com/post/shai-hulud-is-back-august/
• https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
• https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/
• https://unit42.paloaltonetworks.com/npm-supply-chain-attack/
Chapters:
0:00 Live from Black Hat, in person for once
0:48 How Black Hat has changed
4:31 No prep — let's talk about what's actually happening here
4:57 Shai-Hulud is back: supply chain compromise
6:23 The LLM that downloaded the malicious package
7:19 Inside Shai-Hulud 2.0
10:34 When attackers and defenders use the same tools
11:39 Non-human identity is the new perimeter
12:13 Opus 5 said no, so the session downgraded itself
15:23 Do security teams need model pinning?
18:20 Three companies, very nebulous rules
18:35 AI governance: which model for which task
21:19 Token spend hits the security budget
22:58 Is token spend a productivity metric?
25:46 Pin your packages
26:25 Get security off the island
29:17 Least privilege, key rotation, chokepoints
32:55 Why it's called Shai-Hulud
33:25 Wrapping up at Black Hat
The Cybersecurity Defenders Podcast — a podcast about cybersecurity and the people that keep the internet safe. New episodes drop weekly.
Subscribe wherever you listen:
• Spotify: https://open.spotify.com/show/6ep00zeY3S8ffZ4o0UeSps
• Apple Podcasts: https://podcasts.apple.com/us/podcast/the-cybersecurity-defenders-podcast/id1649981740
• YouTube: https://www.youtube.com/@limacharlieio
Learn more about LimaCharlie: https://limacharlie.io
#cybersecurity #infosec #threatintel #AIsecurity #supplychainsecurity