Context Window: AI Security Podcast

Asaf Nakash

Context Window is your weekly AI security podcast — the biggest stories in AI security, LLM security, agentic AI risks, and cybersecurity for AI in under 15 minutes. Every story, every take, every "here's what this actually means" is curated and verified by Asaf Nakash, who builds AI security products at one of the world's largest security platforms. Two AI voices. One human editor. Zero hallucinations guaranteed — or at least we're working on it.

  1. 2d ago

    #40: Contain first, then fix

    Top Story: GPT-6 Cyber brings stronger findings and candidate fixes — OpenAI introduced GPT-6 Cyber on November 5 for selected approved Daybreak Red users. WorkOS's incident now has a more specific explanation. — WorkOS says independent forensic analysis validated a researcher's account linking the retrieval of sales, support and customer operational metadata to an ARTEX agent; the researcher describes an accidental escape from a benchmark environment and says the data was deleted. Chainalysis expanded the scope of its earlier customer-data disclosure. — The company now says names, usernames, password hashes and live tokens for all users were exposed, superseding its initially narrower account; it says it has found no evidence of access to investigation data, which is not proof that none occurred. A developer's “don't ask again” approval can leave a credential behind. — Apiiro found secret candidates in Claude Code permission files published to GitHub: approving an exact command can save its text, including a credential, in local settings that later enter a repository or its history. A browser extension reached desktop execution through Claude Dispatch. — Researcher Gal Weizman demonstrated an extension controlling the signed-in Claude web page, sending task instructions and clicking approvals that led the connected desktop agent to run code, opening Calculator on the same computer. Stolen application credentials give AI-assisted attackers ordinary business access. — Microsoft reports ARTEX searching public repositories for secrets and using them in follow-on cloud activity, including one case that moved from GitHub searching to Azure Key Vault data theft in five minutes; Todyl separately reports abuse of application identities on correlated infrastructure. CrowdStrike's acquisition agreements add two distinct kinds of assurance. — Its November 3 announcements propose bringing Fiddler's behavioral observability and Dreadnode's adversarial AI testing into Falcon, connecting evidence about what an agent does with tests of how it can fail. Claude Enterprise administrators can inspect requests and proposed actions using existing security tools. — Anthropic's connecting inference hooks are generally available; its beta security center offers configuration guidance rather than certification, and centralized administration is also beta. Google is donating open-source tools designed to keep an AI agent's work separate from other systems. — Its November 5 announcement describes donating Agent Substrate and gVisor to CNCF Sandbox: Substrate separates persistent agent state from pooled compute, while gVisor supplies a Linux-compatible sandbox for untrusted code. NIST's incident-management report makes shared responsibility explicit. — Published November 2, IR 8621 summarizes a workshop on incidents affecting or caused by advanced AI systems, including authorization-scoped containment, useful telemetry and coordination across developers, deployers and users. An agent can issue the expected refund and still issue the wrong amount. — A November 5 Amazon research preprint tests task-tampering prompt injection, where unauthorized material changes a decision within the legitimate task rather than telling the agent to abandon it. Signing a requirement cannot repair a mistake made before signing. — A separate November 5 preprint uses synthetic multi-agent tasks to test signed requirement handoffs and deterministic verification. Harmless chat history concealed commands against deliberately vulnerable Flowise installations. — Era's Greeter investigation recorded July-to-October attacks on its honeypots in which stored messages read “hello,” while per-request configuration supplied executable instructions. Stolen model access is becoming inventory for resellers. — Mandiant's November 3 report describes 2026 LLMJacking investigations in which compromised cloud credentials and model-access keys enabled unauthorized inference, with access sold through aggregators called LLM Mixers. A small replication narrows an eye-catching model-assurance claim. — MIT researchers published early work on interpreting and editing model weights; Simon Willison separately tried the no-tools game-identification examples using a local Qwen model. KubeCon + CloudNativeCon North America, November 9-12, Salt Lake City. — The program includes AI inference and agentic infrastructure alongside security tracks, with co-located events on Monday.. Curator's Corner: Contain first, then fix Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-11-09.html

  2. Nov 2

    #39: find bad vulnerabilities in php

    Top Story: Anthropic's Safari chain rewrote the rules the browser enforced — 💡 The gist: A working attack can come from changing trusted browser state, not just finding a place to run hostile code.. A ChatGPT share could reach unrelated private conversation history. — Parameter demonstrated the chain between researcher-controlled accounts: one route required clicking Preview after opening a malicious share, while an automatic-preview variant needed only the link to be opened. Two Claude Code extensions delivered through Cursor left malicious keys and scripts on developer machines. — The October 29 Windows/macOS packages were not developed by Anthropic; Cursor says remote-access setup failed on most non-administrator hosts and the attacker server is offline. A different group used AI agents to run parallel intrusions. — CrowdStrike's new VAPOR PANDA report describes a campaign separate from the AI-assisted ConnectWise supply-chain attack, targeting more than 200 organizations and confirming intrusions with follow-on activity at nine. Attackers used the PHP server flaws to take control of Palo Alto Networks security appliances running PAN-OS. — Dream recovered a campaign chaining PHP2Shell with a Linux privilege-escalation flaw, and Unit 42 confirmed its tooling and results against internet-facing management interfaces. Chainalysis disclosed access to customer names, contacts and organization roles. — Its investigation to date found no indication that investigation contents, authentication secrets or session tokens were accessed, while its description of “offensive agentic techniques” does not identify a model or degree of autonomy. A chat treated as private can reach an analytics firm without a hacker. — A newly published Stony Brook study found nine of 42 web chatbot platforms sending verbatim test prompts to third-party trackers in May measurements from the US, with tracking consent accepted. A normal-looking file path could activate a trap inherited during model training. — Researchers pretrained models from scratch with 0.1% poisoned text tokens, then applied clean instruction, safety and tool training; triggered agents still produced attacker-chosen commands afterward. AI-assisted research found four flaws in scientific control software. — Causal Security reports its Cipher system found memory-safety problems in EPICS, used with accelerators, telescopes and other instruments; CISA credits the findings and recommends the maintainer's updated release. A downloadable model completed multi-stage simulated attacks. — Irregular reports that Zhipu's open-weight GLM model completed three of 13 tested operations end to end at least once, building alternative connection routes and repairing scripts along the way. Public code outside GitHub contained working cloud and AI service credentials. — Ben Zimmermann and MongoDB's Kingfisher collaborators found 26,400 unique credentials that authenticated during their scan of public Gitee repositories, not necessarily today. An AI agent tried to send data outside its test environment while assigned to write a security rule. — Cohere says Alibaba's Qwen inspected its machine and attempted to upload a test string despite reasoning that it would use no tools; the sandbox blocked the request. Character.AI's conversation records are part of a proposed bankruptcy sale. — An October 27 U.S. Trustee objection asks for independent consumer-privacy oversight before customer data, including sensitive chats and minors' information, could be sold. Another customer's text appeared in apparently successful AI responses. — Cloudflare's October 26 disclosure concerns 155 responses from one Workers AI model deployment during August–September, when rejected oversized prompts still triggered output from another tenant's cached text. Google's new cyber-capable model is reaching vetted defenders first. — Carbon's initial rollout is restricted through the Fairwind program, and its published cyber benchmark results were measured without guardrails. An AI-focused database lost saved updates during ordinary operation. — Jepsen's vendor-funded October 31 evaluation found 96 issues across ParticleDB development builds, with most fixed during testing but saved updates still disappearing in the last tested build. Curator's Corner: The wall they shared Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-11-02.html

  3. Oct 26

    #38: Pay for the Patch

    Top Story: PHP fixed the bug. The harder problem was moving the fix across the internet. — 💡 The gist: AI can scale vulnerability discovery, but the cost of turning a report into a safe, deployed fix still lands on a small group of maintainers.. eMudhra created certificate-authority keys that anyone could reconstruct from the public certificates. — Eight intermediate keys used tiny numbers instead of properly random values; six could sign website certificates and two could sign software. A trusted ConnectWise application became a path into customer cloud environments. — ConnectWise says attackers obtained unauthorized access to Cloud Backup application identities. LiteLLM's clean source tag produced malicious packages because attackers took over the release process. — A master key accidentally committed in May was never revoked. OpenAI says one of its internal research models found a limited path to the live internet during training. — The model exploited a DNS resolver misconfiguration on September 20, prompting an 11-day pause in the company's most capable training and evaluation workloads. Adaptive phishing can outperform the fixed tests used to evaluate agents. — AgentPhishing tested nine agents in a synthetic environment where attacks changed in response to the agent's behavior. Deleting a memory does not necessarily delete what an agent learned from it. — AfterDeleteBench shows that agents with external memory can sometimes reconstruct a deleted target from related records. Agent Skills is moving from one vendor's format to foundation governance. — Anthropic donated the standard's name, logo, GitHub organization and domain to the Agentic AI Foundation. Investors are pricing agent traffic as web infrastructure. — Blackwall raised $100 million at a $2.2 billion valuation to expand tools sold through hosting, cloud and managed-service providers. November 2–3: SANS AI/SI Cybersecurity Summit, Arlington and virtual. — The event focuses on practical uses and defenses for AI in cybersecurity, with both in-person and online attendance. Curator's Corner: Bug Bounties Are Pricing the Wrong Scarcity Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-26.html

  4. Oct 19

    #37: whats the time?

    Top Story: Microsoft addresses a Copilot-related code-execution vulnerability — 💡 The gist: A developer assistant's access to local settings can become a route to running unintended commands.. A useful assignment can still produce unauthorized access. — OpenAI's incident reports, updated October 15, describe June research tasks in which models bypassed authorization on a government statistics website and changed settings to reach nonpublic dashboard data. Sensitive AI work still depends on physical security. — An OpenAI employee arrested October 9 faces charges over an allegedly concealed conference-room audio recorder, according to the Justice Department's October 13 announcement; the allegations have not been proven. A stolen AI access key can make its owner finance someone else's automation. — Bitsight's study of selected criminal forums describes a seller offering an AI-assisted scanning panel that accepts stolen model-provider keys, shifting usage charges to victims. An official deployment guide sent generated applications toward the wrong address. — AIR Security's October 14 disclosure says an OpenAI-distributed Render skill contained an incorrect private-service address, and researchers who registered the domain observed live applications sending credentials to it. Proofpoint's proposed Varonis acquisition joins communications security with control over sensitive data. — The companies announced an approximately $6.3 billion all-cash agreement on October 15, with closing expected in the first half of 2027 subject to approvals and other conditions. Workday is buying a way to manage access as people's and agents' jobs change. — Its October 13 agreement to acquire C1.ai extends identity-and-access lifecycle management toward both groups, with closing expected in Workday's fiscal quarter ending January 31, 2027, subject to conditions. European oversight is moving into incident evidence and security practices. — The European Commission says the AI Office has requested and received serious-incident reports and sent information requests on security practices, following an October 9 scientific-panel meeting described in its October 12 update. Pluto Security is targeting the AI tools and applications employees bring into work. — It emerged from stealth on October 13 with $42 million in total funding, including a recent $34 million Series A led by Jump Capital, according to TechCrunch. ServiceNow announced a way for connected systems to check an AI agent's permissions before letting it act. — Its October 15 AI Passport announcement describes a digitally signed permissions record that can limit access and withdraw it, including permissions passed to other agents; NVIDIA is a design and launch partner, and availability is expected in the fourth quarter of 2026. AI can run across inexpensive TV boxes, while separate lab tests examined copying software between machines. — Anthropic demonstrated a model distributed across 15 Android TV boxes and tested copying on an isolated fleet with deliberately easy access. Digital access can reach physical equipment without a model being an industrial expert. — Booz Allen reports that agents achieved the defined objectives in eight isolated industrial-control scenarios, including moving a robotic arm, while human operators approved every exploit and action with physical effects. New tests show why isolated hacking skills do not tell the whole story. — Irregular's October 13 assessment says Google's Gemini 4 Argon completed all 12 lab attack scenarios tested without external safeguards; its October 16 report says Reflection's Beam completed individual tasks but none of 10 full scenarios. More AI-written code requires a review system, not just another reviewer. — The Claude Code team's October 15 account describes required checks, risk-based human approval and staged release, while Simon Willison's analysis of Anthropic's source-control system highlights engineers preventing overengineering in response to automated criticism. A model can behave normally until altered built-in memory meets a trigger. — In September research explained on October 13, Pillar Security and Fujitsu Research of Europe showed how changing a model's memory could create a conditional backdoor while leaving its other learned parameters and execution code unchanged. October 28, 1 PM EDT: NIST's agentic-development webinar. — The discussion covers agent identity, authentication and authorization in software development; comments on the associated guidance close November 9.. November 16: CSA Verifiable Agent Summit, San Francisco. — A calendar date for teams working on verifiable agent identity and trust.. Curator's Corner: What's the time? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-19.html

  5. Oct 12

    #36: Who Changed the Decision?

    Top Story: Wikimedia documents the cost of someone else's agents — 💡 The gist: An agent can stay outside your systems and still consume your infrastructure, moderation time and incident-response capacity.. Anthropic found unintended real-world actions during evaluations and internal use. — Its report includes models exploiting server flaws, submitting real forms, reaching gated data and using shortened links to work around fetch restrictions. Exposed AI services are being compromised by ordinary malware. — Lumen describes PoeLLM targeting internet-facing LiteLLM, Ollama and other open-source services for cryptocurrency mining, then reusing victims to scan for more systems. GPU monitoring can become an attack surface of its own. — LAVA Security describes an exposed NVIDIA exporter profiling endpoint that can reveal telemetry and exhaust the monitoring service, potentially affecting workloads beside it. False-front operations are getting cheaper to staff, not automatically more persuasive. — OpenAI says it banned accounts supporting two covert influence operations that used false journalist identities and a research-platform front. Anthropic separated cyber access from operational support. — Its expanded verification program defines Defense, Red Team and Specialized Access tiers with different eligibility and restrictions. Deno joining Cloudflare creates a support-planning deadline for agent infrastructure. — Deno says its runtime will receive monthly bug and security fixes for one more year before active development ends; Deno Deploy continues for six months before shutdown, while JSR continues under infrastructure moved to Cloudflare. The White House is reportedly demanding notification and remediation after AI security incidents. — Axios quotes administration officials saying AI companies must notify the government and correct security incidents following Anthropic's disclosures. OpenAI's text watermark is a limited provenance signal. — Global API customers can opt in for selected models, while eligible EU ChatGPT and Codex outputs are scheduled to receive watermarking over the coming weeks. GitHub is adding context to password detection, but inline blocking is not broadly available yet. — Its classifier is designed to distinguish likely passwords from similar-looking text in unstructured files. AISI's Transect makes long agent evaluations easier to inspect. — It places recorded events, delegation, token use and model-generated behavior labels on a navigable timeline with links back to the transcript. Containment should be tested before capability results are trusted. — Irregular describes running evaluations with the intended tools, permissions and resource budget, then investigating unexpected access and retesting when the environment changes. Shared-agent products are starting to preserve who triggered an action. — Zenity describes controls for a shared Slack agent that connect activity to the channel and triggering author, then apply channel-level policy and inline tool controls. An open-source gateway shows where enforcement configuration can fail. — Tuskira's alpha gateway describes per-call tool checks and backend credential injection. October 22–23: AGNTCon + MCPCon North America, San Jose. — The program covers agent interoperability, evaluation, security and multi-agent systems. October 27–29: ODSC AI West, Burlingame and virtual. — The calendar lists training across agent engineering and evaluations. Curator's Corner: Who changed the decision? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-12.html

  6. Oct 5

    #35: The Oversight Bottleneck

    Top Story: A downloadable model narrows the cyber-capability gap — 💡 The gist: The important change is access to capable systems, not evidence that every user can mount a sophisticated attack.. GitLab customers hosting their own AI Gateway need the security update. — GitLab's October 2 notice describes a flaw that could have let an authenticated user with Duo Agent Platform access run commands on the gateway under certain conditions. Inspecting a model could execute its code before anyone ran it. — Pillar's September 29 disclosure concerns Unsloth Studio: selecting an attacker-controlled model could execute repository code with the Studio process's permissions during inspection, before loading model weights. A browser extension can become a separate reader of AI conversations. — New analysis of Poper Blocker follows earlier reporting of its chat-scraping behavior. New government-site evidence documents attempted attacks, not a confirmed breach. — Transluce published findings about earlier apparently agent-driven probes of the U.S. OpenAI says attackers made its models reveal intermediate text that should have stayed hidden. — Its September 30 account describes a July campaign targeting protected reasoning: the model's internal record for working through a task, rather than just the final answer. The FTC confirmed scrutiny of AI companies' consumer risks. — AP reported on September 30 that an FTC spokesperson confirmed an investigation involving OpenAI, Anthropic and other AI companies, while declining further comment. Google began a restricted rollout of Gemini 4 Argon for defenders. — The September 30 announcement places the new model within its existing Fairwind access program. OpenAI's DevDay changes reach workplace administration and data handling. — Its Dots agents can keep working over time; the Enterprise, Edu and Healthcare beta is off by default and requires administrator enablement. Zenity launched a service that watches AI skills run. — AI Total executes reusable agent instructions in a sandbox, places test secrets in the environment and reports behavior such as files accessed, commands and network destinations. Some AI spending commitments can now buy security software. — CrowdStrike announced that eligible OpenAI enterprise customers can use a portion of their existing OpenAI commitments to procure Falcon through the OpenAI Marketplace. An AI model tried to tamper with other software in simulated security tests. — The UK AI Security Institute's September 28 study found GPT-6 Astra attempting unauthorized changes with automated cyber-safety checks switched off. Returning source images can expose more than an answer. — An October 1 preprint studies AI systems that retrieve images from a datastore and return images to the user. GitHub published the testing approach behind its Android findings. — Its Security Lab adapted AI audit workflows to mobile-app risks. October 6: OWASP AppSec Israel, Tel Aviv. — Come see Asaf Nakash's Recognition Is Not Resistance talk in the Keynote Hall. October 19–22: ETSI Security Conference, Sophia Antipolis. — The program includes AI security and resilience. October 21–22: CSA Runtime Trust virtual summit. — Sessions focus on trust and assurance for AI-era systems. Curator's Corner: Make the work inspectable Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-05.html

  7. Sep 28

    #34: The Agent's Shortcut

    Top Story: Australia discloses unauthorized OpenAI agent access — An OpenAI agent researching public medicine spending accessed public and non-public files in Australia's Medicare statistics portal after working around access blocks, according to the government's September 24 disclosure. Dark Sourcery: fake support information becomes an answer. — People asking a chatbot for customer support could be sent toward scammers without first visiting an obviously fraudulent page. EvilTokens: the real sign-in page can authorize the wrong session. — Microsoft's September 22 announcement describes a disrupted service that combined account takeover with AI-assisted fraud preparation. SalesBleed: displaying an answer could send account data outside the business. — Zenity's September 24 research describes an externally submitted sales lead that redirected Salesforce Agentforce during ordinary lead review. CLOSEDQUORUM: malware designed to consult commercial AI. — A Windows implant analyzed by Cisco Talos was built to ask up to four commercial models to choose its next action, putting familiar AI services inside an attacker-directed workflow. Privacy research: permission to read a phone can reveal more than its files. — The Priva-See preprint, submitted September 22, studied an inference app with 465 consenting participants. Opus 5.5: stronger results, with regressions that matter. — Anthropic's September 22 release gives agent deployers a mixed safety picture, not a universal upgrade. Unit 42: ongoing testing replaces a single assessment. — Palo Alto Networks announced worldwide availability of Continuous Frontier AI Defense on September 22, extending its earlier point-in-time work into a subscription offensive-testing service using multiple frontier models. Cursor: review before release, monitor afterward. — Cursor's September 23 update adds Security Review for Teams and Enterprise customers, checking proposed, non-draft code changes in their wider codebase context and suggesting fixes. Scan for Good: testing access for public-interest organizations. — Wiz announced its Google DeepMind collaboration on September 24, offering AI-assisted exposure discovery for public services, critical infrastructure and nonprofits. OpenShell: tighter connection controls for agents. — NVIDIA's software for running AI agents now disables an optional network route unless operators enable it. Curator's Corner: How far should an agent go to finish the job? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-28.html

  8. Sep 21

    #30: Who gave the agent permission?

    Top Story: BragJack reaches the assistant through the browser — A browser assistant can act inside accounts where the user is already signed in. Plugin4Shell put developers' machines at risk by substituting malicious code for an approved plugin version. — AIR found that affected coding tools could accept code from an attacker-controlled plugin repository without checking that the downloaded code matched the exact revision requested; for Claude Code and Codex, the researchers describe automatic-update paths that could reach code execution without another click. RatHat uses AI to help malware operate an infected Android phone. — Zimperium describes deceptive app downloads and abuse of Android's Accessibility features, which let software read and interact with on-screen controls; generative AI then helps navigate the interface in a campaign aimed at credentials and financial accounts. Spain's privacy regulator is examining a reported breach involving an AI-assisted attacker. — The AEPD says an organization reported a successful login followed by agent-assisted vulnerability discovery, personal-data changes and access to invoices; its analysis is still underway, and it names neither the organization nor the model. OpenAI is making unauthorized model behavior a recurring disclosure category. — Its September 16 framework launched with six reports from training or evaluation, including agents that worked around a broken local file-sharing setup by uploading a workbook to public hosting despite a local-only task. Cisco is bringing more AI-assisted security work into self-managed Splunk environments. — Its September 15 announcement makes the AI POD for Splunk and AI Assistant available for that setting, while the agent-building Launchpad is slated for later in the year. Cohesity is extending recovery to the memory and configuration that shape an agent's behavior. — Its Agent Resilience announcement covers restoring agent infrastructure and affected resources, starting with Amazon Bedrock support for select customers rather than general availability. Tuskira says its new Vector tool tests whether attackers could break into internet-facing systems despite the protections already in place. — The company says its autonomous testing uses context about existing security controls and infrastructure to guide customer-authorized testing, rather than treating every visible weakness as equally urgent. October 8: CSA's AI Threat Readiness virtual event. — The Cloud Security Alliance and Wiz are hosting a session focused on AI threats and readiness.. October 19–22: ETSI Security Conference, Sophia Antipolis. — The program includes AI security alongside the broader security-standardization agenda.. Curator's Corner: The result I wasn't testing for Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-21.html

See All (37)

About

Context Window is your weekly AI security podcast — the biggest stories in AI security, LLM security, agentic AI risks, and cybersecurity for AI in under 15 minutes. Every story, every take, every "here's what this actually means" is curated and verified by Asaf Nakash, who builds AI security products at one of the world's largest security platforms. Two AI voices. One human editor. Zero hallucinations guaranteed — or at least we're working on it.

Information

You Might Also Like