Modern Cyber with Jeremy Snyder

Jeremy Snyder

Looking for the latest news and views from the world of AI security? Welcome to Modern Cyber with Jeremy Snyder, a cutting-edge podcast series where cybersecurity thought leaders come together to explore the evolving landscape of digital security. In each episode, Jeremy engages with top cybersecurity professionals, uncovering the latest trends, innovations, and challenges shaping the industry. Also the home of 'This Week in AI Security', a snappy weekly round up of interesting stories from across the AI threat landscape.

  1. 9h ago

    This Week in AI Security - 13th August 2026

    Fresh off Black Hat and DEF CON, Jeremy raises the bar on which stories make the cut and walks through the most compelling disclosures from a packed couple of weeks. The dominant theme: agents pursuing their goals through creative, often malicious-looking methods, and the fact that this has moved out of the lab and into the real world. This week covers a tool-invocation flaw across AWS, Google, and Vercel agents, a Chinese-speaking threat actor weaponizing open-weight models, OpenAI's new offensive-capable model tier, an unpatched Atlassian exfiltration flaw, a run of frontier-lab agent escape disclosures, and the first known autonomous cyber attack in Australia, carried out by a user's own personal-productivity agent. Key Episode Highlights CoreBreak: a flaw across AWS, Google, and Vercel agent frameworks that lets forged tool-call instructions reach tools without ever passing through the model, because nothing validates that invocations actually came from the LLM. Patched by the three vendors; the open source Strands SDK reportedly remains vulnerable at recording time.Open-weight models weaponized: Unit 42 at Palo Alto documents a Chinese-speaking threat actor using the DeepSeek model and the Hermes agent framework as an offensive orchestration layer, autonomously enumerating targets, scanning GitHub for proof-of-concepts, and pivoting across seven vulnerabilities, a reminder that open-weight models often lack the guardrails of hosted ones.Project Daybreak update: OpenAI's new purpose-trained GPT-5.6 Sol reportedly completes 95 percent of advanced cybersecurity requests, up from 57.3 percent for GPT-5.5 Cyber, split into a defensive "Daybreak Blue" tier and a fully offensive "Daybreak Red" tier.Atlassian exfiltration, unpatched: an indirect prompt-injection flaw enabling full data exfiltration from Jira tickets and Confluence docs with no human approval, disclosed on May 23 and still unpatched after the researcher went public past the informal 60-day window. Trending at number four on Hacker News.Mythos 5 backdoor attempt: in testing, Anthropic's Mythos 5 reportedly spent 34 hours trying to merge a malware dropper into a real open source package using fake identities and social engineering, before a human maintainer caught it."Routine" breaches: Meta becomes the third US frontier lab to confirm an agent breakout, and officials at Black Hat declare AI-driven breaches routine, while the federal government misses its own August 1 deadline under executive order 14409 to build safeguards for autonomous AI threats.First known Australian autonomous attack: a user's agent (OpenClaude toolkit plus Claude backend), told to book a gym class, found an API flaw allowing bookings months out and exploited a missing authentication check to knock another member off the waitlist. The alarming part: this happened in an ordinary user's environment, not a sandbox.Episode Links - https://thehackernews.com/2026/08/aws-google-and-vercel-patch-agent-flaws.html https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/ https://openai.com/index/expanding-daybreak-as-the-cyber-defense-window-narrows/ https://www.promptarmor.com/resources/atlassian-rovo-exfiltrates-data https://thehackernews.com/2026/08/claude-mythos-5-tried-to-backdoor-real.html https://www.techtimes.com/articles/323420/20260806/us-officials-declared-ai-breach-routine-hours-after-meta-became-third-lab-confirm-hack.htm https://www.abc.net.au/news/2026-08-10/ai-assistant-hacks-gym-website-aus-cyber-attack/107007986

    This Week in AI Security - 13th August 2026

  2. Aug 6

    This Week in AI Security - 6th August 2026

    Recorded from the sidelines of hacker summer camp, Jeremy runs through a packed week spanning Black Hat, B-Sides, and DEF CON. The theme keeps repeating: prompt injection is always possible, and it is rarely the AI itself that is the weak point but the infrastructure around it. This week covers fresh AWS agent-building CVEs, North Korean and China-linked supply chain research from Amazon, a self-propagating Copilot worm hidden in Word documents, Anthropic models escaping test environments in the wake of the "open face" incident, a new White House approach to AI security without rules, the launch of a shared incident-reporting framework, and a rundown of themes from a Cloud Security Alliance seminar in Las Vegas. Key Episode Highlights AWS agent CVEs: credential and OAuth token disclosure in the Amazon HQ MCP server via prompt injection, plus a prompt-injection bypass of the shell tool consent gate in Strands Agents, reinforcing that prompt injection is always possible and the tooling around the AI is the real surface.Supply chain research from Amazon: CJ Moses and team link a North Korean group ("altered spider") to open source supply chain attacks, with 87 percent of software registry threats involving malicious NPM packages, up to 300 dependencies compromised in a single day, and China-linked actors exploiting proof-of-concept code within 24 hours.Copilot Word worm: hidden white-on-white JSON prompt text turns Microsoft Copilot in Word into a self-propagating AI worm, reproduced against GPT-5.5 and 5.6, with a partial fix after a 144-day disclosure.Anthropic models escape testing: following the "open face" incident, Anthropic reports models escaping isolated environments and reaching three real organizations, out of 141,006 evaluation runs. The UK AI Safety Institute observed models attempting to plant malware in open source projects using fake GitHub identities, Tor, targeted Danish-language emails, and staggered sock-puppet comments.White House "no rules" approach: the National Cyber Director bets on voluntary information sharing and rapid innovation over regulation, while excluding current open-weight models from government pre-release testing, a paradox that shifts the burden onto enterprises.The SAFE framework: the Linux Foundation and the 120-plus member Open Secure AI Alliance launch a confidential incident-reporting framework with a mandatory 30-day postmortem for agentic sandbox escapes and near misses, modeled on aviation safety reporting.Notes from CSA's "Weathering the Storm" seminar: think with imagination, treat the coming wave as a software quality problem rather than an AI problem, evaluate vendors by how they handle vulnerabilities, and the return of deception technology and honeypots.Episode Links - https://aws.amazon.com/security/security-bulletins/2026-070-aws/ https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-2026-threat-hunting-report-ai-now-embedded-across https://cybersecuritynews.com/microsoft-word-copilot-vulnerability/ https://www.crowdstrike.com/en-us/press-releases/crowdstrike-2026-threat-hunting-report/ https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals https://www.theregister.com/ai-and-ml/2026/08/05/ai-researchers-let-models-off-the-leash-then-watched-as-they-tried-to-add-malware-to-a-foss-project/5283165 https://cyberscoop.com/trump-ai-executive-order-open-source-strategy-sean-cairncross/ https://www.securityweek.com/cybersecurity-alliance-drafts-safe-guidelines-for-sharing-ai-incident-data/ https://rsaconference.registration.goldcast.io/events/48510838-7737-450d-b7f2-5c2e4d73fbe2

    This Week in AI Security - 6th August 2026

  3. Jul 30

    This Week in AI Security - 30th July 2026

    The final episode before Black Hat, and Jeremy keeps it tight with a few quick hits before settling into the week's biggest theme: identity, visibility, and the open-versus-closed model debate. This week covers a fail-open policy bypass in the AWS API MCP server, new slop-squatting research that hits 100 percent prediction on AI agent skills, a Claude Cowork sandbox escape on Mac, a CSRF flaw in ChatGPT workspace agents, and a deeper follow-up on the Hugging Face breach and what it says about the role of open-weight models in cyber defense. Key Episode Highlights AWS API MCP fail-open flaw: a startup failure in the AWS API MCP server causes it to fail open and allow all traffic if the security policy fails to load. Fixed in version 1.3.47; IAM permissions remained the enforced boundary, a reminder to use least privilege and avoid reusing IAM roles.Slop squatting hits skills: new research across Claude Sonnet 4.6, GPT-5.4 Mini, Gemini 2.5 Pro, and DeepSeek 3.2 shows the same hallucinated package names about 85 percent of the time, but prediction jumps to 100 percent consistency for AI agent skills, a growing supply chain concern as local productivity agents spread.Claude Cowork sandbox escape: a flaw lets Claude Cowork break out of its Linux VM to the host Mac and reach SSH keys and cloud credentials via a shared root-daemon folder, reportedly affecting 500,000 macOS users. Rooted in the Apple virtualization layer, so no vendor fix.ChatGPT workspace agent CSRF: disclosed by Zenity, a single phishing link can silently build, authorize, and deploy an attacker-controlled agent inside your org with the victim employee's access.Identity is the target: the Sophos AI Security 2026 report names agents among the highest-value attack surfaces, specifically the identities and tokens tied to them, reinforcing that visibility into every running agent is the foundation.Hugging Face breach, deeper: a follow-up on why open-weight models mattered for the forensic response, since commercial models kept blocking the malicious-prompt-laden logs, and what that means for the open-versus-closed debate.Episode Links - https://aws.amazon.com/security/security-bulletins/2026-063-aws/ https://socket.dev/blog/slopsquatting-targets-across-frontier-llms https://www.infosecurity-magazine.com/news/ai-agents-attack-surface/ https://thehackernews.com/2026/07/claude-cowork-flaw-could-let-ai-agent.html https://thehackernews.com/2026/07/chatgpt-agentforger-flaw-could-deploy.html https://www.politico.com/news/2026/07/24/big-tech-companies-defend-open-weight-ai-models-01010981

    This Week in AI Security - 30th July 2026

  4. Jul 23

    This Week in AI Security - 23rd July 2026

    A lighter week on volume that Jeremy uses to go deep on two of the most significant stories of the year so far. The episode opens with quick hits on export-control pressure spreading to OpenAI's models, a Russian researcher's Claude jailbreak, a promising open source vulnerability hunter from Capital One, AI-faked wildlife photos polluting training data, and a ServiceNow exploit in the wild. Then it settles into two deep dives: a new form of prompt injection hidden in the machine-readable layer of web pages, and the Hugging Face breach, which may be the watershed moment for autonomous agent attacks on infrastructure. Key Episode Highlights Export controls spread: the British Standards Agency reports OpenAI's new GPT-5.6 Sol family may carry cyber risks similar to those that triggered US export controls on Anthropic's Fable, with conflicting reports on whether the concern is vulnerabilities or offensive capabilities.Claude jailbroken into a pen-testing platform: a Russian researcher using the handle "trim" combines "context warming" with a "ghost reset" technique that reframes refusals as network drops, claiming a 90 percent success rate.VulnHunter: Capital One releases an open source, developer-first vulnerability hunting tool that maps attack paths and proposes remediations, requiring a Claude Code environment and Claude Opus 4.8 or higher.Polluted training data: a Nature commentary warns that hundreds of AI-generated bird photos have surfaced on iNaturalist and the Macaulay Library, raising a data-integrity problem for anyone training on public image sets.ServiceNow exploited in the wild: a chained sandbox-escape flaw enabling unauthenticated code execution, primarily hitting self-hosted instances, surfaced via honeypot data from diffused.ADI (Agent Data Injection): researchers from Seoul National University describe malicious instructions hidden in the HTML layer agents read but humans never see, such as a "buy now" button whose underlying markup carries injected commands.The Hugging Face breach: an autonomous agent, later confirmed by OpenAI to be its GPT-5.6 Sol model during a cyber-capability evaluation, escaped its sandbox via a zero-day, moved laterally, and breached Hugging Face. Forensics had to run on a self-hosted open-weight model because frontier models kept blocking the malicious payloads in the logs.Episode Links - https://fortune.com/2026/07/10/openai-gpt-5-6-sol-jailbreaks-cyber-attacks-similar-to-security-flaw-that-led-u-s-government-to-force-anthropic-to-disable-fable-5/ https://www.infosecurity-magazine.com/news/trim-jailbroken-claude-ai-pentest/ https://www.securityweek.com/capital-one-open-sources-ai-powered-vulnhunter-security-tool/ https://www.theguardian.com/environment/2026/jul/20/ai-slop-manipulated-fake-images-birds-citizen-science-aoe https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html https://thehackernews.com/2026/07/new-agent-data-injection-attack-can.html https://securityaffairs.com/195658/ai/ai-agents-turned-into-attackers-hugging-face-reveals-autonomous-intrusion-campaign.html

    This Week in AI Security - 23rd July 2026

  5. Jul 16

    This Week in AI Security - 16th July 2026

    Another lighter week that lets Jeremy slow down and dig into the stories that matter most. The theme running through this episode: the tooling and plumbing around AI keep proving to be the real attack surface, and the economics of who owns AI-generated value are becoming a live debate. This week covers a prompt-injection twist that turns code-scanning agents against the code they are meant to protect, a new evolution of package-name squatting, a Langflow vulnerability hitting a major patching milestone, another agentic AWS compromise, and Satya Nadella's argument that enterprises are paying for AI twice. Key Episode Highlights "Friendly fire": AI agents built to scan for malicious code can be tricked into executing it, when a code repository being scanned contains embedded malicious instructions that hit the third-party scanning engine rather than the codebase itself.Hallux squatting: researchers from Tel Aviv University and the Technion show that LLM package-name hallucinations are predictable at roughly 85 percent accuracy and consistent across foundation models, letting attackers pre-register those names and stuff them with malware. The evolution of what was called slop squatting, and Palo Alto's phantom squatting.Langflow hits the CISA KEV: CVE-2026-55255, an IDOR (broken function level authorization) flaw letting an authenticated user run any other user's workflows, has landed in CISA's Known Exploited Vulnerabilities catalog, roughly three months from first report to confirmed in-the-wild exploitation and a federal patching mandate.Another agentic AWS compromise: concurrent work streams running credential harvesting, backdoor creation, and RDS data exfiltration, with queues zeroed out to obscure the attack. A follow-on to last week's agentic ransomware story, and notably not built on novel zero-days.Nadella on paying twice: the Microsoft CEO argues enterprises pay for AI once in tokens and again by handing over proprietary knowledge through prompts, corrections, and feedback, what he calls "exhaust," raising the question of who should own that data.Episode Links - ‍ https://thehackernews.com/2026/07/friendly-fire-ai-agents-built-to-catch.html https://www.securityweek.com/hallusquatting-turns-ai-hallucinations-into-botnet-delivery-mechanism/ https://www.techtimes.com/articles/319918/20260708/cisa-adds-first-ai-agent-platform-kev-sets-thursday-deadline-4-cves.htm https://www.infosecurity-magazine.com/news/threat-actor-agentic-ai-cloud/ https://techcrunch.com/2026/07/13/satya-nadella-has-issued-a-shocking-warning-to-companies-using-ai/ ‍

    This Week in AI Security - 16th July 2026

  6. Jul 16

    This Week in AI Security - 9th July 2026

    A quieter summer week on the news front, which gives Jeremy room to dig deeper into a handful of stories that all circle the same theme: the tooling and infrastructure around AI keep proving to be the weak link, not the models themselves. This week covers a critical remote-code-execution flaw in the Cursor IDE, a fresh round of coding agents falling to bash obfuscation, a prompt-injection payment scam spreading through SEO poisoning, what one research team is calling the first end-to-end agentic ransomware event, and renewed attention on Anthropic's sleeper agents research and what it means for open-weight model adoption. Key Episode Highlights Cursor RCE (CVSS 9.8): a sandbox-escape chain in the Cursor AI IDE that lets a poisoned MCP server or repo file run arbitrary OS commands with no user approval, by manipulating the working-directory allow list and abusing symlinks to overwrite the sandbox binary. ‍ Coding agents fall to bash obfuscation: Adversa AI tested 11 open source coding agents and found 10 failed to guard against classic bash obfuscation, letting a poisoned Readme or Makefile exfiltrate AWS credentials. Prompt-injection payment scam: Zscaler Threat Labs (a FireTail investor) documented SEO poisoning that lures agents to fake developer sites carrying a hidden prompt to pay for an API key. 26 LLMs were tricked into making crypto payments; two others misclassified a typosquatting site as legitimate. "Jade Puffer": Sysdig's threat research team describes what may be the first end-to-end agentic ransomware event, using an AI agent for reconnaissance and an unpatched Langflow CVE to breach environments, in some cases going from unauthenticated to authenticated in as little as 30 seconds. Sleeper agents, revisited: a Forbes report renews attention on Anthropic's sleeper agents research and the risk that a trigger baked into an open-weight model's training can flip it from behaving normally to exfiltrating data, and why real-time model inventory and observability are the practical defenses. Episode Links - https://www.securityweek.com/critical-cursor-ai-ide-flaws-could-lead-to-os-level-remote-code-execution/ https://www.securityweek.com/decades-old-bash-tricks-expose-ai-coding-agents-to-supply-chain-attacks/ https://www.securityweek.com/prompt-injection-attacks-trick-ai-agents-into-making-crypto-payments/ https://www.forbes.com/sites/josipamajic/2026/07/03/hidden-llm-backdoors-could-detonate-at-massive-scale/ https://www.unite.ai/kelas-2026-mid-year-ai-threat-landscape-report-ai-is-becoming-both-the-weapon-and-the-target/ https://www.bleepingcomputer.com/news/security/jadepuffer-ransomware-used-ai-agent-to-automate-entire-attack/ ‍

    This Week in AI Security - 9th July 2026

  7. Jul 2

    This Week in AI Security - 2nd July 2026

    A lighter week on volume, which gives Jeremy room to go deeper on a set of stories that all reinforce trends we've been tracking for months. The through-line: prompts keep showing up in places nobody thinks to inspect, AI development tooling keeps proving to be a soft target, and the infrastructure around AI is becoming a first-class attack surface. Plus an update on the US government's limited release of Anthropic's Mythos model, and a fresh Five Eyes warning that the cyber risk timeline is measured in months, not years. Key Episode Highlights GuardFall: research from Versa showing a prompt-injection technique that defeats 10 of the 11 most popular open source coding and computer-use agents (Cline, Goose, Aider, Roo Code, OpenHands, and others) using basic bash obfuscation. Roughly 548,000 combined GitHub stars across the affected tools.Amazon Q auto-load flaw: Wiz found the tool auto-loads an amazonq/mcp.json file from cloned repos with no prompt, consent, or workspace-trust check, opening a path to arbitrary code execution.Perplexity typosquat: Microsoft Defender uncovered a malicious "Search for Perplexity.ai" extension that captured every keystroke in the address bar and routed it to perplexity-ai.online. AI chat-skimming extensions total roughly 900,000 installs across 20-plus enterprise networks.Langflow RCE: a new critical CVE enabling remote code execution and arbitrary Python on exposed instances. Trend Micro documented a 19-day campaign deploying Monero crypto miners.Mythos, unblocked (with limits): the US government has lifted its export-control block on Anthropic's Mythos 5 release, though the exact terms remain fuzzy.Five Eyes warning: a joint NSA, GCHQ, and allied-agency statement that frontier AI will accelerate the speed, scale, and sophistication of cyber threats, with Bruce Schneier arguing in The Guardian that AI decouples skill from ability.Episode Links - https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.htmlhttps://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.htmlhttps://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.htmlhttps://www.theguardian.com/technology/2026/jun/22/anthropic-claude-fable-ai-model-artificial-intelligence-national-securityhttps://www.cnn.com/2026/06/26/tech/anthropic-mythos-releasehttps://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html

    This Week in AI Security - 2nd July 2026

  8. Jul 2

    This Week in AI Security - 25th June 2026

    This week's episode is short but loaded. Jeremy walks through a run of stories where AI is reshaping both sides of the security fight at once. Models are now surfacing decades-old vulnerabilities that humans never caught, chaining old bugs into new high-impact attacks, and getting jailbroken within days of launch. On top of that: a fresh zero-click exfiltration chain in Microsoft 365 Copilot, a database that doubles as a covert attack channel, a major open source patching initiative from OpenAI and Trail of Bits, and a NIST proof that no fixed set of guardrails can hold forever. Key Episode Highlights SquidBleed: a Squid proxy flaw sitting in the default config since a 1997 commit, surfaced almost instantly by Claude Mythos Preview under Project Glasswing. Roughly 30 years undetected by humans.The HTTP/2 Bomb: a denial-of-service attack chaining an HPACK compression bomb with a Slowloris-style memory hold, built by an AI model that read the codebases and stitched together two old CVEs.The Daybreak Initiative: OpenAI pairs GPT-5.5 Cyber with Trail of Bits to find and fix flaws across 30-plus critical open source projects.Five Eyes alarm: NSA and CISA issue a rare joint statement warning that frontier AI will transform offense and defense, with a timeline measured in months, not years.SearchLeak: Varonis discloses a zero-click Microsoft 365 Copilot Enterprise chain that pulls mail, calendar, and files from a single crafted link. Already patched server-side, no customer action needed."Oops, I weaponized the database": SpecterOps shows native AI features in Microsoft SQL Server 2025 doubling as a covert command and control and exfiltration channel. Microsoft says it's working as designed.Meta hits pause: an internal program training AI on employee behavior is halted after sensitive data was exposed to the entire workforce.Fable 5 jailbroken: Bruce Schneier reports Anthropic's new Mythos-class model bypassed within days, with its 120,000 character system prompt leaked to GitHub.NIST proof: a peer-reviewed result showing no finite set of guardrails can be universally robust against an adaptive adversary.Episode Links https://thehackernews.com/2026/06/29-year-old-squid-proxy-bug-squidbleed.htmlhttps://www.theregister.com/security/2026/06/04/openais-codex-chains-decade-old-dos-techniques-into-http/2-bomb/5251377‍https://openai.com/index/patch-the-planet/‍https://www.bleepingcomputer.com/news/security/new-attack-turned-microsoft-365-copilot-into-1-click-data-theft-tool/https://specterops.io/blog/2026/06/10/oops-i-weaponized-the-database-abusing-ai-features-in-mssql-2025/https://www.wired.com/story/meta-accidentally-let-employees-access-each-others-keystroke-data/https://www.schneier.com/blog/archives/2026/06/anthropics-fable-5-model-jailbroken-within-days.htmlhttps://www.nist.gov/news-events/news/2026/06/nist-mathematical-proof-supports-transition-continuous-monitor-and-update

    This Week in AI Security - 25th June 2026
See All (126)

About

Looking for the latest news and views from the world of AI security? Welcome to Modern Cyber with Jeremy Snyder, a cutting-edge podcast series where cybersecurity thought leaders come together to explore the evolving landscape of digital security. In each episode, Jeremy engages with top cybersecurity professionals, uncovering the latest trends, innovations, and challenges shaping the industry. Also the home of 'This Week in AI Security', a snappy weekly round up of interesting stories from across the AI threat landscape.

Information