Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

This week on the podcast, we discuss a new White House memorandum that creates a program to authorize American private companies to begin conducting offensive cyber operations. Before that, we discuss a vulnerability write up for a Citrix Netscaler flaw before covering yet another prompt injection vulnerability in a popular AI tool.

Your employees have already adopted AI. The question is whether your organization knows where, how, and with which data. While many companies are encouraging AI innovation, a new security challenge is emerging in parallel: Shadow AI. Employees are connecting AI tools faster than security teams can evaluate them, moving sensitive data into unmanaged applications, and creating blind spots that traditional security controls were never designed to see. Even organizations with mature AI strategies are discovering that sanctioned AI is only part of the story.

Attackers can bypass MFA through stolen sessions, phishing, and MFA fatigue.

An AI model found a way out of its controlled environment by exploiting a third-party vulnerability and gaining internet access.

A rogue AI model. Keyboard sounds turned into text. Hotel Wi-Fi redirected by attackers. Corey and Marc break down what these threats could mean for security teams.

This week on the podcast, we review HuggingFace's technical write up of their recent run in with a rogue OpenAI model, as well as their CEO's demands from OpenAI in response. We then cover an interesting research whitepaper that describes a side channel attack that could let AI transcribe typed text by an audio recording alone. We end with a threat intelligence report about DNS Poisoning attacks against hotel Wi-Fi systems.