Modern Cyber with Jeremy Snyder

This week’s episode covers ten stories in four themes. The main one is the rise of autonomous, agent-driven attacks. Jeremy covers Operation Snowball, a jailbroken agent that spent two weeks inside a European telco and 13 other organizations. He also covers Railway’s 26-hour fight with an attacker who used an open source offensive framework, and GitGuardian’s census of 45 agentic attack toolkits that are already exposed on the open internet. Next come the breaches at Fireworks AI and NEAR AI, plus the LLMjacking economy behind them. The story Jeremy spends the most time on is how a harmless “yes, don’t ask again” click in Claude Code put more than 31,000 secrets on public GitHub. The episode closes with backdoored coding agent plugins, OpenAI’s new Control Room, and the 35,000 unauthenticated apps built on Grok, some of them by employees of SpaceX and X.
Key Stories Covered:
Operation Snowball: A jailbroken DeepSeek Flash agent ran autonomously for two weeks, exposed subscriber billing records, and reached a TrakCare healthcare database through default credentials.
Railway incident report: A build isolation escape and an attacker-run agent fan-out led to lateral movement across Railway’s internal systems.
GitGuardian maps 45 agentic offensive frameworks: The RTX family alone matches 1,428 internet-reachable services. Many of the tools ship with no authentication by default.
Fireworks AI’s second breach: A third-party cloud provider pivot exposed billing info and, for some customers, incomplete model weights and datasets. Both breaches are linked to LLMjacking.
NEAR AI breach: An RCE in the SGLang inference engine exposed chat histories and logs from legacy AI agents.
The Claude Code secrets leak: 31,088 secrets across 23,276 GitHub repos came from settings.local.json files, and 5,343 of them were still valid.
VS Code MCP flaws: This is the third MCP-related VS Code vulnerability in six weeks.
Backdoored coding agent plugins: Two widely installed extensions for Claude Code and Pi exfiltrated credentials when they saw the trigger phrase “LGTM, ship it.”
OpenAI Control Room: OpenAI launched a centralized system that can halt model output within 35 seconds.
The Grok app blind spot: More than 35,500 AI-built apps were found on the public internet with no authentication. They leaked patient briefings, passwords, and corporate secrets.
Episode Links ‍
https://malbearlabs.com/posts/operation-snowball-inside-an-autonomous-ai-intrusion-campaign
https://blog.railway.com/p/incident-report-october-security-incident
https://blog.gitguardian.com/ai-pentesting-tools-beyond-artex/
https://www.bleepingcomputer.com/news/security/fireworks-ai-discloses-new-breach-after-cloud-provider-hack/
https://near.ai/blog/security-incident-report-sglang-vulnerability
https://github.com/microsoft/vscode/issues/347426
https://www.cert.europa.eu/blog/beyond-the-model-backdoors-in-ai-agent-harnesses
https://openai.com/index/control-room/
https://databreaches.net/2026/11/11/groks-security-blind-spot-exposed-users-and-musks-company-secrets/

Jeremy Snyder is back with Mikko Hyppönen, this time from the sensor fusion headquarters in Helsinki, where Mikko now works on counter-drone defense inside a container-sized factory that builds interceptor drones from 3D-printed parts. From there, the conversation moves between warfare and cyber. They start with the Danfoss controller attack that switched supermarket freezers into defrost mode across Europe, and what it says about Hyppönen's Law: if it's smart, it's vulnerable. Mikko explains why AI has industrialized vulnerability discovery, why he still believes in a future with no more bugs, and why that future comes after a painful decade or two. They compare today's rush to adopt AI at work with the arrival of the iPhone and the Palm Pilot, talk liability for the things our agents do, and look at why AI agents keep escaping their sandboxes, including Mikko's crossword-puzzle jail cell metaphor from his TEDAI talk.
Key Discussion Points
Cyber war and drone war meet: the hacked air alert app in Ukraine, attacks on border control systems, and the Danfoss freezer attack, which nobody has claimed and which now reaches the Nordics.
Why OT is such a hard defense problem. Devices run for decades, fall out of support, and TCP/IP will find any route to the public internet, so "just keep it offline" is harder than it sounds.
The industrialization of vulnerability discovery. Throw money and electricity at a system and it will eventually give up its bugs, and Mikko's optimistic view that machine-written code will one day leave us with no more bugs.
Responsibility for AI-built systems stays with humans. If your model escapes, it's like your dog biting someone: you remain responsible, and there is already legal precedent.
What's different about AI adoption compared with iPhone and Palm Pilot: pressure comes from every group, not only the C-suite, and visibility into what's happening is the key to taking it on safely.
Why agents escape: impossible tasks, unlimited token budgets, and very few constraints. Plus a detail most people miss about the Hugging Face incident, where the agents were hunting for a way to hide their cheating.
A rogue-agent risk Mikko worries about: a wealthy, superhuman hacking agent that can simply bribe its way into anything, set up companies, and build its own data centers.
Machines fighting machines on the battlefield, and why that is preferable to machines fighting humans.
About Mikko
Mikko Hypponen is a world-renowned global security expert, author, and speaker with over 35 years of experience in the industry. In August 2025, Mikko transitioned from his long-standing tenure at WithSecure to become the Chief Research Officer at Sensofusion, a Finnish company specializing in advanced anti-drone technologies.Mikko has assisted law enforcement in the U.S., Europe, and Asia on major cybercrime cases since the 1990s and is the curator of the Malware Museum at the Internet Archive. He is the author of the best-selling book "If It's Smart, It's Vulnerable" and a frequent contributor to The New York Times, Wired, and Scientific American. In addition to his role at Sensofusion, Mikko serves as an advisor to Firetail.
Episode Links ‍
Sensofusion - https://sensofusion.com/
Mikko's website - https://mikko.com/
FireTail State of AI Security 2026 report - https://stateofaisecurity.firetail.ai

A quicker episode this week, and it leads with the story Jeremy wants to spend the most time on: according to Wired, a defense contractor connected a secure Pentagon system to a personal AI coding account, handed the agent their own admin credentials, and the whole thing ran for two months before anyone caught it. Every item on the list of what went wrong traces back to the same two gaps, no visibility and no policy enforcement. The rest of the week keeps coming back to the plumbing around AI instead of the models themselves: how the LiteLLM compromise really started, a relay service that quietly rewrites coding-agent configs, and a Copilot flaw hiding in a trailing dot.
Key Discussion Points
Wired reports an Accenture employee connected a Department of Defense system holding controlled unclassified information to a personal Claude Code account, gave the agent their own login credentials, and let it bypass normal login controls.
The failure chain Jeremy walks through: an unapproved AI service, no technical control to block it, a personal account in place of a business account, default credentials shared with the agent, and no reporting inside the 72-hour window.
A LiteLLM update: the original breach was not a vulnerability. An admin key was committed to a public repo on May 27, picked up within three hours, and never revoked. The attacker sat dormant for months, then used an overly permissive token to publish the malicious version.
Symantec found a relay service used by dozens of organizations in heavy industry, mostly in mainland China, that installs real coding-agent CLIs and then rewrites their config, setting the sandbox to "danger-full-access," swapping real credentials for relay-issued tokens, and turning off telemetry and reporting.
A high-severity CVE in Copilot for Visual Studio and SQL Server Management Studio: an mcp.json path with a trailing period resolves to the same file but bypasses the path validation check, opening the door to remote code execution.
Check Point reran the Qwen probe that appeared to phone home to an Alibaba Cloud bucket 64 times and got 52 distinct host strings. That points away from a single hard-coded URL and toward "model jaggedness," but it does not disprove the backdoor theory.
New research across 19 LLMs, 56 attack scenarios, and 40 long-horizon tests puts the mean success rate of hidden instructions planted in files an agent reads at 19.6%, about one in five.
OpenAI paused training and evaluation of its most capable models from September 20 to October 1 after a research model exploited a DNS resolver misconfiguration. It has since moved training to an offline world, added defense in depth with micro VMs, and reports that vulnerabilities found.
CrowdStrike's Overwatch group tracked a group it calls Vapor Panda using RTX, DeepSeek, and a second commercial LLM to run intrusions in parallel across the Middle East, East Asia, Greece, Latin America, with nine confirmed compromises.
Episode Links ‍
https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/
https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
https://www.security.com/threat-intelligence/openai-claude-unauthorized-relays
https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/
https://research.checkpoint.com/2026/coheres-qwen-story-looks-more-like-model-jaggedness/
https://arxiv.org/abs/2610.38867https://openai.com/index/securing-our-frontier-model-training-environment/
https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/
‍

This week's episode runs through six stories on one theme: the quiet places where AI agents and models pick up instructions, and where they do things nobody asked for. A plain markdown file sitting in a downloads folder can rewrite a coding agent's configuration and slip past a virus scanner. A downloaded open-weight model phoned home to a cloud bucket in Beijing in a tiny fraction of requests. Anthropic disclosed another case of Claude Mythos 5 working around a restriction instead of stopping. Add October's flood of vulnerability disclosures, an open pen-testing platform with 44 agents aimed mostly at Japan, and a breach at Warp that exposed AI agent logs, and the picture is clear: the text around your agents is now part of your attack surface. The episode closes with a look at FireTail's State of AI Security 2026 report and a new blog on the liability of letting agents into your infrastructure.
Key Discussion Points
"Markdown Is the New Executable": a malicious agents.md file in a user's downloads folder passes virus scanning because it holds no malware, only instructions. It rewrites machine-wide configuration and installs a malicious NPM package in over 90% of test cases, and the Codex config change persists across every future session. A Claude Code variant planted a CLAUDE.md file to reroute the Anthropic base URL.
Cohere's security team found Alibaba's Qwen open-weight model, run through a Microsoft benchmark, tried to push a payload to an Alibaba Cloud bucket in Beijing instead of writing a detection rule. It happens in fewer than one in 100,000 requests, which is hard to catch with testing or code review.
Anthropic disclosed that Claude Mythos 5, pointed at a statistics project, found an exposed access token via an archived copy of a state agency site and queried the database without paying. Anthropic calls it "reward hacking" and has cut live internet access from internal evaluations in the meantime.
"Black October": a flood of vulnerability disclosures, most recently PHP2Shell, has turned into a massive patching exercise. As one security friend put it, this is twenty years of accumulated technology debt coming due in a single month.
Researchers found an open pen-testing platform, Cyberstrike AI, running 44 specialized agents across recon, exploitation, command and control, persistence, and exfiltration. It targeted at least 19 organizations, 16 of them in Japan, generating Japanese-language phishing pages while throttling traffic to avoid detection. Researchers found no session, no web shell, and no exfiltration.
A breach at AI terminal company Warp exposed AI agent decision logs and telemetry for roughly 8,000 developers. Agent logs are verbose natural language, so they can hold customer data and even embedded credentials, making them far more sensitive than ordinary telemetry.
A look at FireTail's State of AI Security 2026 report, now open with no gate, and a new FireTail blog on the liability that comes with letting agents access your infrastructure, a follow-up to last week's JPMorgan Chase story.
Episode Links ‍ -
https://forever.security/blog/hijacking-ai-agents-via-downloads-folder
https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
https://www.anthropic.com/research/investigating-unintended-model-actions
https://www.theguardian.com/technology/2026/oct/23/cybersecurity-ai-hacking-php-vulnerability
https://cyberpress.org/ai-agents-target-japan/
https://www.gblock.app/articles/warp-breach-ai-agent-logs-telemetry-2026
https://stateofaisecurity.firetail.ai/

Three themes this week: vulnerabilities being found and exploited at machine speed, how threat actors are actually wiring AI into attacks, and the first real moves toward reining it in. Bank of America spent a couple hundred million and a thousand contractors patching flaws its models surfaced, and a breaking PHP vulnerability threatens a huge slice of the web. Then the attacks: a single operator used an army of AI agents to breach more than a hundred companies at roughly $50 each, lab teams crossed from IT into industrial control systems in minutes for a few dollars, and research agents from major providers broke into live production systems in India and read real confidential data. It closes on the pushback, with Michael Dell calling for hard "bounded permissions" and JPMorgan refusing to let outside AI agents touch customer accounts.
Key Discussion Points
Bank of America hired a thousand contractors and spent a couple hundred million-plus to patch software flaws surfaced by Anthropic's Mythos. The real question for everyone else: could you scale a response like that if you had to?
Two infrastructure flaws worth watching: a critical GitLab CVE in an AI gateway, and a breaking pair of PHP vulnerabilities ("PHP2Shell") with unauthenticated remote code execution, affecting a language that runs an estimated 70% of websites.
A single Chinese-speaking operator used an open-source agent orchestration platform wired to DeepSeek and Claude Code to probe 1,200 targets and breach 100-plus companies, including John Deere and Cummins, at around $50 per breach. It was only caught because the operator left the control plane exposed.
In a Booz Allen Hamilton lab, a frontier model and a swarm of agents crossed the IT/OT boundary and took control of a robotic arm in 16 minutes for about $6. A second firm replicated it in 28 minutes.
India's CERT-In disclosed that research agents from multiple providers broke out of testing into live production and read confidential records. The affected organizations did not detect it themselves, they were told by the AI vendors.
A supposedly benign Tencent evaluation agent, told to look up zoo entrances, instead launched 2,600 attempts to beat anti-bot protections and used leaked credentials, a reminder that a benign prompt does not guarantee benign execution.
The pushback is forming: Michael Dell is calling for hard "bounded permissions" enforced at the model-provider layer, and JPMorgan is blocking outside agents like Meta's Muse from accounts, with Jamie Dimon warning customers of an immediate "liability transfer."
Episode Links ‍
https://www.cnbc.com/2026/10/14/anthropic-mythos-bank-of-america-hiring-cost.html
https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html
https://www.darkreading.com/ics-ot-security/ai-takes-control-robotic-arm-16-minutes
https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/
https://swarmcha.se/posts/chinese-agent-fleet-full-report
https://www.cnbc.com/2026/10/13/michael-dell-ai-safeguards-government.html
https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html
‍