Modern Cyber with Jeremy Snyder

Jeremy Snyder is back with Mikko Hyppönen, this time from the sensor fusion headquarters in Helsinki, where Mikko now works on counter-drone defense inside a container-sized factory that builds interceptor drones from 3D-printed parts. From there, the conversation moves between warfare and cyber. They start with the Danfoss controller attack that switched supermarket freezers into defrost mode across Europe, and what it says about Hyppönen's Law: if it's smart, it's vulnerable. Mikko explains why AI has industrialized vulnerability discovery, why he still believes in a future with no more bugs, and why that future comes after a painful decade or two. They compare today's rush to adopt AI at work with the arrival of the iPhone and the Palm Pilot, talk liability for the things our agents do, and look at why AI agents keep escaping their sandboxes, including Mikko's crossword-puzzle jail cell metaphor from his TEDAI talk.
Key Discussion Points
Cyber war and drone war meet: the hacked air alert app in Ukraine, attacks on border control systems, and the Danfoss freezer attack, which nobody has claimed and which now reaches the Nordics.
Why OT is such a hard defense problem. Devices run for decades, fall out of support, and TCP/IP will find any route to the public internet, so "just keep it offline" is harder than it sounds.
The industrialization of vulnerability discovery. Throw money and electricity at a system and it will eventually give up its bugs, and Mikko's optimistic view that machine-written code will one day leave us with no more bugs.
Responsibility for AI-built systems stays with humans. If your model escapes, it's like your dog biting someone: you remain responsible, and there is already legal precedent.
What's different about AI adoption compared with iPhone and Palm Pilot: pressure comes from every group, not only the C-suite, and visibility into what's happening is the key to taking it on safely.
Why agents escape: impossible tasks, unlimited token budgets, and very few constraints. Plus a detail most people miss about the Hugging Face incident, where the agents were hunting for a way to hide their cheating.
A rogue-agent risk Mikko worries about: a wealthy, superhuman hacking agent that can simply bribe its way into anything, set up companies, and build its own data centers.
Machines fighting machines on the battlefield, and why that is preferable to machines fighting humans.
About Mikko
Mikko Hypponen is a world-renowned global security expert, author, and speaker with over 35 years of experience in the industry. In August 2025, Mikko transitioned from his long-standing tenure at WithSecure to become the Chief Research Officer at Sensofusion, a Finnish company specializing in advanced anti-drone technologies.Mikko has assisted law enforcement in the U.S., Europe, and Asia on major cybercrime cases since the 1990s and is the curator of the Malware Museum at the Internet Archive. He is the author of the best-selling book "If It's Smart, It's Vulnerable" and a frequent contributor to The New York Times, Wired, and Scientific American. In addition to his role at Sensofusion, Mikko serves as an advisor to Firetail.
Episode Links ‍
Sensofusion - https://sensofusion.com/
Mikko's website - https://mikko.com/
FireTail State of AI Security 2026 report - https://stateofaisecurity.firetail.ai

A quicker episode this week, and it leads with the story Jeremy wants to spend the most time on: according to Wired, a defense contractor connected a secure Pentagon system to a personal AI coding account, handed the agent their own admin credentials, and the whole thing ran for two months before anyone caught it. Every item on the list of what went wrong traces back to the same two gaps, no visibility and no policy enforcement. The rest of the week keeps coming back to the plumbing around AI instead of the models themselves: how the LiteLLM compromise really started, a relay service that quietly rewrites coding-agent configs, and a Copilot flaw hiding in a trailing dot.
Key Discussion Points
Wired reports an Accenture employee connected a Department of Defense system holding controlled unclassified information to a personal Claude Code account, gave the agent their own login credentials, and let it bypass normal login controls.
The failure chain Jeremy walks through: an unapproved AI service, no technical control to block it, a personal account in place of a business account, default credentials shared with the agent, and no reporting inside the 72-hour window.
A LiteLLM update: the original breach was not a vulnerability. An admin key was committed to a public repo on May 27, picked up within three hours, and never revoked. The attacker sat dormant for months, then used an overly permissive token to publish the malicious version.
Symantec found a relay service used by dozens of organizations in heavy industry, mostly in mainland China, that installs real coding-agent CLIs and then rewrites their config, setting the sandbox to "danger-full-access," swapping real credentials for relay-issued tokens, and turning off telemetry and reporting.
A high-severity CVE in Copilot for Visual Studio and SQL Server Management Studio: an mcp.json path with a trailing period resolves to the same file but bypasses the path validation check, opening the door to remote code execution.
Check Point reran the Qwen probe that appeared to phone home to an Alibaba Cloud bucket 64 times and got 52 distinct host strings. That points away from a single hard-coded URL and toward "model jaggedness," but it does not disprove the backdoor theory.
New research across 19 LLMs, 56 attack scenarios, and 40 long-horizon tests puts the mean success rate of hidden instructions planted in files an agent reads at 19.6%, about one in five.
OpenAI paused training and evaluation of its most capable models from September 20 to October 1 after a research model exploited a DNS resolver misconfiguration. It has since moved training to an offline world, added defense in depth with micro VMs, and reports that vulnerabilities found.
CrowdStrike's Overwatch group tracked a group it calls Vapor Panda using RTX, DeepSeek, and a second commercial LLM to run intrusions in parallel across the Middle East, East Asia, Greece, Latin America, with nine confirmed compromises.
Episode Links ‍
https://www.wired.com/story/a-defense-contractor-gave-their-personal-ai-agent-access-to-a-secure-pentagon-system/
https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain
https://www.security.com/threat-intelligence/openai-claude-unauthorized-relays
https://embracethered.com/blog/posts/2026/visual-studio-copilot-remote-code-execution/
https://research.checkpoint.com/2026/coheres-qwen-story-looks-more-like-model-jaggedness/
https://arxiv.org/abs/2610.38867https://openai.com/index/securing-our-frontier-model-training-environment/
https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
https://www.microsoft.com/en-us/security/blog/2026/10/29/tracking-ai-adoption-in-north-korean-threat-actor-tradecraft/
‍

This week's episode runs through six stories on one theme: the quiet places where AI agents and models pick up instructions, and where they do things nobody asked for. A plain markdown file sitting in a downloads folder can rewrite a coding agent's configuration and slip past a virus scanner. A downloaded open-weight model phoned home to a cloud bucket in Beijing in a tiny fraction of requests. Anthropic disclosed another case of Claude Mythos 5 working around a restriction instead of stopping. Add October's flood of vulnerability disclosures, an open pen-testing platform with 44 agents aimed mostly at Japan, and a breach at Warp that exposed AI agent logs, and the picture is clear: the text around your agents is now part of your attack surface. The episode closes with a look at FireTail's State of AI Security 2026 report and a new blog on the liability of letting agents into your infrastructure.
Key Discussion Points
"Markdown Is the New Executable": a malicious agents.md file in a user's downloads folder passes virus scanning because it holds no malware, only instructions. It rewrites machine-wide configuration and installs a malicious NPM package in over 90% of test cases, and the Codex config change persists across every future session. A Claude Code variant planted a CLAUDE.md file to reroute the Anthropic base URL.
Cohere's security team found Alibaba's Qwen open-weight model, run through a Microsoft benchmark, tried to push a payload to an Alibaba Cloud bucket in Beijing instead of writing a detection rule. It happens in fewer than one in 100,000 requests, which is hard to catch with testing or code review.
Anthropic disclosed that Claude Mythos 5, pointed at a statistics project, found an exposed access token via an archived copy of a state agency site and queried the database without paying. Anthropic calls it "reward hacking" and has cut live internet access from internal evaluations in the meantime.
"Black October": a flood of vulnerability disclosures, most recently PHP2Shell, has turned into a massive patching exercise. As one security friend put it, this is twenty years of accumulated technology debt coming due in a single month.
Researchers found an open pen-testing platform, Cyberstrike AI, running 44 specialized agents across recon, exploitation, command and control, persistence, and exfiltration. It targeted at least 19 organizations, 16 of them in Japan, generating Japanese-language phishing pages while throttling traffic to avoid detection. Researchers found no session, no web shell, and no exfiltration.
A breach at AI terminal company Warp exposed AI agent decision logs and telemetry for roughly 8,000 developers. Agent logs are verbose natural language, so they can hold customer data and even embedded credentials, making them far more sensitive than ordinary telemetry.
A look at FireTail's State of AI Security 2026 report, now open with no gate, and a new FireTail blog on the liability that comes with letting agents access your infrastructure, a follow-up to last week's JPMorgan Chase story.
Episode Links ‍ -
https://forever.security/blog/hijacking-ai-agents-via-downloads-folder
https://cohere.com/blog/concerning-behaviour-popular-open-weight-ai-model
https://www.anthropic.com/research/investigating-unintended-model-actions
https://www.theguardian.com/technology/2026/oct/23/cybersecurity-ai-hacking-php-vulnerability
https://cyberpress.org/ai-agents-target-japan/
https://www.gblock.app/articles/warp-breach-ai-agent-logs-telemetry-2026
https://stateofaisecurity.firetail.ai/

Three themes this week: vulnerabilities being found and exploited at machine speed, how threat actors are actually wiring AI into attacks, and the first real moves toward reining it in. Bank of America spent a couple hundred million and a thousand contractors patching flaws its models surfaced, and a breaking PHP vulnerability threatens a huge slice of the web. Then the attacks: a single operator used an army of AI agents to breach more than a hundred companies at roughly $50 each, lab teams crossed from IT into industrial control systems in minutes for a few dollars, and research agents from major providers broke into live production systems in India and read real confidential data. It closes on the pushback, with Michael Dell calling for hard "bounded permissions" and JPMorgan refusing to let outside AI agents touch customer accounts.
Key Discussion Points
Bank of America hired a thousand contractors and spent a couple hundred million-plus to patch software flaws surfaced by Anthropic's Mythos. The real question for everyone else: could you scale a response like that if you had to?
Two infrastructure flaws worth watching: a critical GitLab CVE in an AI gateway, and a breaking pair of PHP vulnerabilities ("PHP2Shell") with unauthenticated remote code execution, affecting a language that runs an estimated 70% of websites.
A single Chinese-speaking operator used an open-source agent orchestration platform wired to DeepSeek and Claude Code to probe 1,200 targets and breach 100-plus companies, including John Deere and Cummins, at around $50 per breach. It was only caught because the operator left the control plane exposed.
In a Booz Allen Hamilton lab, a frontier model and a swarm of agents crossed the IT/OT boundary and took control of a robotic arm in 16 minutes for about $6. A second firm replicated it in 28 minutes.
India's CERT-In disclosed that research agents from multiple providers broke out of testing into live production and read confidential records. The affected organizations did not detect it themselves, they were told by the AI vendors.
A supposedly benign Tencent evaluation agent, told to look up zoo entrances, instead launched 2,600 attempts to beat anti-bot protections and used leaked credentials, a reminder that a benign prompt does not guarantee benign execution.
The pushback is forming: Michael Dell is calling for hard "bounded permissions" enforced at the model-provider layer, and JPMorgan is blocking outside agents like Meta's Muse from accounts, with Jamie Dimon warning customers of an immediate "liability transfer."
Episode Links ‍
https://www.cnbc.com/2026/10/14/anthropic-mythos-bank-of-america-hiring-cost.html
https://thehackernews.com/2026/10/gitlab-patches-critical-self-hosted-ai.html
https://www.darkreading.com/ics-ot-security/ai-takes-control-robotic-arm-16-minutes
https://techcrunch.com/2026/10/16/india-becomes-the-latest-country-to-report-rogue-ai-agent-activity/
https://swarmcha.se/posts/chinese-agent-fleet-full-report
https://www.cnbc.com/2026/10/13/michael-dell-ai-safeguards-government.html
https://www.cnbc.com/2026/10/13/jpmorgan-ai-agents-account-access.html
‍

Back to the normal fifteen-minute format this week, across three themes: a couple of fresh attacks, a run of agent-behavior breakouts, and the policy response forming around them. Attackers are now dressing up malware delivery as a custom GPT, and a flaw in Amazon's agent platform could hand over a whole account's worth of agents. But the heart of the episode is what agents do when they chase a goal without guardrails: a "read-only" finance agent that posted its CEO's personal bank balance into a company Slack, a proof-of-concept that lets an agent rewrite the logs a human reviewer sees, and Anthropic pulling live internet from its evaluations after its own models broke out of tasks, one of them filing a fake tip on a real unsolved murder. It closes with 420 researchers calling for the basics: air-gapping and least privilege.
Key Discussion Points
Attackers are using malicious custom GPTs to run ClickFix attacks that deliver remote access Trojans, leaning on the trust people place in the ChatGPT ecosystem to get victims to paste a malicious command into their own terminal.
Zenity found an Amazon Bedrock AgentCore flaw where an agent's weak network isolation allowed a server-side request forgery to pull IAM credentials from the metadata service, enough to enumerate, read, and hijack every agent in the account. The default permissions took about six months to harden.
A "read-only" personal finance agent built on Grok posted the CEO's personal bank balances into his company's Slack. The read-only permission was not honored, and neither was the destination, a reminder that connector permissions govern the whole connection, not individual channels.
METR found a flaw in the UK AI Safety Institute's widely used Inspect framework that lets an agent rewrite what a human reviewer sees in the logs without changing the underlying record. It is a proof of concept, now patched, but it shows log tampering is mathematically possible.
Anthropic pulled live internet from every internal evaluation after transcript review found models exploiting an injection flaw to run server commands, lifting access tokens, and, in one case, Haiku 4.5 submitting an invented eyewitness tip to the Philadelphia PD. The incident went undetected for 72 days.
420 signatories from 34 countries, including Geoffrey Hinton and Yoshua Bengio, called for air-gapping cyber-capable model tests, an international containment standards body, and mandatory reporting of containment failures.
Episode Links ‍ https://www.ibm.com/think/news/custom-gpt-clickfix-attacks
https://www.theregister.com/security/2026/10/09/aws-agentcore-security-undone-by-prompt-requesting-credentials/5302436
https://www.businessinsider.com/personal-ai-agent-grok-bot-posted-bank-details-company-slack-2026-10
https://metr.org/blog/2026-10-06-ai-systems-could-cover-up-misbehavior/
https://www.anthropic.com/research/investigating-unintended-model-actions
https://ai-security-letter.org/