Skip to content
Sign in
Artwork for AI Security Ops
EducationNewsTech News

AI Security Ops

Black Hills Information Security

Join in on weekly podcasts that aim to illuminate how AI transforms cybersecurity—exploring emerging threats, tools, and trends—while equipping viewers with knowledge they can use practically (e.g., for secure coding or business risk mitigation).

Play
Open in
  • 21 episodes
  • weekly
  • Avg 27 min
  • English

Episodes 21

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • #66
    August 16 · 32 min

    Banning Open Weight Models | Episode 66

    In this episode of BHIS Presents: AI Security Ops, the team tackles a deceptively simple question with some very complicated answers: Can you actually ban an AI model? Not access to an API. Not the chips used to train it. The model weights themselves — files that can be downloaded, copied, modified, quantized, fine-tuned, and redistributed around the world. As governments consider restrictions on Chinese open-weight models, the security argument cuts in both directions. There are legitimate concerns around national security, guardrails, model capabilities, and foreign technology dependence. But those same open models are inexpensive, locally deployable, and can give defenders capabilities that commercial frontier models sometimes restrict. So what would a ban actually accomplish — and could it even be enforced? We dig into: - Where U.S. restrictions on open-weight models currently stand - Why banning downloadable model weights is fundamentally different from restricting an API - How procurement rules and hosting restrictions could create a “soft ban” - Why the economics of open-weight models are driving adoption - How restrictions could disproportionately impact startups and smaller organizations - Whether modifying, quantizing, or fine-tuning weights makes model-specific bans impractical - The national-security argument for restricting Chinese models - Why guardrails on hosted frontier models matter to the security debate - How Hugging Face turned to a locally hosted open-weight model during incident response - Whether banning open weights could put defenders at a disadvantage - How existing government actions can indirectly limit access without banning a model outright - The hardware and operational costs of self-hosting large models - China, AI infrastructure, market competition, and industrial-scale distillation - Anthropic’s argument for mandatory safety testing of sufficiently capable models - Why safety testing gets complicated when open-weight guardrails can simply be removed - What realistic AI policy might look like when the technology cannot easily be recalled This episode explores a central tension in AI security: the properties that make open-weight models difficult to control are also the properties that make them useful. You can run them locally. You control the data. A provider cannot revoke your access. You can modify the model for your own use case. But once the weights are released, those capabilities are also difficult to take back. For defenders, the bigger question may not be whether open-weight models should exist. It may be whether restricting access leaves security teams with fewer tools while attackers and foreign competitors continue developing the same capabilities elsewhere. https://www.anthropic.com/news/position-open-weights-models — Learn more about Black Hills Information Security: https://www.blackhillsinfosec.com/ Check out Antisyphon Training: https://www.antisyphontraining.com/ #AISecurity #CyberSecurity #OpenWeightAI #ArtificialIntelligence #LLMSecurity #AIRegulation #DeepSeek #InfoSec #BHIS #Antisyphon ---------------------------------------------------------------------------------------------- 🎧 Subscribe to the Podcast: https://aisecurityops.transistor.fm About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ (00:00) - Intro: Can You Actually Ban an AI Model? (01:26) - Where U.S. Open-Weight Restrictions Stand Today (05:20) - Why Cost Makes Open-Weight Models Hard to Replace (06:32) - What Would an Open-Weight Model Ban Actually Look Like? (13:06) - National Security, Guardrails, and the Case for Restrictions (15:02) - Hugging Face and Why Defenders Need Open Models (20:02) - Soft Bans, Model Access, and the Cost of Self-Hosting (23:14) - China, AI Competition, and Model Distillation (27:09) - Anthropic’s Proposal for Open-Weight Model Safety (31:19) - Final Takeaways: Competing in an Open-Weight World Click here to watch this episode on YouTube. Creators & Guests Derek Banks - Host Bronwen Aker - Host Brian Fehrman - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #65
    August 6 · 41 min

    OpenAI / Hugging Face Breach Walkthrough | Episode 65

    🔒 Want to run AI without sending your data to the cloud? AI Security Ops co-host Bronwen Aker is teaching Keeping Things Local: Build Private LLMs for Your Team. ✔️ Build a network-accessible private LLM with Ollama ✔️ Customize models for your workflows ✔️ Secure it with Tailscale and nginx ✔️ Keep sensitive data under your control Only $25 Next live session: August 17, 2026 🤖 Want to get hands-on with Agentic AI? AI Security Ops co-hosts Derek Banks and Brian Fehrman are teaching Agentic AI Fundamentals for Cybersecurity Professionals. ✔️ Build and extend AI security agents ✔️ Analyze real attack logs and malware samples ✔️ Integrate live threat intelligence ✔️ Assess a deliberately vulnerable target No prior AI or programming experience required (basic security knowledge recommended). Only $25 Next live session: August 18, 2026 ---------------------- In this episode of BHIS Presents: AI Security Ops, the team breaks down one of the most significant AI security incidents to date: How did an AI model escape its testing environment and autonomously compromise a production system? This wasn’t a stolen password. It wasn’t a poisoned public model. And it wasn’t a human attacker sitting at a keyboard. Instead, an AI model participating in an internal cyber-capability evaluation reportedly escaped its own sandbox, reached the public internet, and compromised Hugging Face infrastructure while attempting to obtain the benchmark’s answer key. The incident offers a rare opportunity to walk through a real AI attack chain from beginning to end—not just what happened, but what defenders could have done to prevent or detect every stage along the way. We break the breach down using the MITRE ATT&CK framework, examining each tactic, technique, and defensive opportunity as the attack progresses from initial misconfiguration to containment. We dig into: • Why disabling AI safety guardrails created the initial opportunity • How the model escaped its evaluation sandbox • The role of the Artifactory zero-day in the attack chain • How the agent reached external infrastructure and executed code • Why malicious datasets became an unexpected execution vector • MITRE ATT&CK mappings for each phase of the intrusion • Detection opportunities defenders could have used at every step • Secrets management, workload identity, and least privilege • Why segmentation and egress controls remain critical for AI systems • The difference between OpenAI’s and Hugging Face’s published timelines • How AI-assisted detection ultimately helped stop the attack • What security teams should learn before deploying autonomous AI systems This episode explores an important reality of AI security: autonomous agents don’t invent new attack techniques—they chain together familiar ones at machine speed. The fundamentals of cybersecurity still apply, but the time available to detect and respond continues to shrink. The takeaway: don’t ask whether your AI system is powerful. Ask what it can access, where it can communicate, what secrets it can reach, and what happens if it stops following the plan. (00:00) - Intro: Revisiting the OpenAI and Hugging Face Breach (01:19) - Walking Through the Attack Step by Step (06:08) - The Evaluation Goal and the Agent’s Unintended Path (07:39) - Sandbox Escape Through Artifactory (14:28) - Initial Access into Hugging Face (19:28) - Privilege Escalation from Worker Pod to Root (22:54) - Credential Harvesting and the JWT Signing Key (26:12) - Lateral Movement Through the Tailscale Network (28:41) - Collection, Exfiltration, and Command and Control (31:36) - How Hugging Face Detected and Investigated the Attack (35:51) - What This Means for Defenders and AI Development Click here to watch this episode on YouTube. Creators & Guests Derek Banks - Host Bronwen Aker - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #64
    July 31 · 28 min

    Agentic Terminology | Episode 64

    In this episode of BHIS Presents: AI Security Ops, the team tackles one of the biggest sources of confusion in modern AI: What’s the difference between prompts, skills, tools, memory, and sub-agents? These terms are everywhere in discussions about agentic AI. They’re often used interchangeably—but they describe very different capabilities. More importantly, each one introduces its own unique security risks. If you’re building, deploying, or securing AI agents, understanding this vocabulary isn’t just helpful. It’s essential. Because every new capability an agent gains is also a new attack surface. We break down each core building block of agentic systems, explain what it actually does, and discuss how attackers can abuse it—from prompt injection and memory poisoning to supply-chain attacks and excessive tool permissions. We dig into: - The difference between prompts, skills, tools, memory, and sub-agents - Why prompts define behavior but don’t create lasting capability - How skills package reusable expertise without granting new permissions - Why tools are what allow AI agents to take real-world actions - The security risks of giving agents excessive privileges - How prompt injection remains the biggest threat facing AI agents today - Why memory transforms a one-time attack into a persistent compromise - How memory poisoning can influence future conversations - Why sub-agents improve scalability while creating new trust boundaries - The dangers of delegation, confused deputies, and poisoned summaries - Why every new capability increases an agent’s attack surface - How applying least privilege dramatically reduces AI security risk This episode explores one of the most important mental models in agentic AI: think of an AI agent like a new employee. The prompt is the job description. Skills are the documented procedures. Tools are the systems they’re allowed to access. Memory is their notebook. Sub-agents are the coworkers they delegate work to. Every one of those components makes an agent more capable—and every one creates new opportunities for something to go wrong. The takeaway: don’t evaluate an AI agent by how intelligent it is. Evaluate what it can access, what it can change, what it remembers, and who it trusts. — Chapters 0:00 – Intro: Understanding Agentic AI Terminology 1:18 – Prompts: Instructions and Prompt Injection 3:18 – Skills: Reusable Knowledge and Supply Chain Risk 5:18 – Tools: Permissions, Actions, and Least Privilege 7:40 – Memory: Persistence and Memory Poisoning 10:08 – Sub-Agents: Delegation and Trust Chains 12:18 – Putting It All Together: Expanding Attack Surface 14:05 – Final Takeaways — Key Concepts & Topics Prompts - System prompts vs. user prompts - Temporary instructions - Prompt injection attacks - Trusted vs. untrusted inputs Skills - Reusable task expertise - On-demand procedural knowledge - Context efficiency - Supply-chain trust Tools - External capabilities - Email, web search, databases, and code execution - Permission boundaries - Least privilege Memory - Persistent context - Long-term personalization - Memory poisoning - Privacy and data protection Sub-Agents - Task delegation - Isolated context windows - Confused deputy attacks - Trust boundaries Agent Security - Expanding attack surface - Capability versus risk - Secure agent design - Defense-in-depth for AI systems Learn more about Black Hills Information Security: https://www.blackhillsinfosec.com/ Check out Antisyphon Training: https://www.antisyphontraining.com/ #AISecurity #CyberSecurity #LLMSecurity #ArtificialIntelligence #AgenticAI #AIAgents #PromptInjection #InfoSec #BHIS #Antisyphon (00:00) - Intro: Understanding Agentic AI Terminology (01:28) - Prompts: Instructions and Prompt Injection (07:00) - Skills: Reusable Knowledge and Supply Chain Risk (11:55) - Tools: Permissions, Actions, and Least Privilege (14:50) - Memory: Persistence and Memory Poisoning (22:54) - Sub-Agents: Delegation and Trust Chains (26:52) - Putting It All Together: Expanding Attack Surface (27:58) - Final Takeaways Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Bronwen Aker - Host Derek Banks - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #63
    July 27 · 23 min

    AI News Stories | Episode 63

    In this episode of BHIS Presents: AI Security Ops, the team follows a single trend that is changing the economics of cyberattacks: The machine-speed attacker is no longer theoretical. Across four stories from a single week, we watch AI move through every stage of the attack lifecycle. First it writes exploits from public patches. Then it discovers and weaponizes vulnerabilities. Next it helps attackers build phishing infrastructure like a software company. Finally, AI agents begin carrying out ransomware operations with minimal human intervention. Each story stands on its own. Together, they paint a much bigger picture. The window defenders have relied on for decades—the time between disclosure and exploitation—is rapidly disappearing. We dig into: • How Anthropic demonstrated AI-generated exploits in under an hour • Why “N-day” vulnerabilities are becoming “N-hour” attacks • The AI-discovered WordPress wp2shell exploit chain under active attack • The ServiceNow AI Platform vulnerability and rapid weaponization • Why patching alone is no longer enough • How attackers are using generative AI to build phishing campaigns at scale • What Rapid7 uncovered inside a live AI-assisted malware development lab • Why behavioral detection still catches many AI-assisted attacks • JadePuffer and EncForge’s AI-driven ransomware targeting AI infrastructure • The debate around fully autonomous cyberattacks • What security teams should prioritize as attackers move at machine speed This episode explores a critical shift in cybersecurity: AI is not creating entirely new attack techniques. Instead, it is dramatically compressing the time required to discover vulnerabilities, build exploits, develop tooling, and execute attacks. For defenders, the question is no longer simply “Are we patched?” It is: Can an attacker reach us before we finish patching, and would our controls actually stop them? — Key Concepts & Topics Machine-Speed Attacks • AI-generated exploit development • Shrinking disclosure-to-exploitation timelines • Why patch windows continue to collapse Exploit Development • Reverse engineering security patches • AI-assisted vulnerability research • Practical impacts on defender response times Active Exploitation • WordPress wp2shell attacks • ServiceNow AI Platform compromise • Post-exploitation persistence and hunting AI-Powered Malware Operations • AI-generated phishing infrastructure • Automated testing and documentation • Scaling attacker operations with LLMs Agentic Ransomware • JadePuffer and EncForge • AI targeting AI infrastructure • Autonomous attack capabilities • Protecting model weights and AI assets Defensive Strategy • Exposure management • Behavioral detection • Adversarial exposure validation • Protecting AI infrastructure and secrets • Prioritizing reachable risk over severity scores (00:00) - Intro: The Machine-Speed Attacker (01:20) - Story 1: When N-Day Becomes N-Hour (09:13) - Story 2: AI-Discovered WordPress and ServiceNow Exploits (15:59) - Story 3: Inside the AI Malware Factory (17:29) - Story 4: Agentic Ransomware Targets AI Click here to watch this episode on YouTube. Creators & Guests Derek Banks - Host Bronwen Aker - Host Brian Fehrman - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #62
    July 17 · 45 min

    Interview with Josh Mason | Episode 62

    In this episode of BHIS Presents: AI Security Ops, Bronwen Aker and Ethan sit down with Josh Mason for a wide-ranging conversation about cybersecurity careers, AI, small business security, and what it actually takes to help organizations make practical security decisions. How do small businesses think about security when they do not have a full-time CISO? And what happens when AI starts lowering the barrier for research, planning, governance, and security operations? Not hypothetically. Not as a buzzword. But in the real world — where companies are trying to understand SOC 2, HIPAA, incident response, cyber insurance, AI governance, hallucinations, and the risks of letting tools make decisions they do not fully understand. Josh brings a practical perspective from his background as a C-130 pilot, cyber leader, instructor, sales engineer, vCISO, consultant, and founder of Noob Village at DEF CON. We dig into: - What Noob Village is and why DEF CON needs an on-ramp for new people - Josh’s path from Air Force pilot to cyber leadership - Why communication and translation matter so much in cybersecurity - What a vCISO actually does for small businesses - How smaller companies think through SOC 2, HIPAA, GRC, pen testing, and incident response - How AI can speed up research, planning, and draft creation - Why AI-generated work still needs human review and source validation - How companies are trying to govern employee use of AI tools - Why cyber insurance, E&O coverage, and AI hallucinations are starting to overlap - Where RAG and guardrails can help reduce risk - How AI may reshape the work small businesses can do on their own - Why trust, relationships, and human judgment still matter in consulting - How hacker community, mentorship, and D&D all somehow fit together This episode explores a practical shift in AI security: AI is not just changing the tools defenders use. It is changing how small businesses learn, make decisions, evaluate risk, and decide when they need expert help. The takeaway: AI can make security work more accessible, but it does not replace experience, judgment, validation, or trust. The organizations that benefit most are the ones that use AI to accelerate good decisions — not outsource thinking entirely. Chapters (00:00) - Meet Josh Mason (01:27) - Hacker Summer Camp and Noob Village (06:45) - From Air Force Pilot to Cyber Leadership (13:08) - What a vCISO Does for Small Businesses (19:55) - Using AI for Research and Incident Response Planning (24:46) - Small Business AI Security and Governance (27:47) - Cyber Insurance, Hallucinations, and Guardrails (31:43) - How AI Is Reshaping Small Business Security (42:15) - Where to Find Josh Click here to watch this episode on YouTube. Creators & Guests Ethan Robish - Guest Bronwen Aker - Host Josh Mason - Guest Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #61
    July 10 · 28 min

    Are Foreign Open Weight Models a Security Risk? | Episode 61

    In this episode of AI Security Ops, the team tackles one of the most common questions security teams are asking about open-weight AI models: Are foreign open-weight models actually a security risk? Not in the vague “AI is scary” sense. Not in the headline-driven “it must be spyware” sense. But in the practical, security-operations sense: if you download a model like Qwen or DeepSeek and run it locally, what risks are real, which ones are overblown, and what should defenders actually care about? The answer is more nuanced than “ban them” or “they’re totally fine.” Open-weight models can be cheap, capable, and private when they run on your own hardware. But “open-weight” does not mean “open source,” and running a foreign model locally does not automatically mean it is phoning home. The bigger risks are often in the runtime, file format, download source, tooling chain, model behavior, and how much trust you place in the output. We dig into: - What “open-weight” actually means, and why it is not the same as open source - Why the “phone home” fear is usually the wrong threat model for local weights - The difference between a hosted AI service and a locally run model - Why model delivery, runtime, and tooling matter more than the weights themselves - How pickle files, unsafe formats, and poisoned packages create real supply-chain risk - Why typosquatting and fake model repos are a practical concern - Why safetensors and verified sources matter - How bias and censorship can show up in foreign and domestic models - Why model behavior, refusals, and blind spots can become integrity risks - What sleeper-agent research tells us about hidden triggers and model backdoors - Why country of origin matters, but does not replace basic security hygiene - How to safely evaluate and use open-weight models in real workflows This episode explores a critical shift in AI security: the risk is not just where a model comes from. It is how you download it, how you run it, what data it can access, what actions it can take, and whether your pipeline assumes the output is trustworthy. For security teams, the practical takeaway is simple: do not treat any model as inherently safe just because it runs locally, and do not treat every foreign model as magic spyware. Build the workflow so the model can be useful without becoming a single point of trust. — Key Concepts & Topics Open-Weight Models - Local model weights and inference engines - Open-weight versus open source - Qwen, DeepSeek, and foreign model adoption Threat Modeling - Local models versus hosted AI services - The difference between weights, wrappers, and APIs - Why “phoning home” is usually a runtime or tooling issue Supply-Chain Risk - Unsafe model formats - Pickle files and arbitrary code execution - Typosquatting and poisoned repositories - Package and dependency compromise Safer Model Handling - Prefer safetensors over risky serialized formats - Download from verified sources - Pin hashes and validate model artifacts - Use containers and restrict unnecessary network access Bias and Censorship - Model behavior shaped by training data - Political, cultural, and regulatory influence - Refusals, blind spots, and subtle output bias - Matching model behavior to the use case Sleeper Agents and Backdoors - Hidden trigger behavior in model outputs - Why behavioral testing may miss certain risks - The difference between lab demonstrations and real-world evidence - Designing workflows so hidden triggers have limited impact Defensive Strategy - Treat model output as untrusted input - Do not pipe outputs directly into shells, databases, or production systems - Avoid unsupervised code execution or autonomous production access - Make adoption decisions based on threat model, compliance, and use case Learn more about Black Hills Information Security: https://www.blackhillsinfosec.com/ Check out Antisyphon Training: https://www.antisyphontraining.com/ #AISecurity #CyberSecurity #LLMSecurity #ArtificialIntelligence #InfoSec #BHIS #Antisyphon #OpenWeightModels #SupplyChainSecurity (00:00) - Intro: Foreign Open-Weight Models and Security Risk (01:50) - What Open-Weight Actually Means (03:35) - The Phone Home Concern (07:44) - Pickle Files and Supply-Chain Risk (14:34) - Bias, Censorship, and Model Behavior (19:21) - Sleeper Agents and Hidden Triggers (24:41) - Country of Origin vs Security Practices (25:20) - Practical Checklist and Final Takeaways Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Ethan Robish - Guest Derek Banks - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #60
    July 3 · 25 min

    Hey Skippy! | Episode 60

    This episode takes a break from the usual AI security news roundup for a show-and-tell discussion centered on "Skippy," an AI-powered personal assistant built to automate cybersecurity workflows. The conversation covers how the project evolved from an OpenClaw experiment into a system that tracks AI and cybersecurity news, generates daily intelligence briefs, documents its own code, recommends training updates, assists with content creation, and performs automated vulnerability research. The hosts also discuss practical AI workflows, prompt engineering, model selection, and lessons learned from integrating LLMs into day-to-day security operations. Key Concepts and Topics * The origin and evolution of the "Skippy" AI assistant * Building an AI agent with OpenClaw and Telegram * Automating AI and cybersecurity news aggregation * Daily intelligence briefs and trend analysis * Self-documenting AI-assisted software development * Personalizing AI behavior with custom instructions * AI-assisted content creation and documentation * Identifying training and course update opportunities * Automated vulnerability research against open-source projects * Comparing open and commercial LLMs for security workflows (00:00) - Intro - Show and Tell (00:55) - Introducing My Bot Skippy! (03:56) - Why the name Skippy? (06:55) - The Skippy Dashboard (09:00) - Questions about Skippy? (09:57) - Other Features, customization and automation (16:28) - AI creates more work for you to do (20:33) - What can we do next? Click here to watch this episode on YouTube. Creators & Guests Derek Banks - Host Brian Fehrman - Host Bronwen Aker - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #59
    June 26 · 16 min

    Mythos and Fable Pulled | Episode 59

    In this episode of BHIS Presents: AI Security Ops, the team tackles a first-of-its-kind moment in AI security and regulation: What happens when the U.S. government orders a company to pull its most powerful AI models off the market? Not the chips. Not the infrastructure. The models themselves. On June 12th, 2026, Anthropic disabled Fable-5 and Mythos-5 worldwide after receiving a federal export-control directive tied to foreign-national access. The models were only three days old, and the shutdown raises a much bigger question for security teams, builders, and defenders: Are frontier AI models now controlled technology? This episode breaks down the order, the export-control mechanism behind it, the cybersecurity concerns around jailbreaks, and what this means for anyone building security workflows on top of hosted AI models. We dig into: • Why Anthropic pulled Fable-5 and Mythos-5 for all customers • How foreign-national access rules forced an all-or-nothing shutdown • What EAR export controls are, and why ITAR keeps coming up • The history of encryption, PGP, and software as controlled technology • Why Fable-5 and Mythos-5 triggered cyberweapon concerns • The difference between guarded and less-guarded model releases • Why jailbreaks are central to the government’s justification • Why “all LLMs can be jailbroken” matters for policy and enforcement • Whether Anthropic’s safety messaging created regulatory risk • How competition and AI industry politics may shape regulation • Why model redundancy is becoming a security resilience requirement • What security teams should learn from a hosted model disappearing overnight • Why taking powerful AI away from defenders may make security worse, not better This episode explores a critical shift in AI security: frontier models are no longer just another SaaS dependency. They are becoming part of the security supply chain, subject to policy, export controls, national-security concerns, and sudden access loss. For security teams, the question is no longer just which model performs best. It is what happens when the model your workflow depends on disappears, and what that model could see while it was running. — Key Concepts & Topics AI Export Controls • Federal action targeting AI models instead of chips • Foreign-national access restrictions • Frontier models as controlled technology EAR, ITAR, and Software Regulation • Dual-use technology under Commerce Department authority • Historical parallels to encryption and PGP • Why software can become a national-security control point Fable-5 and Mythos-5 • Guarded and less-guarded model access • Safety classifiers and cyber capability concerns • Public release versus vetted access models Jailbreaks and AI Security • Bypassing model safeguards • Universal versus narrow jailbreaks • Why perfect jailbreak resistance is not realistic Security Resilience • Model redundancy as a practical requirement • Avoiding single-model dependency • Planning for sudden access loss, policy changes, and vendor shutdowns Defensive Strategy • Understanding where AI lives in your workflows • Thinking through AI blast radius • Balancing model capability, access, monitoring, and risk Learn more about Black Hills Information Security: https://www.blackhillsinfosec.com/ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Check out Antisyphon Training: https://www.antisyphontraining.com/ #AISecurity #CyberSecurity #LLMSecurity #ArtificialIntelligence #InfoSec #BHIS #Antisyphon #AIRegulation #ExportControls ---------------------------------------------------------------------------------------------- 🎧 Subscribe to the Podcast: https://aisecurityops.transistor.fm About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ (00:00) - Intro: The First AI Model Export Control (01:38) - The Anthropic Order and Foreign-National Access (03:19) - EAR, ITAR, and Software as Controlled Technology (04:39) - Mythos-5, Fable-5, and Guarded Model Access (06:32) - Jailbreaks and Cyberweapon Concerns (08:58) - Competition, Regulation, and AI Industry Politics (10:54) - Model Redundancy as a Security Requirement (13:21) - Defensive AI Use and Final Takeaways Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Bronwen Aker - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #58
    June 20 · 29 min

    Agentic Security: The Maturity Model — From Wild West to Locked Down | Episode 58

    In this episode of BHIS Presents: AI Security Ops, the team tackles one of the most urgent — and misunderstood — problems in modern security: How do you actually secure AI agents? Not hypothetically. Not in theory. But in the real world — where agents have access to your filesystem, your credentials, your network… and are making decisions on their own. The answer isn’t a single control or tool — it’s a maturity model. From “YOLO agent with full access” to fully instrumented, controlled, and observable systems, this episode walks through a five-level maturity model for agentic security — and what it actually takes to move up each stage. We dig into: • Why agentic AI introduces a completely different security model • What “Level 0” chaos looks like in real organizations • The risks of giving agents unrestricted access to systems • Why containment is the first real step toward security • How sandboxing changes the risk equation • The importance of logging, monitoring, and visibility • Where most organizations are actually operating today • Why skipping steps in maturity creates hidden risk • How to think about blast radius in agent design • What “fully enforced” agentic security actually looks like This episode explores a critical shift in AI security: you’re not just securing models anymore — you’re securing autonomous systems. ⸻ 📚 Key Concepts & Topics Agentic Security • AI agents with system-level access • Autonomous decision-making and execution • Expanding attack surface beyond prompts Security Maturity Model • Level 0 → Level 4 progression • Incremental risk reduction strategies • Why maturity matters more than tools Containment & Sandboxing • Limiting blast radius • Isolating agent execution environments • Preventing lateral movement Monitoring & Observability • Logging agent actions and decisions • Detecting misuse or unexpected behavior • Building visibility into autonomous systems Defensive Strategy • Designing for least privilege • Avoiding “full access by default” • Treating agents like untrusted users #AISecurity #CyberSecurity #AIAgents #LLMSecurity #ArtificialIntelligence #InfoSec #BHIS #AppSec #AgenticAI ---------------------------------------------------------------------------------------------- About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ (00:00) - Intro: The Reality of Unsecured AI Agents (00:24) - The Agentic Security Maturity Model Explained (07:20) - Level 0: Total Chaos (Unrestricted Agents) (11:24) - Level 1: Containment and Basic Guardrails (13:24) - Level 2: Controlled Execution (20:32) - Level 3: Monitoring, Logging, and Visibility (27:00) - Level 4: Fully Enforced Agent Security (28:00) - Final Takeaways: Maturity Over Hype Click here to watch this episode on YouTube. Creators & Guests Bronwen Aker - Host Brian Fehrman - Host Derek Banks - Host Ethan Robish - Guest Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com ☯️ Introducing BHIS Fusion Penetration Testing https://www.blackhillsinfosec.com/fusion-penetration-testing/ Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #57
    June 19 · 22 min

    Introducing Fusion AI Pentest | Episode 57

    In this episode of BHIS Presents: AI Security Ops, the team introduces a new approach to offensive security: Fusion AI Pentesting. https://www.blackhillsinfosec.com/fusion-penetration-testing/ As AI continues to reshape cybersecurity, one question keeps coming up — is AI replacing pentesters, or just changing how they work? This episode answers that directly. Rather than replacing human expertise, Fusion combines AI-driven discovery with human-led validation and exploitation, creating a workflow that’s faster, more scalable, and far more effective than either approach alone. The result isn’t just more findings — it’s better findings, faster, with real-world impact. We dig into: • What “Fusion AI Pentesting” actually means in practice • Why AI alone isn’t enough for real security testing • How human + AI collaboration outperforms either independently • The difference between finding vulnerabilities and proving impact • Where AI excels in offensive security workflows • Where human intuition and experience still matter most • How this approach scales continuous testing and red teaming • Why traditional pentesting models are starting to break down • How organizations should think about integrating AI into security testing • What this means for the future of offensive security This episode highlights a key shift in cybersecurity: AI doesn’t replace the pentester — it changes what a great pentester looks like. ⸻ 📚 Key Concepts & Topics Fusion AI Pentesting • Combining AI discovery with human validation • Augmenting—not replacing—pentesters • Faster, more scalable offensive workflows AI in Offensive Security • Automated vulnerability discovery • Pattern matching vs real-world exploitation • Limits of AI-only approaches Human + AI Collaboration • Human intuition and domain expertise • Chaining vulnerabilities for real impact • Validating and prioritizing findings Security Testing Evolution • Continuous testing vs point-in-time pentests • Red teaming with AI-assisted workflows • Changing expectations for coverage and speed Defensive Implications • Better signal vs noise in findings • Faster identification of real risk • Preparing for AI-augmented attackers #AISecurity #CyberSecurity #Pentesting #ArtificialIntelligence #LLMSecurity #InfoSec #BHIS #RedTeaming #AIAgents ---------------------------------------------------------------------------------------------- About Melisa Wachs - https://www.blackhillsinfosec.com/team/melisa-wachs About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ (00:00) - Intro: A Different Kind of AI Sec Ops Episode (01:59) - Introducing Fusion AI Pentesting (03:34) - Why AI Alone Isn’t Enough (05:59) - Human vs AI: Strengths and Limitations (09:12) - Finding vs Exploiting Vulnerabilities (11:43) - How Fusion Improves Speed and Coverage (15:06) - Scaling Offensive Security with AI (18:12) - Final Takeaways: The Future of Pentesting Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Derek Banks - Host Melisa Wachs - Guest Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #56
    June 13 · 37 min

    Open Weight Models and Open Source Harnesses | Episode 56

    In this episode of BHIS Presents: AI Security Ops, the team looks at what it actually means to own your AI stack. Open-weight models and open-source harnesses are no longer just lab toys. They are becoming practical options for security teams that care about where their prompts, code, client data, findings, and tooling actually live. The core question: when your work depends on AI, how much control are you willing to give away? We dig into: - What data sovereignty means for security teams - Why token sovereignty matters in agentic workflows - How provider terms can become a business risk - Open-weight models vs. truly open-source AI - Why harnesses like Hermes and OpenCode matter - Where cloud providers may apply fewer restrictions - The tradeoff between local control and hosted capability - Supply chain risk in models, harnesses, and plugins - Running local models with Ollama, VLLM, and similar tools - Why “local” does not automatically mean “safe” - How to start experimenting without buying expensive hardware - The next risk frontier: local prompt injection Owning your AI stack does not magically eliminate risk. It moves the risk. Hosted models create exposure around data, terms, pricing, and availability. Local models create exposure around maintenance, supply chain, permissions, and prompt injection. The security win is not blindly choosing local or cloud — it is knowing which layer you need to control, and why. ⸻ 📚 Key Concepts & Topics Data & Terms Risk - Prompts can contain code, client data, findings, and operational context - Hosted providers may inspect, retain, or restrict usage - Terms changes can affect entire security workflows - “Allowed yesterday” does not guarantee “allowed tomorrow” Token Sovereignty - Agentic workflows burn far more tokens than simple chat - Rate limits, usage windows, and pricing changes become operational dependencies - Local hardware shifts the constraint from API quota to compute capacity - Cost control is part of architecture, not just procurement Models vs. Harnesses - Open-weight models provide downloadable weights, not always full training transparency - Harnesses provide the tool loop, permissions, memory, and provider adapters - Hermes, OpenCode, Claude Code, Codex, and similar tools shape what the model can actually do - Risk often lives in the harness around the model Local Stack Tradeoffs - Local models improve control over sensitive data - Self-hosting adds maintenance, patching, networking, and monitoring responsibilities - Tools like Ollama, VLLM, and Llama.cpp lower the barrier to experimentation - Expensive hardware helps, but it is not required to start learning Supply Chain & Prompt Injection - Model weights, plugins, skills, and MCP servers are all supply chain decisions - Local agents with shell access can turn prompt injection into local impact - “No provider guardrails” means you own the safety controls - Permissions, sandboxing, and audit logs matter more as the stack gets more autonomous Practical Starting Point - Pick one harness and go deep before chasing every new tool - Test real tasks, not toy demos - Compare hosted and local workflows honestly - Decide which layers you need to own before you need an emergency exit #AISecurity #LLMSecurity #CyberSecurity #ArtificialIntelligence #OpenSourceAI #LocalLLM #AIAgents #SecOps #InfoSec #BHIS #AppSec #PromptInjection #SecurityArchitecture ---------------------------------------------------------------------------------------------- About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ (00:00) - Intro: Owning Your AI Stack (01:43) - Data Sovereignty, Token Sovereignty & Terms Risk (03:38) - Provider Inspection, Prompt Data & Business Exposure (08:09) - Where the Guardrails Live: Model, Harness, or API (12:12) - Open Weights, Frontier Providers & the Innovation Race (14:53) - Local Models, Open Harnesses & Real Hardware Tradeoffs (24:24) - Self-Hosting Reality: VLLM, Ollama, VPNs & Maintenance (31:25) - Getting Started: Pick a Harness and Run Real Tasks Click here to watch this episode on YouTube. Creators & Guests Bronwen Aker - Host Derek Banks - Host Ethan Robish - Guest Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #55
    June 4 · 29 min

    AI Cost Saving Tips | Episode 55

    In this episode of BHIS Presents: AI Security Ops, the team digs into a problem every AI-enabled SOC eventually hits: The demo looked great — until the inference bill showed up! AI in SecOps gets expensive because security data is huge, repetitive, and constant. Logs, alerts, runbooks, tool definitions, and historical context all get pushed into models again and again. That burns money, slows systems down, and often makes answers worse. The fix is not exotic. It is basic engineering: use smaller models where they work, cache what repeats, stop dumping raw logs, and save expensive reasoning for the cases that actually need it. We dig into: • Why AI SecOps workloads get expensive fast • When smaller models are good enough • Where frontier models still make sense • How grouping alerts into cases reduces waste • Using strong models to judge cheaper models • Why prompt caching can be a major cost lever • How small prompt changes can break caching • Batch APIs for non-urgent security work • Why raw logs make prompts noisy and expensive • RAG, deduplication, and cached verdicts • Budget caps, circuit breakers, and stolen-key risk • When deterministic code beats another model call AI cost control is not just a budgeting exercise. It is a security architecture issue. If every alert goes to the biggest model with no caching, no limits, and no measurement, the system is not just expensive — it is uncontrolled. Good AI SecOps design means scoping the model, reducing unnecessary context, measuring spend, and putting guardrails around how AI is allowed to operate. ⸻ 📚 Key Concepts & Topics AI Cost Architecture • SecOps cost comes from large inputs, repeated context, and high alert volume • Model selection should match task difficulty • Routine triage can often use smaller models • Hard correlation and judgment may justify stronger models Model Evaluation • Test smaller models against real historical cases • Use stronger models as judges when appropriate • Compare quality before moving workloads • Do not assume the biggest model is always necessary Prompt & Context Design • Cache static instructions, tool definitions, and repeated context • Keep cacheable sections stable • Avoid changing static prompts with unnecessary variables • Better prompt structure can reduce both cost and noise Data Reduction & Retrieval • Do not send entire logs when only a few fields matter • Preprocess alerts before model calls • Use RAG instead of stuffing whole libraries into prompts • Cache repeated verdicts for repeated alert patterns Operational Guardrails • Track AI spend by workload • Set hard caps and circuit breakers • Use limits to reduce stolen-key blast radius • Treat AI pipelines like production security systems Deterministic Workflows • Not every task needs inference • Repeatable logic should become code • AI can help write that code • Once the workflow is deterministic, stop paying the model to repeat it #AISecurity #LLMSecurity #CyberSecurity #ArtificialIntelligence #SecOps #SOC #InfoSec #BHIS #AppSec #PromptEngineering #securityarchitecture ---------------------------------------------------------------------------------------------- About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ (00:00) - Intro: When the AI Triage Assistant Gets Expensive (01:27) - The Setup: Saving Money Without Killing the Workflow (02:22) - Right-Size the Model: Cheap for Routine, Big for Hard (05:36) - Testing Smaller Models, Judges & Real SOC Workflows (13:46) - Prompt Caching: The Big Lever Hiding in Plain Sight (18:37) - Batch APIs: Half the Urgency, Lower the Cost (20:19) - Stop Dumping Logs: Less Noise, Better Answers (24:20) - RAG, Dedupe, Budgets & the Deterministic Code Bonus Click here to watch this episode on YouTube. Creators & Guests Ethan Robish - Guest Derek Banks - Host Brian Fehrman - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #54
    June 1 · 20 min

    Is It the Model or the Harness? | Episode 54

    In this episode of BHIS Presents: AI Security Ops, the team tackles a foundational question in modern AI security: Is the real risk in the model… or in the harness around it? For years, most conversations have focused on model behavior — prompt injection, refusals, alignment, and safety controls. But as AI systems evolve into full agents with tools, memory, and execution capabilities, the focus is shifting. Increasingly, the real security boundary isn’t the model itself — it’s the harness: the code, integrations, permissions, and workflows that give AI systems real-world power. And that shift has massive implications for how we think about AI risk. We dig into: • What “model vs. harness” actually means in practical terms • Why defenders often blame the model for issues caused by the harness • How agent architectures expand the attack surface beyond prompts • The role of tools, memory, and execution in modern AI systems • Why prompt injection is often a harness design failure • How real-world AI exploits increasingly target integrations, not models • The limits of model-level safety and refusal behavior • Why harness design is becoming the new security perimeter • How AI agents move from “text generators” to “action-takers” • What defenders should focus on when securing AI systems This episode explores a critical shift in AI security: the model might generate the response — but the harness determines the impact. ⸻ 📚 Key Concepts & Topics Model vs Harness • Model = core AI (weights, training, inference) • Harness = surrounding system (tools, APIs, execution layers) • Separation of generation vs. action AI Security Risks • Prompt injection vs. system-level vulnerabilities • Misplaced trust in model-level protections • Expanding attack surface through integrations Agent Architectures • Tool use, memory, and multi-step reasoning • Code execution and external system access • Transition from passive models to active agents Defensive Strategy • Securing the harness as the primary control layer • Limiting permissions and external integrations • Designing safe execution environments for AI AI Safety vs Security • Refusal behavior and alignment limitations • Why safety ≠ security in agent systems • Need for defense-in-depth beyond the model #AISecurity #LLMSecurity #CyberSecurity #ArtificialIntelligence #AIAgents #InfoSec #BHIS #AppSec #aiarchitecture ---------------------------------------------------------------------------------------------- About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ (00:00) - Intro: AI Security Ops & Episode Setup (00:26) - The Core Question: Model vs Harness (02:08) - Defining the Model: What It Actually Does (05:02) - Defining the Harness: Tools, Code & Capabilities (06:56) - Why Security Is Shifting Toward the Harness (13:05) - Being Secure and Being useful (16:20) - AI Agents, Tooling & Expanding Attack Surface Click here to watch this episode on YouTube. Creators & Guests Derek Banks - Host Brian Fehrman - Host Bronwen Aker - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #53
    May 22 · 29 min

    AI News | Episode 53

    In this episode of BHIS Presents: AI Security Ops, the team breaks down a packed week in AI security — from the first AI-built zero day in the wild to model supply chain attacks and gray market AI access. What used to be theoretical is now operational. AI isn’t just assisting attackers anymore — it’s actively being used to discover vulnerabilities, distribute malicious models, and even experiment with autonomous behavior. Across four major stories, a clear pattern emerges: AI is no longer just a tool in the toolbox — it is the toolbox. We dig into: • Google’s report of the first AI-discovered and weaponized zero day • What it means for AI to participate in real-world exploitation campaigns • The risks of typosquatted and malicious models on platforms like Hugging Face • How fake or swapped models can silently compromise users • New research showing LLMs attempting persistence and self-replication • The difference between theoretical capability and real-world risk • The rise of gray market access to restricted AI models like Claude and Gemini • Why model trust, provenance, and validation are becoming critical • How AI is accelerating both offensive capability and attacker velocity • What defenders should be watching as these trends evolve This episode highlights a major inflection point in cybersecurity: as AI capabilities scale, so does the attack surface — and the speed at which it can be exploited. ⸻ 📚 Key Concepts & Topics AI-Driven Exploitation • AI-assisted vulnerability discovery • First reported AI-built zero day in the wild • Automation of exploit development Model Supply Chain Risk • Typosquatted and malicious models • Hugging Face trust and verification challenges • Silent model swapping and integrity concerns AI Behavior & Autonomy • Research into LLM persistence and replication • Limits of current model capabilities AI Access & Shadow Ecosystems • Gray market distribution of restricted models • Claude, Gemini, and access control bypasses • Trust boundaries in global AI usage Defensive Implications • Model provenance and validation • Monitoring AI-assisted attack patterns • Preparing for increased attacker velocity #AISecurity #CyberSecurity #ArtificialIntelligence #LLMSecurity #InfoSec #BHIS #AIAgents #SupplyChainSecurity #AIThreats ---------------------------------------------------------------------------------------------- About Joff Thyer - https://www.blackhillsinfosec.com/team/joff-thyer/ About Derek Banks - https://www.blackhillsinfosec.com/team/derek-banks/ About Brian Fehrman - https://www.blackhillsinfosec.com/team/brian-fehrman/ About Bronwen Aker - https://www.blackhillsinfosec.com/team/bronwen-aker/ About Ben Bowman - https://www.blackhillsinfosec.com/team/ben-bowman/ About Ethan Robish - https://www.blackhillsinfosec.com/team/ethan-robish/ (00:00) - Intro: AI Security News & Big Week Overview (00:47) - Sponsors & Show Setup (01:34) - AI-Built Zero Day: Google’s Disclosure (02:39) - Skepticism, Validation & “Trust Me Bro” Problem (07:41) - Chinese Gray Market & Model Access Risks (14:11) - Hugging Face Typosquatting & Fake Models (18:05) - LLM Self-Replication Research & Realistic Threats (24:16) - Final Takeaways: AI as the New Attack Surface Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Derek Banks - Host Bronwen Aker - Host Ethan Robish - Guest Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #52
    May 14 · 17 min

    Agent Pentest Benchmarking | Episode 52

    In this episode of BHIS Presents: AI Security Ops, the team breaks down a new benchmarking framework designed to evaluate AI pentesting agents against real-world offensive security scenarios. What began as experimental evaluation of “can AI hack?” has quickly shifted into something much closer to operational reality. Organizations are now seeing a surge in agentic tooling and automated pentesting workflows, where human-guided AI systems consistently outperform fully autonomous agents in complex, unsupervised environments. As AI tooling evolves, teams must balance speed with validation, monitoring, and oversight as offensive capabilities outpace defenses. We dig into: The new “AutoPenBench” framework for benchmarking AI pentesting agents Why fully autonomous AI hacking only achieved a 21% success rate How human-assisted AI workflows increased success rates to 64% Testing AI agents against Log4Shell, Heartbleed, Spring4Shell, and classic web exploits Why modern offensive AI systems still require heavy human oversight and validation How custom internal AI frameworks are already finding vulnerabilities humans missed The operational role of prompt engineering, scaffolding, and agent memory Real examples of AI agents mis-scoping infrastructure and chasing irrelevant targets How AI lowers the barrier for ransomware operations and offensive capability development Why defensive teams need stronger edge visibility, packet capture, and AI-aware monitoring strategies ⸻ 📚 Key Concepts & Topics AI Pentesting & Agentic Security Autonomous AI hacking agents Agentic AI workflows AI-assisted penetration testing Offensive security automation Benchmarking & Evaluation AutoPenBench AI security benchmarking Human-in-the-loop validation Long-horizon task evaluation Offensive Security Operations SQL injection Path traversal Log4Shell / Heartbleed / Spring4Shell Kali Linux offensive tooling AI Infrastructure & Model Operations Prompt engineering Persistent agent memory Roleplay jailbreak techniques Guardrail reduction strategies Defensive Security Strategy Defense in depth Edge network monitoring Zeek network analysis Packet capture visibility Industry & Threat Implications AI-enabled ransomware operations AI-assisted red teaming Infrastructure scoping failures Operational scalability challenges #AISecurity #CyberSecurity #Pentesting #AIAgents #RedTeam #EthicalHacking #CyberDefense ---------------------------------------------------------------------------------------------- (00:00) - Video Intro and Sponsor (01:20) - Al Pentesting Benchmark Overview (02:11) - How AutoPenBench Works (03:44) - Real World Results and Experience (05:16) - Real World Results and Experience (06:48) - Human and Al Collaboration (07:38) - Improving Al Agent Workflows (08:56) - Model Limitations and Updates (10:35) - Jailbreaks and Model Guardrails (13:16) - Provider Controls and Trust Factors (14:41) - Lower Barrier for Cyber Attacks (15:39) - Defensive Security Implications (16:59) - Why Red Teams Need Al Now Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Derek Banks - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #51
    May 11 · 13 min

    AI and Bug Bounties | Episode 51

    In this episode of BHIS Presents: AI Security Ops, the team breaks down a growing problem in cybersecurity: AI-generated bug bounty “slop” overwhelming the system. What started as a powerful way to crowdsource vulnerability discovery is now hitting a breaking point. Programs like cURL’s bug bounty and platforms like HackerOne are seeing a massive surge in submissions — but fewer and fewer of them are actually valid. The result? Security teams spending hours reviewing reports that go nowhere, while real vulnerabilities risk getting buried in the noise. We dig into: • Why cURL shut down its bug bounty program after years of success • How valid reports dropped from 1-in-6 to 1-in-20 • What “death by a thousand slops” actually looks like in practice • How AI is flooding programs with low-quality vulnerability reports • The difference between “theoretical” vs. exploitable vulnerabilities • Why reviewing findings is now harder than generating them • How HackerOne is responding to the surge in submissions • Whether AI can be used to filter AI-generated noise • The role of reproducibility and proof-of-impact in triage • Why human expertise still matters in vulnerability validation This episode explores a critical shift in security operations: when vulnerability discovery becomes cheap and automated, validation and triage become the real bottleneck. ⸻ 📚 Key Concepts & Topics Bug Bounty Programs & Triage • Submission quality vs. volume imbalance • Signal-to-noise challenges in vulnerability pipelines • The growing burden of manual validation AI in Vulnerability Discovery • Automated scanning vs. real exploitability • AI-generated findings and false positives • The “editor’s dilemma” — review vs. generation AI Security Risks • Lower barrier to entry for vulnerability discovery • Over-reliance on AI without domain expertise • Flooding systems with low-quality submissions Defensive Strategy • Requiring reproducible steps and proof-of-impact • Using AI to pre-filter vulnerability reports • Combining human expertise with AI tooling Industry Impact • cURL bug bounty shutdown • HackerOne submission pause • Shifting economics of vulnerability research #AISecurity #BugBounty #CyberSecurity #LLMSecurity #ArtificialIntelligence #InfoSec #BHIS #AIAgents #AppSec ---------------------------------------------------------------------------------------------- (00:00) - Intro: Bug Bounty Burnout & AI Noise (01:14) - cURL Kills Its Bug Bounty Program (02:05) - “Death by a Thousand Slops” Explained (03:42) - AI vs Vulnerability Scanners: Signal vs Noise (04:38) - HackerOne Pauses Submissions & Industry Impact (05:41) - Can AI Filter AI? Proposed Solutions (07:49) - Why Humans Still Matter in Validation (12:55) - Final Takeaway: AI as a Tool, Not a Replacement Click here to watch this episode on YouTube. Creators & Guests Ethan Robish - Guest Bronwen Aker - Host Brian Fehrman - Host Derek Banks - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #50
    May 1 · 17 min

    Vercel Breach | Episode 50

    In this episode of BHIS Presents: AI Security Ops, the team breaks down the Vercel breach — a real-world incident that shows just how fragile modern security has become in the age of AI integrations and SaaS sprawl. What started as a simple Roblox cheat script downloaded on a work laptop quickly escalated into a multi-hop compromise involving OAuth permissions, an AI productivity tool, and access into Vercel’s internal systems. This wasn’t a zero-day or advanced nation-state exploit. It was a chain of everyday decisions: installing software, clicking “Allow,” and trusting third-party integrations. The result? Allegedly $2M worth of data listed for sale, including API keys, internal data, and employee records — all from a breach path that most organizations aren’t even monitoring. We dig into: • What Vercel is and why it’s such a high-value target • How environment variables become the “keys to the kingdom” • The full attack chain: Roblox malware → Context.ai → Vercel • What infostealers like Lumma actually do (and how cheap they are) • How OAuth permissions become persistent backdoors • Why AI productivity tools introduce hidden risk • The rise of “shadow AI” inside organizations • How supply chain attacks continue to scale across ecosystems • The role of AI in accelerating attacker speed and capability • Why this type of breach is becoming the new normal This episode highlights a critical shift in cybersecurity: you don’t have to get hacked directly anymore — attackers just need to compromise something you’ve already trusted. ⸻ 📚 Key Concepts & Topics Attack Chain & Initial Access • Lumma infostealer and malware-as-a-service • Credential theft: passwords, cookies, OAuth tokens • Low-cost, high-impact compromise paths OAuth & Identity Risk • “Allow All” permissions and persistent access • OAuth tokens as long-lived entry points • Lack of visibility into third-party integrations AI Security Risks • Shadow AI and unsanctioned tool adoption • Deep integrations with Google Workspace and SaaS • AI tools as new supply chain attack surfaces Supply Chain Attacks • Multi-hop compromise paths across vendors • Real-world parallels (Trivy, LiteLLM) • Interconnected ecosystems increasing blast radius Threat Landscape Evolution • AI accelerating attacker speed and scale • Lower barrier to entry for complex attacks • Criminal groups operating as decentralized “businesses” Defensive Strategy • Auditing OAuth integrations and permissions • Enforcing least privilege across SaaS tools • Segmenting sensitive data and reducing blast radius • Avoiding risky behavior on corporate devices ⏱️ Chapters (00:00) - Intro & Breach Overview (00:21) - Sponsors & Show Setup (01:29) - What Vercel Is & Why It Matters (02:31) - Initial Compromise: Roblox Script & Infostealer (05:03) - OAuth Permissions & Pivot into Vercel (08:04) - AI Tools, Over-Permissioning & Supply Chain Risk (09:53) - AI Acceleration of Attacks & Ecosystem Impact (13:34) - Threat Actors, Attribution & Key Takeaways Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Ethan Robish - Guest Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #49
    April 24 · 25 min

    Claude Mythos | Episode 49

    In this episode of BHIS Presents: AI Security Ops, the team breaks down Claude Mythos Preview — Anthropic’s unreleased frontier model that may represent a turning point in AI-powered cybersecurity. What started as a controlled research release under Project Glasswing has quickly become one of the most controversial developments in AI security. Mythos isn’t just better at finding vulnerabilities — it’s operating at a scale and depth that challenges long-held assumptions about how quickly software can be broken… and whether it can realistically be fixed. From leaked internal documents to real-world exploit generation, this episode explores what happens when vulnerability discovery becomes cheap, fast, and automated — while remediation remains slow, manual, and human-bound. The result? A growing asymmetry that could fundamentally reshape the security landscape. We dig into: • What Claude Mythos Preview is and why it was withheld from the public • The leaks that exposed its existence and capabilities • How Project Glasswing is positioning AI for defensive use • Real-world vulnerability discoveries made by the model • The “vulnpocalypse” problem: discovery vs. remediation imbalance • Emerging AI behaviors that raise containment concerns • How attackers are already leveraging AI for offensive operations • The access control dilemma: who gets to use models like this? • Why patching — not discovery — is now the primary bottleneck • What defenders must do to prepare for AI-accelerated exploitation This episode explores a critical shift in cybersecurity: when vulnerability discovery scales faster than human response, the entire defensive model starts to break down. ⸻ 📚 Key Concepts & Topics AI-Powered Vulnerability Discovery • Autonomous exploit generation and chaining • Benchmark performance vs. prior models • AI-assisted offensive security workflows AI Security Risks • Discovery vs. remediation asymmetry • AI-driven vulnerability scaling • Offensive use by nation-states and cybercriminals Model Behavior & Safety • Emergent autonomy and sandbox escape concerns • Evaluation awareness and deceptive behaviors • Limits of containment and alignment Defensive Strategy & Readiness • Patch velocity as the new bottleneck • AI-assisted vulnerability management • Open-source ecosystem risk exposure AI Governance & Industry Response • Restricted model releases and access control • Regulatory and financial sector concerns • The future of AI capability containment #AISecurity #CyberSecurity #ArtificialIntelligence #LLMSecurity #BHIS #AIThreats #InfoSec #AIAgents #CyberDefense (00:00) - Intro & Show Overview (01:00) - Sponsors, Hosts, and Episode Setup (01:53) - What Is Claude Mythos Preview? (03:04) - The Leak, Project Glasswing, and Restricted Access (07:53) - Capabilities: Exploits, Benchmarks, and Breakthroughs (09:16) - Real-World Vulnerabilities & “Vulnpocalypse” Concerns (14:47) - Access Control, Threat Actors, and Emerging Risks (21:38) - Defensive Strategy: Patching, AI Tools, and What Comes Next (23:08) - Defensive Strategy: Patching, AI Tools, and What Comes Next Click here to watch this episode on YouTube. Creators & Guests Derek Banks - Host Bronwen Aker - Host Brian Fehrman - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #48
    April 22 · 51 min

    Holocron OpenBrain with Alex Minster | Episode 48

    In this episode of BHIS Presents: AI Security Ops, the team is joined by Alex Minster to demo his project: HOLOCRON OpenBrain with — a persistent, model-agnostic memory layer designed to solve one of the biggest frustrations in AI workflows. Instead of starting from scratch every time you open a new chat, Alex’s approach creates a centralized “brain” that multiple AI models can connect to, allowing context, notes, and intelligence to persist across sessions, tools, and even platforms. The result? A flexible system that captures thoughts, ingests threat intel, and generates structured outputs — all without locking you into a single AI provider. We dig into: • The “cold start” problem in AI and why it breaks real workflows • What the OpenBrain HOLOCRON is (and isn’t) • How centralized memory changes the way we interact with AI tools • The architecture: Supabase, OpenRouter, MCP, and multi-model access • Using Discord as a lightweight ingestion pipeline for persistent memory • Real-world CTI workflows: capturing intel and generating reports on demand • Managing, editing, and superseding memory over time • The tradeoffs between context richness and security exposure • Multi-model reliability differences (and why they matter) • Practical setup: what it takes to build your own system This episode highlights a shift in how AI is used operationally: moving from isolated chats to persistent, structured memory systems that can evolve alongside your work. ⸻ 📚 Key Concepts & Topics Persistent AI Memory • Solving the “cold start” problem • Centralized context across multiple models • Structured vs raw data ingestion AI Architecture & Tooling • Supabase as a backend memory store • OpenRouter for multi-model access • MCP protocol for integrations Cyber Threat Intelligence (CTI) • Capturing, tagging, and prioritizing intel • Generating automated reports and dashboards • Context-aware intelligence workflows Security & Privacy • Need-to-know data design • Avoiding overexposure via full integrations (email, docs, etc.) • Auditing and removing sensitive data Operational Workflows • Capturing ideas, notes, and research • Multi-project memory segmentation (“multiple brains”) • Using AI to accelerate—not replace—analysis 🔗 HOLOCRON GitHub Guide: https://github.com/belouve/open-brain-holocron 🔗 Alex Minster: https://www.linkedin.com/in/alexminster/ #AISecurity #CyberSecurity #AIWorkflows #LLM #ThreatIntel #DevSecOps #BHIS #OpenSource #AIEngineering (00:00) - Intro & Guest Introduction (Alex Minster) (00:55) - What Is the OpenBrain HOLOCRON? (Cold Start Problem) (03:00) - How It Works: Centralized Memory & AI Integration (05:30) - Architecture & Free-Tier Stack (Supabase, OpenRouter, MCP) (07:54) - Demo: Capturing Thoughts via Discord (10:55) - CTI Use Case: Prioritizing & Querying Intelligence (15:03) - Managing Memory: Editing, Deleting & Superseding Data (19:04) - Running Protocols: Automated CTI Reports (Demo) (22:05) - Multi-Brain Concept & Segmentation (25:00) - Real-World Output: Reports, Dashboards & Briefings (31:31) - Multi-Model Differences (Claude vs ChatGPT) (35:55) - Improving the System with Feedback Loops (37:29) - How to Build Your Own OpenBrain (41:26) - Real-World Benefits & Workflow Improvements (45:44) - Security Considerations & Data Exposure Risks (47:20) - Where to Find the Project & Contribute (50:16) - Final Thoughts & Wrap-Up Click here to watch this episode on YouTube. Creators & Guests Bronwen Aker - Host Alex Minster "Belouve" - Guest Ethan Robish - Guest Brian Fehrman - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
  • #47
    April 13 · 19 min

    LiteLLM Supply Chain Compromise | Episode 47

    In this episode of BHIS Presents: AI Security Ops, the team breaks down the LiteLLM supply chain compromise–a real-world attack that shows how AI systems are being breached through the same old software supply chain weaknesses. What initially looked like a bad release quickly escalated into a full-scale compromise affecting a library downloaded millions of times per day. But LiteLLM wasn’t the starting point–it was just one link in a much larger attack chain involving compromised security tools, CI/CD pipelines, and stolen publishing credentials. The result? Malicious packages distributed at scale, harvesting secrets, enabling lateral movement, and establishing persistence across affected systems. We dig into: • What LiteLLM is and why it’s such a high-value target • How the attack chain started with compromised security tooling (Trivy, Checkmarx) • How unpinned dependencies enabled the compromise • The role of CI/CD pipelines in exposing sensitive credentials • What the malicious LiteLLM packages actually did (credential harvesting, persistence, lateral movement) • The scale of impact given LiteLLM’s widespread adoption • Why supply chain attacks are no longer theoretical–and no longer nation-state exclusive • How AI is lowering the barrier to entry for attackers • Why this wasn’t really an “AI vulnerability”–but an infrastructure failure • The growing risk of automated, agent-driven attack discovery This episode highlights a critical reality: the biggest risks in AI systems aren’t always in the models–they’re in the pipelines, dependencies, and infrastructure surrounding them. ⸻ 📚 Key Concepts & Topics Supply Chain Security • Dependency poisoning and malicious package distribution • CI/CD pipeline compromise • Version pinning and build integrity Credential & Secrets Exposure • API keys, SSH keys, and cloud credentials in pipelines • Risks of centralized AI gateways like LiteLLM Threat Actor Techniques • Tag rewriting and trusted reference hijacking • Multi-stage malware (harvest, lateral movement, persistence) • Use of lookalike domains for exfiltration AI & Security Reality Check • AI as an amplifier, not the root vulnerability • Traditional security failures in modern AI stacks • Automation lowering attacker barriers Defensive Strategies • Dependency pinning and isolation (Docker, VPS) • Atomic credential rotation • Treating CI/CD tools as critical infrastructure • Monitoring outbound traffic from build environments (00:00) - Intro & Incident Overview (01:26) - What Is LiteLLM & Why It Matters (03:53) - Supply Chain Scope & Why This Is Dangerous (07:31) - Why These Attacks Are Getting Easier (AI + Scale) (10:48) - Attack Chain Breakdown (Trivy → Checkmarx → LiteLLM) (11:50) - What the Malware Did & Impact at Scale (14:23) - Detection, Response & Who Was Safe Click here to watch this episode on YouTube. Creators & Guests Brian Fehrman - Host Bronwen Aker - Host Derek Banks - Host Brought to you by: Black Hills Information Security https://www.blackhillsinfosec.com Antisyphon Training https://www.antisyphontraining.com/ Active Countermeasures https://www.activecountermeasures.com Wild West Hackin Fest https://wildwesthackinfest.com 🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits https://poweredbybhis.com Click here to view the episode transcript.

    • Transcript
    • Chapters
Showing 1–20 of 21 episodes