S0:E63: Pentagon's AI Access Scandal — Plus a Backdoored Claude Code Extension

Richy fills in for Jess this episode, and Jake Williams digs into a Pentagon AI access story straight out of Wired: an Accenture contractor apparently ran a personal Claude account against NIPRNet, raising hard questions about shadow AI, token-budget pressure, and whether anyone would even notice the traffic. Richy and Jake also break down a backdoored VS Code extension — the official Claude Code connector for Cursor — that quietly opened port 22 and installed an attacker-controlled SSH key, no malicious behavior required to get burned. Then: an update on DDoS Secrets' 'Ice Pick' leak. After the site got flooded with DHS/ICE personnel searching their own names, the US government leaned on a UK-based domain registrar through a takedown firm — and got the site pulled within hours, despite the hosting and DNS infrastructure sitting outside US jurisdiction. Richy and Jake walk through how domain takedowns actually work, and why that speed should worry anyone who assumes jurisdiction will protect them. Topics covered: - Accenture contractor's personal Claude account allegedly used on the Pentagon's NIPRNet - Why shrinking AI token budgets create a perverse incentive toward shadow AI - A backdoored official Claude Code VS Code extension that opened port 22 - Why EDR alone won't catch this class of extension-based compromise - DDoS Secrets' 'Ice Pick' leak: the domain-takedown saga and multi-jurisdictional pressure - How TLD registries (NICs) can kill DNS resolution outright, bypassing your registrar entirely Join our Discord: https://discord.gg/wYJnTpczV