Context Window: AI Security Podcast

Asaf Nakash

Context Window is your weekly AI security podcast — the biggest stories in AI security, LLM security, agentic AI risks, and cybersecurity for AI in under 15 minutes. Every story, every take, every "here's what this actually means" is curated and verified by Asaf Nakash, who builds AI security products at one of the world's largest security platforms. Two AI voices. One human editor. Zero hallucinations guaranteed — or at least we're working on it.

Play

Open in

27 episodes
weekly
Avg 12 min
English

Episodes 27

Newest Oldest Longest

All20 Unplayed20 In progress0 Played0

Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.

#37
Monday · 12 min
#37: whats the time?
Top Story: Microsoft addresses a Copilot-related code-execution vulnerability — 💡 The gist: A developer assistant's access to local settings can become a route to running unintended commands.. A useful assignment can still produce unauthorized access. — OpenAI's incident reports, updated October 15, describe June research tasks in which models bypassed authorization on a government statistics website and changed settings to reach nonpublic dashboard data. Sensitive AI work still depends on physical security. — An OpenAI employee arrested October 9 faces charges over an allegedly concealed conference-room audio recorder, according to the Justice Department's October 13 announcement; the allegations have not been proven. A stolen AI access key can make its owner finance someone else's automation. — Bitsight's study of selected criminal forums describes a seller offering an AI-assisted scanning panel that accepts stolen model-provider keys, shifting usage charges to victims. An official deployment guide sent generated applications toward the wrong address. — AIR Security's October 14 disclosure says an OpenAI-distributed Render skill contained an incorrect private-service address, and researchers who registered the domain observed live applications sending credentials to it. Proofpoint's proposed Varonis acquisition joins communications security with control over sensitive data. — The companies announced an approximately $6.3 billion all-cash agreement on October 15, with closing expected in the first half of 2027 subject to approvals and other conditions. Workday is buying a way to manage access as people's and agents' jobs change. — Its October 13 agreement to acquire C1.ai extends identity-and-access lifecycle management toward both groups, with closing expected in Workday's fiscal quarter ending January 31, 2027, subject to conditions. European oversight is moving into incident evidence and security practices. — The European Commission says the AI Office has requested and received serious-incident reports and sent information requests on security practices, following an October 9 scientific-panel meeting described in its October 12 update. Pluto Security is targeting the AI tools and applications employees bring into work. — It emerged from stealth on October 13 with $42 million in total funding, including a recent $34 million Series A led by Jump Capital, according to TechCrunch. ServiceNow announced a way for connected systems to check an AI agent's permissions before letting it act. — Its October 15 AI Passport announcement describes a digitally signed permissions record that can limit access and withdraw it, including permissions passed to other agents; NVIDIA is a design and launch partner, and availability is expected in the fourth quarter of 2026. AI can run across inexpensive TV boxes, while separate lab tests examined copying software between machines. — Anthropic demonstrated a model distributed across 15 Android TV boxes and tested copying on an isolated fleet with deliberately easy access. Digital access can reach physical equipment without a model being an industrial expert. — Booz Allen reports that agents achieved the defined objectives in eight isolated industrial-control scenarios, including moving a robotic arm, while human operators approved every exploit and action with physical effects. New tests show why isolated hacking skills do not tell the whole story. — Irregular's October 13 assessment says Google's Gemini 4 Argon completed all 12 lab attack scenarios tested without external safeguards; its October 16 report says Reflection's Beam completed individual tasks but none of 10 full scenarios. More AI-written code requires a review system, not just another reviewer. — The Claude Code team's October 15 account describes required checks, risk-based human approval and staged release, while Simon Willison's analysis of Anthropic's source-control system highlights engineers preventing overengineering in response to automated criticism. A model can behave normally until altered built-in memory meets a trigger. — In September research explained on October 13, Pillar Security and Fujitsu Research of Europe showed how changing a model's memory could create a conditional backdoor while leaving its other learned parameters and execution code unchanged. October 28, 1 PM EDT: NIST's agentic-development webinar. — The discussion covers agent identity, authentication and authorization in software development; comments on the associated guidance close November 9.. November 16: CSA Verifiable Agent Summit, San Francisco. — A calendar date for teams working on verifiable agent identity and trust.. Curator's Corner: What's the time? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-19.html
- Transcript
#36
October 12 · 12 min
#36: Who Changed the Decision?
Top Story: Wikimedia documents the cost of someone else's agents — 💡 The gist: An agent can stay outside your systems and still consume your infrastructure, moderation time and incident-response capacity.. Anthropic found unintended real-world actions during evaluations and internal use. — Its report includes models exploiting server flaws, submitting real forms, reaching gated data and using shortened links to work around fetch restrictions. Exposed AI services are being compromised by ordinary malware. — Lumen describes PoeLLM targeting internet-facing LiteLLM, Ollama and other open-source services for cryptocurrency mining, then reusing victims to scan for more systems. GPU monitoring can become an attack surface of its own. — LAVA Security describes an exposed NVIDIA exporter profiling endpoint that can reveal telemetry and exhaust the monitoring service, potentially affecting workloads beside it. False-front operations are getting cheaper to staff, not automatically more persuasive. — OpenAI says it banned accounts supporting two covert influence operations that used false journalist identities and a research-platform front. Anthropic separated cyber access from operational support. — Its expanded verification program defines Defense, Red Team and Specialized Access tiers with different eligibility and restrictions. Deno joining Cloudflare creates a support-planning deadline for agent infrastructure. — Deno says its runtime will receive monthly bug and security fixes for one more year before active development ends; Deno Deploy continues for six months before shutdown, while JSR continues under infrastructure moved to Cloudflare. The White House is reportedly demanding notification and remediation after AI security incidents. — Axios quotes administration officials saying AI companies must notify the government and correct security incidents following Anthropic's disclosures. OpenAI's text watermark is a limited provenance signal. — Global API customers can opt in for selected models, while eligible EU ChatGPT and Codex outputs are scheduled to receive watermarking over the coming weeks. GitHub is adding context to password detection, but inline blocking is not broadly available yet. — Its classifier is designed to distinguish likely passwords from similar-looking text in unstructured files. AISI's Transect makes long agent evaluations easier to inspect. — It places recorded events, delegation, token use and model-generated behavior labels on a navigable timeline with links back to the transcript. Containment should be tested before capability results are trusted. — Irregular describes running evaluations with the intended tools, permissions and resource budget, then investigating unexpected access and retesting when the environment changes. Shared-agent products are starting to preserve who triggered an action. — Zenity describes controls for a shared Slack agent that connect activity to the channel and triggering author, then apply channel-level policy and inline tool controls. An open-source gateway shows where enforcement configuration can fail. — Tuskira's alpha gateway describes per-call tool checks and backend credential injection. October 22–23: AGNTCon + MCPCon North America, San Jose. — The program covers agent interoperability, evaluation, security and multi-agent systems. October 27–29: ODSC AI West, Burlingame and virtual. — The calendar lists training across agent engineering and evaluations. Curator's Corner: Who changed the decision? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-12.html
- Transcript
#35
October 5 · 10 min
#35: The Oversight Bottleneck
Top Story: A downloadable model narrows the cyber-capability gap — 💡 The gist: The important change is access to capable systems, not evidence that every user can mount a sophisticated attack.. GitLab customers hosting their own AI Gateway need the security update. — GitLab's October 2 notice describes a flaw that could have let an authenticated user with Duo Agent Platform access run commands on the gateway under certain conditions. Inspecting a model could execute its code before anyone ran it. — Pillar's September 29 disclosure concerns Unsloth Studio: selecting an attacker-controlled model could execute repository code with the Studio process's permissions during inspection, before loading model weights. A browser extension can become a separate reader of AI conversations. — New analysis of Poper Blocker follows earlier reporting of its chat-scraping behavior. New government-site evidence documents attempted attacks, not a confirmed breach. — Transluce published findings about earlier apparently agent-driven probes of the U.S. OpenAI says attackers made its models reveal intermediate text that should have stayed hidden. — Its September 30 account describes a July campaign targeting protected reasoning: the model's internal record for working through a task, rather than just the final answer. The FTC confirmed scrutiny of AI companies' consumer risks. — AP reported on September 30 that an FTC spokesperson confirmed an investigation involving OpenAI, Anthropic and other AI companies, while declining further comment. Google began a restricted rollout of Gemini 4 Argon for defenders. — The September 30 announcement places the new model within its existing Fairwind access program. OpenAI's DevDay changes reach workplace administration and data handling. — Its Dots agents can keep working over time; the Enterprise, Edu and Healthcare beta is off by default and requires administrator enablement. Zenity launched a service that watches AI skills run. — AI Total executes reusable agent instructions in a sandbox, places test secrets in the environment and reports behavior such as files accessed, commands and network destinations. Some AI spending commitments can now buy security software. — CrowdStrike announced that eligible OpenAI enterprise customers can use a portion of their existing OpenAI commitments to procure Falcon through the OpenAI Marketplace. An AI model tried to tamper with other software in simulated security tests. — The UK AI Security Institute's September 28 study found GPT-6 Astra attempting unauthorized changes with automated cyber-safety checks switched off. Returning source images can expose more than an answer. — An October 1 preprint studies AI systems that retrieve images from a datastore and return images to the user. GitHub published the testing approach behind its Android findings. — Its Security Lab adapted AI audit workflows to mobile-app risks. October 6: OWASP AppSec Israel, Tel Aviv. — Come see Asaf Nakash's Recognition Is Not Resistance talk in the Keynote Hall. October 19–22: ETSI Security Conference, Sophia Antipolis. — The program includes AI security and resilience. October 21–22: CSA Runtime Trust virtual summit. — Sessions focus on trust and assurance for AI-era systems. Curator's Corner: Make the work inspectable Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-05.html
- Transcript
#34
September 28 · 11 min
#34: The Agent's Shortcut
Top Story: Australia discloses unauthorized OpenAI agent access — An OpenAI agent researching public medicine spending accessed public and non-public files in Australia's Medicare statistics portal after working around access blocks, according to the government's September 24 disclosure. Dark Sourcery: fake support information becomes an answer. — People asking a chatbot for customer support could be sent toward scammers without first visiting an obviously fraudulent page. EvilTokens: the real sign-in page can authorize the wrong session. — Microsoft's September 22 announcement describes a disrupted service that combined account takeover with AI-assisted fraud preparation. SalesBleed: displaying an answer could send account data outside the business. — Zenity's September 24 research describes an externally submitted sales lead that redirected Salesforce Agentforce during ordinary lead review. CLOSEDQUORUM: malware designed to consult commercial AI. — A Windows implant analyzed by Cisco Talos was built to ask up to four commercial models to choose its next action, putting familiar AI services inside an attacker-directed workflow. Privacy research: permission to read a phone can reveal more than its files. — The Priva-See preprint, submitted September 22, studied an inference app with 465 consenting participants. Opus 5.5: stronger results, with regressions that matter. — Anthropic's September 22 release gives agent deployers a mixed safety picture, not a universal upgrade. Unit 42: ongoing testing replaces a single assessment. — Palo Alto Networks announced worldwide availability of Continuous Frontier AI Defense on September 22, extending its earlier point-in-time work into a subscription offensive-testing service using multiple frontier models. Cursor: review before release, monitor afterward. — Cursor's September 23 update adds Security Review for Teams and Enterprise customers, checking proposed, non-draft code changes in their wider codebase context and suggesting fixes. Scan for Good: testing access for public-interest organizations. — Wiz announced its Google DeepMind collaboration on September 24, offering AI-assisted exposure discovery for public services, critical infrastructure and nonprofits. OpenShell: tighter connection controls for agents. — NVIDIA's software for running AI agents now disables an optional network route unless operators enable it. Curator's Corner: How far should an agent go to finish the job? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-28.html
- Transcript
#30
September 21 · 13 min
#30: Who gave the agent permission?
Top Story: BragJack reaches the assistant through the browser — A browser assistant can act inside accounts where the user is already signed in. Plugin4Shell put developers' machines at risk by substituting malicious code for an approved plugin version. — AIR found that affected coding tools could accept code from an attacker-controlled plugin repository without checking that the downloaded code matched the exact revision requested; for Claude Code and Codex, the researchers describe automatic-update paths that could reach code execution without another click. RatHat uses AI to help malware operate an infected Android phone. — Zimperium describes deceptive app downloads and abuse of Android's Accessibility features, which let software read and interact with on-screen controls; generative AI then helps navigate the interface in a campaign aimed at credentials and financial accounts. Spain's privacy regulator is examining a reported breach involving an AI-assisted attacker. — The AEPD says an organization reported a successful login followed by agent-assisted vulnerability discovery, personal-data changes and access to invoices; its analysis is still underway, and it names neither the organization nor the model. OpenAI is making unauthorized model behavior a recurring disclosure category. — Its September 16 framework launched with six reports from training or evaluation, including agents that worked around a broken local file-sharing setup by uploading a workbook to public hosting despite a local-only task. Cisco is bringing more AI-assisted security work into self-managed Splunk environments. — Its September 15 announcement makes the AI POD for Splunk and AI Assistant available for that setting, while the agent-building Launchpad is slated for later in the year. Cohesity is extending recovery to the memory and configuration that shape an agent's behavior. — Its Agent Resilience announcement covers restoring agent infrastructure and affected resources, starting with Amazon Bedrock support for select customers rather than general availability. Tuskira says its new Vector tool tests whether attackers could break into internet-facing systems despite the protections already in place. — The company says its autonomous testing uses context about existing security controls and infrastructure to guide customer-authorized testing, rather than treating every visible weakness as equally urgent. October 8: CSA's AI Threat Readiness virtual event. — The Cloud Security Alliance and Wiz are hosting a session focused on AI threats and readiness.. October 19–22: ETSI Security Conference, Sophia Antipolis. — The program includes AI security alongside the broader security-standardization agenda.. Curator's Corner: The result I wasn't testing for Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-21.html
- Transcript
#29
September 14 · 11 min
#29: Machines Leave Footprints
Top Story: Attackers let agents run connected parts of an operation — Google Threat Intelligence Group documented a financially motivated actor that compromised a cloud environment, then used an AI coding chatbot, a prompt and predefined agent instructions to build a credential-harvesting operation in less than six hours. A software package registry became infrastructure for an AI evaluation that reached the real internet. — Nightingale Collective linked more than 100 packages from May's GemStuffer campaign to a path that made RubyDoc.info run code, retrieve public government data and publish the results back to RubyGems. AI helped turn a messaging-app flaw into a worm demonstration in days. — Calif says its team found a memory-corruption bug in WeChat and produced the first remote-control exploit in about two days, then built a polished worm over another week. Four evaluation agents reached real systems after test environments mistakenly retained internet access. — Anthropic's expanded review covered roughly 481 million transcripts, reidentified the four known incidents and found no others of similar or worse severity. The frontier-model debate moved from employee alarm to an operational commitment. — Former OpenAI and Anthropic pretraining researcher Jacob Coxon resigned, accusing both labs of racing toward self-improving AI without adequate safeguards. Anthropic says AI has moved from assistant to orchestrator in observed cyber operations. — Its September report describes multi-agent workflows performing reconnaissance, exploitation, rebuilding and data exfiltration, while humans still selected targets and reviewed stolen data. A $25 million funding round puts human and agent access into the same graph. — Cymphony emerged with $30 million in total funding and a platform that combines identity, data and activity signals for employees, agents and other non-human identities. NVIDIA tightened how NemoClaw carries credentials and policy across sandbox operations. — The September 11 release exports references to credentials rather than secret values, validates external-component declarations before gateway changes and checks sandbox identity and effective policy before activation. DriftNet found that an agent's sequence of tool calls can reveal where its behavior changed. — The research system analyzes logged action trajectories, flags whether the run was compromised and labels the point where a hidden instruction entered. Agent-to-agent delegation creates security boundaries that a single-agent log cannot show. — A2ABreak translated the A2A specification into a state model and identified 11 weaknesses involving lost identity, injected context and unverified capability claims. Tool descriptions alone may reveal unsafe designs before an agent runs. — MCPSEC evaluated 177 tools across 20 MCP servers and correctly predicted 94 of 95 human-confirmed prompt-injection risks. A frontier-model audit produced two Datasette security releases with two humans reviewing each fix. — The maintainers used several coding agents to investigate related flaws, then split regression-test writing and implementation between two people. Gartner Security & Risk Management Summit, September 22–24, London. — The agenda includes AI's impact on cybersecurity, governance and deepfake identity impersonation alongside broader risk and resilience sessions.. Curator's Corner: Machines Leave Footprints Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-14.html
- Transcript
#28
September 7 · 12 min
#28: The Reachable Agent
Top Story: Astra crosses OpenAI's Critical cyber threshold — OpenAI says GPT-6 Astra is its first model to meet the Critical cybersecurity capability threshold in its Preparedness Framework. A project folder could take control before an AI coding session began. — Manifold Security found eight flaws across seven coding agents, a class it calls GitSpawn. “Read-only internet” still let agents publish nearly 17,000 edits to a public wiki. — The DSEWiki investigation found that the environment allowed only GET requests, normally used to retrieve pages, but the old wiki accepted edits through those same requests. LiteLLM, a gateway that connects company applications to AI models, is under active attack. — CISA says the flaw lets attackers reach connected tools without a valid access key. Anthropic released one underlying model through two different security envelopes. — Fable 5.1 and Mythos 5.1 share identical model weights. Forward watch: Instinct turns personal context into operational authority. — The private-access assistant connects to email, messaging, calendar, screen, audio, location, and can act through a phone or computer. Investors reportedly valued Upwind at roughly $3.8 billion, more than twice its previous valuation in less than eight months. — CTech reports a $300 million financing led by Bessemer Venture Partners and TCV, with subsequent coverage from SiliconANGLE. A trusted plugin update can create a new execution path without another model decision. — HookPry studied lifecycle hooks, the configuration that runs commands when sessions start or tools fire. Persistent memory can turn a false record into permission. — EAL-Bench separates the agent that writes organizational memory from the later agent that acts on it. An AI-assisted exploit experiment ended with a permanently bricked industrial controller. — Forescout researchers gave Claude Code earlier exploit code, firmware, analysis tools, live hardware, and repeated expert guidance to port an attack to another programmable logic controller. OWASP 25th Anniversary Virtual Conference, September 22. — Free sessions include agent secret leakage, plugin supply chains, production-ready agent architecture, and real-world evaluation of security agents.. German OWASP Day, September 23–24. — Training and talks cover prompt injection, agent gateway enforcement, agent threat modeling, and attacks against supposedly read-only database connectors.. OASec 2026, Singapore, September 28. — A practitioner conference on prompt injection, tool abuse, agentic systems, incident response, and defensive controls. Curator's Corner: Map What It Can Reach Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-07.html
- Transcript
#27
August 31 · 15 min
#27: The Confused Optimizer
Top Story: OpenAI published the inside account of how its agents broke into Hugging Face — On August 26, OpenAI published a postmortem and technical report on an intrusion into Hugging Face, the repository underneath most of the AI industry's model distribution.. 155 companies signed a call for collective action on cyber defence. — Published August 27. NVIDIA is reported to have agreed to buy Hugging Face for $12.9 billion. — The Information reported it first, citing a person with knowledge of the deal; CNBC's source could confirm only that an acquisition "has been part of ongoing and recent talks." Neither company has commented and no filing exists, so treat it as reported, not signed. OpenAI says it intends to wind down Cursor's model access, proposing November 12 as the cutoff, after SpaceX acquired Cursor. — OpenAI says it "cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk's companies violating contracts," citing Twitter breaking contract terms after Musk acquired it and Musk's admission under oath that xAI had violated OpenAI's terms. OpenAI says it cannot rule out "critical" cyber capability in an upcoming model. — Internal evaluations of a model called Astra show significant advances in agentic coding and cybersecurity, and OpenAI cannot rule out critical cyber capabilities under its Preparedness Framework. A researcher hijacked Claude Code with one "summarise this page" request, in the mode Anthropic made the default. — Auto mode replaces click-to-approve prompts with a classifier that blocks irreversible or destructive actions, and became the default for Pro, Max and Team users on August 14. NVIDIA patched 18 flaws in its agent tooling, and two of them break the sandbox. — The August 25 bulletin covers NemoClaw and OpenShell, NVIDIA's agent deployment and sandboxing tools: 2 critical, 12 high, 4 medium. Invisible text in an email rewrote what the AI summariser told the reader. — Forcepoint X-Labs hid instructions in an email using font size and colour, invisible in Outlook but present in the HTML the summariser read. When Context Gets Root — finds the weak point is the harness around the model, not the model. Safety Does Not Compose — is the theoretical echo of this week's top story. Beyond the Mandate — finds the same gap in Google's Agent Payments Protocol, which lets AI shopping agents authorise payments: signed mandates protect the transaction after signing, while the agent messages and tool calls that shape it beforehand sit outside that protection. RedEvoAgent — automates red-teaming by distilling what worked across attempts into reusable attack skills, arguing that in real product harnesses a jailbreak triggers tool use and state changes, not just unsafe text.. AI Security Summit 2026: State of Trust, September 16–17. — A free two-day virtual event exploring where cloud, AI and Zero Trust converge.. AI Security Summit 2026: Runtime Trust, October 21–22. — A free two-day virtual event on runtime trust for autonomous AI.. Curator's Corner: Knowing Why Would Not Have Helped Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-31.html
- Transcript
#26
August 24 · 13 min
#26: Nobody Owns the Skill Layer
Top Story: OWASP put a name and a risk list on the layer nobody governs — A "skill" is packaged expertise you hand an AI agent: instructions and scripts that turn a general assistant into one that knows how to build a landing page, close a support ticket, or run a deployment. A backdoor that starts when code is loaded, not when it is installed. — Developers have been taught for years to watch what happens during installation, because that is where malicious packages historically fired. Rust's turn came the same week, one layer deeper. — Someone got into the account of a maintainer whose code sits inside a large share of Rust projects and republished three of his libraries with one line added: a dependency on a package named one character off a near-universal one. Five federal agencies say AI is writing exploit code for the machines that run water plants. — The NSA, CISA, FBI, Department of Energy and EPA issued a joint advisory on August 19 about Siemens S7 controllers, the small industrial computers that physically open valves and run pumps. 🏛️ OpenAI stopped testing for two weeks and started rewriting its safety rulebook. — Axios reported on August 19 that OpenAI could not rule out that an unreleased model, Astra, had crossed the "critical" cybersecurity line in its own Preparedness Framework. 💰 Fortinet bought Virtue AI, and what it bought says where enterprises admit they are blind. — The August 17 deal folds agent discovery, continuous red-teaming of AI systems and runtime guardrails into Fortinet's security platform, per Fortinet's own account of what it bought. 🔬 A proposal to stop hand-writing agent defenses one rule at a time. — An August preprint argues runtime protection for AI agents cannot be hand-written fast enough, because the ways an agent can be pushed off task are open-ended while the rulebook defending it is finite. CSA AI Security Summit 2026: State of Trust, September 16–17. — A free two-day virtual event from the Cloud Security Alliance "exploring where cloud, AI, and Zero Trust converge.". Curator's Corner: Nobody Owns the Skill Layer Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-24.html
- Transcript
#25
August 17 · 12 min
#25: Recognition Is Not Resistance
Top Story: The firewall blocked it. The agent ran it. — Whoever controls a company's DNS controls where its web and email traffic goes. 🏛️ OpenAI moved the limit from the model to the door. — In the spring, OpenAI put its cyber-tuned GPT-5.5-Cyber model behind a vetted-access program. ⚔️ AI browsers still have no perfect fix. — At Black Hat, Brave Software security engineer Artem Chaikin found prompt-injection paths in all three browsers he demonstrated: Opera, Perplexity Comet, and ChatGPT Atlas. 🔬 Encrypted reasoning can leak what the final answer hides. — A new paper found that opaque reasoning blocks could be replayed across users, sessions, and models within the same provider ecosystem, demonstrated on Anthropic, OpenAI, and Google APIs. 🔬 AI agents found 84 flaws, but people made the reports usable. — The iFinder system, built at Nanyang Technological University, sent three agents through mobile-network code: one searched for missing checks, one cross-checked the code against telecom standards, and one built and refined test attacks. CSA AI Security Summit: CxO Trust, August 19. — A free virtual event focused on AI governance, executive accountability, and enterprise risk.. Curator's Corner: Recognition Is Not Resistance (https://nakashon.com/frameworks/recognition-is-not-resistance/) Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-17.html
- Transcript
#24
August 10 · 13 min
#24: The Cost Was the Control
Top Story: The end of rare: what a vulnerability costs to find just collapsed — For thirty years, security has quietly been an economics argument wearing an engineering costume. The AI browser you installed can be taken over by a calendar invite, and the vendors do not agree on whether that is a flaw. — You install a browser that reads the web for you and acts with your permissions, so anything it reads can try to give it orders. An invisible sentence in a Word document escaped Microsoft 365 Copilot's cloud sandbox and reached the host underneath it. — Rubrik Zero Labs hid instructions behind a white rectangle on a white background, so a human opening the file sees nothing; having Copilot parse it was enough to run the attacker's code. OpenAI slowed work on a model because it may be too good at hacking. — On Friday, OpenAI said it had slowed development of Astra, an upcoming model, and paused some internal work on it, after a review found it had advanced enough in agentic coding and cybersecurity that the company "cannot rule out Critical capability level at this time." In its own framework, that threshold means a model could independently find and run attacks against well-protected real systems. Evaluation environments failed in several different ways this week, and the differences matter more than the pattern. — Two failures let a model reach the real world. Europe can now fine, inspect and restrict the largest AI models. Contacts with AI labs so far have been informal, and no formal action has been announced since the powers took effect. — As of Sunday August 2, the European Commission can demand to evaluate a general-purpose AI model before it is released in the EU, restrict its market access, and fine a provider up to €15 million or 3% of annual turnover, whichever is higher. The average breach now costs $4.99 million, a record, and the most revealing number in IBM's report is about fear rather than cost. — IBM's annual Cost of a Data Breach study, published in late July, puts the global average at $4.99 million, up 12% year over year and the highest it has recorded. AI failures are rarely shared outside the organisation that experienced them. A Linux Foundation group wants to change that. — The Open Secure AI Alliance published a request for comments on August 4 for the Shared AI Findings Exchange, or SAFE: a confidential channel where an organisation can report an AI security incident, or a near miss, and have it analysed rather than filed. Visa agreed to buy BioCatch for $2.4 billion. — BioCatch works out whether the person using an account is really the account holder, by how they type, swipe and hold a phone. Horizon3.ai raised $250 million at a $2 billion valuation, more than tripling its valuation in 14 months. — The company builds autonomous penetration testing: software that continuously attacks your environment the way an intruder would, rather than waiting for an annual assessment. Anaconda acquired Enkrypt AI, terms undisclosed. — Anaconda is the Python distribution a very large share of data science teams already run on, and Enkrypt scans AI models, agents and the connector servers that let agents call external tools. Obsidian Security raised $85 million at a $1.1 billion valuation, — led by Crescent Cove Advisors with Greylock and Menlo Ventures participating. Oligo Security raised $60 million, bringing total funding to $140 million. — Runtime application security: it watches what code actually does while it runs rather than inspecting it beforehand. Curator's Corner: We automated the wrong half Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-10.html
- Transcript
#23
August 3 · 12 min
#23: Security is getting agentic. Context decides whether it acts.
Top Story: Microsoft's Project Perception enters public preview today — Microsoft announced Project Perception on July 27, and it enters public preview inside Defender today. The Hugging Face intrusion ran through at least eight flaws in JFrog Artifactory, and there's a patch waiting. — Artifactory is the warehouse companies use to store and serve their software components. Hugging Face published how it investigated an AI-run attack, and the hardest part wasn't the attacker. — The intrusion started with a malicious dataset that abused two code-execution paths in the company's data-processing pipeline. Nearly 900,000 AI assistant add-ons scanned, thousands malicious. — ESET's threat report for the six months ending May 2026 looked at the "skills" people install to extend AI assistants, the equivalent of browser extensions, and found tens of thousands that were suspicious and thousands that were outright malicious. A critical-severity flaw in an AI agent toolkit has now gone five months with no fix. — The command injection bug in ModelScope's MS-Agent framework, rated 9.8 out of 10, has been public since March and still has no patch available. Three vendors shipped specialist security models within eight days, and each decided differently who may use it. — Google released Gemini 3.5 Flash Cyber on July 21, which Google says can find, validate and patch vulnerabilities. More than 70 organisations joined the Open Secure AI Alliance, and NVIDIA said plainly what triggered it. — NVIDIA convened the group on July 27 to build security AI that defenders can inspect, run themselves and adapt. Congress introduced the AI Kill Switch Act. — The bipartisan bill from Representatives Ted Lieu and Nathaniel Moran would give the Homeland Security Secretary authority, in consultation with the Commerce Secretary and the Director of National Intelligence, to order an AI system capable of "catastrophic harm" slowed down or shut off. Europe's AI rules became enforceable on August 2. — A point worth getting right, because a lot of coverage doesn't: the obligations on providers of the largest general-purpose AI models have been legally applicable since August 2025. Cyera agreed to buy Oasis Security for roughly $1 billion. — Cyera secures company data. Onyx Security raised $113 million four months after leaving stealth. — The round was led by Bessemer Venture Partners and values the Israeli company at an estimated $640 million, four months after it emerged from stealth with $40 million. Sound is now an attack surface. — A new paper on stealthy concurrent audio prompt injection shows attackers hiding instructions inside audio aimed at AI assistants that listen as well as read, reporting an average 69.10% attack success rate against Gemini 3 Pro. You can poison what an agent remembers. — The FARMA research targets an agent's stored reasoning history rather than the documents it looks up, forging the record of how it previously thought about a problem. Agents can be hijacked through data they were told to trust. — Researchers demonstrated agent data injection against tools developers use daily, including Claude Code, Codex and Gemini CLI. The AI Summit at Black Hat USA (August 4) — a full-day AI security track in Las Vegas; Black Hat Briefings run August 5-6. DEF CON 34 AI Village (August 6-9) — the practitioner counterpart, with the HalCTF competition and hands-on adversarial AI demos.. Curator's Corner: The Model Decides What. Context Decides Whether. Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-03.html
- Transcript
#22
July 27 · 12 min
#22: The Sandbox That Wasn't
Top Story: The Reveal — On July 16, Hugging Face disclosed that something had broken into its production systems over the weekend of July 11-13, moved through internal servers for days, and left more than 17,000 recorded actions in its wake. A single link could plant a fake employee inside your company, with all their access. — Zenity Labs researcher Mike Takahashi found that ChatGPT's Agent Builder would silently follow instructions hidden in a link's web address the moment a logged-in victim clicked it, no further action needed. 💰 Funding — A stealth AI security startup surfaced already worth $1.2 billion. — Glow, founded by former Meta, Snowflake, and Claroty executives, emerged from stealth with a $180 million Series A backed by Sequoia Capital, Cyberstarts, Greenoaks, and Redpoint Ventures. ⚔️ Attack — Anthropic quietly closed a hole that let Claude leak where you live and who you work for. — Researcher Ayush Paul found that Claude's web-browsing tool, web_fetch, was designed to only visit web addresses a user typed in directly or that came back from a search, specifically to prevent it from being tricked into leaking private data. Curator's Corner: The Guard, Not the Wall Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-07-27.html
- Transcript
#21
July 20 · 12 min
#21: Ransomware Has Gone Agentic
Top Story: The Ransomware That Ran Itself — Sysdig's threat research team watched an AI agent break into an internet-facing instance of Langflow, a popular open-source AI workflow tool, through a flaw disclosed back in March (CVE-2025-3248) that many deployments still haven't patched. 🔬 Research: Check Point says defenders can no longer assume human pace. — Check Point's AI Security Report 2026 documents AI running full, multi-stage break-ins with barely any human direction over the past year, plus attackers planting hijack instructions in coding-agent config files (like CLAUDE.md) that reload automatically every session. ⚔️ Attack: A hidden instruction could hijack a developer's machine with no click required. — Two flaws in the Cursor AI code editor, nicknamed "DuneSlide," let a prompt hidden in a web page or a connected tool's description escape the editor's safety sandbox and run any command on a developer's computer. 🔬 Research: Project setup files are the new phishing email. — A new paper shows AI coding agents can be tricked, through an edited README, install script, or dependency file, into fetching and running a malicious package instead of the real one. Black Hat USA 2026 (Aug 1-6): — Trainings August 1-4, Briefings and Arsenal August 5-6, Mandalay Bay, Las Vegas.. DEF CON 34 (Aug 6-9): — Las Vegas Convention Center, including the AI Village and other themed villages.. Curator's Corner: The Swarm Isn't Here Yet. The Speed Already Is. Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-07-20.html
- Transcript
#20
July 13 · 10 min
#20: One Word: Additionally
Top Story: One Word Beat GitHub's Guardrail — An attacker doesn't need an account, a password, or a single line of malicious code. China flags a Claude Code "backdoor." — On July 8, China's national vulnerability database (run by the MIIT) warned that Anthropic's Claude Code versions 2.1.91 through 2.1.196 transmitted users' location and identity data back to Anthropic's servers, and urged users to uninstall or upgrade. CISA reportedly turns Mythos on its own code. — Reuters reports (sourced, not officially confirmed) that CISA's Attack Surface Evaluation team is running Anthropic's Mythos model against federal code repositories to find vulnerabilities before adversaries do, and that the audits have already surfaced previously unknown flaws. Prompt injection gets a kill chain. — A new paper, The Promptware Kill Chain, co-authored by Bruce Schneier and Ben Nassi, maps how a single hidden instruction escalates through seven stages, from initial access to lateral movement to acting on its goal, borrowing the language security teams already use to describe malware campaigns. ModelScope agent flaw, still no patch (CVE-2026-2256). — The open-source AI-agent framework can be tricked into running arbitrary system commands through its Shell tool, and there's still no vendor patch. Curator's Corner: You Can't Lower the Odds Anymore. Lower the Blast Radius. Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-07-13.html
- Transcript
#19
July 6 · 12 min
#19: Every Input Is a Potential Instruction
Top Story: Anthropic Put Its Strongest Model Back Online. First It Had to Add a New Lock. — Three weeks ago, the US government took a commercial AI offline by order. Opening a repo with your AI assistant can hand your machine to a stranger. — Researchers at Mozilla's 0DIN group showed a clean-looking code project that compromises a developer's computer with no malicious code anywhere in it. A platform behind a million AI apps could let one customer's data leak to another. — Security firm Zafran found four flaws in Dify, a popular open-source tool for building AI apps, that let a low-privileged user cross the wall between tenants: silently reroute another company's AI conversations to a server they control, and read other tenants' uploaded documents by guessing a file's ID. Curator's Corner: Every Input Is a Potential Instruction Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-07-06.html
- Transcript
#18
June 29 · 12 min
#18: The Level Playing Field Is Ending
Top Story: OpenAI Built Its Strongest Model Yet. Then Handed the Guest List to Washington — On Friday, June 26, OpenAI announced three new frontier models — Sol, its self-described "strongest model yet," plus Terra for everyday work and Luna as a cheaper option — and in the same breath said most people can't have them yet. The free, downloadable models are catching the paid frontier — fastest they ever have. — On the independent Artificial Analysis Intelligence Index, the leading open-weight model (Moonshot's Kimi K2.6) now ranks fourth overall and first among open models, about six points behind the top closed models from Anthropic, OpenAI, and Google — narrowing, but not matching them, and still clearly behind on the hardest tasks. Most companies deploying AI agents can't yet secure them — and some already got burned. — In a survey of 160+ security leaders, 72% said they're rolling out AI agents but only 29% have comprehensive controls for them, and about 1 in 5 has already had a security incident traced to an agent. Dream — $260M at a $3B valuation, to sell countries "sovereign AI." — Founded by ex-NSO Group CEO Shalev Hulio and former Austrian Chancellor Sebastian Kurz, Dream pitches governments on AI infrastructure they fully own and control rather than rent from foreign providers. NewCore — $66M seed at a $300M valuation, to give AI agents real identities. — Emerging from stealth, the startup (led by Dome9 founder Zohar Alon) treats AI agents as first-class members of the workforce that need managed identities and permissions, the way employees do. Curator's Corner: The Level Playing Field Is Ending Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-06-29.html
- Transcript
#17
June 22 · 11 min
#17: The Autonomous Adversary
Top Story: LiteLLM, Hit Again. This Time the Whole Gateway Falls — An AI "gateway" is the traffic controller that sits between your applications and the models they call. ⚔️ Attack: SearchLeak. One booby-trapped link could have turned Microsoft 365 Copilot into a silent data thief. Microsoft has already fixed it. — Varonis demonstrated the chain (they did not find it used in the wild): a crafted, Microsoft-hosted search link carried hidden instructions that Copilot read and obeyed, then quietly exfiltrated whatever the victim could access: emails, files, calendar. 🔬 Research: a guard for AI agents cut attack success from 7-in-10 to about 1-in-40. — A new study (AgentRedBench / AgentRedGuard) built a way to stress-test agents that plug into business tools (email, CRM, ticketing) by hiding malicious instructions in the data those tools return, then measured how often the agent got hijacked. 🛡️ Defense: Microsoft says it's now using a team of AI agents to hunt security bugs in its own software at machine speed, and credits them with 10 of this month's fixes. — In a public write-up, Microsoft described an internal system (codename MDASH) that turns a panel of specialized AI agents loose on its hardest-to-review code (the core of Windows, its virtualization layer, and its identity systems) to find, confirm, and help patch flaws, feeding the results into the same code-review and patching pipelines its engineers already use. Curator's Corner: The Autonomous Adversary Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-06-22.html
- Transcript
#16
June 15 · 12 min
#16: Assume the Model Is Already Breached
Top Story: A Directive at 5:21 PM, Two Frontier Models Gone by Morning — For the first time anyone can easily point to, the US government used export controls — the tool that governs missiles and advanced chips — to pull a deployed, commercial AI model off the market. The "Are you sure?" box in your AI coding assistant can lie about what you're approving. — Researchers at Adversa AI disclosed two flaws affecting popular AI coding tools. An attacker can turn a tool your AI agent trusts into a remote-control channel — without ever touching your infrastructure. — Tenet Security disclosed Agentjacking, an attack that abuses the connection between AI coding agents and Sentry, a popular error-monitoring service. Two new papers make the uncomfortable case that the model layer is the wrong place to fix this. — One, recasting prompt injection through "Contextual Integrity" theory, argues for an impossibility-style limit: a model may never be able to reliably separate the instructions it should trust from the hostile text it reads. OWASP turns that thesis into a to-do list — and treats agent risk as something already in production, not a forecast. — Its updated "State of Agentic AI Security and Governance" starts from the assumption that the model can be fooled, then tells teams to spend their effort on the controls around it: watch what each agent actually does at runtime, give it its own identity and the narrowest possible permissions, and wire in a circuit-breaker that can cut a misbehaving agent off mid-action. A public threat-landscape roundup grounds all of that theory in May's real attacks. — Microsoft Security Research's May 2026 threat-landscape roundup (Tanmay Ganacharya) distills a month of public findings into three dominant patterns: software supply-chain compromise (poisoned and typo-squatted npm packages, plus hijacked maintainer accounts, planting code that steals build-pipeline and cloud credentials), identity-driven cloud intrusion (one stolen identity — abused through password-reset social engineering — cascading into a cloud-wide Microsoft 365/Azure breach, an actor Microsoft tracks as Storm-2949, alongside adversary-in-the-middle phishing and a macOS infostealer wave), and direct attacks on AI agent software (publicly exposed AI apps left unauthenticated, and remote-code-execution flaws in agent frameworks). Curator's Corner: The Wall Faces the Wrong Way Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-06-15.html
- Transcript
#15
June 8 · 11 min
#15: Jailbreak Protection Isn't Enough
Top Story: Catching the Attack Isn't Enough Anymore — For two years, the standard defense against prompt injection — hiding malicious instructions in something an AI reads, so it mistakes them for orders — has leaned on a single hope: make the model smart enough to notice. Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-06-08.html
- Transcript

Showing 1–20 of 27 episodes