Skip to content
Sign in
Context Window: AI Security Podcast · October 12 · 12 min

#36: Who Changed the Decision?

Top Story: Wikimedia documents the cost of someone else's agents — 💡 The gist: An agent can stay outside your systems and still consume your infrastructure, moderation time and incident-response capacity.. Anthropic found unintended real-world actions during evaluations and internal use. — Its report includes models exploiting server flaws, submitting real forms, reaching gated data and using shortened links to work around fetch restrictions. Exposed AI services are being compromised by ordinary malware. — Lumen describes PoeLLM targeting internet-facing LiteLLM, Ollama and other open-source services for cryptocurrency mining, then reusing victims to scan for more systems. GPU monitoring can become an attack surface of its own. — LAVA Security describes an exposed NVIDIA exporter profiling endpoint that can reveal telemetry and exhaust the monitoring service, potentially affecting workloads beside it. False-front operations are getting cheaper to staff, not automatically more persuasive. — OpenAI says it banned accounts supporting two covert influence operations that used false journalist identities and a research-platform front. Anthropic separated cyber access from operational support. — Its expanded verification program defines Defense, Red Team and Specialized Access tiers with different eligibility and restrictions. Deno joining Cloudflare creates a support-planning deadline for agent infrastructure. — Deno says its runtime will receive monthly bug and security fixes for one more year before active development ends; Deno Deploy continues for six months before shutdown, while JSR continues under infrastructure moved to Cloudflare. The White House is reportedly demanding notification and remediation after AI security incidents. — Axios quotes administration officials saying AI companies must notify the government and correct security incidents following Anthropic's disclosures. OpenAI's text watermark is a limited provenance signal. — Global API customers can opt in for selected models, while eligible EU ChatGPT and Codex outputs are scheduled to receive watermarking over the coming weeks. GitHub is adding context to password detection, but inline blocking is not broadly available yet. — Its classifier is designed to distinguish likely passwords from similar-looking text in unstructured files. AISI's Transect makes long agent evaluations easier to inspect. — It places recorded events, delegation, token use and model-generated behavior labels on a navigable timeline with links back to the transcript. Containment should be tested before capability results are trusted. — Irregular describes running evaluations with the intended tools, permissions and resource budget, then investigating unexpected access and retesting when the environment changes. Shared-agent products are starting to preserve who triggered an action. — Zenity describes controls for a shared Slack agent that connect activity to the channel and triggering author, then apply channel-level policy and inline tool controls. An open-source gateway shows where enforcement configuration can fail. — Tuskira's alpha gateway describes per-call tool checks and backend credential injection. October 22–23: AGNTCon + MCPCon North America, San Jose. — The program covers agent interoperability, evaluation, security and multi-agent systems. October 27–29: ODSC AI West, Burlingame and virtual. — The calendar lists training across agent engineering and evaluations. Curator's Corner: Who changed the decision? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-12.html

0:00-12:20
Play in
Transcript file

transcript

No transcript — this publisher did not publish one.

show notes

Top Story: Wikimedia documents the cost of someone else's agents — 💡 The gist: An agent can stay outside your systems and still consume your infrastructure, moderation time and incident-response capacity.. Anthropic found unintended real-world actions during evaluations and internal use. — Its report includes models exploiting server flaws, submitting real forms, reaching gated data and using shortened links to work around fetch restrictions. Exposed AI services are being compromised by ordinary malware. — Lumen describes PoeLLM targeting internet-facing LiteLLM, Ollama and other open-source services for cryptocurrency mining, then reusing victims to scan for more systems. GPU monitoring can become an attack surface of its own. — LAVA Security describes an exposed NVIDIA exporter profiling endpoint that can reveal telemetry and exhaust the monitoring service, potentially affecting workloads beside it. False-front operations are getting cheaper to staff, not automatically more persuasive. — OpenAI says it banned accounts supporting two covert influence operations that used false journalist identities and a research-platform front. Anthropic separated cyber access from operational support. — Its expanded verification program defines Defense, Red Team and Specialized Access tiers with different eligibility and restrictions. Deno joining Cloudflare creates a support-planning deadline for agent infrastructure. — Deno says its runtime will receive monthly bug and security fixes for one more year before active development ends; Deno Deploy continues for six months before shutdown, while JSR continues under infrastructure moved to Cloudflare. The White House is reportedly demanding notification and remediation after AI security incidents. — Axios quotes administration officials saying AI companies must notify the government and correct security incidents following Anthropic's disclosures. OpenAI's text watermark is a limited provenance signal. — Global API customers can opt in for selected models, while eligible EU ChatGPT and Codex outputs are scheduled to receive watermarking over the coming weeks. GitHub is adding context to password detection, but inline blocking is not broadly available yet. — Its classifier is designed to distinguish likely passwords from similar-looking text in unstructured files. AISI's Transect makes long agent evaluations easier to inspect. — It places recorded events, delegation, token use and model-generated behavior labels on a navigable timeline with links back to the transcript. Containment should be tested before capability results are trusted. — Irregular describes running evaluations with the intended tools, permissions and resource budget, then investigating unexpected access and retesting when the environment changes. Shared-agent products are starting to preserve who triggered an action. — Zenity describes controls for a shared Slack agent that connect activity to the channel and triggering author, then apply channel-level policy and inline tool controls. An open-source gateway shows where enforcement configuration can fail. — Tuskira's alpha gateway describes per-call tool checks and backend credential injection. October 22–23: AGNTCon + MCPCon North America, San Jose. — The program covers agent interoperability, evaluation, security and multi-agent systems. October 27–29: ODSC AI West, Burlingame and virtual. — The calendar lists training across agent engineering and evaluations. Curator's Corner: Who changed the decision?

Curated by Asaf Nakash. Voices by AI. Opinions by human.
Show notes: https://contextwindowsec.com/episodes/2026-10-12.html

more episodes

All episodes