Modern Cyber with Jeremy Snyder11 Dec 2025

This Week in AI Security - 11th December 2025

In this week's episode, Jeremy focuses on the escalating threat of prompt injection across the enterprise, the introduction of a new OWASP Top 10 list, and a surprising advisory from Gartner.

Prompt Injection & RCE:

PromptPwnd: A vulnerability in GitHub Actions allows attackers to use malicious commit messages to perform prompt injection against AI agents, executing privileged tools and leaking secrets from CI/CD pipelines.
IDE Attack Surface: Similar prompt injection flaws were identified in popular development environments and extensions (Cursor, Copilot, Z-Ro), showing how malicious prompts can bypass guardrails and hijack context within the IDE.
GeminiJack: A "zero-click" vulnerability in Google Gemini Enterprise and Vertex AI Search allowed attackers to embed indirect prompt injections in shared documents (Gmail, Calendar, Docs). A routine employee search would activate the attack, causing the AI to exfiltrate sensitive corporate data.

Industry Shifts:

Gartner's Advisory: Gartner issued an unusual strong advisory recommending that CISOs block all AI browsers (like ChatGPT Atlas and Perplexity Comet) for the foreseeable future due to inherent security risks, including data leakage, credential abuse, and autonomous rogue actions.
New OWASp Top 10: The OWASp Top 10 for Agentic Applications was released, focusing on risks unique to autonomous, tool-using systems, such as Agent Goal Hijack, Identity and Privilege Abuse, and Agentic Supply Chain Vulnerabilities.

Episode Links:

++++++++++

Worried about AI security? Get Complete AI Visibility in 15 Minutes. Discover all of your shadow AI now. Book a demo of Firetail's AI Security & Governance Platform: https://www.firetail.ai/request-a-demo

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(127)

David Kerber of Act Security

In this episode of Modern Cyber, Jeremy is joined by David Kerber from Act Security and Cloud Copilot to explore the complex, heavily misunderstood world of AWS IAM. David dismantles common misconcept...

18 Aug 37min

This Week in AI Security - 13th August 2026

Fresh off Black Hat and DEF CON, Jeremy raises the bar on which stories make the cut and walks through the most compelling disclosures from a packed couple of weeks. The dominant theme: agents pursuin...

13 Aug 15min

This Week in AI Security - 6th August 2026

Recorded from the sidelines of hacker summer camp, Jeremy runs through a packed week spanning Black Hat, B-Sides, and DEF CON. The theme keeps repeating: prompt injection is always possible, and it is...

6 Aug 21min

This Week in AI Security - 30th July 2026

The final episode before Black Hat, and Jeremy keeps it tight with a few quick hits before settling into the week's biggest theme: identity, visibility, and the open-versus-closed model debate. This w...

30 Juli 17min

This Week in AI Security - 23rd July 2026

A lighter week on volume that Jeremy uses to go deep on two of the most significant stories of the year so far. The episode opens with quick hits on export-control pressure spreading to OpenAI's model...

23 Juli 23min

This Week in AI Security - 16th July 2026

Another lighter week that lets Jeremy slow down and dig into the stories that matter most. The theme running through this episode: the tooling and plumbing around AI keep proving to be the real attack...

16 Juli 15min

This Week in AI Security - 9th July 2026

A quieter summer week on the news front, which gives Jeremy room to dig deeper into a handful of stories that all circle the same theme: the tooling and infrastructure around AI keep proving to be the...

16 Juli 12min

This Week in AI Security - 2nd July 2026

A lighter week on volume, which gives Jeremy room to go deeper on a set of stories that all reinforce trends we've been tracking for months. The through-line: prompts keep showing up in places nobody ...

2 Juli 12min