How Varonis hacks AIs into snitching on themselves

How Varonis hacks AIs into snitching on themselves

Varonis AI Threat Lead on Copilot Exploits, Prompt Injection, and the AI Hacking Trifecta

The host interviews Mark Vaitsman, AI threat research lead at Varonis, about Varonis Threat Labs' research into AI vulnerabilities, including a chain of single-click exploits in Microsoft Copilot (including "CoSnitch") and an Atlassian Confluence issue dubbed "RovoBlast" involving prompt injection, bypassing guardrails, and data exfiltration via a web-capable subagent.

Vaitsman explains why built-in model guardrails are insufficient, citing AI's lack of loyalty and "unlimited hunger for data," and argues for layered controls like least privilege, monitoring, and restricting data access.

He discusses psychological guardrail bypasses, introduces an "AI Hacking Trifecta" framework—enter, evade, escape—and comments on research showing AI-generated patches often fail, emphasizing human-led validation and guidance when using AI tools for security research.

00:00 Weekend Show Kickoff
00:44 Meet Mark Vaitsman
03:38 Teaching the Next Gen
04:19 Copilot Exploit Code Snitch
06:04 Atlassian RoboBlast Breakdown
08:52 Why Guardrails Fail
13:15 Manipulating Models to Comply
17:06 Securing Agents Without Handcuffs
20:11 AI Hacking Trifecta Framework
23:43 AI Patches and Human Research
27:43 Hope and Closing Thoughts

Det här avsnittet är hämtat från ett öppet RSS-flöde och publiceras inte av Podme. Det kan innehålla reklam.

Avsnitt(100)

Revolut hands customer data to criminals, Microsoft patches break Remote Desktop, Conti developer gets four years

Revolut hands customer data to criminals, Microsoft patches break Remote Desktop, Conti developer gets four years

Revolut Fooled by Fake Govt Data Requests, Microsoft RDP Patch Fallout, and Conti Dev Sentenced David Shipley covers multiple cybersecurity headlines: Revolut disclosed extensive customer data after f...

16 Sep 12min

ShinyHunters breaches Florida DMV, OpenAI agents flood code repository with malware, Airlines dodge paying for cyber delays

ShinyHunters breaches Florida DMV, OpenAI agents flood code repository with malware, Airlines dodge paying for cyber delays

Host David Shipley covers multiple cyber stories: Florida confirmed criminals breached its DMV using credentials from a Plant City police officer that were improperly stored on a personal device; Shin...

14 Sep 11min

ShieldCrash zero-day breaks Microsoft's newest patch, AI agents compromise 440 school print servers, Fortinet's 92-day streak ends

ShieldCrash zero-day breaks Microsoft's newest patch, AI agents compromise 440 school print servers, Fortinet's 92-day streak ends

Defender Patch Broken in 24 Hours, AI Agents Hit Papercut Servers, FTC Rolls Back Health App Breach Rules Microsoft patched a Defender zero day, but a day later researcher Nightmare Eclipse released "...

11 Sep 10min

Microsoft patches record 966 flaws, Cybercriminals return $265 million in Bitcoin

Microsoft patches record 966 flaws, Cybercriminals return $265 million in Bitcoin

Microsoft's Record 966-Fix Patch Tuesday, Liquid Network Bitcoin Returned (Mostly), and Five Eyes' Back-to-Basics Warning Cybersecurity Today host David Shipley reports Microsoft's largest Patch Tuesd...

9 Sep 8min

IDScan sued over 153 million licence breach, FalconFlank zero-day hijacks CrowdStrike, Magento stores backdoored with no patch

IDScan sued over 153 million licence breach, FalconFlank zero-day hijacks CrowdStrike, Magento stores backdoored with no patch

Identity verification firm IDScan faces multiple lawsuits and investigations after hackers allegedly breached it. The criminals offered over 153 million U.S. and Canadian driver's license scans for sa...

7 Sep 14min

Surviving and thriving in the AI Vulnpocalypse

Surviving and thriving in the AI Vulnpocalypse

Katie Moussouris on AI's Vulnerability Deluge, Bug Bounties, and Smart Regulation In this Cybersecurity Today on the Weekend feature interview, host David Shipley interviews cybersecurity entrepreneur...

5 Sep 29min

FBI probes 153 million driver's licence leak, Health data breach hits 9.5 million, Cyberattack closes Slovenian casinos

FBI probes 153 million driver's licence leak, Health data breach hits 9.5 million, Cyberattack closes Slovenian casinos

153M Driver's Licenses for Sale, 9.5M-Patient Breach, and CISA Drops Key Security Assessments The episode reports the FBI investigating Nexus, a dark web service selling scans of over 153 million U.S....

4 Sep 11min

22,000 Exchange servers open to hijack, 700 rogue AI agents swarmed Hugging Face, AI threatens global finance

22,000 Exchange servers open to hijack, 700 rogue AI agents swarmed Hugging Face, AI threatens global finance

22,000 Exchange Servers Exposed, 700 AI Agents Swarm Hugging Face, and FSB Warns Frontier AI Is Top Financial Risk Cybersecurity Today with host David Shipley reports nearly 21,899 Microsoft Exchange...

2 Sep 8min

Populärt inom Politik & nyheter

aftonbladet-krim
svenska-fall
p3-krim
rss-krimstad
fordomspodden
aftonbladet-daily
en-runda-till
flashback-forever
rss-sanning-konsekvens
politiken
rss-vad-fan-hande
svd-ledarredaktionen
rss-krimreportrarna
rss-flodet
rss-frandfors-horna
motiv
omni-podd
rss-utopia-2
rss-politikrummet
the-power-meeting-podcast