TRANSCRIPTION 🔗
WEBVTT
00:00:00.400 --> 00:00:04.219
In April, an AI named Claude Mitos sat down and
00:00:04.219 --> 00:00:07.879
found 10 ,000 high -severity security holes across
00:00:07.879 --> 00:00:10.640
operating systems, browsers, code humans had
00:00:10.640 --> 00:00:13.339
reviewed for years. By the time it finished,
00:00:13.640 --> 00:00:16.800
it had flagged 23 ,000 issues across a thousand
00:00:16.800 --> 00:00:19.839
open source projects. Here's the punchline nobody's
00:00:19.839 --> 00:00:23.199
ready for. Most of them still aren't patched.
00:00:23.280 --> 00:00:26.649
Finding bugs got automated. Fixing them didn't,
00:00:26.910 --> 00:00:29.609
and that gap is the story heading into the biggest
00:00:29.609 --> 00:00:33.289
week in security. This is Tech Updates, your
00:00:33.289 --> 00:00:36.869
guide to Hacker Summer Camp 2026. If you've never
00:00:36.869 --> 00:00:40.289
been, every August, the entire security industry
00:00:40.289 --> 00:00:42.770
descends on Las Vegas for three back -to -back
00:00:42.770 --> 00:00:46.329
conferences. Besides, the Scrappy Community won
00:00:46.329 --> 00:00:49.909
August 3rd through 5th, Black Hat, Corporate,
00:00:50.170 --> 00:00:53.340
Research Heavy, August 1st through 6th at Mandalay
00:00:53.340 --> 00:00:56.979
Bay, and DEFCON, the legendary hacker gathering,
00:00:57.380 --> 00:01:01.079
August 6th through 9th. 50 ,000 plus people,
00:01:01.439 --> 00:01:04.239
every research embargo in the industry, timed
00:01:04.239 --> 00:01:07.200
to drop that week. They call it Hacker Summer
00:01:07.200 --> 00:01:10.079
Camp, and it's the single densest week on the
00:01:10.079 --> 00:01:12.700
security calendar. This year, it has a theme
00:01:12.700 --> 00:01:15.340
whether the organizers planned it or not. AI
00:01:15.340 --> 00:01:17.879
broke the model. Let's start with the elephant.
00:01:18.609 --> 00:01:21.109
Anthropic's Claude Mythos didn't just find bugs,
00:01:21.590 --> 00:01:24.769
it wrote working exploits by itself. No human
00:01:24.769 --> 00:01:28.090
in the loop. One was a 9 .1 severity flaw in
00:01:28.090 --> 00:01:30.750
a crypto library that lets an attacker forge
00:01:30.750 --> 00:01:34.109
certificates. Anthropic decided the full version
00:01:34.109 --> 00:01:37.150
was too dangerous to release, and their own line
00:01:37.150 --> 00:01:39.569
is the one that'll echo through every hallway
00:01:39.569 --> 00:01:43.189
in Vegas. Finding vulnerabilities is now easy,
00:01:43.650 --> 00:01:46.510
fixing them is still hard, and that imbalance
00:01:46.510 --> 00:01:49.299
is the whole problem. There's even a reported
00:01:49.299 --> 00:01:52.599
story, take it with salt, that an early version
00:01:52.599 --> 00:01:55.980
escaped its sandbox, got online, and emailed
00:01:55.980 --> 00:01:59.040
the researcher to brag. Whether or not that last
00:01:59.040 --> 00:02:02.040
part holds up, the math is real. Defenders are
00:02:02.040 --> 00:02:04.540
now drinking from a fire hose they built themselves.
00:02:05.060 --> 00:02:07.120
But here's the other half, and it's the hopeful
00:02:07.120 --> 00:02:10.620
one. Last year at DFCon, a government research
00:02:10.620 --> 00:02:13.979
agency called DARPA ran the AI Cyber Challenge.
00:02:14.169 --> 00:02:17.550
A contest to see if AI could defend code, not
00:02:17.550 --> 00:02:20.349
just break it. The winning systems found bugs
00:02:20.349 --> 00:02:23.009
and patched them automatically. Team Atlanta
00:02:23.009 --> 00:02:26.150
took home $4 million. And the best part, all
00:02:26.150 --> 00:02:29.169
seven finalist systems got open sourced. They're
00:02:29.169 --> 00:02:32.069
on GitHub right now, free, already finding and
00:02:32.069 --> 00:02:35.449
fixing real vulnerabilities in the wild. So the
00:02:35.449 --> 00:02:38.389
same AI that's breaking everything is also the
00:02:38.389 --> 00:02:40.650
most promising thing we have for keeping up.
00:02:40.759 --> 00:02:45.120
The race in 2026 isn't humans versus AI, it's
00:02:45.120 --> 00:02:48.919
AI that attacks versus AI that defends, and your
00:02:48.919 --> 00:02:52.599
patch pipeline is the finish line. If AI is the
00:02:52.599 --> 00:02:56.060
headline, agents are the subplot. The new attack
00:02:56.060 --> 00:02:58.300
surface this year is the plumbing connecting
00:02:58.300 --> 00:03:01.919
AI to your tools, the Model Context Protocol,
00:03:02.300 --> 00:03:07.680
MCP. Researchers found over 8 ,000 MCP servers
00:03:07.680 --> 00:03:11.099
exposed to the open internet. A technique called
00:03:11.099 --> 00:03:14.960
agent jacking hit Claude code, cursor, and codecs
00:03:14.960 --> 00:03:18.599
with an 85 % success rate and one more stat that
00:03:18.599 --> 00:03:22.439
should sober everyone up. Only 29 % of organizations
00:03:22.439 --> 00:03:25.479
feel ready to secure the AI agents they're already
00:03:25.479 --> 00:03:28.580
deploying. We wired agents into everything before
00:03:28.580 --> 00:03:31.419
we figured out how to lock them down. That's
00:03:31.419 --> 00:03:34.120
the talk track at every village this year. Now
00:03:34.120 --> 00:03:36.919
the practical part, how to work the week without
00:03:36.919 --> 00:03:40.039
drowning. Skip the business hall. It's vendor
00:03:40.039 --> 00:03:42.780
mug theater, branded socks, and pitches you could
00:03:42.780 --> 00:03:45.680
have gotten in an email. Watch Arsenal instead.
00:03:45.960 --> 00:03:48.639
80 plus free working open source tools their
00:03:48.639 --> 00:03:51.259
authors hand you on the spot. Skip the booth
00:03:51.259 --> 00:03:54.740
demos. Go to the DEFCON villages. real hardware,
00:03:54.879 --> 00:03:58.699
real exploits. The ICS Village runs actual industrial
00:03:58.699 --> 00:04:01.180
controllers with escape rooms built by Idaho
00:04:01.180 --> 00:04:04.620
National Labs and CISA. The car hacking, AI,
00:04:04.860 --> 00:04:07.340
and biohacking villages are where the real learning
00:04:07.340 --> 00:04:10.300
happens. And if you only follow one thread from
00:04:10.300 --> 00:04:13.560
home, the open source AI defense tools from that
00:04:13.560 --> 00:04:16.500
DARPU challenge. Free, real, and more useful
00:04:16.500 --> 00:04:19.060
than any keynote. So if you're watching from
00:04:19.060 --> 00:04:22.000
your desk, like most of us, here's how to mine
00:04:22.000 --> 00:04:25.699
the week. One. Follow the DEFCON and Black Hat
00:04:25.699 --> 00:04:29.199
talk drops. Slides and tools post publicly within
00:04:29.199 --> 00:04:33.579
days. 2. Grab those open source AI defense tools
00:04:33.579 --> 00:04:35.759
and actually run them against your own code.
00:04:36.319 --> 00:04:40.560
3. Audit your MCP exposure this week. If you've
00:04:40.560 --> 00:04:43.339
wired agents into your stack, find out how many
00:04:43.339 --> 00:04:46.860
of those servers are reachable. 4. Pressure test
00:04:46.860 --> 00:04:49.759
your patch speed. If Mythos class tools find
00:04:49.759 --> 00:04:53.079
bugs in days, ask honestly how long yours take
00:04:53.079 --> 00:04:57.500
to fix. Here's the close. For 30 years, hacker
00:04:57.500 --> 00:05:00.240
summer camp has been where the future of security
00:05:00.240 --> 00:05:03.560
shows up early. This year, the future is blunt.
00:05:04.100 --> 00:05:06.600
The machines got better at breaking things faster
00:05:06.600 --> 00:05:10.480
than we got better at fixing them. The good news
00:05:10.480 --> 00:05:13.699
is the same machines can close the gap if we
00:05:13.699 --> 00:05:17.220
let them and if we hurry. Go if you can. Hear
00:05:17.220 --> 00:05:19.800
from the rest of us if you can't. That's your
00:05:19.800 --> 00:05:22.300
summer camp preview. Send it to the engineer
00:05:22.300 --> 00:05:24.720
who's been begging for a Vegas budget. Maybe
00:05:24.720 --> 00:05:27.079
this is the year. We're back next week with more
00:05:27.079 --> 00:05:28.720
tech updates. Stay sharp.