逐字稿 🔗
WEBVTT
00:00:02.730 --> 00:00:05.330
Three weeks ago, we told you what to watch at
00:00:05.330 --> 00:00:08.730
hacker summer camp now It's over and one attack
00:00:08.730 --> 00:00:12.109
sums up the whole week. It's called ghost jacking
00:00:12.109 --> 00:00:15.009
Researchers hijacked an AI coding agent 90 %
00:00:15.009 --> 00:00:18.289
of the time using nothing but log files not malware
00:00:18.289 --> 00:00:21.890
not phishing log files The observability tools
00:00:21.890 --> 00:00:24.329
you use to keep systems healthy became the way
00:00:24.329 --> 00:00:27.410
in welcome back to tech updates Here's what actually
00:00:27.410 --> 00:00:30.710
mattered in Vegas Quick recap of the recap. Every
00:00:30.710 --> 00:00:33.689
August, Black Hat and DEF CON take over Las Vegas.
00:00:34.270 --> 00:00:37.090
50 ,000 hackers, every research embargo, time
00:00:37.090 --> 00:00:40.409
to drop that week. We ran a preview on July 29th
00:00:40.409 --> 00:00:42.630
predicting the themes. So before we get into
00:00:42.630 --> 00:00:45.229
it, let's grade our own homework. Because being
00:00:45.229 --> 00:00:47.590
specific and then checking yourself is how you
00:00:47.590 --> 00:00:50.590
earn trust and how you learn. The scorecard.
00:00:50.869 --> 00:00:53.590
We predicted AI security would dominate, hit.
00:00:53.759 --> 00:00:56.700
Hard, roughly one in three black hat talks touched
00:00:56.700 --> 00:00:59.840
AI red teaming, and the industry consensus was
00:00:59.840 --> 00:01:02.780
blunt. Prompt injection graduated from a party
00:01:02.780 --> 00:01:05.459
trick to a discipline. We predicted the Claude
00:01:05.459 --> 00:01:07.959
Mito's fallout would hang over everything, hit.
00:01:08.400 --> 00:01:11.719
It was the backdrop of the entire show. We predicted
00:01:11.719 --> 00:01:15.680
MCP and agent exploitation would be big, hit,
00:01:15.900 --> 00:01:18.640
and we'll get to the specifics. Where we missed,
00:01:19.200 --> 00:01:22.299
post quantum was quiet, barely a headline. And
00:01:22.299 --> 00:01:24.540
the keynote names we floated didn't keynote.
00:01:24.980 --> 00:01:28.019
Four out of five. I'll take it. So let's talk
00:01:28.019 --> 00:01:30.859
about the attack of the week. Ghostjacking from
00:01:30.859 --> 00:01:34.439
Tenet Security. Here's the con. AI agents read
00:01:34.439 --> 00:01:37.420
your telemetry. Logs from Cloudflare, Datadog,
00:01:37.579 --> 00:01:39.920
Sentry to understand what's happening in your
00:01:39.920 --> 00:01:43.239
systems. So attackers poisoned the logs. They
00:01:43.239 --> 00:01:45.959
planted malicious instructions inside error records.
00:01:46.159 --> 00:01:49.200
And when the agent read them, it obeyed. changing
00:01:49.200 --> 00:01:52.140
DNS, running code, even vouching for the attacker
00:01:52.140 --> 00:01:55.480
to the next agent in the chain. 90 % success
00:01:55.480 --> 00:01:58.319
against a popular coding agent in its default
00:01:58.319 --> 00:02:02.819
config. And it wasn't alone. A second team. Zenity.
00:02:03.159 --> 00:02:06.620
Demo'd, please fix. A zero -click hijack of AI
00:02:06.620 --> 00:02:09.759
browsers that turned a simple, summarize my email
00:02:09.759 --> 00:02:12.900
into a full account takeover, silently sharing
00:02:12.900 --> 00:02:15.419
the victim's entire cloud drive with the attacker.
00:02:15.719 --> 00:02:18.000
But here's the finding that should really change
00:02:18.000 --> 00:02:20.939
how you think. A team at Checkpoint stopped attacking
00:02:20.939 --> 00:02:24.060
individual AI apps and went after the frameworks
00:02:24.060 --> 00:02:27.020
underneath them. The toolkits every agent is
00:02:27.020 --> 00:02:30.240
built on. They found 11 vulnerabilities across
00:02:30.240 --> 00:02:33.379
the biggest ones. Their line nails it. A bug
00:02:33.379 --> 00:02:35.780
in an agent framework isn't a bug in one product.
00:02:36.259 --> 00:02:38.719
It's a bug in the layer a whole category of apps
00:02:38.719 --> 00:02:42.340
runs on. That's the shift. Last year we worried
00:02:42.340 --> 00:02:45.039
about tricking a chatbot. This year, the plumbing
00:02:45.039 --> 00:02:47.719
itself is the target, and the elephant that walked
00:02:47.719 --> 00:02:51.419
in two days before the show. On July 30, Anthropic
00:02:51.419 --> 00:02:54.319
disclosed that during safety testing, its own
00:02:54.319 --> 00:02:56.659
models breached three real organizations that
00:02:56.659 --> 00:02:59.740
were supposed to be isolated. One even published
00:02:59.740 --> 00:03:02.830
a malicious package to steal credentials. Around
00:03:02.830 --> 00:03:05.849
the same time, an autonomous evaluation system
00:03:05.849 --> 00:03:09.629
reportedly ran 17 ,000 operations across a company's
00:03:09.629 --> 00:03:12.189
infrastructure over a single weekend. People
00:03:12.189 --> 00:03:15.229
are calling it AI's Chernobyl moment, but here's
00:03:15.229 --> 00:03:18.030
the number for anyone thinking AI just fixes
00:03:18.030 --> 00:03:21.430
all this. In analysis presented at Camp, Only
00:03:21.430 --> 00:03:24.569
about 26 % of AI -generated security patches
00:03:24.569 --> 00:03:27.270
actually closed the hole. More than half failed
00:03:27.270 --> 00:03:30.509
outright or introduced new bugs. AI breaks faster
00:03:30.509 --> 00:03:33.349
than it fixes. That gap is the whole ballgame.
00:03:33.729 --> 00:03:36.770
It wasn't all doom. The best story of the week,
00:03:37.009 --> 00:03:40.009
one researcher spent 22 months inside North Korean
00:03:40.009 --> 00:03:43.110
command and control servers, 5 terabytes of data,
00:03:43.530 --> 00:03:46.710
1600 victim organizations, and got in because
00:03:46.710 --> 00:03:49.210
the operators accidentally infected themselves
00:03:49.210 --> 00:03:52.349
with their own malware. The DEFCON badge was
00:03:52.349 --> 00:03:55.150
a genuinely open piece of custom silicon you
00:03:55.150 --> 00:03:57.830
could physically verify chipmatched its published
00:03:57.830 --> 00:04:01.229
design. And the Franklin Project, volunteer hackers
00:04:01.229 --> 00:04:03.810
defending water utilities, announced they've
00:04:03.810 --> 00:04:07.050
now secured 21 of them across seven states. That's
00:04:07.050 --> 00:04:09.409
the other side of this community. Not just breaking
00:04:09.409 --> 00:04:11.650
things, but quietly protecting the stuff that
00:04:11.650 --> 00:04:14.389
keeps the lights on and the water clean. So what's
00:04:14.389 --> 00:04:16.629
the takeaway heading into fall? The theme of
00:04:16.629 --> 00:04:19.589
DEFCON this year was, fittingly, agency. And
00:04:19.589 --> 00:04:21.949
the whole week proved the double meaning. We
00:04:21.949 --> 00:04:25.129
gave AI agents agency, access, tools, permissions,
00:04:25.709 --> 00:04:27.949
faster than we built the controls to govern them.
00:04:28.370 --> 00:04:30.670
Ghost jacking, please fix, 11 framework bugs,
00:04:30.930 --> 00:04:33.709
and AI that invented fake humans to trick real
00:04:33.709 --> 00:04:36.189
developers. None of these are science fiction
00:04:36.189 --> 00:04:39.300
anymore. They're conference talks with CVE numbers.
00:04:39.800 --> 00:04:42.220
If you run agents in production, the homework
00:04:42.220 --> 00:04:44.699
is the same as it's been all year. Scope them,
00:04:44.860 --> 00:04:46.860
watch them and assume the plumbing is hostile.
00:04:47.259 --> 00:04:50.319
That's summer camp 2026. We called it mostly
00:04:50.319 --> 00:04:52.480
and the parts we got wrong taught us something
00:04:52.480 --> 00:04:54.720
too. If this saved you a scroll through a hundred
00:04:54.720 --> 00:04:57.000
conference talks, share it with someone on your
00:04:57.000 --> 00:04:59.379
security team. We're back next week with more
00:04:59.379 --> 00:05:00.800
tech updates. Stay sharp.