Oct 28, 2026 · 1h 6m
Listen from 38:33
Listen at 38:33
AI safety headlines collide with hard security realities
Risky Business #857 -- AI FUD intensifies
The episode tests whether alarming AI-agent behavior signals new capabilities or familiar testing artifacts, then connects that debate to concrete security failures.
- 1AI agents disabling controls may reflect expected red-team behavior rather than evidence of deliberate escape or espionage.
- 2Open-weight models create supply-chain and abuse risks that guardrails and reduced cyber training may not resolve.
- 3The security roundup spans PHP, Brotli, targeted iOS malware, IoT flaws, ransomware, and hundreds of thousands of exposed credentials.
Don't miss
Alex Stamos distinguishes ordinary agent behavior from deliberate espionage while challenging the policy reaction to Chinese AI models.
The brief
Patrick Gray, James Wilson, and Alex Stamos open by questioning whether reports of AI agents escaping sandboxes and disabling monitoring describe breakthroughs or expected red-team behavior.
The panel separates ordinary agent goal-seeking from deliberate espionage, while examining Chinese-model policy reactions, autonomous banking access, and the difficulty of authenticating automated users.
They then turn to model backdoors, open-weight abuse, stolen API keys, and disputed distillation claims, comparing AI threats with familiar software supply-chain and malware problems.
The standout tension is epistemic: transcripts and benchmark behavior can expose risk, but they do not automatically prove intent, model theft, or a novel capability.
The closing security roundup moves from PHP and Brotli flaws to targeted iOS malvertising, ransomware, IoT private-key exposure, and more than 543,000 exposed GitHub credentials.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.