Latest / Along The Edge Podcast: Breaking, Defending, and Understanding Agentic AI / AI Security Brief - August 26, 2026
Transcript
- Andrius Useckas: Hi again, welcome to AI security brief. I'm Andrew Susackis. I'm founder and CTO of Zio Sec. I've been in security for twenty five plus years now and been playing with AI security, breaking AI basically for the last two years. Alex Gatz: Hi, I'm Alex Katz. I also work for Zosec. I'm a security architect here. and yeah, here we are. Andrius Useckas: Yeah, today we got some new topics, I suppose. What's been happening in AI security in the past week or so. the first topic, seeing it all all over Axe at this point, is you know, news articles saying that attackers, especially from China, starting to use models like Deep Seek to attack things. again, news are kind of you know catching on to these AI topics as it's some kind of hot thing, even though you know these attacks and models being used in attacks has been happening now for about two years. Sure, the models are getting better, but I'm not really sure why. Must be slow newsweek. Wha why do we need to hear about these things? Alex Gatz: I don't know. It's a I it has absolutely been happening for much longer than just last week. I think I'm assuming they're riding on the coattails of all of the the other model attacking hype that's been going on. like we saw it with open AI, we saw it with Anthropic. surprised Gemini hasn't tried to jump on on the bus also, but even who was it? Meta. Meta even had an announcement about how dangerous their I AI was. So I think they're just Andrius Useckas: Yeah. Alex Gatz: They're just trying to say, all of these great frontier models are are dangerous and you should be concerned about these things. Andrius Useckas: But it's not even a frontier model in this case, it's Deep Seek. Yes, I've tried Deep Seek. It's pretty good at generating attacks. As long as you're using the uncensored versions, which obviously you can get from Hugging Face, not a big deal. so is Quen. The new Quen 26 billion parameter is good. and the new Quen Flash, I guess, came out this week as well. I haven't tried that one yet. But apparently I can run that on my DGX Park as well. So maybe I should check that out. But again, nothing new. This has been happening for a long time. local models are getting more powerful, sure, but the threat, the issues existed now for close to two years. So you have to be prepared for it from my perspective. But it's not like it's this big news. but I guess as you said, yeah, it's on the co coattails. So everybody has to talk about it. And if it's a slow news week, then news organizations catch and go with it. Have you heard about this like NPM packages, trojan trojanized NPM packages, like AI driven? what what is exactly the story there? Alex Gatz: Yeah, so it honestly it's kind of related to talking about the danger of models, but this is this was a legitimate incident that happened where about fourteen MPM packages were compromised with red C two, which the interesting piece here is it's AI assisted command and control software. So, like again, this is not something that's super new. I would say it's not very often talked about. There has been AI assisted C two software in the wild for quite a while now, but this is definitely a pretty significant case if you use any of these the it's the the streak package set so like streak metrics maths streak map cache streak map kit those types of packages but I don't know it's pretty pretty wild to see that whole thing play out. There's a few write-ups about it. Don't Andrius Useckas: Do you know what C2 channel they use by by any chance? Just curious. Alex Gatz: do I know what? Andrius Useckas: What C2 channel is being used? Are they using DNS? Are they using HTTP? what what makes it so special? I mean again we've seen these, you know, NPM packages being compromised all over the place for a long Alex Gatz: Yeah. Andrius Useckas: time now. I think the news here is that AI is involved, but why is it special? Alex Gatz: That's just it. It's just special because it was AI assisted. And that was kind of the point is like Andrius Useckas: Okay, okay. Alex Gatz: this is yet another example of something where this has been around for quite a while, but someone caught it in the wild and now now there's a headline about it. It's not I'm not it's not super exciting, but it is it is interesting because it's AI assisted, really. That's it. Andrius Useckas: Yeah, and it's NPM. I mean we've seen so many attacks on NPM, supply chain attacks on NPM packages at this point. that entire ecosystem Alex Gatz: Yeah, that's it. Andrius Useckas: is a crapshoot, I don't know. Alex Gatz: No, really is. I mean, this is why you use fixed version, like fixed version dependencies, right? And you have an S bomb and you're doing evaluations before you're moving on to the next version to prevent this exact type of incident. Cause if you're auto-updating everything constantly, every release that you do without having some kind of process in place, you're just asking for problems like this across the board, supply chain-based issues, exactly like this. Andrius Useckas: Yeah, I know there are companies that specialize it, but I don't know if you can solve that NPM issue without like ripping out the entire infrastructure and rebuilding it somehow. I I think somebody's trying to do it, but I'm not really sure. Alex Gatz: Yeah, yeah, they're the products in this space are a dime a dozen, no question. I mean SAST and like supply chain type evalu like S bomb evaluation type solutions, there's yeah, they're a dime a dozen. Andrius Useckas: In other news, Grok, SpaceX released in a bot, which is I guess similar to something like Hermes and OpenClaw, if you still remember OpenClaw. but the big advantage for it is that you can do teamwork in it now. So you can do tasks as a team. From security perspective, I'm yeah, I'm not sure exactly what the issues are. Obviously, from they're saying that audit rails are not even in yet. so you can't really see what's being done yet. sounds exciting. A lot of people are excited about it. I don't know. What's your take on it? Alex Gatz: Well, just what you just said, my visceral reaction was if I don't have an audit trail, I don't wanna use it because espe did you say it has team capability, so like more than one person can Andrius Useckas: Yeah, yeah, yeah, yeah, yeah. Alex Gatz: interact with the same agent at the same time? yeah, that's Andrius Useckas: Same flows, yeah. Alex Gatz: great. Yeah. So if if my if my coworker that maybe is a little less tech savvy or aware of indirect prompt injections goes and visits a website and poisons the memory of the agent, now I get to be I get to be taken advantage by that as well, apparently. And there's no audit log to even find out what how like when it got poisoned. Andrius Useckas: No, then there is licensing issues. I would like to try it to be honest, but I have to be what on like Cursor Pro Plan or something like that to even try the thing? Or like Super Groc on the other side to try it out. I I don't know why they restricted it so much. If this is so great, let people try it. Why why do we need to purchase these licenses in order to even try it? I guess at this point. Alex Gatz: Well, per they want money, obviously. I mean it makes it like it does sound like a scarcity play where it's like limited sign up and you have to you have to buy your way in. So like one, scarcity, only a few people can do this thing, so it makes more people want to try to use the thing. And then two, if you're buying into it, how do you feel? Don't you if you pay a lot of money for something or if you're paying for something Do you not use it more than if you got it for free? That's I mean like basic human psychology, I believe. Andrius Useckas: Sure, initially you do, but then you forget about it and you no longer use it. I don't know, at this Alex Gatz: Sure. Andrius Useckas: point there is Hermes. I mean you can use it for free with something like Deep Seek or Quen running on your DGX Park. So why even you know pay for trying it? If you have a DGX park. Alex Gatz: Yeah. If you can if you have a DGX Spark. I for the record, most people don't just have a DGX Spark sitting on their desk, like just to kinda level set. Or a few of them sitting on their desk. Andrius Useckas: Well okay, so Mac Studio. I guess that's news as well this week. You know, new Mac Studios came out. that Alex Gatz: True, yeah. Yeah. The six and the five Max chip. Pretty impressive. Andrius Useckas: Yeah, that seems exciting. The memory bandwidth is exciting, but as far as the processing power is still behind like RTX fifty ninety, so Alex Gatz: Yeah, that reminds me there's there are a couple other physical products that were released too in that space. Like, did you see the there's a pyramid? I don't remember the name of the product. I don't have an article pulled up on this. This Andrius Useckas: Do see it now. Alex Gatz: is a tangent, but there is like a a pyramid that you could put on your desk that's it basically just like handles all the agentic setup for you and it'll just kind of function on its own. It's like an all in one product. And then Huawei released a similar product. Which we'll probably not get our hands on in the US, I assume, if there's still wasn't there an embargo on Huawei products? What's that? Andrius Useckas: I'm not trying Wave anything. I'm not trying anything from Wave. you never know what they built Alex Gatz: Yeah, well Andrius Useckas: into that, what kind of back doors and everything else. So no thank you. Alex Gatz: Well, I'm sh yeah, sure. It's sketchy, but y you ha you can't deny the some of the technological advancements they've made in some of their products that they have released. Like we're okay. Andrius Useckas: They are definitely good at copying stuff and making it better. I I do not deny Alex Gatz: That no, exact that is the exact example I was gonna give. So the Samsung fold phone that has a crease that you can tell and you can feel like that, you know, a main reason why people don't want to buy those. Huawei solved that by scanning the hinges and vi like using that scan to decide where they should place it's like an at a type of adhesive that kind of like fills in the space. So they have an invisible seam on their fold phone that was copied right from Samsung. Andrius Useckas: No surprise there. Yeah, Alex Gatz: Total total tangent here, but Andrius Useckas: total tangent. that again I'm not buying a new Mac Studio, but looks exciting for this for now I'm gonna stick to NVIDIA cards still. Yes, memory is everything. Alex Gatz: Well, I do but that is the direction the world seems to be going is at home sell like home use AI and home use agents where like you people are becoming more aware of the risk of giving all of your information to anthropic and open AI and the big model providers. And it seems like there is some momentum going in that direction, which of Andrius Useckas: Absolutely. Alex Gatz: course kind of changes the risk profile from a security perspective to Now instead of anthropic ha I'm relying on anthropic's protections and like their judges and you know like their controls that they have in place. Now I have to worry about if I have a device in my own house, what does this thing have access to? Like are are the everyday person that's wanting to use AI at home gonna be considering these things? Andrius Useckas: Absolutely. And I I think it's great. I think you know where things are going great. I think Mac, I mean Apple needs to get better about it. Like from quantization perspective. They don't even support like, you know, N4. Yeah, it's it's terrible from that. That's why you know Alex Gatz: No, it's terrible. Yeah. It's absolutely terrible. Yeah. Andrius Useckas: like two D G X parks, string together still makes more sense to me because I can run on N V F P four and that Alex Gatz: Yeah. Andrius Useckas: makes everything faster. So it's they need to solve that issue until they do I'm not gonna be interested in a studio, but Alex Gatz: Yeah, I haven't rabbit holed on that. I assume it would have to be a total kernel up like a a pretty major kernel update, Andrius Useckas: Absolutely. Alex Gatz: as well as like s supporting software like for through MLX or otherwise. Andrius Useckas: Yep. Anyway, moving on. This was quite a tangent, so what what is this? I heard like you know Siemens IoT devices like the ones on power plants and water plants being attacked. Do you know anything about that? Alex Gatz: Yeah, so there actually was a pretty big announcement about this. Like it came through the NSA, CISA, and I guess I should say NSA like National Security Agency, if you're not aware, Cybersecurity and Infrastructural Security Agency, the FBI, Department of Energy, and the EPA all kind of came together and they're saying that this isn't just hypothetical anymore. Like we have 100% validated that in the wild there's been AI generated exploits being used against critical infrastructure. In this specific case, it was the Siemens S7 series PLCs. And to be frank, I'm not super familiar with PLCs. I've I have like played with them before, but as far as like their use in critical infrastructure, I a very high-level understanding of maybe like a water treatment plant and how that would be used. maybe you have some extra insights on that angle from a security perspective. Andrius Useckas: I don't really, but I mean any critical infrastructure, the first question that comes to my mind, why is it connected to the internet? Alex Gatz: Yeah, well yeah. Andrius Useckas: I mean, there are so many things that you can do. Yes, I understand remote management, all of that. Sometimes you might need to get into it, but there are ways to do it. Alex Gatz: That's exactly it though, too. Like being on call. Yeah. Andrius Useckas: Yeah, but being on call, I mean, you can still protect it. You can still segment the actual data. There are ways to do it, like you know, you put it in a special VLAN. You have jump boxes, you have dual like Alex Gatz: Mm-hmm. Andrius Useckas: t two factor authentication. Only certain people can get into it. Least privilege and everything like that. So I mean, we you've been in these plants, I've been in these plants, none of the stuff is implemented. That's the main issue. I mean Alex Gatz: Not at all. No, not even close. It's very rudimentary. Andrius Useckas: Yeah, yeah. And that's until people like realize that this is possible, then you cannot just disconnect completely. You need to put these protections in place. I don't know what else to say Alex Gatz: Yep. Andrius Useckas: about that. Alex Gatz: No, I think it's that it's the same trope of all of cybersecurity where it's like until there's fear, right? Like until an actual incident happens, people aren't willing to free up the budget to address the problem like the core issues. And even then they're gonna try to find the the path of least resistance, i.e. least expensive way to address the issue. Andrius Useckas: Which is phishing attacks still. I mean you can talk about all the sophisticated attacks till you're blue in the face, but in the end sending an email and, you know, phishing somebody is still the easiest way to do it. Alex Gatz: Absolutely. Yeah. Yeah. And I mean, like these like we were talking about it, I think it's a it is definitely a people problem and it comes from both sides because if I fish someone I know who's using who's like on call or like that may go on call that's working for a water treatment plant or you know a power facility, that's it much easier target to get through because they have the div like if you compromise that device that has the access to the remote system. controls for the plant and you can make adjustments or you know go through the whole like establish persistence and hide and you know fly under the radar and all that fun stuff. But yeah, it's pretty interesting. I so which begs the question, again, it's this is kind of becoming the theme of this news segment to me, which is it's not new that AI has been used to generate exploits. So the new thing here is just This is the first time an AI generated exploit was caught in the wild targeting critical infrastructure. But the AI has been used to generate exploits since I don't know, forever now, it feels like like three years, four years. I mean, quite a long time. It's Andrius Useckas: Absolutely. Alex Gatz: like this is not anything new. what's new is maybe Andrius Useckas: It is not. Alex Gatz: the sophistication of the exploits have improved slightly. But so like the level of entry has gone down to be able to use AI for the exploits. Andrius Useckas: Yeah, but but as you said, Yes, but as you said, the the easiest way to get in is still a fishing attack. And if you have if you fish somebody, you don't need any of these exploits. AI Alex Gatz: Absolutely. Yeah. Andrius Useckas: is not needed. I I think in the these things are making news right now just because AI is a hot topic, which is fine. We like it. We'll take it. Anyway, thanks. this has been our segment. Thank you very much for listening.