Latest / Along The Edge Podcast: Breaking, Defending, and Understanding Agentic AI / AI Security Brief - November 5, 2026
Transcript
- Andrius Useckas: Welcome to another Long The Edge news segment. I'm Andrew Sushetskis. I've been in security for twenty five plus years and been doing AI security for a couple of years now. Just Alex: And I'm Alex Katz. I've been in security for quite a while and I've been breaking and defending all things AI for the past few years. Andrius Useckas: Another interesting week in AI security subjects. as always, we have stuff from OpenAI. Employees reportedly warned about operational security problems for years at this point. We'll touch on that. Then we have CrowdStrike, which introduced AI kill switch. W what is that actually? What does it stop? We're gonna touch on that as well. And OpenAI releases another paper. is it a marketing paper or not? we'll see. And we have a couple of other subjects we're gonna discuss. Anyway, let's dive into the open AI, years of operational security warnings. And I think this comes after the camera, that little camera was discovered behind the TV or wherever that was. Or recording device. I I'm not sure it's a camera. I think it was a recording device. Hot micing. Just Alex: Yeah, it was l hot micing. Yeah, the hot micing. Yeah. Andrius Useckas: Yeah, but that's what we hear. So apparently, Reuters, they released an article, they had a con conversation with a bunch of employees, ex-employees, whatever else, and They said that these issues have been brought up before. repository access, no lease privilege, nothing. It's d I mean, they were basically operating as a research lab, not paying attention to security from what I understand. Just Alex: IoT devices have been used in large scale attacks for a decade, decades. I don't know. It's been a very long time. that's definitely not anything new. Andrius Useckas: Yeah, but it's not just IoT devices. It's not just, that specific recording device that was discovered. It's the actual monorepo that they have. So apparently, not even real, you know, least privileged controls for the access to those sensitive resources. And I mean, to be fair, OpenAI came back and said, Okay, yeah, we know this was an issue and we are spending more time on security. Just Alex: what I was reading was they were saying they they moved a significant portion of their engineering or towards a security focus, which my immediate knee-jerk reaction was just like, Okay, so you took a bunch of people that don't usually think in terms of security and if anything, tend to push against security recommendations for fear of not being able to make a deadline or otherwise. often as security professionals we're trying to keep in mind the business side and not like hamstring the the engineering teams too much on what they're trying to do. Like we don't want to cause deadlines not to be hit either. But if you don't have that, it is a special mindset. Like be thinking like an engineer and thinking like a security professional are two different areas. So I I Andrius Useckas: Absolutely. Just Alex: question the efficacy of using engineers as security practice, like pure security practitioners. Not that they can't, and not that there's not a gray area where there are security. minded engineers who are aware of how all these things work. It's just, I don't know. It's in my ex experience, it's not the same. It's it's definitely not. Andrius Useckas: Go back to the old Caddy Shack joke. To catch a gopher, you have to think like a gopher. Just Alex: Exactly. Yes. Yep, that's a hundred. Andrius Useckas: But I agree with you, absolutely. You need some cyber cybersecurity professionals looking at it. And you know model security and infrastructure security are not the same things as well. You cannot align your infrastructure security. You have to know people that you have to hire people that actually know how to secure the assets and how to enforce lease privilege and so and so forth. Just Alex: Yeah, absolutely. it it's a nightmare of a a control issue to deal with as well. it was already a problem with agents to begin with. And if all you're using are agents and you it keeps telling you like, I need access to this thing, and then you're making requests to get access to this thing that maybe maybe you only needed access for a day and that's it. But then these these permissions are being left in place over long horizons and as this adds up more and more like your your risk goes up more and more along with it. Andrius Useckas: Yeah, speaking of models and agentic security, so CrowdStrike introduces what they call a I kill switch, which sounds like a marketing term. Just Alex: Yeah. Well it sounds like it's like the thing that is supposed to shut down all AI if it like runs wild and is unaligned and Andrius Useckas: Yeah, yeah. But what does it actually do? So basically what it does from what I can understand is when it detects in the prompts that something is going off the rails, it just basically the gateway just shuts down the access to the actual L L model. Just Alex: Well, their their report was saying they have endpoint process termination. They can do restart prevention, identity revocation, like broader cloud and SaaS containment are described as coming soon. And then I think yeah, exactly. So that Andrius Useckas: Coming soon. Just Alex: I think that was the big thing is like how much of this is roadmap versus reality. And I mean, obviously, like you should always evaluate this when you're doing POCs or agreeing to pay more money for like an add on product, especially with something like. CrowdStrike because they they sell a lot of modules that you can add on to your existing contract, things like that. but what's missing for me is like we we run into this before where it's what's the time frame between detection and response? Like how quickly are you determining that there's an issue here? Like, is the process already running? Is the script already running? What happens if I just kill that process that's running that script? Are there any like catastrophic issues Andrius Useckas: spawn processes at that point. Just Alex: or like you know, like Is it just gonna is it spawning a child process and you're just killing a child process and the parent process is still running? There's a lot of issues that come with trying to do enforcement at that level. So I just I question the ability for them to actually make this work effectively, how they're advertising currently. Andrius Useckas: Yeah, and why call it an AI kill switch? when people think about AI kill switches, they think about, something that will stop an entire data center from processing things at that point. It's like No. Just Alex: Yeah, exactly. Yeah. There's a joke job description. Have you seen that? Where it's like AI kill switch engineer or something like that. two hundred thousand dollars. You have to work nights and weekends and sit by sit in this room by the giant switch and wait to get a call to turn the thing off to shut down all of AI. Or I Andrius Useckas: So those guys that sit in nuclear silos and wait for go ahead. Just Alex: Yeah, exactly like that. Yeah. you're you're just in this Faraday cage box. you got one landline coming in, you get Andrius Useckas: With a kill switch. Just Alex: a phone call from the red phone, you gotta flip the switch right away. Andrius Useckas: I know, yeah, it is not a kill switch. Yes, it's a security thing. It's it's a good thing, I suppose. And yes, a lot of questions still Just Alex: Yeah. Andrius Useckas: remain, as you said. It's like, yes, if you just cut off an LLM, if the process is already running, if they respond, if they if they don't look like malicious processes and they're doing things that look normal from the user perspective, it's if if it spawns some kind of CLI command, for example, to your well, not necessarily like get your passwords and things like that, but like it's Or even establish a reverse telnet connection, but something that looks like a user could do, then how will you know that it's malicious at that point? It's already running, it's done, LLM was cut off, so what? Just Alex: Yeah, the historic problem is always developer machines like that tend to have these type like the types of tooling that you wouldn't expect. Sure, if it's like someone in the marketing or sales team, it's really easy to say like, okay, I know that I could run like a security profile for sales and they're not running bash scripts or like any kind of CLI tools. So you can just like block all of those or kill most of that and shut that down. Andrius Useckas: Yeah. So next topic is why this is bad. if if if a command is pawned that there is a child process already running, well it can use things like local escalations in your Linux kernel, for example, and that's the next story. So open AI. Just Alex: It's a good segue. Andrius Useckas: Yeah, open AI apparently came up came out came out with a story yesterday that they ran They basically unleashed one of the models, one of the new models on Linux kernel, and they found all of these different vulnerabilities. They generated POCs. It seems like a really good flow from the technical perspective. It's what a cybersecurity person would. Just Alex: Yeah, absolutely. That was the one thing I liked about the document is they broke down and they actually gave a great diagram breaking down their vulnerability research pipeline where they start with just basic vulnerability discovery, then they do some dynamic validation, they do exploit exploitability assessment to like determine what does the end-to-end look like. then they generate the patches, so they're doing like some form of remediation and then the top cherry on top, right? A human in the end is actually doing working through the whole RCA and making the final determination, submitting the report, you know, like submitting the change requests to the I'm assuming they were going through the normal processes where you're trying to like work with a maintainer of the particular area of the Linux kernel that you're wanting to make a patch in and go through that whole process. But I don't I don't know the that specific of details on how they're doing this. But that is one thing I like. There's Andrius Useckas: Yeah, and that is yeah. Just Alex: other things obviously that were not great, but that was one Andrius Useckas: Yeah. Just Alex: thing I Andrius Useckas: But that's my question. Yes, I like the process. The process sounds pretty sound. Yes, they spend one point two one million in just API credits doing it, and God knows what else on the God knows Just Alex: So there's one problem, yeah. Andrius Useckas: what else on the actual manpower to actually accomplish this, which is still fine. I mean it's great. Somebody's looking for these vulnerabilities and are trying to fix things in open source projects. Fantastic. But again, what is the third party validation? We haven't heard anything from kernel maintainers about this. Just Alex: Right. Yeah. And we like Andrius Useckas: So we don't know what these POCs look like. Just Alex: That would be my question and I didn't read that. Maybe that isn't here. what how many of these actually went through and will be included in a patch? Like how many of these will actually get patched versus just claiming that they were found? So we roughly spent Andrius Useckas: We don't know. No, I th I looked for information. Just Alex: we'll say there was a thousand vulnerabilities. So they spent about a hundred thousand of vulnerability to find it, first of all. And then second of all, like how many of those are actually gonna make it into a new, you know, like whatever the latest kernel version is or however. However far downstream we gotta go to wait, but Andrius Useckas: Yeah, it's it's it's what one point two thousand I think pro vulnerability or something like that. I can't remember exact numbers. But yes, I looked for I looked for the confirmation from third parties, be that kernel developers who are actual maintainers or whatever, also as you said, whichever part of the kernel it was specific maintainer, there was nothing on the internet about, how this was submitted and how this is being addressed. Just Alex: Yeah, we'd have to search like what is it? LKML, I think. Is that the Linux kernel mailing list? We'd have Andrius Useckas: Yeah, yeah. Yep. Just Alex: to search the Linux kernel mailing list to come up with something. I well, first of all, we need Andrius Useckas: Yeah, but you wouldn't Just Alex: to know what all the details of the vulnerabilities are that they allegedly discovered to even search for them. So yeah, I don't know how to validate. Andrius Useckas: Absolutely that that that is my that is my question. Absolutely. If these are real, why there is no third party, included in in this. Even meter, even invite meter to this to actually validate the findings, whatever. Just Alex: Yeah. Andrius Useckas: Anyway, Just Alex: Yeah, there's no way I I would love to look into that. There's no way I can I need way more details to even search for Andrius Useckas: Yeah, same here. Just Alex: what yeah. Andrius Useckas: So next news is a bit on the other side, LLM jacking. What do you know about that? Just Alex: Yeah, this was honestly, like some of these things they come out, it's like, okay, old news. Like, why is this in a hype cycle right now? This would be a great example of that for me. Like, this is not a new problem. This is not the day one when the first chatbot went out, there was a risk of people hijacking those APIs and using them for things outside of the scope of what they originally intended on being used for. So, like, let's say you have a chatbot. Well, I think McDonald's was a big one that was really popular. There were a couple that have been popular where it's like I can get this thing to generate Python scripts for me. I don't even need to pay my chat GPT subscription. I can just abuse. Andrius Useckas: Amazon as well, yes. Just Alex: Yeah, exactly. So my understanding is this is just a culmination of that. It's like taking it to the next level where people have now been collecting all access to all of these, throwing it all into one tool, like an LL an LLM mixer is what it was coined. I don't know the actual phrase for it. Where you can then just like select from a drop down pick which thing you want to mess with or use a combination of them. And just ask questions and avoid having to pay your subscriptions. Now, of course, what's the quality of the output you're getting? What models are you actually using? Most of the chatbots that I've played with are using very low tier models because they're trying to save cost or open weights models that anybody could get a hold of anyway. So from that angle, it's not a big deal. I think the the big issue is what is it costing the owners of these agents? And the report was saying it something the highest number they saw was a hundred thousand dollars in a day that someone racked a bill up on. And the higher than that probably, I would imagine. Andrius Useckas: So basically darknet version of open route is what you're talking about. You don't know what you're gonna get. Just Alex: Ba yeah, pretty much. Yeah, exactly. Yeah. Ba yeah, basically. Yeah. Andrius Useckas: Yeah, basically. yeah, interesting. But makes all kinds of sense as models as inference is becoming more expensive and you get access to somebody's API key. Well, why not do that kind of service? And that's what we used to see on the dark net, credential stuffing attacks for hire and things like that. those vulnerabilities. That's just the next level. It's like you need more inference, we'll give you more inference. Run it in fast mode of o on open AI. Get as many tokens through as you can until they shut you down, which, Yes, people need to look at those. They need to look at their bills, they need to set limits, they need to do all of that. Just Alex: That's a big takeaway for sure. put a budget cap on your agents. definitely put a budget cap, put a usage cap on your agents. It should be pretty obvious from your user base how many people are actually interacting with your chat bots. And you can put usage limits on those, like request limits. otherwise, yeah, I mean, this is a problem even without the mixers to have a runaway AI bill blow up in your face. Andrius Useckas: Absolutely. Just Alex: So Andrius Useckas: And the last story, well, AI assisted intrusions. They're still happening and happening more and more, according to Mandy on the October thirtieth report, apparently. that is, you know, attackers are using all kinds of frameworks, attack frameworks like our text at this point. and they're noisy. So that's that's what we're seeing. We're not seeing these, you know, AI stealthy attacks. We're seeing them try everything in the kitchen sink. They're just throwing things at you, seeing what they can find. Just Alex: See, but that to me that's always been the claim is we're only seeing the noisiest thing, but it's like that's just because that's all you're looking for. there's always there is very often low and slow stuff sneaking by that you're missing unless you're looking for it. So I yeah, I don't know. I guess I kind of question their their claims there. Andrius Useckas: Well, absolutely, but this is what I mean what they're seeing is, the new level of script kitties. So back in the day before the Just Alex: Basically, yeah. Andrius Useckas: AI, we saw these script kitties basically th throwing everything they can find and any kind of repo at you and seeing exactly Just Alex: Yeah. Andrius Useckas: what they can get, how far they can get and so on and so forth. Well now script kitties, they move to using AI agents, which probably makes them a bit more dangerous. Just Alex: I think so. Yeah. It can it can they can it will pivot on its own once it detects that something is being blocked, it can reason and make small adjustments to increase the success rates, even without completely changing, like let's say you started with a just a basic vulnerability scanner of some kind. If you add a little bit of LLM sprinkled on top of that to just mutate the payloads from the the scanner. people have found a lot of success in that. So I imagine that's what they're seeing now. Just as noisy, but a little a little smarter. Andrius Useckas: Yeah, but as you said, there will be sophisticated attacks based on the AI frameworks as well. And those are harder to capture. Those are harder to see especially with the current controls and current current defenses in place. We need that new Just Alex: Absolutely. Andrius Useckas: level of defenses, and I'm sure they're coming. Just Alex: Yep, no question. Andrius Useckas: On that note, thank you for watching us. We'll be back next week. Just Alex: Thanks.