Latest / Along The Edge Podcast: Breaking, Defending, and Understanding Agentic AI / AI Security Brief - October 29, 2026
Transcript
- Andrius Useckas: Welcome to another news episode of Along the Edge Podcast. For those of you that don't know us yet, I'm Andrew Sushetskis. I've been doing security for a long time now, AI security for last two and a half years. Just Alex: And I'm Alex. I've been breaking and protecting AI for the past couple of years. Andrius Useckas: Yeah, so welcome, welcome. An interesting week. a lot of hype going on, especially with the what's stuff that we discussed last week. So PHP to shell and agents are doing what agents do. at this point, I guess they're accessing bank accounts. obviously users approve that access. we're gonna dive deeper into all of that. And then the last interesting thing is the evil quen story. So apparently A researcher, Lyra, they published a recipe of steering two neurons within Quen three point five four billion parameter model. And just by steering these two neurons, the model apparently gets hostile and answers like seventeen of twenty prompts in a hostile manner towards humans. Did you hear about this story? Just Alex: just a little bit. It sounds pretty crazy. I I have so many questions around one, calling something evil is very subjective. So like how are we measuring this? Like Andrius Useckas: It's hype, man. It's hype. Yeah. Just Alex: what? Yeah, it's obviously hype. Andrius Useckas: You gotta make the story interesting. If you don't call it Yeah. Just Alex: We flip two bits and the the model's gonna take over the world now, just by shifting one in one layer by plus one and one in another layer by minus one. Andrius Useckas: Well, that's the story. yes. and I looked at the articles, I looked at the proof. Obviously, I did not try it myself, but it does look like it starts getting hostile. But but it is still, this is still the question of alignment versus actual cybersecurity and controlling your agents. So this is the problem with alignment. I basically like flip. Well, it's flip, it's it's wrong word, but you know, for the purpose of shortening Just Alex: Shift or yeah. Andrius Useckas: the actual technical term, let's call it flip. I flipped one neuron within MLP and and suddenly all the alignment is gone. So do actual cybersecurity, make sure to actually to monitor these things and not just trust the alignment of the model. Just Alex: Yeah, I think that's that's been an ongoing theme for a long time. we just never know what's actually gonna happen with these. I mean, they're probabilistic intentionally, right? So they could they can come up with anything. I mean they can say anything, they can have any sort of output, it can be completely garbled garbage, or it could be evil apparently, or it could be totally rational, Andrius Useckas: Evil garbage, yes. Just Alex: or maybe you will miscount the number of R's in strawberry. Andrius Useckas: They got pretty good at strawberry at this point. I think that's the alignment. But maybe if if I flip a neuron in MLP, suddenly it cannot do strawberry R's again. Who knows? Anyway, moving on back to back to the favorite subject of the last couple of weeks, PHP to shell. so apparently this thing again was a lot of hype. was hyped up. Yes, the vulnerability is real, but exploitation is not as easy as you know we were led to ex expect. apparently, Just Alex: Yeah. Andrius Useckas: it was reported that they saw no successful end-to-end exploitation in the own telemetry at this point. Unit 42 withdrew the earlier attribution to European government compromise. Apparently, there is no real evidence that it is PHP to shell. But of course, pa Palo Auto Networks comes out, you know, hold my beer. our our management interface can be exploited Just Alex: Wow. Andrius Useckas: with PHP to shell. And we are seeing it in, you know. Real life scenarios. So that's where where my my questions there are, how are you seeing it in your management interface, which is supposed to be just internal, not exposed to the internet? And how are they gathering that data? Just Alex: I guess I think the obvious thing is people have to be exposing it to the internet, apparently. maybe that was a decision made during COVID era with remote work, like hey, we gotta have access to this thing remotely. I don't know. I'm just sp this is pure speculation. I have no idea. But otherwise, Andrius Useckas: Yeah, same here. Just Alex: like yes, I mean it makes no unless there was like already some kind of internal compromise, it makes no sense well how you could possibly see that. And Flipping back to the evil Quen thing, if you're gonna abuse that, that's memory manipulation. You'd have to have access to the actual memory of that the model's running on for that to ever be a security risk as well. So those both of those cases are just like, I mean, you you're assuming a lot of existing access to things you shouldn't have access to. Andrius Useckas: Yeah, and the honeypot is not real environment. So Pretorian they did demonstration of the actual exploit and they said that it's it's pretty difficult to do without there are a lot of variables, so like PHP versions, memory limits and things like that, and it's really hard to exploit it, especially when your display errors are off, which is a default setting in PHP. So if you don't have, you know, detailed error, you c you can't really see what you're doing. So yes, under like a Just Alex: So you're just blindly trying to get this thing to oom kill or oom to to trigger the exploit path. Andrius Useckas: Well, you you're trying to trigger it, but if you don't see the actual output from the trigger, if your display errors are disabled, then you're just blindly trying it, period. Just Alex: So you're saying so people just ran the news ran with this far more than they should have. I mean, Log4J, we were comparing it to that before. Log4J was very obviously in the wild. I mean, we we were seeing it across countless, countless places before. So Andrius Useckas: Yeah. Just Alex: like real attempts, real attempts, yes. Andrius Useckas: Yeah, that that one actually was exploited. It was all over the place. We saw it in our own logs and so on and so forth. So I agree. I don't know, man. I I think the issue here again is that it's it's this cabal of the select people, select large companies that have access to mythos. They ran with this and they used it as a marketing campaign. So decisions I don't know if this decisions were actually made by security people. or it was just, you know, hyped up. And released prematurely well, not released prematurely, it was released too late. It was they needed to release it way earlier to the larger community to actually do all of this stuff. Yes, AI found the exploit the exploit, but you still need POCs, you still need exploitation attempts, you still need actual researchers working on it to understand the actual risk and not just the hype going away. Just Alex: There there are risks to releasing POCs too early, obviously. Andrius Useckas: there is, but still the research needs to be I don't know, man. It we're just seeing a lot of hype at this point. So you after PHP to Shell came out, now we're seeing all of these other if you're on X, it's companies and researchers popping up all over the place saying, this is the new exploitation that will basically down every single server and things like that. There is just a lot of hype. So companies that have access to these tools, that have access to mythos that share this data. It helps them from a marketing perspective. But e even like other companies to try to, you know, get on it so so so to say. So, like, you know, with one company, one researcher released this potential vulnerability that affects apparently according to them most of the service on earth. And then you dig into actual technical details. And apparently the vulnerability is in the Pixie network boot driver for EDK2. The target must have the firmware incorporating the actual vulnerable code. It must actually be going through the Pixie boot at the time that it's exploited. And you have to send it a malicious ICMP error message basically during that boot window. So all of these, I mean f Just Alex: Hitting a moving target. Andrius Useckas: Not only that, but you have to have access to internal network. I are you being routed into the actual network that Pixie Boot is on? And how do you how are you sending ICMP error messages to it? Just Alex: Yeah. Andrius Useckas: all of these things have to come together. I I don't know what the solution here is. I guess you know, as a security researcher and security guy, I would like I would like to have a service out there or like a community service out there that gives me all of these vulnerabilities that are coming out without all the hype attached to it and tells me what the actual risk is, what the actual potential risk is, instead of, just coming out and telling me to shut down my servers. Just Alex: we've tried that with like C V S S scores, right? And it's like it's always missing the business context or like what's the criticality of the the system that might have this vulnerability. it it's been attempted so many times. Like I I don't know. It seems like an a nearly impossible problem to solve for, Andrius Useckas: That's why I'm saying it's maybe we need to create a community. that, you know, let's call it unhyped dot AI. Were we were we basic unhyped. Yeah. Just Alex: Unhyped, dehyped. Yeah. Andrius Useckas: Were we basically, you know, just, publish these things and tell what the actual exploitation risks are and actually, you know, what the be what the real data shows and Tell you patch it now, or patch it in a week, or patch it in a month, or just sit on it because you need access to the Pixie Boot environment exploit. Anyway, moving on. back to the AI agents. your Muse AI dots, grog bots, and things like that. Apparently banks are complaining that all of these things are accessing the customer accounts at this point. So apparently people are giving access to the AI bots to go into the accounts. Just Alex: Yeah, they haven't been listening to the show, I guess, because we talked about Andrius Useckas: I guess not. Just Alex: this multiple, multiple times about don't plug in your bank account information, don't use your credit personal credit card, personal debit card. I've seen plenty of posts about people letting like Muse handle their entire budget and like find find improvements in their budget or ask for refunds for things. and handle their taxes even. So it's it's gone way too far. It makes me very queasy. Andrius Useckas: Yeah, I can understand that up to some point, I I might want to hook up QuickBooks to my account to just get like, you know, the the actual stats as to what's going on and, you know, budget it and so on and so forth. So, you know, like if I'm using Grogbot or something like that, may maybe it would be nice to give it some kind of, you know, restricted read only access, Just Alex: Yeah. Andrius Useckas: where you can actually do that analysis. Maybe that is an actual use case that banks should ex Explore like they do with QuickBooks. It kinda makes sense. Just Alex: So you don't want to give it your social security number and have it file your taxes for you? Andrius Useckas: I don't think IRS is gonna be forgiving if I tell it that, my CPA is Muse AI. Just Alex: Mm-hmm. Andrius Useckas: That is just not good defense is like to the auditor. It's like sorry, sorry, IRS auditor. I didn't do this. Muse AI did this, blame them. Blame Zuckerberg, I guess. Just Alex: Yeah, that's not gonna go very far. Andrius Useckas: No, it will not. so yeah, don't don't do your taxes with AI yet. And unless you know there is an actual guarantee behind it and insurance like you get from some providers, whose names we're not gonna mention. Anyway, AI agents are here to stay, I guess, and and we do need to, you know, explore it from security perspective. People like using them and if you're a bank, I think you need to consider the use case that somebody wants to actually look at the account and do the budgeting and everything else. So there in there needs to be some kind of agentic access to the bank account, that is my opinion. Just Alex: Yeah, I agree. Everything's gone agentic. You need to start catering to the agentic use cases and making sure it's not taking down your internal systems. Andrius Useckas: Yep. So there you have it. Don't trust the alignment. Do the actual security. Monitor your agents. and don't give your agents access to you full access to your bank accounts 'cause 'cause you don't know what they're gonna do with it, especially if they go evil. Good episode. we'll see you next week.