Latest / Tech Talks With Kinsoft / Last Week in Tech - F5 and Check Point Under Fire, a $387 Million Spoofed Approval, and AI Agents Go Carding

Transcript

Last Week in Tech - F5 and Check Point Under Fire, a $387 Million Spoofed Approval, and AI Agents Go Carding · Tech Talks With Kinsoft

• 0:00
  Welcome to today's deep dive. Imagine for a second
• 0:03
  spending millions of dollars on state -of -the
• 0:06
  -art digital security, right? You fortify your
• 0:09
  network, you hire the best teams, only to realize
• 0:12
  that the very firewalls you bought to protect
• 0:15
  you are like the exact doors hackers are using
• 0:18
  to break in. Yeah, it completely flips the entire
• 0:21
  concept of security on its head. It really does.
• 0:24
  And we know you are here because you want a clear,
• 0:27
  you know, hype -free synthesis of exactly this
• 0:30
  kind of paradigm shift. You're looking for the
• 0:32
  actual signal through the noise of the weekly
• 0:33
  news cycle. Right. And it is a profound shift.
• 0:36
  Honestly, it's the definitive theme we pulled
• 0:39
  from our briefing covering the most critical
• 0:41
  tech and cybersecurity events from the past week,
• 0:43
  ending September 28th, 2026. Which is just a
• 0:47
  packed week. Oh, yeah, absolutely. And the core
• 0:50
  takeaway is that the foundational technologies
• 0:52
  and systems we just implicitly trust to keep
• 0:56
  us safe, well, they're failing at a structural
• 0:58
  level. Yeah. And our mission today is to explore
• 1:01
  exactly how this illusion of control is being
• 1:05
  shattered for you. We're going from perimeter
• 1:08
  defenses becoming the actual attack surface to
• 1:10
  a massive crypto heist where the security system
• 1:13
  functioned perfectly but still authorized the
• 1:15
  theft. And then looking at how the sheer economics
• 1:18
  of cybercrime are just collapsing due to AI.
• 1:21
  It's a lot of ground to cover. It is. So let's
• 1:25
  start right at the perimeter wall. We historically
• 1:27
  view firewalls and VPN gateways as our digital
• 1:31
  armor. But this week, the major story is about
• 1:34
  vulnerabilities in F5, Big IP, and checkpoint
• 1:37
  systems. It's like the armor essentially grew
• 1:39
  spikes on the inside. Right. And the speed of
• 1:42
  the response from federal authorities here really
• 1:45
  tells you everything you need to know about the
• 1:46
  severity. So on September 22nd, F5 published
• 1:49
  an advisory for a flaw in their big IP access
• 1:52
  policy manager. And this isn't just a small tool,
• 1:55
  right? No, not at all. This is a component massive
• 1:58
  organizations use. Think global banks, governments,
• 2:01
  Fortune 500s. They all use it to manage remote
• 2:04
  access. And the U .S. Cybersecurity and Infrastructure
• 2:07
  Security Agency, or CISA, they added it to their
• 2:11
  known exploited vulnerabilities catalog that
• 2:13
  exact same day. Wow, the exact same day. Yeah,
• 2:16
  giving federal agencies a mere three days to
• 2:18
  secure it. Okay, let's unpack this. A three -day
• 2:22
  turnaround for federal agencies is a massive
• 2:25
  scramble. I mean, the vulnerability is cataloged
• 2:28
  as CVE -2026 -94127, and it carries a 9 .8 severity
• 2:34
  score. out of 10. Nearly perfect. Right. Almost
• 2:37
  as bad as it gets. The briefing describes it
• 2:40
  as an unauthenticated remote code execution caused
• 2:43
  by a heap buffer overflow. And I know we've touched
• 2:46
  on buffer overflows before, but remind us of
• 2:48
  the mechanics behind why this allows someone
• 2:50
  to just walk in without a password. Well, to
• 2:54
  understand the mechanics of a heap buffer overflow,
• 2:56
  you have to think of a computer's act of memory,
• 2:59
  the heap, as a series of meticulously organized,
• 3:03
  flexible storage bins. Okay. Bins. Got it. Right.
• 3:06
  So a buffer overflow happens when an attacker
• 3:09
  intentionally shoves way too much data into one
• 3:12
  specific bin. The software basically fails to
• 3:15
  check the size of the data, so the excess spills
• 3:17
  over into the adjacent bins. And what's in those
• 3:20
  adjacent bins usually? Well, that's the danger.
• 3:23
  If those adjacent bins happen to hold critical
• 3:26
  system instructions, the attacker's spillover
• 3:29
  data actually overwrites those instructions with
• 3:31
  their own malicious code. Oh, wow. Yeah. So the
• 3:34
  system then executes that malicious code thinking
• 3:37
  it's just part of its normal routine. So it's
• 3:40
  not even like a broken lock on a bank vault.
• 3:42
  It's more like a bank teller's cash drawer. Like
• 3:45
  if a hacker shoves a massive stack of $1 bills
• 3:48
  into the $20 slot and they spill over into the
• 3:50
  $100 slot, suddenly the system's reality is warped.
• 3:54
  It thinks you deposited hundreds instead of ones.
• 3:56
  That is a highly accurate way to visualize it,
• 3:59
  actually. You've just overwritten the system's
• 4:02
  reality by cramming too much data into a space
• 4:04
  that wasn't built to contain it. Exactly. You
• 4:07
  are manipulating the system's memory to force
• 4:09
  it to execute commands it was never programmed
• 4:12
  to run. And what's fascinating here is that we
• 4:15
  are witnessing the devices meant to face the
• 4:17
  hostile Internet and protect our internal networks
• 4:20
  becoming the primary attack surface themselves.
• 4:23
  Because they're the things exposed to the outside.
• 4:25
  Right. And we saw a similar crisis unfold on
• 4:28
  the very same day with Checkpoint. Yeah. Checkpoint
• 4:31
  released an advisory bluntly titled Action Required,
• 4:35
  dealing with two critical flaws being actively
• 4:37
  exploited. One involved how their security gateways
• 4:40
  and Spark firewalls handle VPN certificates.
• 4:43
  But the second one really caught my eye. The
• 4:46
  zero day. Yes, it was a true zero day in their
• 4:50
  security management server. It was described
• 4:52
  as a pre -authentication path traversal vulnerability.
• 4:55
  Wait, let me make sure I've got path traversal
• 4:58
  right. Is that like if I ask a librarian for
• 5:01
  a specific book in the public reading room, but
• 5:03
  I use some weird coded language that tricks her
• 5:06
  into walking backwards through the staff doors
• 5:08
  and handing me the master keys to the building?
• 5:10
  You've captured the exact mechanism there. In
• 5:12
  a typical web application, a user might request
• 5:15
  a file. Like an image. And the application looks
• 5:19
  in the public images folder. Makes sense. But
• 5:22
  with a path traversal vulnerability, the attacker
• 5:25
  inputs a sequence of characters, usually a series
• 5:27
  of dots and slashes. And that commands the server
• 5:30
  to move backwards out of that public directory
• 5:33
  and up into the restricted system directories.
• 5:36
  So they're literally just telling the computer
• 5:38
  to go back a folder? Yes, over and over. And
• 5:41
  suddenly, instead of serving a harmless image,
• 5:44
  the server is handing over password files or
• 5:46
  execution scripts. And importantly for checkpoint
• 5:49
  users, fixing this requires a full system update.
• 5:52
  Oh, you can't just patch it. No, you can't just
• 5:54
  apply a quick live patch, which is their system
• 5:57
  for applying fixes without rebooting. It requires
• 6:00
  actual downtime. And just to show how widespread
• 6:03
  this perimeter failure really is, Arista's Valero
• 6:06
  Orchestrator also has a critical, actively exploited
• 6:09
  flaw right now regarding certificate authentication.
• 6:12
  Right, the orchestrator. Yeah, which manages
• 6:14
  their SD -WAN products. For anyone unfamiliar,
• 6:17
  that stands for Software Defined Wide Area Network.
• 6:20
  It's essentially the intelligent traffic cop
• 6:22
  that routes a company's data across different
• 6:24
  internet connections. If that gets compromised,
• 6:26
  well, the attacker controls the map. They absolutely
• 6:29
  do. But to bring this back to practical reality
• 6:32
  for you, the listener, There is a crucial nuance
• 6:35
  with the F5 situation specifically. Okay, what's
• 6:38
  that? It is only exploitable if the access policy
• 6:41
  manager is configured as an OAuth authorization
• 6:44
  server. Okay, wait, let's define that quickly
• 6:47
  because that sounds like a massive piece of jargon
• 6:49
  that dictates whether an IT team needs to panic
• 6:52
  today or not. Yeah, fair enough. OAuth is essentially
• 6:55
  the digital bouncer for your network. When you
• 6:58
  click log in with Google or log in with Microsoft
• 7:01
  on a third -party website, That's OAuth. You
• 7:04
  are giving the third party your password, right?
• 7:06
  The bouncer verifies your identity and hands
• 7:09
  the third party a temporary VLP wristband, a
• 7:12
  token that grants them access. Oh, I see. So
• 7:15
  if your F5 system is set up to be that bouncer
• 7:18
  generating those wristbands, you are vulnerable.
• 7:21
  Scanners show over 14 ,700 internet -facing IP
• 7:25
  addresses with that specific big IP fingerprint
• 7:28
  right now. Over 14 ,000. So the strategic takeaway
• 7:32
  for anyone running F5 or Checkpoint Spark isn't
• 7:35
  just to casually patch during the next cycle.
• 7:38
  The consensus from the data is clear. You have
• 7:40
  to assume you've been probed. The most critical
• 7:43
  question for IT teams this morning is checking
• 7:45
  for that specific OAuth bouncer configuration.
• 7:48
  Precisely. Now, if the perimeter walls, the firewalls,
• 7:51
  and VPNs are compromised, attackers are inside
• 7:54
  the network. So how do we catch them? Right.
• 7:57
  Usually we rely on human verification and internal
• 8:00
  controls, but our next piece of intelligence
• 8:03
  really demonstrates what happens when the information
• 8:05
  humans rely on to verify transactions is structurally
• 8:10
  compromised. Which brings us to the BitGet cryptocurrency
• 8:13
  exchange theft. On September 24th, BitGet detected
• 8:16
  unauthorized transfers that resulted in a staggering
• 8:19
  $387 .5 million being stolen. Just a massive
• 8:24
  amount of money. Huge. But the amount isn't even
• 8:27
  the most alarming part. It's how they did it.
• 8:30
  The attackers didn't steal the private keys to
• 8:32
  the crypto wallets. Instead, they compromised
• 8:35
  a back -end system, spoofed the transaction data,
• 8:38
  and fed that fake data into BitGet's own authorization
• 8:41
  process. The methodology is the core issue here.
• 8:45
  The internal controls worked exactly as they
• 8:48
  were designed to work. Right. The system required
• 8:50
  an approval, and an approval was given. Exactly.
• 8:54
  The problem is that the attacker controlled the
• 8:56
  back end, preparing the request. See, here's
• 8:59
  where it gets really interesting for me. I'm
• 9:01
  reading this and thinking, a human still had
• 9:04
  to approve this transfer. If a human clicks approve
• 9:07
  on sending hundreds of millions of dollars to
• 9:09
  a criminal, how is that not just a colossal human
• 9:12
  error? I mean, shouldn't they have noticed the
• 9:14
  destination address was wrong? It is entirely
• 9:16
  natural to look for a human scapegoat in that
• 9:19
  scenario. But it is not human error if the screen
• 9:22
  is actively lying to the human. Lying to them?
• 9:26
  Yeah, think about it. If the human is looking
• 9:28
  at a dashboard that says, transfer $50 ,000 to
• 9:31
  internal wallet A for daily liquidity, they will
• 9:34
  click approve. But if the attacker has compromised
• 9:37
  the backend API, the middleman that carries data
• 9:40
  from the database to the screen, they can alter
• 9:42
  the reality. How exactly does that API interception
• 9:46
  work, technically, though? So the front end,
• 9:49
  which the human sees, asks the back end database
• 9:51
  for the transaction details. The attacker is
• 9:54
  sitting right in the middle, intercepting that
• 9:56
  request. Okay. The database says, yes, this is
• 10:00
  a routine $50 ,000 internal transfer. The attacker's
• 10:03
  script grabs that data before it reaches the
• 10:06
  screen, rewrites it to still say routine $50
• 10:08
  ,000 transfer, but changes the hidden destination
• 10:12
  code to the attacker's wallet. Oh, man. And they
• 10:15
  multiply the hidden amount. So the human sees
• 10:17
  a perfectly legitimate looking screen, clicks
• 10:20
  approve, and the system logs that a human verified
• 10:22
  the transaction. The human control is entirely
• 10:25
  bypassed because they were just rubber stamping
• 10:27
  a lie. So they didn't forge the signature on
• 10:30
  the bank check. They altered the printed numbers
• 10:32
  on the check after it was already signed, essentially.
• 10:34
  Basically, yes. Just to wrap up the facts on
• 10:37
  BitGet, they claim their cold wallets are secure,
• 10:40
  their user protection fund covers the loss, and
• 10:43
  they've actually started reopening withdrawals.
• 10:45
  Their internal assessment suspects North Korea
• 10:47
  is behind it, based on VPN IP addresses, though
• 10:51
  we always have to note that's unverified by law
• 10:53
  enforcement at this stage. They've also frozen
• 10:55
  some funds and offered a 5 % recovery bounty.
• 10:58
  The larger implication here translates directly
• 11:01
  into your daily business workflows, far beyond
• 11:04
  cryptocurrency. How so? Well, consider your own
• 11:06
  finance team. When they approve a massive payroll
• 11:09
  run or a vendor payment into your accounting
• 11:11
  software, where does the information on their
• 11:14
  screen actually come from? Could a compromised
• 11:16
  API alter the destination routing numbers before
• 11:19
  the human ever sees the final approval screen?
• 11:21
  That is a terrifying thought. We inherently trust
• 11:25
  internal dashboards. But if the foundation feeding
• 11:28
  them is compromised, your human verification
• 11:30
  is totally useless. And bypassing human controls
• 11:33
  like that requires intense sophistication. Doing
• 11:36
  it at scale used to require an army of highly
• 11:39
  skilled, expensive hackers. But looking at our
• 11:42
  next source, the barrier to entry for that level
• 11:44
  of sophistication has completely vanished. It
• 11:47
  really has. The economics of cybercrime are just
• 11:50
  collapsing due to AI. We are pulling from a sobering
• 11:53
  report by Gambit Security regarding a Chinese
• 11:56
  -speaking operator running an AI card skimming
• 11:59
  campaign. And the operator didn't write hundreds
• 12:02
  of custom exploits. They used three open source
• 12:05
  AI agent tools to build an automated self -managing
• 12:08
  attack pipeline. The technical breakdown of this
• 12:11
  is wild. They used one AI agent as the orchestrator,
• 12:14
  like the project manager. A second AI agent was
• 12:18
  the scout. deployed to scan the internet for
• 12:20
  vulnerabilities. And a third AI agent was the
• 12:23
  demolition expert executing the actual exploits.
• 12:25
  And the efficiency is staggering. Between September
• 12:28
  10th and 15th, they executed 105 attacks. They
• 12:32
  compromised at least 27 companies, including
• 12:34
  a Fortune 500 hospitality brand and a major U
• 12:37
  .S. airline. Wow. Over 600 ,000 credit card records
• 12:41
  were stolen from just two of those victims. I
• 12:43
  have to push back here, though. Aren't models
• 12:45
  like Anthropix Clod or OpenAI systems supposed
• 12:48
  to have strict safety guardrails precisely to
• 12:51
  stop them from writing malicious code? This raises
• 12:53
  an important question, and the source material
• 12:55
  provides a fascinating look into the attacker's
• 12:58
  methodology here. The attacker used Anthropix
• 13:01
  Clod Opus 4 .6 for the orchestration agent. Okay.
• 13:04
  The report specifically notes that newer models
• 13:06
  did refuse the attacker's request due to safety
• 13:09
  guardrails. So the attacker essentially went
• 13:12
  model shopping. They utilized an older or jailbroken
• 13:15
  version of Claude to act as the brains, while
• 13:18
  using models like DeepSeek and GLM for the grunt
• 13:21
  work. Okay, let's unpack this orchestration part,
• 13:23
  because how does a chatbot actually orchestrate
• 13:26
  an attack? It's not just sitting there typing
• 13:28
  out code into a terminal, right? No, no, these
• 13:31
  aren't chatbot interfaces. These are API agents
• 13:34
  plugged directly into the execution environment.
• 13:37
  Claude acts as the manager. It is given a high
• 13:40
  -level goal like extract data from this target.
• 13:43
  And then what does it do? It generates the command
• 13:45
  prompts, sends them to the deep -seek scanning
• 13:48
  agent, reads the scout's report, and then formulates
• 13:51
  a specific attack plan. If the GLM execution
• 13:54
  agent tries the attack and gets an error code
• 13:57
  back from the server, the cloud orchestrator
• 13:59
  reads the error, understands why the attack failed,
• 14:02
  writes a new script to bypass the error, and
• 14:05
  orders the execution agent to try again. Wait,
• 14:07
  so it just fixes its own mistakes on the fly?
• 14:10
  Yes, it is dynamically adjusting the attack in
• 14:13
  real time without any human intervention. That
• 14:16
  is terrifying. And because they are using automated
• 14:19
  agents, the cost is basically a rounding error.
• 14:21
  The report estimates the mean cost per completed
• 14:24
  scan was about $25. Yep, $25. The entire campaign,
• 14:30
  which yielded hundreds of thousands of stolen
• 14:32
  credit cards, cost between $12 ,000 and $18 ,000
• 14:35
  total. It shatters the economic model of cyber
• 14:38
  defense. A criminal can now buy the equivalent
• 14:41
  of a highly skilled 24 -7 hacking team for the
• 14:45
  price of a used car. So what is the defense against
• 14:48
  a $25 AI mercenary then? The briefing points
• 14:51
  specifically to compliance standards, namely
• 14:53
  PCI DSS version 4. For anyone who doesn't handle
• 14:56
  e -commerce, that's the payment card industry
• 14:58
  data security standard. Historically, a lot of
• 15:01
  merchants viewed PCI compliance as just... you
• 15:04
  know, an annual paperwork headache. Right, but
• 15:07
  version 4 introduces strict requirements to actively
• 15:10
  monitor the scripts running on your payment pages.
• 15:13
  Previously, you might review your code every
• 15:15
  few months. Sure. But with the $25 AI bot constantly
• 15:19
  probing your site, capable of dynamically rewriting
• 15:23
  its attack to bypass your defenses in seconds,
• 15:25
  automated monitoring is no longer just a paperwork
• 15:28
  exercise. It's your only line of defense fast
• 15:32
  enough to notice an AI injecting a malicious
• 15:34
  card skimmer into your checkout page before your
• 15:37
  customer's data is exported. The speed of AI
• 15:39
  attacks mandates high -speed automated defense.
• 15:43
  But running 10 to the pi of dynamic AI agents
• 15:46
  a week isn't magic, right? It requires massive
• 15:49
  physical computing power. And that insatiable
• 15:52
  demand for processing power is quietly triggering
• 15:54
  a massive squeeze in the global hardware supply
• 15:57
  chain. which brings us to an incredible infrastructure
• 16:00
  shift. Yeah, we are looking at an $11 .6 billion
• 16:03
  seven -year agreement between Akamai and Anthropic,
• 16:06
  with room to expand by another $9 billion. Huge
• 16:10
  numbers. Anthropic gets CPU workloads on Akamai's
• 16:12
  cloud, and in return, Anthropic gets a warrant
• 16:15
  for up to roughly 5 % of Akamai's stock. And
• 16:18
  in response to securing this deal, Akamai expects
• 16:21
  about $5 .5 billion in related capital spending.
• 16:25
  Crucially, they are pre -buying $1 .7 billion
• 16:28
  in physical memory this year alone to build out
• 16:31
  the capacity. Wait, Akamai, I know them as a
• 16:34
  content delivery network and a security vendor.
• 16:36
  Their main job is making sure websites load fast
• 16:38
  across the globe and blocking DDoS attacks, which
• 16:41
  is a distributed denial of service. Basically,
• 16:43
  when hackers flood a website with so much junk
• 16:46
  traffic, it crashes. Why is a network routing
• 16:49
  and security company getting into the heavy -duty
• 16:51
  AI computing business? Because the sheer physics
• 16:54
  of AI demand it. Anthropic needs compute power
• 16:57
  closer to the edge of the network, and Akamai
• 16:59
  has data centers everywhere. We are seeing traditional
• 17:02
  security vendors morphing into massive compute
• 17:05
  businesses just to feed the AI beast. So what
• 17:08
  does this all mean? If a company whose main job
• 17:10
  is routing internet traffic is suddenly buying...
• 17:13
  billions in physical memory chips. It's like
• 17:16
  a local parcel delivery service buying up all
• 17:18
  the diesel fuel in the entire country because
• 17:20
  they just partnered with a global freight train
• 17:22
  network. That analogy perfectly captures the
• 17:25
  market disruption. When a single company pre
• 17:28
  -buys $1 .7 billion worth of memory, it sends
• 17:31
  a massive signal. Prices are going up. Hardware
• 17:34
  is going to get scarce and it is going to get
• 17:36
  expensive. The AI boom is literally hoarding
• 17:39
  the world's computer memory. Which means the
• 17:42
  strategic takeaway for you listening is immediate.
• 17:44
  If your company has a server refresh scheduled
• 17:46
  or you need to buy a fleet of new laptops for
• 17:49
  your team in the next 12 months, you need to
• 17:51
  call your vendors and lock in your pricing right
• 17:53
  now. Do not wait or you will be competing against
• 17:56
  these billion dollar AI infrastructure build
• 17:58
  outs. We are looking at a wild future of dynamic
• 18:01
  AI agents and hardware shortages. But, you know,
• 18:04
  the irony of our digital foundation is that some
• 18:07
  of the most critical data in the world. isn't
• 18:09
  being guarded by futuristic tech. It's sitting
• 18:12
  on legacy software, which is just as vulnerable.
• 18:15
  Right, which brings us to the extortion claims
• 18:17
  involving the FBI. The cybercriminal group known
• 18:20
  as Shiny Hunters claimed this week that they
• 18:22
  breached the FBI. They say they used a new unpatched
• 18:25
  zero -day vulnerability in Oracle PeopleSoft
• 18:28
  to steal terabytes of data about FBI staff and
• 18:32
  job applicants. As your guides through this intelligence,
• 18:35
  it is vital we clearly delineate confirmed fact.
• 18:38
  from criminal claim here. Always. The factual
• 18:42
  baseline is this. The FBI confirmed they are
• 18:45
  investigating a claimed compromise. The FBIjobs
• 18:49
  .gov portal was taken offline, and the FBI stated
• 18:52
  that the point of compromise, whether it was
• 18:54
  a third -party vendor or their own systems, is
• 18:57
  still undetermined. Exactly. The claims of a
• 19:01
  new Oracle Zero Day, the specific scale of the
• 19:04
  stolen data, and the actual systems involved
• 19:07
  are strictly the extortion group's unverified
• 19:09
  claims. Oracle has not commented, and there is
• 19:12
  no new CVE issued for this supposed Zero Day.
• 19:16
  Right. But I have to ask, if the Zero Day and
• 19:20
  the terabytes of data are completely unverified
• 19:23
  claims from criminals trying to drum up extortion
• 19:25
  leverage, Why are we dedicating time to it on
• 19:28
  today's deep dive? Why give them the oxygen?
• 19:32
  If we connect this to the bigger picture, whether
• 19:34
  Shiny Hunter's specific claim is true or a complete
• 19:38
  fabrication, the threat vector they are pointing
• 19:41
  at is incredibly real. Oracle PeopleSoft is a
• 19:45
  ubiquitous legacy HR system. It is heavily relied
• 19:49
  upon by government agencies, massive corporations,
• 19:52
  and universities everywhere. Ah, I see. So while
• 19:57
  everyone is worried about highly advanced AI
• 19:59
  orchestrators, the backdoor is a 15 -year -old
• 20:03
  HR portal processing job applications. It's the
• 20:06
  foundation cracking again. You might have a cutting
• 20:09
  -edge AI firewall, but your legacy administrative
• 20:11
  systems are your actual attack surface. Precisely.
• 20:14
  And the takeaway here is clear. If your university
• 20:18
  or government agency runs PeopleSoft, you cannot
• 20:21
  wait around to see if the zero -day rumors are
• 20:23
  true. What should they do? You must ensure that
• 20:27
  the confirmed June PeopleSoft fix, that is CVE
• 20:30
  -2026 -35273, is applied immediately to remove
• 20:35
  the known vulnerabilities while we wait for the
• 20:37
  facts on the unknown ones. Okay, let's take a
• 20:40
  breath and recap the journey we've been on today.
• 20:43
  We set out to explore how the foundations of
• 20:45
  digital trust are shifting. We saw how the very
• 20:48
  firewalls meant to protect us, like F5 and Checkpoint,
• 20:51
  are now the primary targets due to deep memory
• 20:54
  flaws and path traversals. We saw how human approval
• 20:57
  processes mean nothing if a crypto platform's
• 21:00
  backend API is spoofing the data right on the
• 21:02
  screen. We looked at how a $25 AI cyber mercenary
• 21:06
  operation can dynamically rewrite code to steal
• 21:09
  hundreds of thousands of credit cards, and how
• 21:11
  the AI boom is literally hoarding the world's
• 21:14
  computer memory. The illusion of control is dissolving
• 21:17
  across the board. We are relying on legacy software,
• 21:21
  vulnerable perimeters, and screens that can literally
• 21:24
  lie to us. Which leaves us with a final, rather
• 21:28
  provocative thought. Lay it on us. If an AI can
• 21:32
  now orchestrate a highly complex cyber attack
• 21:34
  for the price of a takeout dinner, and if our
• 21:37
  human approval processes can be so easily bypassed
• 21:40
  by spoofed backend data, What happens when those
• 21:43
  two realities merge? Oh, man. What happens when
• 21:47
  an AI agent doesn't just spoof the financial
• 21:50
  data on your dashboard, but also spoofs the internal
• 21:53
  emails, the Slack messages, and generates the
• 21:56
  voice memos from your boss asking you to approve
• 21:58
  it? That is wild. How will we verify what is
• 22:03
  actually real inside our own companies when the
• 22:06
  foundation of communication itself can be so
• 22:09
  cheaply and perfectly fabricated? That is a heavy,
• 22:14
  heavy question to mull over. If the digital foundation
• 22:17
  we stand on is shifting that rapidly, maybe it's
• 22:20
  time we stop admiring the view from the penthouse
• 22:22
  and start thoroughly inspecting the basement.
• 22:25
  Thank you so much for joining us on this deep
• 22:27
  dive. Keep questioning the systems you trust,
• 22:29
  keep learning, and we'll see you next time.