Latest / Along The Edge Podcast: Breaking, Defending, and Understanding Agentic AI / AI Security Brief - October 9, 2026
Transcript
- Andrius Useckas: Welcome to Along the Edge News episode. I'm Andrus Usatskis. I've been in security now for twenty-five plus years, been doing AI security for two and a half years. Alex: And I'm Alex Katz. I've been breaking and defending AI agents for over two years now. Andrius Useckas: Yeah, somewhat slow week, I suppose, in AI news, or at least AI security news. AI news is always ongoing. But we're gonna talk about a scramble to secure Muse AI, Anthropics expanded access program for security professionals, the C VP, otherwise known as CVP, and the exciting world of vulnerabilities in MCP integrations. And then we'll see how it flows and maybe we'll talk about something else too. So starting first, Muse AI. This is a gift that keeps on giving, I guess. And it looks like there were some leaks from meta. And it turns out that there are multiple vulnerabilities and scrambled to fix them just before Muse AI was released. And one of them was an an actual escape from the KVM container. And basically that exposed the risk that could have provided access to sensitive metadata. I don't mean metadata, I mean metas data. well this is this is what we're dealing with but these agents that are running in VMs, in the cloud. I mean in my opinion it's easier to secure the Easy Wood Hermes and e even OpenClaw, when it's running locally, you can at least you know wrap it in different things. But when Meta is doing stuff for you, it's a completely different ballgame. Alex: Yeah, it does require a certain level of expertise to be able to set those things up and this was targeted at consumers. So I guess for like the average consumer this is still better. However, I mean a containerscape is really bad. That's about that's about as bad as it it gets really. So Andrius Useckas: Yeah, that's how how do you g I mean KBM is pretty good. I mean I've used KBM many times over my, you know, professional life and escapes are not do not come up that often and they're patched Alex: No, they don't. Andrius Useckas: pretty fast. So it was this like just complete oversight, just you know, the usual scramble to release things and we're gonna think about security later? Alex: It could have been, yeah. Andrius Useckas: that's an issue and I I'm kind of happy that all of these like AI issues are coming up because it really is exposing how bad companies are at cybersecurity and securing things in general. Alex: Yeah, yeah Andrius Useckas: Well yeah, at least in I mean, even five years ago, all of these things were going in the background. I mean we we are fighting for these things to be secured and tested and everything else, but in the end the priority is releasing the product and security is always an afterthought. At least that's my experience over my twenty five plus years in security. Alex: It's true. Yeah, it has always been an afterthought. Yeah. Well, I mean, isn't this still an afterthought? I mean, they did try to scramble to fix things before the release. But that was like that would have been towards the end. Like we're doing a final security review. look, we found these these gaping issues or these massive issues that we need to patch before we l roll it out. And there was probably a priority list and they fixed the most critical ones. And le we were left with in the release there's probably a number of medium and low severity. Vulnerability still. Andrius Useckas: Absolutely. And it comes down to again the same thing. So it's internal teams doing the testing, internal teams. as I said, one of the issues was escalated to Zuckerberg himself and obviously, you know, the release was more important than doing any kind of, you know, follow up to this. So it is what it is. We're used to it. Alex: Unfortunately it has. Andrius Useckas: We'll see how it goes, but obviously, you know, other vulnerabilities are coming up, not just in meta. I think we're gonna find some more in open AI's dot as well. Alex: Yeah, but following our previous advice, we've stated multiple times with using these types of agents, use separate accounts and your primary accounts. Use a separate bank card or an alternative forms of funding if you're gonna test out the the purchasing options. Don't don't connect this to your checking account that you deposit Andrius Useckas: Yeah. Alex: your paychecks into or something. Andrius Useckas: a checking account might be okay if you have a hundred dollars in it. Savings on the other hand. Alex: Yeah. Andrius Useckas: Anyway, moving on. So Anthropic released a new C V P program, which is I guess good because we were stuck on Opus four point six for C V P stuff for the Alex: Yep. Andrius Useckas: for the access for you know cybersecurity, well defensive stuff at least. And now with the new C V P we get access not just to Opus and Sonnet, I guess we get access to Mythos as well, Mythos five point one. Alex: Yep, the the fabled mythos model. But you can't say fable because that's a different model, I guess. But we we f No, I didn't try it I didn't try it yet. No. No. Honestly I'm out of usage, Andrius Useckas: Did you try it? I mean, how good is it? No. I think one of our g other guys, yeah. Alex: I'm out of tokens on class, so Andrius Useckas: Yeah, that's the issue. I mean, if Mythos is gonna be like Fable and burn through my five hour session in half an hour, then I'll stay away from it and stick to Opus five point five. obviously all the previous author authorizations into C VP got dropped, so I I at least had to redo it again. The good thing about it is anthropic authorized at least my defensive operations, my defensive stuff within forty minutes. As a it's i yeah. Alex: That's im really impressive, honestly. It took it took days for my initial C V P sign up. Andrius Useckas: Well, maybe it's because I already had it. I don't know. But it's still impressive compared to OpenAI, which took me, I finally have Daybreak Blue, which is again defensive work on OpenAI. And it took me two weeks opening multiple tickets, doing the persona verifications, my identification verifications with my driver's license and passport, like five times. And finally somebody reaching out to me on X because I was complaining. Alex: That's the that I think is the key piece of how you gotta approved. Andrius Useckas: But even when the internal person reached out to me, it still took like ten days to get it all resolved. So I finally have it, but I definitely gotta give kudos here to Anthropic. They're taking it seriously and it's not full of bugs. It's not just you know glued, but it's not like daybreak seems to be at this point on OpenAI Alex: Yeah. Andrius Useckas: side. Alex: It's it's really frustrating because there's so many defense even just defensive security applications that I want to test and I want to try out and I feel like I'm hamstrung because it's so hard to get access to these things. And the usage is so like the usage scale is so high. You know, like it if you're burning through your session in five minutes, like that's like a five X usage from Opus five point five or maybe more. so that's It it really is very limiting on on what what Andrius Useckas: It is very limiting and that's why, you know, people like us, we move to we have like little boxes. I mean, I don't know if you can see it there or not. DJ D Spark, Alex: Yep, yep. Andrius Useckas: Nvidia Spark is sitting over there, you know, running Quentin Flash next. horribly quantized, but it still runs just okay, I guess. And that's why we use services like Fireworks as well. Fireworks, if you want to sponsor us, let us know. Shameless plug. Alex: Shameless plug. Yeah. Hey. Andrius Useckas: Yeah. Could use more credits there, 'cause that's all we can Alex: Hey, sponsor us. We'll help you, help us, help you. Andrius Useckas: Exactly. But you know, service like fireworks or even like what was the other one? Groc with the Q at the end. they provide you less restricted models. So you have access to GLM five point three flash and deep seek whatever whatever the latest flash is, which makes the defensive at least defensive work much, much easier. You don't have to worry about all these programs. You don't have to worry that the new model that comes out suddenly has all the guardrails on again and so on and so forth. So for For real cyber work we have to rely on those things. Entropic and open AI, unfortunately, are not reliable enough yet. Alex: Which I mean, this kinda portrays a a bigger picture though, all like a bigger picture issue, which is even if the headline mainstream companies are heavily restricted, there's always ways to get a hold of models that could be used nefariously. So there's I don't I don't know. Like they're just protecting themselves in the end. I understand that, but it's not it's not helping move the world forward by being so restrictive. I mean it could be it like to their I guess like giving them the benefit of the doubt, yes, the volume is probably very high on these requests and they're trying to genuinely review people's applications, maybe. Andrius Useckas: Maybe. But yes, th it it's a good question. I mean, it's still a tool in the end. I mean I can use burp suite all I want. Nobody's restricting and putting guardrails on one while I can deal with burp s in burp suite, which is another pen testing tool, an old one. so why put all these restrictions on me in here? and tell it, you know, it's for what whose protection? I mean you're already authenticating me. Alex: I don't know. Andrius Useckas: You know who I am. You know I'm a security professional, so why all these games? Whatever. I mean legal maybe it is legal repercautions, who knows? Alex: Yeah. Like legal or like liability insurance based, something like that. I don't who knows. Andrius Useckas: Yeah. Speaking of open AI, I think they what said they actually reached out to another hundred plus different companies or tried to break into them or what was the story there? Alex: Yeah, so the the headline was OpenAI notified more than a hundred organizations about agent activity. So it wasn't really specific on were these breaches, like what I didn't I couldn't find any details on like payloads sent or examples of the types of things that may or may not have happened, which is kind of understandable. Like it maybe you maybe there is litigation going on and you can't release that information. Andrius Useckas: They're not great at releasing information anyway, we know that, like. Alex: They just No, not at all. But the scale of this is becoming larger and larger after the initial incidents we talked about. I don't know if it was last week or the week before. So the like the scale is significantly larger than what was originally advertised. Andrius Useckas: Yeah, ki keeps on going. I guess we'll wait for all the subpoenas and all the real details to show up. Maybe through subpoenas, maybe that's what it takes, 'cause otherwise we're not gonna get any root cause analysis from Alex: Yeah, that probably is what it's gonna come down to. Yeah. So s speaking of subpoenas, the California Attorney General Rob Bonta, hope I'm saying that right, he formally subpoenaed OpenAI as part of an investigation into the hugging face incident. So maybe we will finally get full details into the hugging face incident out of that subpoena. Maybe. Maybe. Yep. Andrius Useckas: We'll see. We'll see. Final topic for today is the security of MCP. For those that do not know, that is the new protocol for you know communicating to tools from LLMs, from the agents and so on and so forth, or or agent communicating to an agent as well. it's been around now for probably two years, I guess, somewhere there. And it's based on JSON RPC. So basically it is just API access with a fancy name. that's what it is. But Alex: Yes. Andrius Useckas: Now we're the article came out basically saying that security is severely lacking in in the in common integrations. So like SSRF attacks everywhere, SSRF. So basically you can persuade the server that you access through the MCP to and whatever tool you access to do neferous stuff for you, like you know, send exploitation data to another site or access a database in a way that it's not supposed to be accessed if it's hooked up to the database and so on and so forth. So it's the same topic. It's Wild West out there, everybody's trying to get the features in and security's the afterthought. Alex: Mm-hmm. Andrius Useckas: I don't know, man. What's what's your opinion on this? What what is this gonna take? Is it gonna take regulation? Is it gonna take another framework that's forced on all of these organizations, like you know, SOC two? how Alex: Yeah. Andrius Useckas: yeah. Alex: I'm I think that it like the compliance has to catch up. And once compliance catches up and there's a line item enforcing these types of things, then it won't even be a question. It'll be a requirement. So like if you wanna maintain PCI DSS and HIPAA compliance and you're gonna have to ensure your usage of AI is more secure than it is today. But You know, where where do these line items come in compliance? I g I mean, my understanding is a number of them do come from regulations or like more broader stated regulations coming down from governmental entities. So I guess it's gonna have to be a combination of both. But on the flip side of that, like you look at the EU, it seems like they are regulating, they are cracking down aggressively. But also I don't see any top models coming out of the EU. Like I don't I don't see any latest Andrius Useckas: Well Mistral was just they just came out with a new model that they think is top, but it remains to be seen. And yes, I agree with you. Alex: I I'm skeptical of a lot of those just being distilled from from top tier models, but yes, I mean, okay. Yes. So Andrius Useckas: Benchmaxed as well, yeah, yeah. But yeah, EU regulation unfortunately is a spreadsheet kind of regulation. It does not require a third party validation, does not require pen testing on of any of these things by a third party. so hopefully, you know, whatever the US gonna come up with, whatever standard. maybe that's gonna be the AI UC one or whatever, you know, whatever w new ones are coming out that will actually enforce third party validation. 'Cause that's what you need in this case. If you give organizations Alex: Yes. Andrius Useckas: a say on how to secure things, they will do what Meta did. They will do what these MCP providers do. They will get the features out first and then worry about security. Alex: Yeah, I mean they're heavily financially motivated to do that. It's it is a it is a large cost, one to maintain a security team and two to delay a release for something where there's a lot of marketing backing it and a lot of hype around it. They're watching dollars light on fire the s the longer it takes for something to to be released. Timing is very important, especially when they have very aggressive competition. between anthropic and open AI, for example. Andrius Useckas: Absolutely. So here's there's our segment for this week and parting words, offense is the best the best defense. So third party validation through offense. Yeah. Alex: Third party validation. Let's go. Let's go. Third party validate all of the things. Andrius Useckas: Till next week.