Latest / Along The Edge Podcast: Breaking, Defending, and Understanding Agentic AI / AI Security Brief - September 24, 2026

Transcript

AI Security Brief - September 24, 2026 · Along The Edge Podcast: Breaking, Defending, and Understanding Agentic AI

• Andrius Useckas: Welcome to another news segment from Along the Edge Podcast. I'm Andrew Sushetskis. my background is security. I've been doing it for twenty-five plus years. Alex: And I'm Alex Katz and I've been breaking AI agents and all things AI related for at least three years now. Andrius Useckas: Today's topic is what happens when an AI agent crosses the line. Who is responsible? And and we'll discuss other topics as well, like the what happened in Australia. Apparently somebody hacked one of the government sites, and and then we had a bunch of congressional hearings about what happens when AI attacks and so on and so forth. So let's dive into this. Let's start with the Australian thing. So apparently the government in Australia says that OpenAI hacked them back. When all those hacks were happening and they did not notice it until OpenAI actually informed them about it. It was not part of the initial OpenAI disclosure. apparently was some kind of legacy system. I don't know how much you dug into that. Alex: it seemed like there was some research that OpenAI was trying to do on I believe it was medical billing, right? And then Andrius Useckas: Yeah, statisti statistics of Ma Australian Medicare or something like that, I believe, yeah. Alex: it just seemed exactly what you like we saw with like the gym hack thing. Like I mean, just old systems with old vulnerabilities that have been there for decades and it just took advantage of what has already been there that they just never bothered fixing. I mean, they didn't even notice it, so this could have happened ten thousand times over and the the model was just replicating something someone had already done and posted about. Andrius Useckas: Absolutely. It it just I mean people don't realize that hackers will will try to exploit the systems where there is actual financial return that you know they can get money out of. They will not try to break into like Medicare stat stats system. They don't care about that. It's Alex: Marvel. Andrius Useckas: yeah, there is no money attached to it. I mean, even if you get that information, what can you do with it? Not much. apparently agent doesn't care, you know, it tries those things. So There are a ton of these kinds of things, you know, thousands and thousands of legacy systems just sitting out there and waiting for these AI agentic attacks. again, I mean, if if hackers are using an agent, they will probably still not hit these systems. But if if you're testing and your sandbox doesn't work properly, then maybe that's the way to get them tested. I don't know. I guess it's a free pen test for the Australian government, and maybe they will take Cybersecurity seriously for once, from what I understand, there is not much investment in it, you know, legacy systems just sitting there. Alex: Yeah, that's a that's a good positive spin though, just basically saying, Hey, maybe these AI agents that are just going out and randomly hacking people, it'll it'll get a little more attention from the cyber side, maybe a little more budget to be put in place to evaluate these things or clean up shadow IT that's just been hanging out for two decades now or longer. Andrius Useckas: Absolutely. Yeah, connecting to the the Australian thing, so we had congressional hearings, a bunch of people chimed in. I mean s Sam Altman was there, I guess Dario was there as well. The guy from Hugging Face, I can't remember his name now. He gave his t testimony as well. And there there were a lot of questions as to, you know, exactly what happened. containment failures, monitoring issues, like who allowed what What technical controls were actually in place, who authorized continuing testing after the activity was detected and so on and so forth. There is all all these questions that Congress is asking now. And it's it's the right thing to do. I I think, you know, it's you ask these questions and it's not just the agents, you know, agents hacked me and that's the excuse. Alex: I'm torn on it. I I think it's a good thing. Like it's good that we're talking about it. I'm I'm just scared that it's gonna go too far one direction. We're gonna actually get a bunch of regulations in place and just slow progress. I I don't wanna get regulated out of like what we're working on, right? I mean, we're having a lot of fun doing what we're doing and breaking things, so yeah, we'll see. Andrius Useckas: Well I I think it depends what deregulation is. So it is regulation well, th there are two ways to do it and it seems like there are two school of thoughts, even when it comes to congressmen at this point. The one one of them being just ban everything. Superintelligence, scary. I mean, there is no definition in the proposed bill that I saw from Sanders and somebody else, what superintelligence is, but basically they want to if if you're working on it, they want to put you in jail for twenty years. Which seems kind of crazy. But the the other side of it Alex: Yeah. Andrius Useckas: is actually more reasonable, I think. They they're talking about the actual actual responsibility. It's not the agents' responsibility that they hacked you. It's your responsibility, the company's responsibility that this happened. Like I think Jensen said that if these labs do not control the agents and they're actually dangerous and hacking all of these people, those labs should be shut down. I don't know if I disagree with that. If you are doing the stuff for the which seems to me for marketing reasons. maybe you know you should be responsible for what your agents are doing. Set up proper sandboxes. Alex: what happens if you or I go and hack a random serv like what if we hacked the Australian government system the same way the agent did? What would the ramifications of that be? Andrius Useckas: Well, Australia I don't know, but if we like accidentally hacked even Hugging Face, we would get sued. And and it would not be good. Alex: It's a felony. Like there there could be prison time for gaining access to systems that we're not explicitly allowed to be accessing. Andrius Useckas: Yeah, we have current laws for that. I mean, this is hacking. Hackers do end up in jail. We we have those laws in place. Alex: Yeah, countless people have been in prison for these exact types of things. So why yeah, who is going to be held accountable? Andrius Useckas: Yeah, and and that is I think that is the question we need to be asking. It's responsibility. If you have an agent and or if you use an agent, like if I'm using OpenAI or anthropic agents to do this stuff without actually having permission of doing pen testing, it is my responsibility. It is not the agent's responsibility. It's my responsibility to ensure that they don't do what they are not supposed to be doing. And again, I think it comes down to sandboxing. If I'm testing a specific site. I can restrict my sandbox. Just allow that specific side to be hit. I mean we have that built into our tool and things like that. So I don't know. It's Marketing. Man, it's Alex: I don't know. Yeah. It it has to be. I how is it any different than the autonomous driving? Right? Like who's at fault if a Tesla that's driving itself or like a Waymo or what's Amazon's new driving? It doesn't matter, but like who's at fault if a Waymo runs somebody over? Is Waymo at fault? Is the passenger in the car at fault? I don't know. It's it feels very similar to that. Andrius Useckas: Waymo is at fault in that case. Passenger is not the one actually driving the car. Way more is, I believe. So but Alex: So I'm using Codex on my machine and it goes in, tries to access something it shouldn't. Who's at fault for that? Is it am I at fault because it's running on my machine and like I asked it to do some task? Or is OpenAI at fault? Because they're the ones who design the tool I'm using and the what's that? Andrius Useckas: It's you that's a t well it should you're you you're using a tool at that point. It's like I I think it's like using burp suite. So if you're a pen tester, that's one of the tools that you use. Main of the one of the main tools that you would use is burp suite. If you're using burp suite and have a license for it, and it is your responsibility if you break something that you're not supposed to break. It it's not burp suite's responsibility. Alex: Sure. And if it's originating from your IP, like it's coming from you, your machine, your house, your internet. I mean Andrius Useckas: Absolutely. Alex: your ISP. But but I'm using Codex, but we're sending these inference calls to open AI and it's making the decisions. I didn't decide for it to go and break into this hypothetical thing, but it did it on its own. Andrius Useckas: Yeah, but but you should still be controlling it, I think, in that case. It's should still be your sandbox. You cannot just I mean, maybe open AI is somewhat responsible, which is I guess it it brings up an interesting question, which is alignment versus cybersecurity. There is a lot of this talk about alignment, there is not a lot of talk about actual cybersecurity. So yes, this is exactly the question. Is the open AI responsible because they did not align The agent properly, or are you responsible because you do not have proper sandbox and proper monitoring and proper you know controls in place? Alex: That is that is the core of all of this, yes. Andrius Useckas: Yeah, well I would say both are probably somewhat responsible. I mean, yes, the agent should probably be alignment does make sense, yes, it should be aligned, but at the same time, it's like asking nicely. It alignment itself is not gonna like, you know, solve the issues. It's like asking hackers not to hack. You need the actual controls in place. Alex: those configuration options are in the tool. You can you can restrict DNS and you can restrict the that type of access. So that is a configuration option available to the people using the tool. Andrius Useckas: A and it is up to you what controls you implement. It is up to you what monitoring, what harness you use for that matter. It is your choice in that case. It I mean, if the harness did not do proper control, I mean is it the harness's fault? I don't think so. It is still your fault in that case, because you're the one picking the tools. Alex: So despite the inference provider, the harness, because you chose the harness, you are the one at fault. 'Cause it comes down to like I should have configured it better or you can't how does that go? You can't use ignorance to avoid the law. I don't remember the actual term for that, but just because you're ignorant of the configuration options of the tool does not mean you're free from fault if that goes and hacks a website that it shouldn't have. Andrius Useckas: Absolutely, absolutely. And as you said, it's your IP, it's your computer, Alex: I would agree with that. Andrius Useckas: yeah, it's your VMs. You're responsible for you're controlling it. You're in control of it, so you're responsible. I do understand that alignment is important and all of that, but it is still like asking nicely. In the Alex: Yeah. Andrius Useckas: end it is, you know, what tools you choose. It's up to you, it's your responsibility. Which is inter Alex: And as you said though, this is very common in the cybersecurity world because we I mean, you can make any hacking tool that you want, and you can share that anywhere you want. And it it all comes down to how the person is using that tool, exactly like Burp Suite or I don't know, Netcat, John the Ripper, Wi-Fi, all of those types of all of those Andrius Useckas: Yeah, all of those. All of those. Alex: types of tools. Andrius Useckas: So so yeah, if if your attack if the attack is coming from your IP and you're controlling all the tools, that's cool. Now if you're using something like the new Muse AI, which is, you know, all of the stuff would be coming from VMs that Meta controls in that case. Alex: Yeah. Andrius Useckas: And you could use the damn thing to, you know, hack things. You could ask it nicely and it would, you know, probably execute things for you. Or you could you know jailbreak it and make it execute things. Now whose fault is Alex: Sure. Andrius Useckas: it at that point? Alex: That's we're really blurring the lines because even all of the major platform provides like even Codex, you can run things in the cloud. It does run some things in the cloud. Same thing with clawed code. so that that isn't leaving your machine running in what's supposed to be in a some kind of sandbox and some some form of isolation. And as we talked about during the last segment, Muse does have certain levels of protections in place around sensitive data and what it's doing with sensitive data and where it's getting that information from. but in the end, I the line is getting blurred because that's it's running on its own. so is it the inference provider in that case too? Like are they are they the one or is it the model provider or the the agent harness provider or agent runtime provider, maybe Andrius Useckas: Yeah, yeah. Alex: is a better way to put it. Agent runtime provider is the runtime provider at fault. Andrius Useckas: Yeah, so are you fa at fault if you control the infrastructure? I or is it still the user using the infrastructure that's at fault? And that's I don't think we're gonna solve it on this specific segment. So yeah, if Alex: No, of course not, but it's it's an interesting subject regardless. Andrius Useckas: somebody wants to comment on it, do it. I curious to hear what you think. speaking of Muse AI though, I mean people some people jumped all into it, because it can do all these cool things that OpenClock could do, you know, six months ago. But Or almost well eight months ago at this point. but people are I'm just curious. It's like Facebook basically started with Zuckabrew saying, This is like we we really value your privacy, and this is D VMs that we run, and this is the outline of all the configs that we set up and everything else. And then at the meta conference yesterday, Alex or I don't remember his name, like one one of the guys, mean guys from Meta. He was like, Well, I've been watching what people have been doing with Muse AI. And these are the most popular cases and things like that. And and then all these stories are coming out how they're using actual people to make the calls for you, like you know, an assistant that's supposed to that's supposed to do automatic calls. They're actually routing it to call centers. And yeah. Flintstoning the Alex: What? They're like flintstoning the the call automation stuff? Andrius Useckas: actual call automation and all that stuff. And then, you know, somebody found a Alex: That's wild. Andrius Useckas: Zero D on the Mackey Mac client. Alex: Yeah. Yep. That's a good one actually. That was a creative exploit. Using the like taking Andrius Useckas: What does it do exactly? Yeah. Alex: advantage of the the dictation. That's I I like those like where you're that's thinking out of the box where it's like you're pulling on something that's completely isolated on its own, like how the dictation works and like using that to abuse the overall system and stealing like authentication materials and redirecting the the dictation API or I think it's redirect the dictation traffic to an attacker controlled endpoint is the the core of that. Andrius Useckas: On the phone. Yeah, don't get me wrong. I think you know personal ag personal assistance are great and I think you know that's where the market is going. But is Meta gonna be the one that's gonna give us a private, actual secure agent? That is not the model that I mean, look at Facebook, look at Instagram. The entire thing is advertising, it's collecting as much data about you as they can. Alex: Absolutely. Yeah, and in this Andrius Useckas: Some Alex: case it'll be like purchase choices, like direct purchase choices. Andrius Useckas: Yep, yep. Alex: And who well, kind of going back to this is a side subject, but instead of who's at fault if this thing goes and hacks somebody, who's at fault if this thing goes and buys a bunch of stuff it shouldn't have bought? And then how do how do the return policies work for the for agent purchases, agent based purchases? Andrius Useckas: And I think retailers are already worrying about that. And that's why like Amazon and Walmart, I believe, blocked Muse AI completely. Which is not difficult to do because looks like they're using Fastly networks. So if you see like you know browsers coming out of Fastly, you block them. Anyway, Alex: Block all of FastLeap. Easy. Who needs fastly? Andrius Useckas: my advice, I that's my personal advice. Yes, Muse AI, I used it. It's It's interesting and all of that. And if if you want to try it out, go and do it, but don't give it any credentials. Don't give it don't connect it to your actual email accounts. Open another email account. Don't connect it to your mo to your main Facebook or Instagram feed. You know, just just use some si common sense when it comes to security. Yes, it's it's early stages for these things, and again it's meta, so you know, be careful which. Alex: I mean you know someone has that thing wired up to their bank account, get figuring out their entire budget for them, paying their bills, buying their groceries, meal planning, the whole the whole someone's running with that. I guarantee it. I am so Andrius Useckas: I'm sure they are. And we Alex: positive someone is doing that. Andrius Useckas: and I'm sure more stories are gonna be coming out of that, as you know, meta buying th muse AI buying things for them and all the other stuff. Anyway, this is the end of our segment. Good talk. See you next week.