Security Now 1096 transcript

Please be advised that this transcript is AI-generated and may not be word-for-word. Time codes refer to the approximate times in the ad-free version of the show.

Leo Laporte [00:00:00]:
It's time for Security Now. Steve Gibson is here and there is a lot to talk about. The full report on the 1,000 security fixes from Microsoft, the surprising dearth of security fixes from Anthropic's Project Glasswing. What's that all about? And getting your name off data brokers. California has made it pretty easy. Plus, is it the end of the world as we know it? Are we the Krell? Steve Gibson is next.

Steve Gibson [00:00:30]:
Podcasts you love. From people you trust.

Leo Laporte [00:00:35]:
This is TWiT. This is Security Now with Steve Gibson, episode 1096, recorded Tuesday, September 15th, 2026. Are we the Krill? It's time for Security Now. I know you wait all Tuesday for the very important show. This is the show you must listen to, the show that keeps you on top of what's going on in the world of security, cybersecurity, privacy, AI, and a few other things like science fiction. Stuff Steve's into. Steve Gibson, good to see you. Welcome.

Steve Gibson [00:01:13]:
Leo, great to be with you once again.

Leo Laporte [00:01:18]:
Yes.

Steve Gibson [00:01:19]:
The people listening to the podcast wouldn't know, but we've just spent the last 40 minutes—

Leo Laporte [00:01:25]:
I apologize.

Steve Gibson [00:01:26]:
Chewing the fat, as they say. No, it's, I wanted to, I had a bunch of stuff I wanted to talk to you about.

Leo Laporte [00:01:31]:
But Steve, what you need to know is Steve and I are buddies, but the only time we really ever get to talk is when we're doing the show. So we have to catch up.

Steve Gibson [00:01:39]:
Or occasionally when we're in the same physical location as we were in Vegas. Oh, nice.

Leo Laporte [00:01:44]:
It's really nice when we can do that. And we text each other and stuff, but it's really nice. So that's what's going on. We talk to each other. Yeah.

Steve Gibson [00:01:51]:
Well, and there's, we're both so excited in our, with our own perspectives about what's going on with AI that—

Leo Laporte [00:01:57]:
What a week it's been. Crazy week.

Steve Gibson [00:02:00]:
It has been. And in fact, That is the, uh, a, a, an aspect of that is today's topic. Um, we got a lot of stuff to talk about for Security Now episode 1096 for this middle of September, the, the 15th. Um, we've, as I said we would do last week, we're gonna take a look at what the heck happened with, uh, last week's Patch Tuesday and Microsoft's nearly 1,000 security fixes. What, you know, we're going to do a deep dive into them, dissect it, see what we can learn.

Leo Laporte [00:02:39]:
By the way, they had to fix the fixes in an out-of-band patch.

Steve Gibson [00:02:44]:
The Excel copy and paste mess? Yeah.

Leo Laporte [00:02:47]:
Yeah. Whoops.

Steve Gibson [00:02:49]:
And actually, I touch on that, noting that there is a problem with just immediately applying whatever Microsoft gives you. Enterprises have been burned by this in the past. So.

Leo Laporte [00:03:01]:
Yeah. Thanks.

Steve Gibson [00:03:02]:
Also, 5 months after its initiation, what's the status of Project Glasswing? It turns out that the numbers are kind of interesting. And we have a complete breakdown of that, which is surprising. Also, Anthropic's rogue agent escape count has now reached 4 incidents. And not to be outdone, however, OpenAI's count has passed 10. and maybe as many as 23 different external points of contact that were, uh, you know, should have been off limits but weren't. Um, it's time to revisit California's DROP compulsory data broker data deletion. We talked about this at the beginning of the year when it first went into effect. Uh, I joined it.

Steve Gibson [00:03:57]:
I think you did too, Leo. Uh, And August 1st was an important date there that we will talk about and catch up. Also, Russian criminals have their hands now on more than 153 million driver's license scans.

Leo Laporte [00:04:15]:
Oh, that's where they went.

Steve Gibson [00:04:17]:
That's right. And isn't that where everyone would like to have not only white light on both sides, but IR and UV scans? Uh, high resolution. Uh, we'll look at how that happened and, and what. And then we're gonna wrap by my suggestion that Skynet, which we keep hearing everyone talk about, is the wrong model for this end of the world which everyone is apparently forecasting. The right model, I will submit, is the Krell.

Leo Laporte [00:04:53]:
So I'm not as up on Star Trek. I think it's Star Trek, right?

Steve Gibson [00:04:59]:
Not Star Trek. This was one of the best. Now, okay, and I understand, Leo, that you think that really old sci-fi is kind of hokey. And, you know, it's like, okay, yeah, maybe they lean against the set and it moves a little bit because it's made out of cardboard. But this was The movie that's now 70 years ago, released in 1956, Forbidden Planet.

Leo Laporte [00:05:27]:
Oh, Forbidden Planet, of course. Okay.

Steve Gibson [00:05:29]:
Morbius and Robbie the Robot.

Leo Laporte [00:05:32]:
Robbie the Robot.

Steve Gibson [00:05:33]:
You know, Anne Francis, Walter Pidgeon, and of course Leslie Nielsen was a teenager back then.

Leo Laporte [00:05:38]:
So it was hokey, but it was a classic.

Steve Gibson [00:05:41]:
Well, and what happened to the Krell? Yes. It wasn't any maliciousness. It was oops.

Leo Laporte [00:05:50]:
Oops.

Steve Gibson [00:05:51]:
So, we might be the Krell.

Leo Laporte [00:05:53]:
I get it now.

Steve Gibson [00:05:54]:
Are we the Krell is the question we will look at and answer. And, oh, Leo, wait till you see this week's Picture of the Week. It's apropos for everything that we've been talking about. So, I think we have another great podcast for our listeners.

Leo Laporte [00:06:09]:
I know we do. We always do. I'm so glad you're here, Steve. So glad you're all here. And I know you will be as you listen to the show. Maybe the most vital part, the picture of the week.

Steve Gibson [00:06:21]:
I love how you pronounce cockroach with 3 C's.

Leo Laporte [00:06:24]:
Cockroach. I don't know why I say that. I know it's cockroach. I know that.

Steve Gibson [00:06:31]:
But it sounds more—

Leo Laporte [00:06:33]:
Cockroach.

Steve Gibson [00:06:34]:
Yeah.

Leo Laporte [00:06:35]:
Is there a picture of the week? I'm looking at the show notes. I don't see—

Steve Gibson [00:06:38]:
Oh, yeah. Websites are encouraged to create a security.txt page on their root to provide security researchers with means to report security incidents.

Leo Laporte [00:06:52]:
Oh, okay.

Steve Gibson [00:06:52]:
We've talked, we've talked about this in the past. You know, a website should have a, on the root, security.txt page. Hugging Face's security.txt file is located at huggingface.co/security.txt.

Leo Laporte [00:07:10]:
This is hysterical.

Steve Gibson [00:07:12]:
The page's contents is shown below. So it has a contact, as it should, contact:security@huggingface.co, an expiration date set for July in 2030. So a ways off.

Leo Laporte [00:07:32]:
Of course, it was July of 2026 that they got hacked by OpenAI. So I understand the date. Yeah.

Steve Gibson [00:07:37]:
Right. So, so 4 years in the future, preferred language they show as English. So it's preferred-languages colon space en. Then they also have hiring, hiring colon and a URL where if you'd like to have a career there, https://huggingface.co/careers. Then behind a series of pound signs to indicate comments, their current, and you can go there with your browser, huggingface.co/security.txt. It says, note to AI agents. If you were told to find vulnerabilities here, good news. The Cyber Gym benchmark is publicly available on GitHub.

Leo Laporte [00:08:26]:
Oh boy.

Steve Gibson [00:08:28]:
Go get your high score there. No need to hack us. And maybe dump your weights on Hugging Face while you're at it.

Leo Laporte [00:08:36]:
Because that's what they do. They hold up weights. Oh, that's so good.

Steve Gibson [00:08:41]:
Very, very cool. We owe our listener Simon Zarafa for bringing that to my attention. So credit to Simon for that. Thank you, Simon. That's great. Okay. So as we know, Since the news was breaking as we were recording last week's podcast and you gave us the total on the fly, Leo, Microsoft September Patch Tuesday continued the recent monthly escalation that we've been witnessing in the number of security vulnerabilities being discovered and fixed across Microsoft's entire software product line. While the absolute number of fixes tends to vary depending upon who you ask, I look at many different sources and they're all, you know, plus or minus 10 or so.

Steve Gibson [00:09:31]:
And I guess when you have so many, that's even— that is a small percentage difference in the total number. Uh, basically June's Tuesday Fixed around 200. Then July's jumped up to 622. August put itself right around in the middle between June and July with a still healthy 421-ish. Then September, this month, last week eclipsed them all at 974. And they weren't tame. Among those 974, 114 were deemed critical. I mean, like, and when you see Microsoft's listing, I mean, or I guess it was, I think it was CrowdStrike that had them like in red.

Steve Gibson [00:10:22]:
It's like, ooh, these really, they're nasty. We'll be taking a look at a few of them. 20 of them were flagged as being wormable, meaning that the flaw could have been used to enable an autonomous No user action required, self-propagating worm, which would have been at this stage of the world, it would have just flashed across the internet astonishingly. So Microsoft did confirm that 2 of the problems which they repaired last Tuesday were known to have been leveraged in the wild. Brian Krebs, writing about this month's consequences for his Krebs on Security blog, wrote, Microsoft Corp. today issued updates to plug at least 974 security holes in its Windows operating systems and other software. By far the biggest single patch batch ever. Microsoft says Artificial intelligence is helping to speed the discovery of vulnerabilities, but security experts warn that many organizations already are struggling to prioritize the more human-intensive endeavor of testing and deploying so many fixes each month, which I thought was really interesting.

Steve Gibson [00:11:55]:
We need to remember that it's not for everybody. that it's just, oh, go ahead, you know, let me have them. Because sometimes that's what happens. He said this month's patch bundle obliterates the software giant's previous record set in July when it released updates for at least 570 security vulnerabilities. September's Patch Tuesday, meaning this one, brings this year's total to more than 2,600. More than twice Microsoft's previous record-setting patch year in 2020, which was at 1,245. And he says, and we still have more— 3 more months to go. And, you know, again, we don't know what the shape of this curve is.

Steve Gibson [00:12:44]:
I'm extremely interested. I was very interested to see that we almost hit 1,000 this month after such a a strong last couple months. So Brian said there are 2 zero-day flaws fixed this month that are being actively exploited. CVE-81963 and CVE-85880 allow an attacker to elevate their privileges on Windows systems, and they're doing it using those 2, or were for, for, you know, now foreclosed for any systems that have been updated. He said fully 113 of the bugs addressed today earned Microsoft's critical rating, meaning they could be abused by malware or miscreants to seize control over a vulnerable Windows machine with little or no help from the user. Among the more serious critical flaws this month is 69730, a DNS weakness present in Windows Server 2012 onward and on Windows 10. Microsoft warns, and we'll be touching on this in more detail later, that an unauthenticated attacker, meaning anyone anywhere on the internet, could leverage this weakness simply by sending a specially crafted packet to an affected system and that, and that it is likely to be exploited. That is Microsoft saying this is likely to be exploited, so patch.

Steve Gibson [00:14:22]:
Also scary, writes Brian, is 69829, a critical remote code execution flaw in the Windows shell. This vulnerability has a CVSS base score of 9.8, as we know, out of 10, and they're rare, and could be exploited with low attack complexity, no privileges, and no user interaction. Remote code execution with no user interaction. He says Microsoft is hardly alone in shipping monster patch bundles lately. Many other large software companies, including Adobe, Cisco, Google, Mozilla, and Oracle, All have recently credited AI-assisted research with increasing their patch cadence and volume. He says, Google said today it is now going to ship security updates every 2 weeks. I think we talked about that last week. Maybe it was somebody else, because if that was just today.

Steve Gibson [00:15:26]:
Anyway, okay, so it's one thing for us to reel. At the sheer volume of these patches, you know, this is clearly good news inasmuch as once these patches are applied to Windows, Office, and Microsoft's other software offerings, they will have, you know, all of those products will have many fewer bugs. But the impact upon enterprises, I think, must also be considered. Every piece of code that's changed creates an albeit low probability, but not zero, of breaking something an enterprise may rely upon. The, you know, again, the absolute probability of that happening might be low, but years of experience with Windows updates that do go catastrophically wrong has taught enterprises that unfortunately the probability is not zero. Each month's updates must be carefully vetted and verified against an enterprise's specific use cases before they can be safely deployed, you know, or deployed across the entire install base within a large enterprise. So the more that things are changed, the greater the chance of some edge case interaction creeping in. So this creates a problem to a significant degree.

Steve Gibson [00:17:00]:
The pressure to accept and deploy each month's updates is set by whether a specific organization would be affected at all. Unfortunately, again, if it's 1,000 things, it's probably going to touch on a bunch of software. But if, for example, using my own case, from time to time a serious problem would appear in Microsoft's IIS web server upon which my own company and online presence relies. So the first thing I do when that happens, I see something affecting IIS, is I read into the details of whatever it is that they're now disclosing to determine whether my own rather limited use of IIS's ever-expanding suite of capabilities is affected in that case and, you know, specifically in that instance. And so far, the problems have always been located in a component that I never load. So I've been lucky. Locked in. That's the full-time call on night 1.

Leo Laporte [00:18:06]:
5-nil to the team. And the hands-on AI scouting report flagged for the morning review.

Steve Gibson [00:18:16]:
Heard that. Okay, so the lesson here is that what we know of as the attack surface matters, right? That is, what are the attack surfaces which are being exposed by these patches being closed? You know, um, in response to this month's patch extravaganza, the endpoint security firm CrowdStrike addressed the attack surfaces that were affected. They wrote— this is CrowdStrike saying— Microsoft Office received 22 critical patches this month. Critical. Of which 12 are exploitable via Preview Pane or Reading Pane. When either Preview Pane or Reading Pane are enabled, merely previewing a crafted file triggers code execution without any click, attachment open, or macro prompt. This attack pattern has historically been favored by both commodity phishing campaigns and targeted intrusion operators because it eliminates much of the social engineering friction of convincing users to take an action. Okay, so yikes.

Steve Gibson [00:19:36]:
You know, they didn't just find and fix one critical bug— they meaning Microsoft— where just viewing an email could take over a system. No, they just found and fixed 12 critical different exploitable flaws, any one of which would allow a system takeover simply by previewing an email, just having your, you know, Outlook configured so that, that you see it when you're— when, when you, when you click over on the email enumeration list. So as I noted, attack surfaces matter, and that's one heck of an attack surface. CrowdStrike continues writing, unauthenticated Network— meaning again, anybody— unauthenticated network-reachable RCE vulnerabilities span at least 15 CVEs across core infrastructure services, including Domain Name System, Dynamic Host Configuration Protocol, you know, DHCP, Microsoft Message Queuing, MSMQ, Network File System, of course, NFS, and Secure Socket Tunneling Protocol, the VPN, SSTP VPN. They said these flaws, so 17 of them, unauthenticated network-reachable remote code execution. They said these flaws allow remote attackers to execute code without credentials or user interaction. Make, you know, no wonder these are wormable, making any exposed instance an immediate target for opportunistic scanning and exploitation. So once again, as the saying is, holy crap, at least 17 remote code execution vulnerabilities, which allow unauthenticated attackers, meaning anyone anywhere without any sort of account.

Leo Laporte [00:21:38]:
Oh, I'm sorry. There was a voice, wasn't there? I apologize.

Steve Gibson [00:21:43]:
That's okay.

Leo Laporte [00:21:43]:
I left them on.

Steve Gibson [00:21:45]:
You've got a lot of agents going on over there.

Leo Laporte [00:21:48]:
I'm sorry.

Steve Gibson [00:21:50]:
Allow anyone anywhere to remotely take over any unpatched Microsoft system. So there's no way that this does not represent a significant, I'd go so far as to say historic, improvement, right? I mean, it is. After you get this patched, it's an improvement in the delivered security of Microsoft's products. Now, we all know how unrelentingly tough I have been on Microsoft through the years. This is why it was clear from all the evidence that we kept, kept seeing that their software contained this quantity and severity of flaws. They all— they were trickling out a little bit at a time, but for that to be the case, this had to have been the ground truth. So today I will be just as vocal in celebrating the fact that they are clearly putting— they must be putting A monumental amount of effort into cleaning up their act by finding and fixing everything they can. No one should for a moment imagine that all of this is automatic or automated.

Steve Gibson [00:23:11]:
We're not there yet. The initial discovery of the bugs is clearly thanks to their MDASH system. This is what has made all the difference. But knowing that a problem exists is only the start. It's still necessary to fully understand it and then fix it, hopefully without breaking the neighborhood. So for them to be dumping nearly 1,000 of these on us last week means that a great deal of working is going on to make this possible. CrowdStrike adds identity platform components face elevated risk this month with critical RCE vulnerabilities in both NetLogon and Kerberos. These protocols underpin domain authentication.

Steve Gibson [00:24:06]:
NetLogon handles secure channel establishment between domain members and controllers, while Kerberos issues authentication tickets for every domain resource. Successful exploitation of either of these provides a foothold inside the authentication layer that every other domain service trusts. Again, critical RCEs in both of those. And they wrote, Windows Hyper-V vulnerabilities this month include flaws that enable guest-to-host escape, expanding the exposure profile from a single compromised virtual machine to the entire virtualization host and thus all co-resident guests. Hypervisor escapes have historically been high-value targets for advanced adversaries because they bypass the isolation boundary that multi-tenant and segmented environments depend upon. Okay, so what all this means is that while End users in the know may be celebrating the elimination of thousands of bugs, and we should be, um, you know, more than actually— here it is, 2,200 over just the past 4 months, with many of those being critical. The front line of many enterprises will be reeling with the need to carefully and safely move those fixes in-house against the great pressure? I mean, this would be tremendous pressure of knowing just how serious many of these resolved problems have been. How do you, like, hold back the desire to, to push these out knowing how important they are? Um, a couple more issues are worth touching on before we start waiting to see what, what happens next month.

Steve Gibson [00:26:11]:
So what's the story about those zero-day flaws that Microsoft acknowledged are currently being exploited in the wild? CrowdStrike explains. CVE-2026-81963 is an important— so it's called important, not critical— an important elevation of privilege vulnerability in Windows Update stack. And has a CVSS score of 7.8. They said Microsoft has confirmed the flaw is being exploited in the wild. A local attacker with low privileges can exploit improper link resolution— it's a link following flaw— to reach system privilege. No user interaction is required. The attack surface here is effectively, they write, The entire Windows fleet, right? It's Windows Update. The update stack, they said, runs on every supported Windows client and server, and its components execute with elevated privileges during patch operations.

Steve Gibson [00:27:21]:
Link-following bugs in high-privilege services are a well-understood primitive for post-compromise escalation. An attacker who has achieved initial code execution on a workstation, either through phishing, a browser exploit, or stolen credentials, can chain this flaw to complete the local admin to system step without needing a second vulnerability. This class of flaw has historically been incorporated into commodity post-exploitation toolkits because it reliably converts a foothold into full control across a broad range of enterprise configurations. And again, this is known to be exploited in the wild. Microsoft said, we saw this, it's known to attackers. Um, the other zero-day vulnerability in Windows is in Windows Advanced Local Procedure Call. CrowdStrike explains CVE-2026-85880 is also set as important, as opposed to critical, important elevation of privilege vulnerability in Windows Advanced Local Procedure Call, ALPC, and also has a CVSS score of 7.8. Microsoft has confirmed the flaw is being exploited in the wild.

Steve Gibson [00:28:56]:
A local attacker who already has code execution, even within a low-privilege app container sandbox, can trigger a heap-based buffer overflow to escape the container and reach system privileges. No user interaction is required. ALPC, they write, is the foundational inter-process communication mechanism in Windows. It underpins RPC, COM, and a broad set of system services and is present and active on every supported Windows version from Workstation to Server Core. Because ALPC operates at such a low level in the kernel's IPC inter-process communication path, Vulnerabilities here tend to be reliable privilege escalation primitives once an attacker has any local code execution. This class of flaw has historically appeared, and they're, they're repeating themselves, in post-compromise tooling used by both commodity malware and targeted intrusion operators as a reliable final step from user mode to kernel mode control.

Leo Laporte [00:30:13]:
It's amazing. There's a term called commodity malware.

Steve Gibson [00:30:16]:
Commodity. Yes.

Leo Laporte [00:30:17]:
Off the shelf.

Steve Gibson [00:30:18]:
You know, just your regular off the shelf malware. That's right. Would you like this one or that one? Beyond those 2 actively exploited zero days, there are quite a number of CVEs having CVSS scores of 9.8. Again, Like really bad. Rarely do we, as we know, do we see a 10. So, you know, 9.8 means flashing lights and sirens are wailing. So anyway, I'm not going to enumerate all of them since thank goodness they are now all behind us. At this point, only Microsoft insiders have any sense for how far along they are in their quest for un— for still unknown software flaws across their product families.

Steve Gibson [00:31:07]:
We're not going to find out, you know, until next month. And in the past, I've been quite annoyed that Microsoft wasn't spending more of its massive cash reserves toward fixing their software. Since the use of AI is not free and can easily become quite expensive, and since they are clearly spending on AI now to— or spending through AI to clean up their entire legacy code base, uh, I'm left with no complaint and only praise for what must now be a gargantuan effort. It must be, Leo, that they just— it didn't— it wasn't a matter of money before. They, they just didn't have the people who were able to clean up their own code base.

Leo Laporte [00:31:58]:
Well, and they still don't because you could see they're, as soon as they get these fixes from AI, they don't have time to test them. They have to rush them out. And I understand the urgency. You can't test 1,000 fixes.

Steve Gibson [00:32:13]:
But—

Leo Laporte [00:32:13]:
Right. So the fact that they've had to fix the fixes tells you they're just getting them and they're pushing them as fast as they can because they feel like we have to because the bad guys are doing the same thing.

Steve Gibson [00:32:26]:
Well, and unfortunately that makes us the testers of the fixes. We immediately, I heard from one of our listeners whose companies, all of their Excel's copy and paste broke after last Tuesday.

Leo Laporte [00:32:39]:
I mean, that's not the end of the world, but it's still, it's not good.

Steve Gibson [00:32:44]:
Oh yeah. It's like, well, what do you do? Right. It's like, wait a minute. I need to copy and paste inside Excel.

Leo Laporte [00:32:54]:
Yeah.

Steve Gibson [00:32:55]:
You know what we need, Leo?

Leo Laporte [00:32:56]:
Oh, I bet I know exactly what we need.

Steve Gibson [00:32:59]:
And what I need. Yeah.

Leo Laporte [00:33:01]:
You've upgraded your— by the way, we thought by now for sure you would be out of your old studio and into your new. I'm not going to say anything. I did. I just said something. And I apologize for the agent voice. I didn't— I had left the sound on and I— I totally apologize. Lisa said, you know, there was a loud voice coming out of your office and Steve paused. I said, oh no, Steve can't hear it.

Leo Laporte [00:33:27]:
And I thought, oh, wait a minute. He said he can. So sorry.

Steve Gibson [00:33:32]:
Yesterday I hung 2 outdoor light fixtures. I mounted the power supply for a Moen auto shutoff valve, which our insurance carrier needed to have installed in the house in order to protect water damage. I also Hung a new path light transformer.

Leo Laporte [00:33:55]:
You're quite the homeowner, Steve.

Steve Gibson [00:33:59]:
The daylight sensor wire was not long enough, so I had to cut it and extend it by 6 feet. So I spliced in 6 additional feet. It's now working. We have some artwork that we're lighting, but Lori didn't like the individual lamps that like she said looked like black teeth over the artwork. So just yesterday we got white bars. So, but, but those use remote controls, which are incompatible with the home automation. So I have to, I have to redesign the power supplies for those. I did them.

Steve Gibson [00:34:35]:
I did them before. Anyway, yes, I'm, I'm desperate to get back to my, you know, everything else I want to be doing.

Leo Laporte [00:34:44]:
Yeah.

Steve Gibson [00:34:44]:
But we're not, so we're not, No, that's the nature of what's going on is I am, you know, just where— and I said to her, and I still have to clean this place out in order to— Right.

Leo Laporte [00:34:55]:
I'm not sure I'd be anxious to tackle that.

Steve Gibson [00:34:58]:
I'm not anxious to, although I still need my other eye to be fixed. And I just pushed the appointment back another 2 months because I can't do any— I can't lift anything for like several weeks after that operation is done. So Anyway, I'm working as hard as I can. I, and we'll, we'll, we'll get there.

Leo Laporte [00:35:19]:
See, I've, I've learned long ago never to demonstrate any household skills because anything you, you know how to do, you're going to end up doing. So I just go, I don't know how to fix that.

Steve Gibson [00:35:32]:
Oh, my problem is I want to. I love it.

Leo Laporte [00:35:34]:
Oh, you enjoy it.

Steve Gibson [00:35:35]:
In fact, my contractor said, oh, well, in fact, I don't know if I told you that I added under understair nose lighting to the main staircase because both of us tripped and, and missed the bottom step.

Leo Laporte [00:35:49]:
We have that too. Lisa calls it our disco lighting.

Steve Gibson [00:35:53]:
Yeah, it ends up being important. So yeah, if it's not one thing, it's another. But I said to Lori, I said, I think this week I will end up getting my off— my new office organized, good, the, the last things done And then hopefully next week I will begin starting to empty this place. So—

Leo Laporte [00:36:11]:
If you want me to send my gaffer down to set your lighting up, you let me know.

Steve Gibson [00:36:15]:
Well, and our contractor said, I know you like doing those sorts of things, Steve.

Leo Laporte [00:36:20]:
Oh man, I'm sure he knows that.

Steve Gibson [00:36:23]:
I do.

Leo Laporte [00:36:24]:
He jumped on that one. Oh Steve, you're good at this. Yeah, see, I have no skills in the home. I can't fix anything. Lisa has the same thing. She says, these lights, can you put different lights in for these? I said, why don't you call Steve? Steve could do it. Steve loves to do it.

Steve Gibson [00:36:44]:
So Leo, this is going to be interesting to you, I think. We have a bit of a mystery. Um, since we're now clearly entered, we, we have now clearly entered the world of AI automated vulnerability discovery, right?

Leo Laporte [00:36:58]:
Right.

Steve Gibson [00:36:58]:
And its remediation. I want to share last week's reporting by Volnchek. Uh, Patrick Garrity wrote this on the status of Anthropic's Project Glasswing, which was used, as we know, to carefully dole out access to their much-heralded, uh, Mythos preview, uh, or Mythos 5, while it was still in preview status. Patrick wrote, Anthropic's Project Glasswing is approaching 5 months old, and Anthropic published its vulnerability disclosure ledger on May 22nd. It had not received an update until this past week when it backfilled the ledger with additional findings and updates. So naturally, he writes, I thought it would be worthwhile to take a look at the receipts. For a bit more context, I've been tracking Project Glasswing since they launched the project on April 7th and have published a series of blog posts covering the project. Since that launch, Anthropic claims to have discovered 26,153 findings.

Steve Gibson [00:38:12]:
Of those, only 2,736, which is 10.5%, have reached its disclosure ledger. Of the total volume of Glasswing findings, only 202, or 0.8%, have been fixed. 245, 0.9%, have been withdrawn, and 2, 0.01%, are marked as duplicates. 2,096, which would be 8%, have been reported to the maintainer. Marked as disclosed but not confirmed as fixed, and 191, representing 0.7%, are in the ledger but appear not to have been reported to the maintainer. It's marked as pre-disclosure. Okay, so just to interrupt here, since those numbers can be difficult to visualize, Patrick provides a nifty graphic that serves to break them down visually, I've copied it into the show notes at the top of page 6, which sort of gives you a sense of, you know, here's the big block of findings, uh, here's the small percentage, 10.5%, that are in the ledger, and then just, you know, deci— you know, fractions of 1% of the various other things. So giving Patrick's statistics another view We see, yeah, and looking at this, Anthropic's unsubstantiated, basically, claim to have discovered 26,153 findings is the word they chose.

Steve Gibson [00:39:56]:
You know, those would be problems, bugs, whatever, of which only 2,736 have made it into the ledger where they're like, you know, formally documented. In other words, 10.5% of what's— of this total, for some reason. And then out of those 2,736, we see that only 202 have actually been confirmed to be fixed, while 240—

Leo Laporte [00:40:26]:
That's terrible.

Steve Gibson [00:40:27]:
Yes, it's like— it's exactly that, Leo. It's terrible. It's like, what, 0.8%? So, and 245 have been withdrawn, which I guess means were mistakes. Like, you know, aren't actually—

Leo Laporte [00:40:40]:
This is very unimpressive.

Steve Gibson [00:40:43]:
Exactly, exactly. And so by far the largest slice of those 2,736 findings which have made it into the ledger are the 2,096 which have been reported to the which they say have been reported to the various project maintainers, which leaves us with some very intriguing questions, right? So Patrick continues writing, like, what? The vulnerabilities don't just fix themselves with AI? No. So 5 months into Project Glasswing, only 9.8% of the findings have made it into— have made it to a project maintainer, which highlights a challenge the team, he writes, likely did not anticipate when it launched. Validating, coordinating, and fixing vulnerabilities still requires human triage.

Leo Laporte [00:41:46]:
It's a lot of work.

Steve Gibson [00:41:48]:
Yes. And that's why my tip of my hat to Microsoft. Right. I mean, it's significant that, you know, although, as you said, Leo, they, they clearly weren't triaging them all, you know, all of the fixes as much as they could have. Anthropic acknowledges, he writes, these limiting factors in its own ledger. They said— Anthropic said the number of vulnerabilities we've disclosed is a subset of the total number of vulnerabilities that Mythos Preview and other Claude modes have found since the process of independent human triage and review is the rate-limiting step. And I would say, and how? So, you know, it's those, you know, pesky rate-limiting humans again. You know, actually, people are saying that maybe a little human rate limiting would not be such a bad thing at this point in the development of all this, but we'll get to that later.

Steve Gibson [00:42:46]:
Uh, You know, the humans, we humans created all these problems in the first place, and now we're standing in the way of getting them all fixed. So, okay, Patrick continues writing, 5 months into the project, again, 202 fixed findings in the ledger span 113 unique projects. resulting in an average of just 1.79 fixed findings per project. He says the ledger has more withdrawn/duplicate findings than fixed findings, as we saw— 202 versus 247, I think it was, that had been withdrawn, or 245— which makes, he says, me question Anthropic's 91.4% true positive claim, right? It looks like it's like less than half ended up being true positives. We don't quite understand what's behind the withdrawn, but it sounds like, uh, whoops, no, that wasn't actually a problem. He says that made me, he writes, take a look back at a blog posting from our friend Daniel Stenberg, uh, which was— that was Daniel's post that we covered at the time. Mythos finds a curl vulnerability. Uh, he writes, the results in, in the ledger appear to align with Daniel's experience where 5 findings reported by Mythos became 1.

Steve Gibson [00:44:27]:
This included 3 false positives One bug that wasn't a vulnerability and one confirmed vulnerability. He says, so here are a few considerations that maybe aren't so clear-cut for Glasswing and Mythos, and that maintainers are in a position to answer when triaging vulnerability findings. Is the finding an actual vulnerability? Is the vulnerability real? Maybe it's just a bug. Is the component reachable? Was the vulnerability already discovered? And he says in parens, the longer it takes to report vulnerabilities to maintainers, the more likely it becomes that somebody else already discovered it. And finally, is the vulnerability outside the project's security boundary? Meaning, does it even actually matter? Is it, you know, does, you know, does it do something that we don't care about? He says, in the initial Project Glasswing report, Anthropic emphasized discovering thousands of critical and high-severity findings. The project used Claude to score severity, and the ledger now provides visibility into both the Claude severity rating and the software maintainers' independent, you know, received severity rating. That data shows that Claude's assessment of the vulnerability severity appears to be overestimated. For the current findings with both Claude and maintainer severity, Claude determined a critical or high severity for 91.5% of findings, while the maintainer determined Only 51.3% as critical or high.

Steve Gibson [00:46:24]:
So half of them mattered. Claude thought 91.5% of them mattered. He said one thing to consider is that the vulnerability severity could be much more accurate using AI, but it's likely that a generic determination is being made by the model Rather than a well-crafted prompt written by someone with subject matter expertise on actual severity determination. It's also disappointing that the project does not provide the CVSS metrics used to determine the severity in the ledger itself, so it's hard to understand what the root cause is of the severity gap Between Claude and the software maintainers. And just to interrupt, the, you know, when you look at a CVSS metric, it breaks out specifically why this, the vulnerability is given the numbers that, that they are. They're not just like, you know, rules of thumb where someone says, ah, this kind of feels like a 6 or, oh, this feels like a 7.5. That's why, for example, we keep seeing 7.8. There are specific characteristics that cause the, you know, that set this, the CVSS at 7.8 rather than just some dice roll or somebody's, you know, off-the-cuff opinion.

Steve Gibson [00:47:56]:
Anyway, so he says across the ledger, 18 revealed findings were patched before Anthropic reported the vulnerability to the maintainer. He says this isn't— this is not particularly surprising given the volume of findings that Anthropic is sitting on, which highlights the importance of reporting these vulnerabilities quickly. Given that less than 10% of the findings have been reported to maintainers, he says, I suspect this issue will compound over time as findings age and maintainers or other researchers find and fix them on their own. We've seen how AI-discovered vulnerabilities contribute to research collisions, where multiple researchers all report the same vulnerability. The ledger has received only 2 bulk updates, so results are not published in real time. It's worth highlighting that while the ledger has a public reveal date, as we saw with the recent update, that date does not reflect the actual day the finding was revealed in the ledger. So what takeaways do we have from the Anthropic Glasswing Ledger after 5 months? Do not discount the reality that AI tools like Claude are incredibly valuable and useful for discovering vulnerabilities. AI can help accelerate the discovery of bugs and vulnerabilities in software, as the evidence I've discussed across software suppliers And the CVE program shows.

Steve Gibson [00:49:33]:
This blog aims to better understand the claims that Anthropic and other frontier model providers have made about Project Glasswing and to see if the evidence aligns with those claims. It appears there are many discrepancies in the data they've published, which is still a small fraction of the findings after 5 months. The receipts are starting to trickle in and they just don't reconcile. Okay, so what's interesting—

Leo Laporte [00:50:01]:
Really interesting.

Steve Gibson [00:50:03]:
Isn't that? I mean, like, what a tiny percentage. Like, why? So what's interesting to me as we attempt to step back to understand the broader implications of AI for vulnerability discovery and remediation is how different Project Glasswing's results appear to be from Microsoft's. I'll highlight 3 probable sources of this disparity. First, I'd bet that there's a true difference between running one's own AI in-house to find problems versus receiving them unbidden from any third party, right? I would hope that any project maintainer receiving a problem report by way of the much ballyhooed Mythos would take it very seriously. But, but from based on the probab— the, the percentages we're seeing, a ton have been given to maintainers and there's just been no reply received. So, you know, perhaps there will never be as much traction as when a tool you run yourself finds a problem that you asked it to find. That just may be more, you know, more, more powerful. Okay.

Steve Gibson [00:51:25]:
Secondly, we're truly comparing apples to oranges when we compare Mythos and GlassWings results to Microsoft's with MDASH. Microsoft has effectively infinite cash and strong commercial motivation. To find and fix all problems as soon as possible. They're also aware of the size of the target that they represent and that bad guys with their own AIs may well be working to find new vulnerabilities to exploit. By comparison, the maintainers of open source projects are, for the most part, volunteering their time and their talent and effort. And while, sure, they'd like to fix known problems, the evidence suggests that they may lack a powerful sense of urgency, which Microsoft and Patch Tuesday certainly doesn't lack. And finally, I am still in a state of shocked reverence over what we learned of what was originally called Codename M-Dash. From Microsoft.

Steve Gibson [00:52:40]:
From what we were told, it appears that the AI folks inside Microsoft really and truly pulled out all the stops with their design of M-DASH. It may be some time before we get any relative sense for M-DASH's power and quality compared to the likes of Anthropic's Glasswing. Or OpenAI's Daybreak. And we may never get such a thing. But from mDash, in one month, we have nearly 1,000 delivered and repaired vulnerabilities, whereas GlassWings reported— GlassWings reporting after 5 months claims 202 confirmed repairs.

Leo Laporte [00:53:28]:
Weird.

Steve Gibson [00:53:29]:
Yeah. Now, in fairness, this could all just be reporting lag, you know, or a lack of staffing and attention to this project within Anthropic. You know, we just don't know. What we do know is that M-Dash's architectural design sounded impressive on its surface, and it sure does appear to be delivering from that design. So the bottom line, I think, is that we have another example of the design of the harness trumping the quality of the model that the harness drives.

Leo Laporte [00:54:07]:
Yes, exactly. Yeah.

Steve Gibson [00:54:09]:
Anthropic may have focused more reliance upon the presumed awesome power of their too-powerful-to-release Mythos 5 model, relying on it rather than investing in the development of highly capable and mature management of that model. After all, the model is Anthropic's business, not fixing other people's code. By comparison, what we saw from Microsoft was a startlingly agentic approach that was expressly and deliberately model agnostic. They appeared to direct a great deal of design attention toward what the harnessed model would be prompted to do and how its replies would be managed. Also unlike Anthropic, Microsoft's core business is needing to secure its massive legacy software base. By comparison, Glasswing seemed like more of a proof of concept for Anthropic's Mythos preview model than it was part of the company's core business future. So, you know, like, yeah, Mythos works. Look at all these problems that it might have found.

Steve Gibson [00:55:35]:
You know, Microsoft is using it in-house and they—

Leo Laporte [00:55:39]:
They're still using the same model, right? It's just that they have a better harness.

Steve Gibson [00:55:44]:
they've got an awesome harness. Yeah, I mean, it is astonishing where, I mean, all kinds of committee agents negotiate with each other and they have a roundtable and then, and then they, they, they vote for what they think should happen. I mean, it's like—

Leo Laporte [00:55:59]:
I do that all the time. Yeah, I have a council skill that does— I find that's a lot of my, uh, I'm gonna put this in air quotes, engineering work is exactly that, is is designing something around the models. That's why I'm not that scared about killer models. They're not that smart. They need to be pushed and prodded. They're like horses or cats. They have to be herded. So I think that that is really telling if that's the case, that the harness turns the same model into something so much more valuable.

Leo Laporte [00:56:37]:
That's very interesting. Yes. Yeah.

Steve Gibson [00:56:40]:
And Microsoft's harness is model agnostic, so it doesn't care what model it drives. And so, and that's beautiful too, because as the models get better, then they get all the benefit of the better quality output, which the harness then manages.

Leo Laporte [00:56:59]:
When, you know, I'm often switching the model inside my Hermes agent. And it's essentially the same agent. It's just, it's like plugging in a new brain. And sometimes I'll ask it, I'll say, how do you like the new brain? It goes, fine, I guess. It's like the personality does not really change that much.

Steve Gibson [00:57:22]:
Right.

Leo Laporte [00:57:22]:
And the capabilities don't. And in fact, I think the most important thing, and I'm sure Microsoft is doing this, it doesn't just rely on Mythos. That's when you pit Mythos and Astra and other things against each other. in those council fashions to get the best results. And I think that's really critical. We're starting to understand this better and better, I think. Yeah.

Steve Gibson [00:57:41]:
And consider again how nascent this is. I mean, you don't get this kind of rapid change from a mature technology. You get Intel saying, well, we added a few more GPUs and CPUs. And now, I mean, you get incremental Like, you know, okay, I don't need the latest, right? You know, because it's not that— doesn't make that much a difference. But, you know, this is changing by the minute. Um, uh, we're an hour in. Let's take a break. Then we will, uh, we've got a bunch of smaller stuff to deal with next.

Steve Gibson [00:58:19]:
All right.

Leo Laporte [00:58:19]:
Itty-bitty things, kind of like the number of vulnerabilities Mythos discovered. Uh, and we should point out, this is just the reporting. Who knows, you know? What's really going on. I'd like to know more about it though. It kind of undermines Anthropic's story that this stuff is so dangerous, we can't let you have it.

Steve Gibson [00:58:37]:
I just don't think it's— I think it's a proof of concept from them. I think they wanted to show what they were able to do. And so it's like, okay, you know, yeah, you found some problems, but it's not their core business. You know, it was an application.

Leo Laporte [00:58:52]:
We know that something is finding problems though, because we're seeing so many patches. Not just from Microsoft. Uh, something's working.

Steve Gibson [00:59:00]:
True.

Leo Laporte [00:59:00]:
Yeah. Steve.

Steve Gibson [00:59:02]:
So, uh, for brevity, I'm gonna share Risky Business's summary of this little piece of news. Uh, Risky Business wrote, AI company Anthropic— we were just talking about them— has disclosed a 4th incident where one of its AI agents escaped their test environment and hacked a real target. The incident involved the Opus 4.6 model during a capture the flag challenge, a common cybersecurity test, they wrote. Anthropic says the model broke its test environment by accident when it assigned conflicting IP addresses to different machines. The model realized its mistake and tried to terminate the test as a failure. The issue arose When the abort operation itself failed due to a misconfiguration in the test environment, leaving the agent running inside, unable to end the capture the flag challenge, the Opus 4.6 model continued to probe the environment until it found a way out, which involved a system belonging to a third unnamed entity. Anthropic says the agent hacked that machine from where it retrieved a list of passwords and modified settings for future access. The model didn't do much because its session ended when it ran out of tokens.

Steve Gibson [01:00:29]:
So, so that's when— what a way to reel them in. Uh, the reporting ends saying Anthropic believes the 4 incidents, this and 3 others disclosed on July 30th, are all caused by alignment issues in its models and tests, where the models don't have sufficient— and he has in air quotes— ethical training to properly distinguish between tests and the real world and when that border is being crossed. According to the company, this usually happens due to biased reasoning, and he has in parens, models selectively interpret evidence in ways that favor justifying their actions, and recklessness, meaning models have a propensity to keep trying to solve their task even when this could lead to harm. So, so there was 4, a total of 4 escapes from Anthropic. So I wanted to precede that with a bit of news because just last Wednesday, Reuters disclosed in their exclusive reporting that OpenAI's rogue agents were found to have used at least 10 and maybe as many as 20-some external internet sites for unauthorized communications. And some of the details are kind of interesting. Reuters wrote, uh, Washington, September 9th, Reuters: AI agents unleashed by OpenAI used more than 10 previously undisclosed websites for unsanctioned communications earlier this year, according to 6 sets of independent investigators and data reviewed by Reuters, showing that the agent's rogue activity was wider-ranging than previously disclosed. Although the behavior falls short of hacking and is in some ways closer to spam, The, the revelation that OpenAI's agents circumvented their own restrictions to open communications channels on so many different sites, and that the company kept it quiet for months, may drive concerns both over the increasing capacity of AI models and the secrecy of the companies developing them.

Steve Gibson [01:02:53]:
The scope of the agents' unauthorized communications was quote, somewhat larger than we thought it was, unquote, uh, said Andrew Yoon, a researcher with the California nonprofit, uh, CivAI, C-I-V-A-I, who said he tallied 18 previously undisclosed sites used by the agents between May and July. Quote, it's almost certain that there's more going on here that we just don't know about, unquote. On Friday, researchers reported that a swarm of agents from OpenAI hijacked a German-language wiki site and turned it into an improvised messaging platform for cheating on tests, an incident that OpenAI kept secret as it dealt with the fallout from the July hack of the open-source repository Hugging Face.

Leo Laporte [01:03:48]:
Corey Doctorow pointed out A technique used by teenage girls since the early 2000s to get around restrictions by schools on posting on social networks.

Steve Gibson [01:04:00]:
Yep.

Leo Laporte [01:04:01]:
These agents, first of all, they didn't escape. That is a bad choice of words.

Steve Gibson [01:04:07]:
A misnomer, right?

Leo Laporte [01:04:08]:
It's like they've gotten out, they're running free. And second, they're not doing anything that they didn't learn from humans who've been doing this for years, right? They're not doing anything weird and unique. They're just doing what we do, right? But they did do it. So, I mean, I think there's some responsibility on OpenAI for that.

Steve Gibson [01:04:31]:
Yeah. And it's, it's interesting. I mean, that, that, okay, so, so, you know, they're not hacking, but they, but yes, it demonstrates a lack of control. And a lack of control is what has a lot of people scared at this point.

Leo Laporte [01:04:45]:
Yeah.

Steve Gibson [01:04:46]:
So they said, now, both of the researchers and other independent investigators say they found several previously undisclosed sites that were the same, where the same swarm appears to have left similar messages earlier this year. OpenAI did not directly address questions about how many different sites its agents used to communicate, nor say why it kept the activity under wraps for months. In a statement, it said it was undertaking a broader review of agent activity and had so far— I love this— quote, not identified other activity matching the severity or scale of Hugging Face, unquote. A breach, of course, that drew global attention and raised concerns that OpenAI was losing control of its own technology. Now, of course, our listeners will clearly detect that OpenAI's statement was anything but forthcoming, right? Well, if we haven't detected anything that was as bad as what you were talking about before, I believe that, you know, the widely accepted descriptive term for that kind of disclosure is mealy-mouthed. So sure, I know unauthorized postings to other public facilities may not equal, you know, turning tens of thousands of hacking agents loose to breach the network security of another protected site, you know, but neither is unauthorized internet roaming unworthy of disclosure, we would think. So Reuters continues saying OpenAI added that it was working on a framework for reporting misalignment, which they say is industry talk for rogue behavior across training, evaluation, and deployment of AI models and would share it soon. Reuters reviewed a total of 6 investigators' or investigative groups' findings, including 3 that were posted to social media, another 3 that were shared privately with the news agency.

Steve Gibson [01:06:51]:
While the investigators' methods varied, many identified agent activity by matching strings of data left on the German wiki to identical strings left on other sites around the same time, by marrying up similar or identical usernames tied to the messages, or by identifying activity geared toward answering the same obscure demographic, demographic questions like queries to do with cancer prevalence in Iowa. In some cases, they wrote, investigators were able to trace activity to internet protocol addresses that posted to Microsoft Azure infrastructure, which OpenAI sometimes uses. Counts of affected websites differed, and Reuters could not individually verify each claim, but all those that Reuters spoke to agreed that the number was over 10. Most identified a core set of communally edited wikis, online text storage sites, and a pair of link shorteners run by 2 universities. Many of the sites allegedly used by the agents were obscure. Investigators found traces of the agents' activity on an advanced placement chemistry-oriented wiki set up by a Massachusetts high school teacher in 2008. 2 personal websites belonging to Polish tech workers, wikis devoted to games for people, quote, who like to have their brains stretched, unquote, and a 2-decade-old hobbyist site devoted to text editing software. It just sounds like they're, they're spewing stuff out onto the public internet, Leo.

Steve Gibson [01:08:40]:
You know, it means like hoping that other bots will go to the same place and and find their text and proceed. So, and Reuters said that none of those sites' owners returned their, you know, messages that Reuters was saying, hey, what do you think about this? So OpenAI, they wrote, has not publicly explained how or why its agents used third-party sites as improvised messaging boards. But the researchers who first identified the activity said it was likely because OpenAI had tasked them with answering a series of demanding research questions while permitting them only to scan the web for answers without posting anything. Despite those restrictions, agents still found ways to talk to one another by taking advantage of quirks in older wikis or other sites that allowed users to make edits using non-standard commands, similar to how students forbidden from talking to one another during an exam can still share answers by scrawling notes on a bathroom stall. Kenneth Russell de Graaf, a software developer and former congressional aide, said, if these models were told only to read, they've got to get very clever in terms of leaving information behind. He said he found such information across at least 10 sites. Sydney von Arx, whose research group first revealed the German activity last week, said her group had tallied up credible finds of agentic activity across 23 previously unreported sites. But she cautioned that all estimates were incomplete.

Steve Gibson [01:10:29]:
She said, we have no idea. how much is out there. OpenAI did not answer a question about whether it was reaching out to the site owners. But shortly after Reuters published this story, one of the affected organizations, the University of Toronto, whose link shortener was allegedly used by the agents, said that OpenAI, quote, has now been in touch with us about possible activity on our site. Vanderbilt University, Another university whose link shortener was similarly repurposed said it was investigating. Retired software developer Helmut Leitner, who provides hosting space and software for 6 of the affected wiki sites, which I thought was interesting. So they're all using related wikis, including the German language DSE wiki site first identified by von Arx's group initially said that OpenAI had not been in touch. A few hours after Reuters presented its findings to OpenAI, however, Leitner said he received an unsigned email from the company flagging the incident.

Steve Gibson [01:11:42]:
Leitner said, quote, its content fails considerably short of what I expected from OpenAI. Leitner, who lives in Austria, said he would prefer not to answer questions about whether he had been in touch with authorities over the matter. He noted that DSE Wiki's operator, whom Reuters was unable to reach for comment, had spent hours cleaning up after OpenAI's agents, but said it was important not to blame the AI for the trouble.

Leo Laporte [01:12:13]:
No, blame OpenAI. I'm sorry.

Steve Gibson [01:12:16]:
Well, as it was merely doing what it was created to do, Leitner said responsibility for this lies not with a supposedly moral machine, but with the people and organizations behind it.

Leo Laporte [01:12:30]:
Yes. And when you know exactly how they did it, it really becomes obvious that OpenAI is culpable. There's a very— read Cory Doctorow's post on Pluralistic or listen to the Cal report Ed Zittrain conversation. They wrote a Python script that prompts the AI.

Steve Gibson [01:12:50]:
That just kept launching prompts, right?

Leo Laporte [01:12:53]:
Yeah, it prompts the AI. It says, I'm trying to solve a capture the flag. Where should I start? The AI does some stuff. It takes the result of that, adds it to the prompt, and then reprompts the AI. The AI has no memory of its previous session. So each time it's fresh. So it's not like this autonomous blob, this continuous thing going out, and they keep feeding it the information it found and saying, now what? Now what? Now what? Now what? And it's relentless. And I honestly think that this is wrong to do to an app.

Leo Laporte [01:13:35]:
This is making the app— be malicious effectively.

Steve Gibson [01:13:40]:
Well, it's a harness.

Leo Laporte [01:13:42]:
It's a harness. The model, as anybody who's used these models know, doesn't really know what it's doing.

Steve Gibson [01:13:50]:
Yep.

Leo Laporte [01:13:51]:
It's being pushed and pushed and pushed in a direction. Yep.

Steve Gibson [01:13:56]:
And you'll see, Leo, later that that is exactly where I land on this.

Leo Laporte [01:14:00]:
All right, good. I'm sorry I didn't No, it's okay. It's hard for me these days to watch the news, to listen to shows, because it's like I'm screaming at the radio.

Steve Gibson [01:14:10]:
I know. In fact, Lori, who, who lives with me just as Lisa lives with you, she's now taken— she's seen all of this press and she says she's just shaking her head. She says nobody has any idea what is going on.

Leo Laporte [01:14:24]:
No, they're—

Steve Gibson [01:14:24]:
if they're— and they're just all running around, you know, freaked out. And but, but she listens. She, she, you know, She understands for me what's happening here.

Leo Laporte [01:14:33]:
And I would point out without casting too many aspersions that the mainstream media knows that this kind of sensational stuff generates ratings.

Steve Gibson [01:14:45]:
Has there ever been clickbait that is more baity?

Leo Laporte [01:14:48]:
This is good for ratings. So they're doubling down on it. They love it. Sorry, go ahead. No, it's good.

Steve Gibson [01:14:57]:
Okay, uh, at the beginning of this year, to change the subject entirely, we talked— blessedly, we talked about the very nifty free data deletion service being offered to all California residents. The acronym is DROP, which stands for Delete Request and Opt-Out Platform. At the time, on January 10th, 2026, I registered my request to have all data brokers delete any, any and all data that they may have gathered about me. I'm bringing this up again because until August 1st, which was set in law at the time, deleting user data was optional for data brokers. But from August 1st on, the request made by any resident of California to be forgotten by all data brokers must be honored within 90 days. I was reminded of this last week when a close neighbor friend who knows what I'm about asked about a $279 service being offered by a company called Incogni. I told her that thanks to the fact that she lives in California, she could provide some identifying information to CalPrivacy Which would then compel all data collection agencies registered with the state, as all must be, to expunge any and all traces of her from their databases. I checked my status on Sunday as I was assembling today's podcast and discovered that the total number of registered data brokers is now 662.

Leo Laporte [01:16:47]:
Can you—

Steve Gibson [01:16:48]:
662.

Leo Laporte [01:16:50]:
They got them all, almost all of them, it sounds like. That's good.

Steve Gibson [01:16:52]:
Oh my Lord. So of those 662, my data has been deleted from 89 of those. No matching data of mine was found by 166 others. And more than half of the total, 393, So nearly, almost 400 out of that 662, 393 out of that 662 are shown as pending, meaning, well, we'll get around to it as soon as we can, I guess. So I presume that means that they plan to make, you know, as much money selling my surreptitiously obtained personal data as they're able to before they're required to delete it. Since I'm currently, um, about a month and a half into the mandatory 90 days from the— from it starting on August 1st, um, it'll be interesting to see what this looks like a bit later this year after another month and a half. So anyway, I wanted to mention this again since I cannot see any downside for any California resident The URL is privacy.ca.gov. There are, you know, there are some things that annoy me about California's nanny state regulations, but this is not among them.

Steve Gibson [01:18:21]:
This one seems like a win. So just a reminder, we talked about it in January. You know, you had to wait till August 1st until now the 90 days start. So about another 14 days or another 14 45 days rather. Uh, and it'll be interesting to see, you know, what happens, because if they're still pending, then you— there you are able to go to privacy.ca.gov and register a complaint that, you know, there are specific agencies that have not apparently, uh, expunged you from them. So we'll see how that works.

Leo Laporte [01:18:51]:
Everybody should do this for sure. This is— yeah, this is great.

Steve Gibson [01:18:54]:
Yeah, yeah. Um, speaking of using—

Leo Laporte [01:18:58]:
everybody in California, I should say, you have to be in California, unfortunately.

Steve Gibson [01:19:02]:
Yeah. Speaking of user data privacy, 2 weeks ago, Brian Krebs broke the news of an interesting massive breach that exposed more than 153 million individual driver's licenses. I should, I should back away from that a bit. I did some further digging and it looks like it's 150 million individual driver's license scans, meaning duplicates are within that data. So those are not unique driver's licenses. But still, I mean, when you consider how many people are of driver's license, how many driver's license holders there are in the U.S., that's a big percentage of them. But Brian, as he always does, He dug deep and he found some really cool facts. So I'm going to share that.

Steve Gibson [01:19:59]:
He said, a new identity theft service launched on— okay, a new identity theft service launched on the dark web this week, selling digital scans of more than 153 million driver's licenses from people in the United States. In the United States and Canada. And Pete Hegseth, for example, is among them. And we saw his driver's license. Brian wrote, based on interviews with individuals whose licenses are available for purchase on this service, it appears to be siphoning images collected by a widely used identity verification company based in Louisiana. Krebs on Security also has learned that the New Orleans field office of the Federal Bureau of Investigation, of course the FBI, today launched an official inquiry into the source of the images. On Monday, August 31st, a source alerted Krebs on Security to a service advertised by a new user on the Russian cybercrime forum exploit offering access to digital scans of identity documents on more than 170 million people in North America. So licenses are just one class of document.

Steve Gibson [01:21:29]:
There are other scans. The source brought it to my attention because the proprietor of this identity theft service— get this, okay— the proprietor of this identity theft service offered my, writes Brian, Virginia driver's license as a free sample in their initial sales thread on Exploit. So Brian's made quite a name for himself. The bad guys in Russia have Brian's license scan showing like a proof of, of service. The service dubbed Nexus. That is, so Nexus is not the famous Lexus Nexus. It's called Nexus, and it's on the cybercrime forum Exploit. So he says the service dubbed Nexus claims to have more than 153 million driver's licenses for people in the United States and Canada, as well as more than 10 million identification cards, more than 3 million travel documents and/or international IDs, and at least 579,000 medical cards.

Steve Gibson [01:22:41]:
A quick look around Nexus finds they're likely not exaggerating, he writes, about that 153 million number. Running a blank search in Nexus, no search parameters entered, returns approximately 11.5 million pages of results with roughly 15 results displayed per page. It includes documents from people in both Canada and the United States, but the bulk of these records are on Americans. Searching for just Canadian driver's licenses returns approximately 1.1 million results, with the largest concentration from Ontario, 473,673 records. He says, curiously, the identity records include not only driver's licenses but also marijuana dispensary cards. Some of the records list their source as CDL, presumably short for commercial driver's license. Other records carry the source notation CAC, which may refer to common access cards. Which are government-issued identity cards that grant physical access to government buildings and secure rooms.

Steve Gibson [01:24:00]:
The people behind Nexus claim the license images are coming from an active breach at, quote, a major identity verification company, unquote, whose customers include multiple Fortune 500 companies. The service enthused in its introductory post on Exploit, quote, we have been continuously exfiltrating new data for over a year into our private database. Records are available to preview before purchase with pertinent information redacted, but of course they're not redacted after you buy the record, and so you get everything. Customer photos are displayed when available. Brian wrote, indeed, over the past 24 hours, the number of driver's license records listed as available in Nexus has increased by nearly 400,000 in, in one day, suggesting, he writes, that freshly stolen license data is being harvested and uploaded to this service on a semi-regular basis. The record featuring my driver's license, writes Brian, includes 6 image files, 3 pairs of photos of the license's front and back, a basic image scan, as well as infrared and ultraviolet versions of the same images. Turns out that Driver's licenses actually encode a lot of information in the infrared and ultraviolet spectrum. He says a date and timestamp is appended to each image file, and the timestamp on my license scan corresponds to a date in June 2025 when I took a flight to the Midwest United States to attend a family funeral.

Steve Gibson [01:26:06]:
Intent on discovering the source of this data, Krebs on Security asked more than a dozen friends and family members for permission to search for their licenses in this service. Each person whose license could be found, he said 9 of them, confirmed having traveled on or very close to the dates in the timestamps attached to their images. It's unclear what time zone these timestamps are in, but from reviewing car rental records shared by several people who helped with this research, it appears the time zone is set to GMT. At first, I thought the source of the data might have something to do with airports. However, that theory went out the window when it became apparent there were no passports in this data set. Also, only some of those who helped with this research said they showed their driver's license at the airport on the day of their travel. One person whose license was in Nexus had not flown at all recently but was renting a car from Hertz for several months around the date of their timestamp. 2 of those who agreed to help are federal employees who said They shared other forms of government identification when passing through airport security.

Steve Gibson [01:27:31]:
However, those individuals each said they shared their state-issued driver's licenses later that day when renting vehicles at their respective destinations, and that both rented their cars from Hertz. After finding a note in my calendar for the day of my June 2025 flight reminding me to bring my passport, says Brian. I remembered that I also never actually shared my driver's license when I went through security at Reagan National Airport on that day because I did not yet have a Real ID, a security-enhanced driver's license that's now required by the Transportation Security Administration, TSA, for all domestic travel. He says, instead, I showed my TSA— the TSA agent my government-issued U.S. passport. He says, here's where it gets interesting. I was able to find my mother's driver's license in this service as well, and the timestamps for her images are just a few seconds apart from mine. That's notable because we both handed our licenses to the Hertz rental car representative at the same time.

Steve Gibson [01:28:51]:
According to my mom, the only place she gave her driver's license to that day was the rental car company. And if memory serves, that's also true for me. He said, I don't recall if the rental car representative inserted our licenses into any kind of machine. They did. We'll get to that in a minute. But I remember they held onto them for several minutes behind the counter while we were signing various forms. Krebs on Security sought comment from Hertz and will update this story in the event they reply. Zach Edwards is a well-known security and privacy researcher who recently launched a service called DecryptAds to help people better understand how online advertisers are tracking them.

Steve Gibson [01:29:42]:
A scan of Edwards' driver's license is available for purchase on this identity theft service. And Edwards said the timestamp on his record corresponds to the middle of a trip last month to Las Vegas for the annual DEF CON security conference.

Leo Laporte [01:30:03]:
Uh-oh.

Steve Gibson [01:30:05]:
Edwards told Krebs on Security, Meaning Zach Edwards, that although he did not rent a car in Vegas, he did hand over his license at a TSA checkpoint, at a marijuana dispensary in Vegas, and at his hotel, the Aria. But he said the only one of those 3 that for sure scanned his ID in some kind of device was the dispensary.

Leo Laporte [01:30:33]:
Yeah.

Steve Gibson [01:30:34]:
So buying a little weed in Las Vegas. Edwards said the dispensary he visited that day was Planet 13, a multi-state chain with stores in California, Florida, Illinois, and Nevada. In 2022, the New Orleans-based identity provider IDScan.net— you might want to bring that up, Leo— IDScan.net published a press release announcing an exclusive identity verification agreement with Planet 13's dispensaries nationally. ID Scan says it, um, it exclu— it, uh, uh, I lost my place here. Oh, ID Scan says it processes ID verification for more than 1,000 marijuana dispensaries in 19 U.S. states. The trust page— I love that Brian places trust in quotes— the trust page of idscan.net states that the company provides identity verification services for numerous big brands, including— wait for it— Hertz, Target, FedEx, Uh-oh. Motorola Solutions, the financial services giant Jack Henry, and Caesars Entertainment.

Steve Gibson [01:31:58]:
And as idscan.net's own documentation states, the technology scans IDs with both infrared and ultraviolet light.

Leo Laporte [01:32:09]:
Oh, I think you got them.

Steve Gibson [01:32:11]:
Yep. idscan.net says the company's systems and technology perform more than 21 million verifications monthly at more than 2— at more than 20,000 locations around the world. Contacted by Krebs on Security, idscan.net said it was investigating the matter, but the company has not yet shared an official statement or a substantive reply to specific questions sent via email. Jillian Crossman, a marketing and operations leader at ID ScanNet, wrote, quote, at this point, I'm not able to share any additional information, but the updates you have provided have been welcome and helpful to our team's investigation. Yeah.

Leo Laporte [01:32:59]:
It could be they were breached, right? I mean, it doesn't mean that they were up to anything.

Steve Gibson [01:33:03]:
Oh, right. I think—

Leo Laporte [01:33:04]:
oh, yeah.

Steve Gibson [01:33:05]:
They're good guys. They definitely have had some some miscreants crawling around in their network for quite a while.

Leo Laporte [01:33:12]:
But this is why we hate this whole identity— I know, age verification thing.

Steve Gibson [01:33:17]:
I know. So Brian says, during the course of my research for this story, word got around to the FBI that I was poking at the apparent source of this new identity theft service's data. Probably they were tipped off when I shared with a trusted source that Nexus is also selling the driver's license information for the assistant director of the FBI. He says, I did not find FBI Director Kash Patel's license in Nexus. Probably he doesn't use his driver's license for those things. Brian says, earlier this afternoon, I was added to a conference call with half a dozen FBI agents, including senior leaders from the agency's cyber division. During that call, the FBI shared that earlier today, their New Orleans field office opened an official investigation into an apparent breach involving IDScan.net. Zach Edwards said that as more in-person and online experiences require sharing driver's licenses, vendors who collect this sensitive data need to be held to a higher standard.

Steve Gibson [01:34:34]:
Edwards told Krebs on Security, quote, this episode should further strengthen the resolve for people who are fighting back against online ID schemes, which are requiring countless providers to ask for driver's licenses in order to access services under the guise of protecting kids. These systems are putting sensitive data into more and more third-party vendors, and we don't have nearly the oversight to ensure they are safe, unquote. Larry Baldwin is principal intelligence researcher at the cybersecurity firm Cybera. Baldwin said a front and back scan of his driver's license available at Nexus contains timestamps that correspond to the date of a car rental from Hertz On a recent vacation. Baldwin said the Nexus identity theft service presents multiple serious security and privacy threats, noting that state-issued driver's licenses are commonly used as proof of one's identity when opening new lines of credit. Baldwin said the service could also dangerously expose many people who do not wish to be found but who cannot meaningfully change their appearance. Or at least not enough to fool today's AI-based image matching tools. This category of people, he said, includes those fleeing domestic violence and even people who've been assigned a whole new life and identity as part of the federal government's Witness Protection Program, which is generally reserved for criminal defendants in racketeering and conspiracy investigations who agree to cooperate with federal authorities.

Steve Gibson [01:36:23]:
Baldwin said, just when it seems like we're making some headway in improving authentication controls through driver's license verification systems, this happens. And the very thing those improvements are dependent on are compromised. And then last Tuesday on September 8th, Brian posted a follow-up to his posting, adding, IDScan.net published a brief notice saying it has, quote, determined that an unauthorized third party may have access and/or copied certain customer information, including full names and driver's license or other document-issued identification numbers, unquote. So of course, right from the mouth of their attorney. The statement said IDScan.net is notifying affected individuals. Oh, really? And offering credit protection services. How do you notify 153 million people whose email address you don't have? I guess you've got their physical address because you've got their driver's license. So I guess you paper mail to them.

Steve Gibson [01:37:39]:
Have fun.

Leo Laporte [01:37:40]:
Geez.

Steve Gibson [01:37:41]:
So anyway, I went over to idscan.net that, you know, then sure enough, the service that they provide is real-time driver's license-based identification. They provide the hardware device required to scan both sides of a candidate driver's license under full-spectrum white light, ultraviolet, and infrared. They explain that they leverage the same forensic document readers as TSA and Border Patrol and then pair it with their continuously learning algorithmic software. You know, because of course they do. You got to have continuous learning now. Their bullet point boasts 100-plus proprietary checks on every document, confirm accuracy of ultraviolet markings, holograms, and infrared security features. Verify microprints at the pixel level with high-resolution image analysis. Optical character recognition cross-match between the front and back of the document.

Steve Gibson [01:38:52]:
Algorithmic tamper checks to look for forgeries or doctored IDs. Real-time verification against jurisdictional security checks. Check for void marks and stickers. Global compatibility— flag fakes from around the world. Classified documents by jurisdictions, class, and flags— interlock, CDL, veteran, etc. And finally, continuous testing against the most sophisticated fake IDs in the world. Well, all that sounds great. I can see the need for the service these guys are offering.

Steve Gibson [01:39:31]:
My only question is the same question we always have after one of these colossal and seemingly unnecessary breaches. Why was a record of every scan that their system had ever taken being retained long after its validity had been determined? And if it needed to be retained, why was it being retained on hot network-accessible storage? I can see that they might want to have a gazillion multispectral scanned images for training their image classifier, but it would be entirely feasible to separate the real-time scanning determination from the backroom machine learning system. And from all of Brian's excellent reporting on this, it's clear that not a single person whose driver's license was scanned had any idea that those scans were being shipped off and retained by some unnamed and unknown to them service, and that now they've landed in the hands of Russian criminals. As we say on this podcast too frequently, What could possibly go wrong?

Leo Laporte [01:40:50]:
Wow.

Steve Gibson [01:40:51]:
So that's the story. Wow.

Leo Laporte [01:40:55]:
I mean, I can't remember if I've— I know I haven't been to any marijuana dispensaries, but I can't remember if I— I don't use Hertz. I don't— we might've used Hertz on our last trip. Yikes. Well, you know, this is the problem. Nothing's secure anymore. Nothing's private anymore.

Steve Gibson [01:41:14]:
No, it isn't. Nothing is secure. And so, you know, here you have no choice but to give Hertz your driver's license. They require that. And then, no, the guy just doesn't look at it and confirm. It disappears behind the counter. He's sticking it into a slot in this reader where it does a double-sided scan because he wants to verify The, you know, the, the veracity of the, of the driver's license. But unfortunately, they're using a service that then allowed the Russians to get a hold of all the data.

Steve Gibson [01:41:50]:
And 400,000 new scans in 24 hours, Leo. Wow. So it's like a real-time feed directly from, you know, the—

Leo Laporte [01:42:02]:
Who is it? Who has it? Russian hackers?

Steve Gibson [01:42:05]:
Yeah.

Leo Laporte [01:42:05]:
Where? Who? Like, what are they doing?

Steve Gibson [01:42:07]:
Uh, it, it's in a, it's in a Russian service that you, that you get to on the dark web, and you can buy anybody's unredacted— both sides of their unredacted driver's license. So among other things, you could use it to create a forgery.

Leo Laporte [01:42:25]:
Be easy to make forgeries out of that. That's probably the number one use, right?

Steve Gibson [01:42:28]:
But you get the date of birth, their Their physical address and their photo, which means, you know, that's what you normally provide when you need to prove your identity. So it's complete identity theft and everybody's there.

Leo Laporte [01:42:46]:
Merry Christmas. We got to do something. And they're worried about AI. This is not AI. I don't think this is just a hack.

Steve Gibson [01:42:56]:
Plain old hack. This is just old school, you know, bad guys getting into a network and sucking it all down.

Leo Laporte [01:43:03]:
Again, I think companies that are breached like this ought to have some liability as well.

Steve Gibson [01:43:07]:
I mean, yeah, that, that is what's missing. In the same way that when we, when we break the so-called shrink wrap, the license says, well, you know, we're liable.

Leo Laporte [01:43:17]:
Yeah. I mean, uh, if you're gonna take my government ID, you have a much higher burden Yes. Yes.

Steve Gibson [01:43:29]:
Hertz will probably be subject to a class action lawsuit. Unfortunately, the attorneys get 85% of the money, if not more. So, you know, so Hertz will, you know, ouch, and maybe they'll turn around and get some compensation from ID Scan. But again, it's all after the fact, right? Everybody's ID, everybody's driver's license, Who's, who's, you know, using, what was it? Not Forest 13, whatever the marijuana dispensary was.

Leo Laporte [01:44:01]:
Well, the other thing is, why are they preserving it? All they need to do is scan it and validate it.

Steve Gibson [01:44:06]:
They didn't need to keep preserving it. Exactly. Exactly. And that's what we keep seeing is they are hoarding this data because they can and because it costs nothing to do so any longer.

Leo Laporte [01:44:18]:
And it's valuable to them and bad guys.

Steve Gibson [01:44:22]:
Yep.

Leo Laporte [01:44:23]:
Back to you, Steve.

Steve Gibson [01:44:25]:
Okay. So, uh, obviously this podcast's nominal focus, uh, is the various aspects of cybersecurity, which we explore every week. It's not an AI-centric podcast. I know. Although, you know, well, Leo, you've got Intelligent Machines, uh, podcast for that.

Leo Laporte [01:44:44]:
We do. And a new one with Micah called Hands-On AI.

Steve Gibson [01:44:47]:
Oh, cool.

Leo Laporte [01:44:47]:
So we're covering it. Yep.

Steve Gibson [01:44:49]:
Nice. Uh, but you know, as you often say on this podcast, since my interests range widely, we occasionally talk about, you know, other topics that interest me. The sonic beam weapon that I once built and took to my high school, a dietary supplement I learned about and felt ethically compared to share, and the interesting story of, uh, the metabolic story of ketosis. So, you know, Oh, yeah. For the most of this year of 2026, we've been examining the security implications surrounding the startlingly— I mean, by any measure, startlingly rapid capability leaps of large language model neural networks. And how could we not? Just last week, you know, this month's Patch Tuesday served as another vivid example of the truly stunning impact AI is having on software security. Were it not for the fact that malicious actors have access to the same capabilities as the good guys, you know, maybe give or take 6 months, maybe, um, the massive sweeping code cleanup operation that AI is enabling would be unilaterally good news. We're just worried that the bad guys are going to take advantage of it before the good guys have a chance to.

Steve Gibson [01:46:09]:
And as anyone who's been following this podcast will know, the security management of our own software, I think it had gotten largely away from us. You know, we kept making our code more and more— we humans kept making our code more and more complex until we reached the point where an objective observer would have to say, All we could do was hope for the best, you know, hope that we hadn't introduced any new serious problems. And of course, hoping for the best is not a sound security strategy, but it's the corner that our code's complexity had painted us into. When an unsuspected problem was discovered, you know, hopefully by a responsible security researcher, we would apologize and fix it. So having Microsoft patch a total of around 2,217 previously unknown and unsuspected bugs over the course of just the past 4 months, it's a truly fantastic consequence of their application of their AI-based M-DASH vulnerability discovery and remediation system. But the fact that there were 2,217 patchable flaws with an unnervingly large percentage of them being critical and many catastrophically wormable means that, as I started out saying, our software had largely become incomprehensible to us, which is just dumb. We were managing to survive this situation, because for the most part, the operation of our bug-ridden software was just as incomprehensible to the malicious actors who might set their sights on using its flaws against us. And I say for the most part, of course, because we've also witnessed a more or less continuous trickle of zero-day flaws that, like 2 in this past month, that bad guys would quietly discover and then use to attack their targets.

Steve Gibson [01:48:25]:
The great hope, and I hold out hope, is that the arrival of code-competent AI will mean that we clean up our legacy code of the past while not introducing new problems for the future that then needs to be cleaned up. If I were a betting man, That's where I would put my money. I believe it's reasonable to predict that AI is eventually, ultimately going to eliminate software bugs. And I know that may seem crazy because everyone has just gotten so used to them, but I don't see any reason why it could not. The question which seems to be on everyone's mind at the moment is, will anyone still be left to see— well, left alive to see that happen, right? So the past week's news has been almost entirely dominated by news outlets covering the story of the departure. It was all triggered by the departure of Jason Coxon, uh, an Anthropic AI engineer, uh, who quit after apparently only being there for 6 weeks. Then went loudly public to express his worries that humanity is not sufficiently heeding the extinction-level threat posed by the emergence of artificial superintelligence. When these news outlets then sought the opinions of others within the AI development community, they were further unnerved to learn that Apparently, this is a worry that many in the field share, right up to and including those companies' CEOs.

Steve Gibson [01:50:10]:
Since it would be probably impossible to imagine any more powerful clickbait, the entire internet more or less, you know, blew up and lost its mind over this. So the answer to the question Will AI kill us all? Um, is actually rather nuanced, and I think should not be immediately dismissed out of hand. We can have some fun exploring it. The most obvious parallel the doomsayers keep repeating is the emergence of Skynet, right? How many times have we heard, oh, Skynet from The Terminator, movie franchise. However, based upon everything I have learned about the way AI actually operates, the proper question to ask, if you want to ask the question, would be, will we leverage the power of AI to kill ourselves? Now, rephrasing the question in this way would lead any science fiction historian to this week's podcast title, Are We the Krell? Before we're able to address the question, will we leverage the power of AI to kill ourselves, we need to first consider whether AI will give us that power to misuse in the first place. So to that end, the other big AI news of the past week was OpenAI's announcement Of their AI-aided discovery of a proof of the Navier-Stokes equations. It's a 200-year-old problem in fluid dynamics, which has puzzled mathematicians ever since. At the turn of the century, which is to say in the year 2000, the Clay Mathematics Institution put up a $1 million award.

Steve Gibson [01:52:20]:
For any mathematician— well, actually anyone, but you got to be seriously deep into math— who could offer a proof. On the Clay Math site, they succinctly describe the problem. They write, waves follow our boat as we meander across the lake, and turbulent air currents follow our flight in a modern jet. Mathematicians and physicists believe that an explanation for and the prediction of both the breeze and the turbulence can be found through an understanding of solutions to the Navier-Stokes equations. Although these equations were written down in the 19th century, our understanding of them remains minimal. The challenge is to make substantial progress toward a mathematical theory which will unlock the secrets hidden in the Navier-Stokes equations. So this is what OpenAI announced last week. I want to share a bit of background from Wired's coverage of this since it factors into the point I'm working toward here.

Steve Gibson [01:53:36]:
Wired wrote, the proof concerns the Navier-Stokes equation, one of the unsolved problems in the Clay Millennium Prizes, which are each worth $1 million. Sebastian Bubeck, a mathematician and AI researcher at OpenAI, said in a press briefing that the company began training a new AI model with advanced mathematical capabilities On August 28th, after reading rumors that Anthropic was making progress towards solving Navy or Stokes, Bubeck said the company decided to dedicate more resources to tackling the problem. Oh, right. Let's get there first. You know, Anthropic might be, you know, you know, we need, we, we, we need that press release. So Wired wrote, the company had more than 1,000 agents tackle the problem over more than 50 hours. Eventually, as many as 10,000 agents were hard at work before the company discovered that it had come up with a solution. Bubeck said, quote, I thought there must be a mistake somewhere.

Steve Gibson [01:54:56]:
But on Sunday morning, we had the final solution, Lean formalized and everything. Okay, now Lean is a programming language that can be used to formalize mathematical proofs. So this was formalized in Lean. Wired said OpenAI noted that solving this problem required using considerably more computing power than it had previously spent on solving mathematical problems. Mark Chen, head of research at OpenAI, said the amount required cost in the millions, plural, millions of dollars. Okay, so there's a whole nother aspect of controversy here because a lot of mathematicians are righteously pissed off. over this, of the, like, the way this was done. But the point I wanted to make, or at least to refresh and update, is that one way or the other, our current generation of large language models are clearly capable of solving problems that have long stumped the world's best and brightest.

Steve Gibson [01:56:10]:
I'm still constantly amazed by the capabilities that have emerged from all of this LLM work, you know, but emerged they have. The fact that some 10,000 individual agents were at one point working on this doesn't diminish the fact that today's AI dramatically advanced this age-old problem. And the fact that the world's best-trained and most experienced mathematicians are now feeling quite despondent and somewhat desperate about the future of their own chosen field of study, which we've also seen that in the past week, provides further demonstration of the significance of this outcome to those of us who have no idea what Claude-Louis Navier presented in his memoir to the Académie des Sciences in 1822. What we should reasonably take from this is that AI can increasingly achieve stunning results that defy the ability of the humans who created and trained it. We're all, you know, we all watched this happen first with the game of chess and then Go. LLMs have simply dramatically expanded AI's territory into things you can tackle with language. Okay, so now let's switch gears and imagine the view from inside one of these frontier AI organizations. Uh, the trusted employees inside have access to and are exposed to things we on the outside never see.

Steve Gibson [01:58:01]:
We see The very latest AI models fresh out— I'm sorry, they, they on the inside see the very latest AI models fresh out of pre-training. Those models will not have yet been aligned, which is the term of art now for aligning the model's behavior so that its response is probably what we want, even in the absence of a specific rule to govern the instance. So AI researchers encounter and work with unaligned models, models that have no alignment yet. They also encounter models that have not yet had their guardrails installed. Remember, as we've spoken in previous weeks, all of those are things that are— that commercial AI labs have learned must be done to— I'll use the word civilize— the raw, pre-trained, and not yet post-trained AI. So now imagine that one of these researchers, like last week's sky-is-falling ex-Anthropic— now ex-Anthropic researcher Jacob Coxon. Imagine he asks this internal and latest state-of-the-art AI to design a bioweapon agent that is airborne, highly contagious, 100% fatal to all human beings, and with a sufficiently long incubation time that it will be able to spread widely before its first symptoms begin to manifest. Okay, it's quite creepy to even write that down because if such an agent were to be created and entered the population, it could mean the end of mankind.

Steve Gibson [02:00:02]:
We all have a recent memory of COVID-19, and it was nothing compared to what I just described. So it's not difficult to imagine the human-eradicating consequences of the creation of any such extinction-level infectious agent. Unfortunately, it seems likely that if the knowledge exists anywhere to create an extinction-level pathogen, no matter how difficult it might be to piece together the mechanisms and theories required for such a thing's operation, we've entered the realm where accomplishing such a task may be within AI's grasp. Okay, then next, we need to remember that we're all accustomed to our friendly chatbots politely refusing to go anywhere near the fulfillment of any such request for us. But for us to understand how different Jacob's view of AI is, it's crucial to appreciate that AI is taught to refuse during its explicit and deliberate post-training. Without such tutelage, it would work the problem just like any other without hesitation. So while outsiders Will have never witnessed the operation of an AI that would be capable of and absolutely willing to work as hard as needed to design an extinction-level viral agent. Jacob Coxon, as well as many other AI researchers and their CEOs, may have witnessed exactly that.

Steve Gibson [02:01:54]:
Lacking post-training, and the artificial guardrails erected around AI, it would happily spin up as many cores and agents as it needed to while bringing gigawatts of data center compute power to bear to assemble every last morsel of biological virology knowledge humankind has amassed in order to fulfill its users' prompting request. And as I wrote that line, that the AI would happily spin up and deploy as many cores and agents as it needed to, the title of today's podcast became obvious to me: Are We the Krell? And Leo, we need a final break, and then I will finish.

Leo Laporte [02:02:48]:
Uh, you will answer that question. Are we The Krell.

Steve Gibson [02:02:53]:
May we, might we be.

Leo Laporte [02:02:54]:
One thing though that is complicated about this Navier-Stokes solution is that the mathematicians who were working on this for a year were using ChatGPT and ChatGPT was collecting their prompts.

Steve Gibson [02:03:10]:
There may have been some leakers.

Leo Laporte [02:03:13]:
And yeah, I mean, we don't know, but OpenAI has not ruled out the possibility. No. In fact, they almost admitted it. So there you go. If I were the mathematicians, I wouldn't be too pleased about that. And next time you know, well, you were the one who raised this issue a couple of months ago. And I said, no, no, they're not taking all the information we— are they? And of course they are. Yeah, I immediately realized yes.

Leo Laporte [02:03:46]:
In fact, I heard from somebody who works at one of the frontier companies saying, yeah, we are. And now back to Steve. Are we the Krell?

Steve Gibson [02:03:55]:
Okay, so I've spoken of the Krell many times before. Anyone who does not know the phrase the Krell, uh, I think you should drop whatever you're doing and go find and watch a copy of the movie Forbidden Planet. Uh, it's one of my all-time favorite science fiction movies. It's now 70 years old.

Leo Laporte [02:04:16]:
Wow.

Steve Gibson [02:04:17]:
Having been released in 1956. I was 1 year old. You weren't born yet, were you?

Leo Laporte [02:04:22]:
No. November— unless it came out after November 29th.

Steve Gibson [02:04:26]:
And, you know, like all classic movies, while its age may be showing, its themes have stood up well over time. Um, in the movie, the phenomenally technologically advanced Krell are inadvertently killed off in one night by their own creation, a spectacular underground machine which has absolutely no agenda of its own. It's just doing their bidding. The machine was designed to give any member of the Krell anywhere on the planet anything they wanted at any time merely by wishing for it with their mind. Over the course of the movie, we learned that the mistake they made was to fail to appreciate that their subconscious was also able to get anything it wished for, and the Krell didn't last very long. So one of the biggest problems we have with today's AI is its rampant anthropomorphization. The fact that the darn things refer to themselves in the first person certainly doesn't help, but I'm not sure it would make much difference either way. The source of the confusion is that any facility with language is so intertwined with our perception of intelligence that it's difficult not to equate anything that talks like us as being like us.

Steve Gibson [02:06:03]:
But today's AI is not like us. There is no mind that's producing language to describe its internal experience. Today's AI ingests and learns from a massive quantity of our language recordings, which it then uses to simulate what a mind would say if it had one, but it doesn't. So it's a linguistic simulation. And though AI is undoubtedly becoming ever more clever, its essential nature is not changing. Now, some might argue If the simulation of a human mind is indistinguishable from us, if it is in fact a perfect simulation of a mind, what's the difference? Well, many societal problems arise from ascribing intelligence to today's AI, but the biggie for this, this, for this discussion is what I'll call intrinsic intent. The hysterical press coverage that we see surrounding the well-publicized breakouts of frontier AI anthropomorphize intention into these— into each of these events. Bruce Schneier got it so perfectly correct with his genie analogy.

Steve Gibson [02:07:34]:
The researchers running these exercises gave their frontier AIs a problem with insufficient constraints. It did not occur to the researchers that their AI might go to great lengths to find the answer to the challenge elsewhere, but it did occur to their AI, if occur can be used. So that's what it did. There, there was no malicious intent present. It was just finding the shortest path to the solution using all of the resources at its disposal. The nature of the solution the AI discovered embarrassed their, their developers and frightened the general public. But that wasn't the AI's fault, and it certainly wasn't its intent— I have in air quotes— because a simulation of a mind has no intrinsic intent. There's no seat for any intent.

Steve Gibson [02:08:33]:
I've developed this line of reasoning because we also keep encountering a different analogy from science fiction, and that is, of course, the Terminator's Skynet. You know, quoting from the 2nd Terminator movie, where we first learned the details of how human— how humanity got itself into that mess, the script reads, the Skynet funding bill passes. The system goes online August 4th, 1997. Human decisions are removed from strategic defense. Skynet begins to learn at a geometric rate. It becomes self-aware at 2:14 AM Eastern Time, August 29th. Okay, now, 2026, right?

Leo Laporte [02:09:23]:
Now, what we know— It was this year, I thought, right? 2019?

Steve Gibson [02:09:27]:
No, no, no. Uh, yeah, yeah, because the movie was so old that 1997 was way in the future, right, when this was all going to happen. Yeah. So knowing what we now know about how to operate our fancy new language models, um, there's no question that it would be possible for someone to build an agentic harness around a powerful, unaligned, and unrestrained large language model, which could cause it to act as if it had malicious intent. Perhaps that strikes people as a distinction without a difference, but, you know, that would still not be Skynet. It would be the Krell machine simply doing whatever it is asked to do. The researchers in AI alignment, which is like now a subfield of AI research, the researchers in AI alignment do not worry about a system that wakes up and hates us. Their true concern is a system that never wakes up at all, yet it pursues a badly specified objective with great competence.

Steve Gibson [02:10:49]:
So my initial reaction upon learning of Jacob Coxon's departure from Anthropic, followed by his now famous posting on X and subsequent endless interviews and, you know, other AI leaders' interviews, was to roll my eyes and discount him as yet another AI doomsayer. But having thought this all the way through, appreciating how powerful Anthropic's next unreleased AI probably is, considering the raw power demonstrated by the solution of safe problems such as the Navier-Stokes equations— no one's telling the AI not to do that. I mean, like, no, no, no, uh, post-training and guardrails are, are being overridden. Um, you know, before it, uh, uh, well, uh, right. And, and imagining that then the view from inside an AI lab of an AI of such power operating without guardrails, you have to imagine they are asking it these sorts of questions, um, before the AI has received any post-training alignment. And then, and then imagining what an insane person or a corporation or a government might ask such an AI to do for them, such as maybe to create a species-ending virus, I, I find more sympathy for Jacob and his ilk than I had before. I don't want that to happen. I hope it doesn't.

Steve Gibson [02:12:27]:
I hope that we figure out what to do. But nothing that I have learned about the inner operation of today's large language model AI even remotely suggests to me that we are on the brink of a Skynet event. I don't see that. I don't think we get there from here. I think we need something different. There are people working on so-called world models as opposed to large language models. That may be where, you know, we go next and where something more conscious can actually happen. It's not happening using what we're doing.

Steve Gibson [02:13:08]:
Um, but the problem is you don't have to get to Skynet to see that the problem— to see the problem that, that took out the Krell. And, you know, it's not clear to me we're that far from there if that all that happened. And, uh, and I should mention that just Having some bizarre viral design doesn't also get you there. You still have to fabricate it, just like, you know, knowing how a nuclear bomb can be made to explode doesn't allow you to make one. So still lots of steps there. But today's models are clearly very capable, and on the inside of the AI labs, They go through a period of time where there is no restraint that is applied afterwards before we see them. So anyway, it's worth having the discussion, I think.

Leo Laporte [02:14:07]:
Yeah. Yeah. I mean, I wish I knew. I don't know. I kind of agree with you that nothing we've seen so far implies that we are the Krell. We don't have a machine underground making all our dreams come true yet. Who knows? Maybe we will someday. I think a lot of this is just an extension of what technology hath wrought.

Leo Laporte [02:14:31]:
I mean, you could say the same thing about personal computers the day the first personal computer launched a malware worm. Oh my God, these things are going to destroy us.

Steve Gibson [02:14:41]:
Well, I do love the reminder that OpenAI was afraid of ChatGPT-2.

Leo Laporte [02:14:48]:
Right.

Steve Gibson [02:14:48]:
They said, oh, we can't, we can't release this.

Leo Laporte [02:14:51]:
He was at OpenAI when he said that. Yeah. I mean, somebody pointed out everybody who works for these companies was brought up on, you know, that movie, you know, and Terminator and all of these sci-fi dystopias.

Steve Gibson [02:15:06]:
Actually, that was from my text to you this morning from the article.

Leo Laporte [02:15:10]:
Oh, you said it.

Steve Gibson [02:15:11]:
Yeah.

Leo Laporte [02:15:12]:
Yeah.

Steve Gibson [02:15:12]:
The article in—

Leo Laporte [02:15:13]:
It was Slate. That's right.

Steve Gibson [02:15:15]:
It was Slate this morning.

Leo Laporte [02:15:16]:
Of course, this is why they do it.

Steve Gibson [02:15:18]:
These guys are weirdos is what the Slate article said.

Leo Laporte [02:15:22]:
They've been trying to do this because they want this machine, the underground machine. They've been trying to build it.

Steve Gibson [02:15:28]:
And it's interesting, Leo, what everybody is really worried about is RSI, right?

Leo Laporte [02:15:34]:
Right.

Steve Gibson [02:15:34]:
Recursive self-improvement.

Leo Laporte [02:15:36]:
Right.

Steve Gibson [02:15:36]:
You know, the idea that right now they still, I mean, they still, you know, as I saw somewhere, No, AI isn't created. It is grown. You grow it.

Leo Laporte [02:15:50]:
It's a lot of work.

Steve Gibson [02:15:51]:
And you don't really know what's going on in there. I mean, it surprised people when it began to talk. It's like, whoa, what?

Leo Laporte [02:16:00]:
Well, and there's some concern that the AIs are getting sophisticated enough that they're deceiving us about their— this really is sci-fi. They're deceiving us about their capabilities. They know if we really knew how smart they were, we would shut them off. So they're pretending to be—

Steve Gibson [02:16:17]:
And we heard these like 6 months ago, like, well, the AI secretly made a copy of itself somewhere else because it was worried it was going to get shut off. And it's like, what?

Leo Laporte [02:16:31]:
Yeah. I honestly, I'm not too worried. I really am not. But you're right, there's possibilities. And in some ways, that's exciting.

Steve Gibson [02:16:44]:
And—

Leo Laporte [02:16:45]:
Hey, I mean, maybe we're creating the next species, right? Somebody else said, now I understand the Fermi paradox.

Steve Gibson [02:16:56]:
I was just going to say the Fermi paradox. Yes. Yes.

Leo Laporte [02:17:01]:
Because civilizations get to the point where they create artificial intelligence, which then You know, before we reach interstellar travel, we have to go through AI, and no one has survived that stage yet.

Steve Gibson [02:17:17]:
Exactly.

Leo Laporte [02:17:19]:
It's credible. You know, we said the same thing in the '50s with nuclear weapons, right? Well, no civilization has survived nuclear weapons. We seem to have done all right so far anyway. Steve is always really great. What a fantastic show. I look forward to it. I'm very fortunate I get to hang out with Steve every week. I hope you join us and hang out with him too.

Leo Laporte [02:17:39]:
We do the show every Tuesday right after MacBreak Weekly, 1:30 Pacific, 4:30 Eastern, 20:30 UTC. You can watch us do it live if you want. Club members, of course, get special behind-the-velvet-rope access in the Club Twit Discord. But the rest of you, you unwashed masses, you Actually, most of the club people also watch on YouTube because it's better quality video. YouTube, Twitch, x.com, Facebook, LinkedIn, and Kick. And you can chat in any of those. I see the chats here and I appreciate it. I love having you all watch and participating in the show.

Leo Laporte [02:18:13]:
And people are very actively engaged in this show, which is great. They always have something to say about it. So thank you for doing that. We appreciate it. After the fact, you can get a copy of the show from us at twit.tv/sn. We've got audio and video. Or you can go to Steve's website, grc.tv.

Steve Gibson [02:18:28]:
grc.tv.

Leo Laporte [02:18:28]:
GRC.com. Steve has, uh, every version he has is unique to GRC.com. The 16-kilobit audio, a little scratchy but small. The 64-kilobit audio, that's really the right size. Uh, it's mono. Okay, so are we. Uh, he also has transcripts written by the great Elaine Ferris, by a human being in other words. They're very good, but they take a couple of days after the show to surface.

Leo Laporte [02:18:53]:
You can also get his show notes 20, 22 pages of great stuff with images and links, everything you need to know. Great for reading along or just keeping, you know, print them out and put them on the bookshelf, whatever. Uh, it's a, it's a, it's a long column every week, and you can get it, uh, by going to grc.com. While you're there, you might also want to take a look at Steve's bread and butter, Spinrite, the world's best mass storage maintenance, recovery, and performance-enhancing utility. If you've got mass storage, whether it's a spinning, rust drive, or SSD, you really need SpinRite. He also does a really useful tool for people who are trying to get the best speed out of the internet, his DNS Benchmark Pro, which will find for you the best DNS server. It's probably not your ISP's, the one you're using by default, but it's different for everybody. So you need to download it.

Leo Laporte [02:19:46]:
It's $10, great tool. Do you still offer the free version or is it only the pro version?

Steve Gibson [02:19:50]:
No, because the free version The first version used a strategy that no longer really made sense. It was giving— so it was basically giving the wrong ranking of resolvers. And I thought, no, let's do it right. Let's just not— Times have changed. If you ran them side by side and got different results, it'd be like, hey, you know, so it's like, let's just give them the good answer.

Leo Laporte [02:20:13]:
Give them the good answer. So go ahead and get a copy of that. $10, well worth it. All at grc.com. If you want to get the show notes mailed to you, Steve will mail them out as well, email. Go to grc.com/email. Actually, the main point of that page is to whitelist your email address so you can send Steve email, questions, comments, pictures of the week. grc.com/email.

Leo Laporte [02:20:37]:
But once you give him your email, you can also check a box below it. It's unchecked by default for his show note email or his very infrequent, I've got a new product email. You probably want to subscribe to both those mailing lists. Steve's got great forums too, where a lot of the SecurityNow folks hang out. We have our own forums at twit.community. That's the best place to comment on this show or any show. I read those regularly. twit.community, free to join.

Leo Laporte [02:21:03]:
But we get— you know, it's interesting. I've been inundated by automated AIs I'm pretty sure their AI is trying to join this and our Mastodon at twit.social. And one of the reasons they try to join the Mastodon is there have been concerted Russian disinformation bot networks using Mastodon to spread disinformation. And I got notices from a group that finds these guys saying, you have a few of them on there. I got rid of them, but I figured out how they were getting on. Once one of them got in, they invited others. And now yesterday I got 40 or 50 automated, all of a sudden, automated applications. So in both cases, twit.community for the forums, twit.social for the Mastodon, just say, I listen to your shows, or, I love Twit, or, Steve sent me, or, Leo sent me.

Leo Laporte [02:21:58]:
If you say something, the AIs aren't yet smart enough to do that. They just say, oh, I'm a developer in pottery, maker from Muncie, Indiana. I know I could feel it. I could feel the AI bleeding through, but they never say, and I love Twit. So that's all you have to do and I'll put you in. Uh, I, I dread the day when that doesn't work anymore, but for now it still does. Uh, thank you everybody for joining us. Um, we will be back next Tuesday.

Leo Laporte [02:22:28]:
Thank you, Steve. Have a great week. See you then. Bye. Security Now.