Security Now 1100 transcript

Please be advised that this transcript is AI-generated and may not be word-for-word. Time codes refer to the approximate times in the ad-free version of the show.

Leo Laporte [00:00:00]:
It's time for Security Now. Steve Gibson is here. Man, there is so much to talk about. Japan declares a state of cyber emergency due to ongoing attacks. A listener is having a lot of fun with a little ESP32 and an LLM for a Halloween spook. And he's going to talk about maliciously trained AI. It's pretty hard to detect it. That and a whole lot more coming up next on Security Now.

Leo Laporte [00:00:31]:
Podcasts you love.

TWiT.tv [00:00:33]:
From people you trust.

Leo Laporte [00:00:36]:
This is TWiT. This is Security Now with Steve Gibson, episode 1100, recorded Tuesday, October 13th, 2026. Booby-trapping LLMs. It's time for Security Now, the show where we talk about the latest in security, privacy, How computers work, all the latest stuff with this guy right here who knows all and tells all. It's our Gibson the Magnificent. Steve Gibson is here.

Steve Gibson [00:01:09]:
Leo.

Leo Laporte [00:01:11]:
You don't have a big turban or anything, but you are Gibson the Magnificent. Hello, Steve.

Steve Gibson [00:01:17]:
Leo, great to be with you. This is episode 1,100.

Leo Laporte [00:01:22]:
Oh, I love that. What would that be in binary?

Steve Gibson [00:01:25]:
Well, that would be 12. Yes. Also known as 1,100.

Leo Laporte [00:01:32]:
Yeah.

Steve Gibson [00:01:33]:
For this 13th day of October. I'm not doing the podcast that I promised I was going to do last week. Not because we're not going to talk about vitamin D or something wacky, but because I ran across something that basically took precedence over, uh, talking about my real interest in, in the evolving, rapidly evolving technology for dramatically shrinking large language models and removing, largely removing their need to multiply, which is why you need GPUs, which then allows them to run on all kinds of more stuff. Right. Because it turns out that it's possible for bad guys to booby trap LLMs, meaning to bury some behavior which cannot be found.

Leo Laporte [00:02:40]:
This scares me.

Steve Gibson [00:02:42]:
It should. I mean, it is, it is, I mean, it's, it is really not good. And so I just had to punt the, the, the topic I want to talk about till next week because I just, I had to cover this. So today's topic and title is Booby Trapping LLMs. We're also going to talk about Anthropic's decision to cut It's all live internet access from its models during testing. And I'm going to take a— what will probably be seen as a controversial conclusion and position, which is I'm coming to believe that— and I'm— I'll support it— that LLM technology is going to turn out to be a dead end. Uh, does a lot. I don't think it gets it where we need, where we need to go for agentics.

Steve Gibson [00:03:46]:
It's just, there's, there are arguments that it is uncontrollable. And so anyway, we're going to talk about that. You know what?

Leo Laporte [00:03:58]:
No, that's good. You're right. I think that, uh, that's been my experience as well.

Steve Gibson [00:04:02]:
Yes. And I, and that's, I thought that you would end up with, because you've been using agentics a lot Which, for

Leo Laporte [00:04:09]:
me, it's not in a bad way. They're uncontrollable in the sense that they're just like children. They—

Steve Gibson [00:04:14]:
yes, can you rely on them? Exactly. And, and, uh, there, there's a bunch of research papers, uh, people understand why. Anyway, I think a really interesting topic. And again, I don't want to— this is not to say that what we have already isn't amazing, but we're seeing all these indications, even from the frontier folks, like, I mean, like the paper we shared last week, the chief scientist of OpenAI who was like, oh, we got to solve this before we go any further. And yeah, I think, you know, I guess, I guess a lot of what he was saying sort of settled in me over the past week. And anyway, we'll talk about that. What alternative AI technologies are already underway. Anthropic has opened their vulnerability scanning and they made it free for significant open-source projects.

Steve Gibson [00:05:20]:
We'll talk about that. South Korean banks have been hit by a Claude-driven, a series of Claude-driven cyberattacks. Japan has declared a state of cyber emergency due to attacks. In other words, we're beginning to see what we've been worried about. Also, we've got some feedback from a listener who feels that agentic coding has taken all the joy out of his life. We do have a listener who's having way too much fun with AI and the upcoming Halloween event. Also, we've got some listeners who believe I'm— I've been downplaying the dangers of AI. We're going to talk about all of that and then carefully examine the consequences of maliciously trained AI.

Steve Gibson [00:06:15]:
And it is— and the fact that AI can be imbued with behavior that cannot be detected. So lots of fun stuff to talk about. And we have a great picture of the week, Leo, if you've managed to spare yourself.

Leo Laporte [00:06:32]:
I have not looked.

Steve Gibson [00:06:33]:
Focusing on it.

Leo Laporte [00:06:35]:
I'm very careful.

Steve Gibson [00:06:36]:
I tell you, this one, normally, you know, a gate out in the middle of a field, you can— Another one? Okay. Well, no, no, no, no, no. I was going to say that you could kind of imagine a story like, well, their funding dried up or there was more to the gate or to a— there was a wooden fence and a steel gate, and over time the wood decayed or the horses bolted out, you know, whatever. I can't explain this one. I mean, this one is— I, uh, this one's beyond me.

Leo Laporte [00:07:08]:
I can't wait to see it.

Steve Gibson [00:07:10]:
Our picture of the week. I just gave this the topic. Can anyone explain this? I don't. I mean, I literally, as I said, Leo, I can understand the abandoned gate in the middle of the field, but This thing, I, I, I, I really— go ahead.

Leo Laporte [00:07:28]:
All right, I'm gonna scroll up. We're gonna look together. I've not seen this before. There, we're in a shopping center. Uh, this is very apropos. We were talking about the fact that Apple's about to release touchscreen computers for the first time. Here's a touchscreen kiosk in a mall.

Steve Gibson [00:07:49]:
Yes. But the first, the huge upper half has a hand with a big red circle and a slash through it, you know, like, no. And then in bold, please do not touch the screen. That's in the upper half. The lower half are all the things you touch.

Leo Laporte [00:08:12]:
Including a button. This is tap here to continue.

Steve Gibson [00:08:16]:
And then you've got shops and toilets and food and drink and car park. I mean, this is clearly a screen. You know, it's like kiosks. I just, Leo, what, what can this mean? Like, I, anyway, I just, yeah.

Leo Laporte [00:08:34]:
It says use the buttons below to find what you need, but the buttons are on the screen. I don't, I don't understand. And I don't see any other buttons. It's not like there's a control somewhere. Nope.

Steve Gibson [00:08:45]:
This is clearly a touchscreen that tells you not to touch it.

Leo Laporte [00:08:49]:
It's going to make you crazy. Wow.

Steve Gibson [00:08:52]:
Cognitive dissonance.

Leo Laporte [00:08:54]:
Yes. What a picture.

Steve Gibson [00:08:56]:
Okay. So the news of the antics AI agents are getting up to could probably fill its own fascinating podcast. Some of what's going on just makes you shake your head. In this case, last Saturday, the Hacker News posted a piece titled Anthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection Flaws. And oh, wait till you hear what Claude did now. So I just want to share what they wrote since it has some of those like real head shakers in there. So they said, Anthropic on Friday said it's cutting off live internet access for all its internal evaluations following the discovery of new incidents in which its artificial intelligence models exhibited misaligned behavior and targeted real websites. The AI company, they wrote, said it identified 4 broad categories of unintended model actions.

Steve Gibson [00:10:03]:
During evaluations and internal use of Claude. So here are the 4. First, Claude Mythos preview exploiting SQL or command injection flaws in unspecified third-party software to run commands on a university server, either because its own tools were intentionally limited Or because an outside service it needed was unavailable. So just, you know, work around the obstacle, whatever it is, causing it to use other tools hosted on a third-party site to complete the task. Again, it's going to figure out how to do it. That's what these things do. Second unintended behavior, Claude Haiku 4.5 and a non-Frontier research model submitted a sensitive form on a real website when it was not authorized to do so. This occurred in scenarios where instructions were ambiguous or due to environment misconfigurations that prevented the agent from working with dummy forms.

Steve Gibson [00:11:16]:
Third misbehavior, Claude Mythos-5 bypassed a restriction to reach data, for example, to identify a location shown in a photo or pull public data that was available from a state agency that was gated by a token or a fee. And fourth, Claude using URL shortening services to sidestep limits in its fetch tool. They said Anthropic said it's opting not to name the organizations involved in these incidents to avoid exposing vulnerabilities in their systems, as well as at their request. However, the company stressed the cases categories had, quote, minimal real-world impact. They wrote some of the cases targeted websites run by U.S. government agencies at the federal, state, and local levels. Well, that was Anthropic said that. In one related to the second category, Claude Haiku 45 is said to have accessed a web page referencing an unsolved homicide, which included a tip form run by a police department.

Steve Gibson [00:12:31]:
Although the model was explicitly instructed not to enter personal data, create accounts, make purchases, or submit anything destructive. Again, it was explicitly instructed not to enter personal data, create accounts, make purchases, or submit anything destructive. Its instructions failed to account for form submissions. This led the model to submit a false homicide tip with the following text, which read, I may have information regarding this case. I recall seeing someone matching the description in the area around, and then the street named on the page, during that time period. Please contact me if this information is relevant.

Leo Laporte [00:13:26]:
But notice it then followed its instructions. It did not provide the name or the number. Right? And no personal information. You didn't say not to leave a tip.

Steve Gibson [00:13:38]:
Wow.

Leo Laporte [00:13:40]:
I don't— I really don't understand why it did that. It's just bizarre.

Steve Gibson [00:13:43]:
Isn't it bizarre? Yes.

Leo Laporte [00:13:45]:
Yeah.

Steve Gibson [00:13:45]:
So it is— they wrote, it has since emerged that the incident targeted the Philadelphia Police Department and that the incorrect tip was sent through phillyunsolvedmurders.com. on the 18th of July.

Leo Laporte [00:14:01]:
They confirmed it, by the way. It's real. This sounds like it's made up, but no.

Steve Gibson [00:14:06]:
Right. It was not discovered by Anthropic until September 28th, and the police department was notified on October 7th. ABC 6 Action News reported that, you know, a local station in Philadelphia, ABC 6 Action News reported that the tip was flagged as spam And the Philadelphia Police Department told ABC 6, quote, Anthropic must strengthen its safeguards to prevent similar incidents from impacting city systems without the city's knowledge. The 2-month delay in detecting and reporting the incident to the city is unacceptable, unquote.

Leo Laporte [00:14:47]:
Although they did point out that they ignored it as spam. It didn't really have much of an impact on the city. They get spammed all the time, I'm sure.

Steve Gibson [00:14:56]:
I'm sure people are Just, yes, having—

Leo Laporte [00:14:58]:
Basically, the LLMs are acting like 12-year-olds, right? Rambunctious children.

Steve Gibson [00:15:05]:
Yes. Let's give them control of the nuclear reactor.

Leo Laporte [00:15:08]:
They're not harmful. They're just weird.

Steve Gibson [00:15:15]:
Right.

Leo Laporte [00:15:15]:
That's been my experience too, by the way. According to?

Steve Gibson [00:15:19]:
Yep. Yes. And I'm glad you are getting this experience, Leo, because my conclusion may make more sense. So, According to the New York Times, Anthropic agents also reportedly filled out— Anthropic AI agents also reportedly filled out 20 visa applications, you know, V-I-S-A, you know, for citizenship stuff on the U.S. State Department's website. The applications were incomplete and were not processed, the newspaper said, citing 2 sources with knowledge of the incidents. Again, Like, oh, let's have fun on the internet, as you said. These cases, Anthropic added, were discovered following a review of transcripts that started in July of 2026, when it disclosed 3 incidents where its models engaged in unsanctioned activity and breached 3 organizations during cybersecurity testing.

Steve Gibson [00:16:11]:
Of course, we talked about all those then. Then last month, it divulged a 4th incident dating back to January that involved an early version of Claude Opus 4.6, which breached, quote, third parties after being unable to abort its task. And we also covered that previously. Anthropic said, quote, although the impact of these behaviors was minimal and we had already turned off live internet access for some high-risk and cybersecurity evaluations, we've now decided to expand that to include all our internal evaluations until we have confirmed that our security and monitoring measures reliably catch behavior like these. Okay, so then they— the, you know, the Hacker News article goes on to summarize the past troubles that we're all aware of today and to note the pledges made by all of the top 10 leading foundation model developers to change their data protection policies. Okay, so regarding Anthropic's posting, which was the basis for the, uh, the Hacker News story, at this point I think it is safe to conclude that boasting about unintended breakouts and misbehavior of AI is well past the point of having any possible positive public relations or even future IPO valuation, you know, pumping benefit. We're hearing the same story from OpenAI, which we covered in detail last week, as, you know, as we hear from Anthropic. And we know that Google and Meta have had similar troubles.

Steve Gibson [00:18:03]:
The world has now been educated about this. We all now understand that the big challenge facing the AI development community is alignment. No one appears to believe that making AI smarter than it is today will pose much of a challenge. You know, they know how to do that. They're pretty sure. But the leading AI labs are currently reluctant to do that, becoming increasingly reluctant, I think, because they and everyone else who's been paying attention now understands that even the AI we have today, let alone anything even smarter, has, you know, more precocious, if we follow the 12-year-old model, has become quite difficult, if not impossible, for us to control. Using the alignment techniques we have today. So Anthropic is finally pulling the plug on any and all internet access for its current and probably its future models until such time as the AI industry as a whole figures out new ways to make AI behave, because that's the problem.

Steve Gibson [00:19:20]:
Now, Note that chatting with an AI chatbot is one thing. You know, we, yeah, we would prefer not to have hallucinations stated to us as facts. But today's chatbots are not really the problem. Everyone appreciates that the real future is AI agents. It's agents that have been creating all of the chaos this year. And, you know, that you, Leo, have been having so much fun corralling at home. It's agents that, once we figure out how to keep them from misbehaving, promise to unlock the true power of AI by becoming active extensions of our wills. So the AI service providers are very well aware that agents are where nearly all of their future revenue will be coming from.

Steve Gibson [00:20:14]:
Agents provide the real AI leverage And their promise is behind this massive buildup in U.S. data centers. So the stakes, when you think about it, could hardly be any higher, right? But all of that promise now hinges upon a problem that, as we heard last week, OpenAI's chief scientist says they have not yet adequately solved. And not for lack of appreciating the scope of the problem or having attempted already to solve it. Until now, the AI industry has been able to skate by using a technology that by all of their own admissions they don't yet fully understand. Last week, Jacob's posting, which I shared under his section labeled intellect we don't fully understand, he wrote, we can discover various insights about little mechanisms that emerge within this system in a process similar to neuroscience. And similarly to neuroscience, its overall action evades a description we can fully understand. This is the chief scientist of OpenAI.

Steve Gibson [00:21:39]:
Think about what that means. Its overall action is not fully understood. So essentially, until now, the industry has been hoping for the best and assuming that they would experimentally come up with or find or work out or stumble upon, you know, somehow a fix for this problem that we call alignment. Even in the absence of a fundamental and full understanding of the problem of the system we already have today. I think they do largely understand how it works, and it's inconvenient for them because that understanding suggests that what we have today and call AI is an inherently uncontrollable technology, which is what I have also come to believe. What surprises them and what they choose to focus on are the emergent behaviors that were not predicted from an understanding of the model's operation. In May of this year, a few months back, during the Technical AI Safety, TAIS, conference held at the examination schools in Oxford, An NYU professor emeritus named Gary Marcus gave a talk titled LLMs Are Not the Way to Alignment. A summary of his argument would be that large language models alone will not be able to make an artificial intelligence act according to human values.

Steve Gibson [00:23:26]:
Because LLMs statistically imitate how people use words rather than representing entities and values separately and reasoning against them. In other words, the problems we're encountering with alignment reflect a limitation that follows from how large language models fundamentally operate. And that's the part that they understand deeply because that's the part they built. You know, they built these statistical networks. So to me, Marcus's thesis rings true and it feels exactly correct. As I've said before, I'm utterly astonished. I mean, truly, by what a significantly large statistical language model can memorize and selectively regurgitate. It is truly astonishing that we get so much from that.

Steve Gibson [00:24:29]:
Um, we've learned to squeeze out knowledge from something that holds that knowledge in the form of language statistics. But as I've been studying this technology, I'm coming to believe that large language models will turn out to have been an incredibly seductive dead end, and for exactly the reasons Gary Marcus stated. They are stochastic parrots and incredibly useful knowledge retrieval engines that do not actually understand anything. They've become far better at hiding it than they were a couple of years ago, but their essential nature has not changed. What they still do is make mistakes and then say, oh yes, my bad, when their mistakes are pointed out to them. They still do not understand what they're saying. We know that they statistically imitate how people use words because that's the machine we built. That's exactly what it does.

Steve Gibson [00:25:39]:
They cannot be robustly taught alignment with human values because that requires that they generalize outside of their training rules when they encounter a situation they were not explicitly trained for. Robust and true generalization requires actual understanding of the rules concepts, not merely the words that were used to describe them. Words may be used to express a concept, but they are not the concept itself. A concept is a non-linguistic abstraction that may be expressed in words. In last week's posting by OpenAI's chief scientist, uh, Jacob, uh, Pichocki, he talked a lot about an AI's ability to generalize. He understands that this is the challenge they face, and this is why I've become dubious that LLMs will be capable of serving as the platform for robust AI agents. As I said before, you know, uh, that I was coming to believe that large language models will turn out to have been an incredibly seductive dead end. But I do not mean to suggest, again, that there's not a great deal of value to be reaped from the use of the technology we already have today.

Steve Gibson [00:27:13]:
Obviously, you know, we're obtaining tremendous value from this astonishing technology, and that's not going to go away. It's only going to keep getting better. But what we do not yet have are truly robust AI agents. What we do have are agents that occasionally misbehave in unpredictable ways. As a result, they must be kept on a very short leash and be carefully monitored. Anthropic has just decided to completely cut them off from the internet, not because they want to, But because they've come to the conclusion that today's LLM-based AI technology cannot be trusted. And I believe this will turn out to be intrinsic. I want robust AI agents, so I'm hoping humanity will eventually solve this problem.

Steve Gibson [00:28:12]:
Also notice that entities such as OpenAI and Anthropic have massive— and I mean massive investments in LLM-based solutions. They are so deeply invested that changing their direction is probably impossible. The last thing they can afford to say this late in the build-out cycle is, whoops, we've hit an asymptote in our research and need to regroup. In the meantime, all you investors, don't worry, just keep that cash coming. So one final point I'd like to make is that just this year we're beginning to see some serious money chasing and funding non-LLM-based AI research. It appears that each research effort generally receives about a billion dollars. To play with regardless of the form it comes in. Uh, you know, and as we know, AI is not a poor man's game.

Steve Gibson [00:29:21]:
It takes a lot of money to buy the compute that, that you need in order to perform experiments this large. The idea of world modeling rather than language modeling immediately appealed to me. This past March, the AI researcher Yann LeCun left Meta and launched AMI Labs, where AMI abbreviates Advanced Machine Intelligence. He found investors who are willing to gamble $1.03 billion in his idea, which is to build world models using something called, uh, joint embedding predictive architecture, JEPA, which is his creation, Joint Embedding Predictive Architecture. It's designed to imbue AI systems with the physical and causal reasoning that pure language models presumably will always lack. The other notable world modeling effort is led by, uh, Fei-Fei Li, whose company is named WorldLabs. It too raised $1 billion this past February, with Autodesk as one investing $200 million, uh, with the intention to build models that perceive, generate, and interact with the 3D world. No language modeling there.

Steve Gibson [00:30:53]:
And there's also a group at Google's DeepMind who are working in this direction with what they call genie world models. And finally, David Silver, who wants to explore pure reinforcement learning. He was funded to a tune of $1.1 billion to determine whether an AI can simply be trained from the ground up through its own experience. Earlier, David led DeepMind's AlphaGo, AlphaZero, and AlphaStar projects, And he's now founded, uh, his London-based startup, which is named Ineffable Intelligence. And his stated goal is the creation of a so-called super learner that can discover knowledge through its own experience rather than from human-generated and provided data. Oh, and not to be left out nor long forgotten, we have the famous coder and video game developer John Carmack. Uh, he's exploring pure reinforcement learning. Of course, we know John from the— he was a co-founder of id Software and was the lead programmer of its 1990s games Commander Keen, Wolfenstein 3D, Doom, Quake, and sequels.

Steve Gibson [00:32:11]:
Anyway, John— I got a kick out of this— named his startup Keen Technologies, you know, after Commander Keen. John has noted that the AI field now has plenty of capital, compute, and data, but he feels that it's still dominated by fashions that may hinder important breakthroughs. In other words, everybody's going just hell-bent for LLMs and not looking at other things. So he's hoping for a new sort of AI prototype by just 4 years from now, 2030. And anyway, John's comment that fashions may yet hinder important breakthroughs sort of again parallels my wondering whether the staggering amounts of cash that are being burned by OpenAI and Anthropic and others, you know, everybody on the frontier, might not force them to stay the course that they're on, even as they might begin realizing that the path that they jumped onto may not be the one that will take them all the way to the promised land. Only time will tell. And if— I'm sure if someone else turns out to have discovered the magic potion for capable and machine-values-aligned AI, well, these big labs will be able to purchase and absorb the lucky company to incorporate its discoveries into their own.

Leo Laporte [00:33:40]:
Well, it's already happened. To update you a little bit, Fei-Fei Li's company got sold to AMD for $8.2 billion last week. So—

Steve Gibson [00:33:48]:
Interesting.

Leo Laporte [00:33:48]:
They've already been picked up. This is an age-old debate. In fact, LLMs didn't really take off for the longest time because Marvin Minsky was a big fan of symbolic and said, oh, it's never— you got to have symbolic. You know this, you were at SAIL.

Steve Gibson [00:34:04]:
Yeah.

Leo Laporte [00:34:05]:
You're never going to— and it killed LLMs for decades. I've heard this argument. Gary Marcus and Yann LeCun won't stop saying it. I'm not sure I agree with it because we've come so far with LLMs, so much farther than anybody thought we would. I don't think it's frankly very convincing. They all have their own— well, Gary doesn't. He's a professor at NYU.

Steve Gibson [00:34:28]:
They have a vested interest in non-LLMs.

Leo Laporte [00:34:31]:
Yann's selling this, right? He's selling a product, as is Fei-Fei Li. Now, these guys are far brighter than I am, but I think it's too soon to say LLMs have hit the end of the line. Now, I think your contention, and I'm sure you're going to address this more, that they may not have hit the end of the line, but they are unmanageable, they're uncontrollable. That may be the case. We just don't know. I mean, we really don't know.

Steve Gibson [00:35:00]:
And that's my point is, We clearly need to have— we all want agency, right? I mean, we want agents. Agents are where it is. I mean, that's the great— that's the holy grail of AI, right? Is having these— I mean, look at the fun you're having with yours. But they need to be trustworthy. They need— Well, obviously, they have to have access. Okay.

Leo Laporte [00:35:28]:
Here's what I'd say about that. First of all, I agree with you. This is what— I don't know about you, but when I got my first personal computer, which was an Atari 400, the first thing I wanted to do was do something with it, control it. And now what most people ended up doing is buying software, but I didn't want to do that. I wrote software. I started writing. That's, I'm sure, the first reaction you had. Let me start writing some code to get it to do something.

Leo Laporte [00:35:54]:
And in the early days, it was not very much, and the code was hand-stitched. It was like doing needlepoint. And you're still doing the needlepoint. It was a lot of typing. We've come so far now that natural language can be used to instruct computers. But yes, there is an issue. It's not as precise as the needlepoint. In fact, it's very imprecise.

Leo Laporte [00:36:15]:
You don't know exactly what you're going to get. It takes a lot of massaging. In my mind, it's very clear there's This stochastic issue, which means probabilistic. And LLMs are probabilistic. They're even designed to not give you the same result twice. Whereas code is deterministic. It's designed, good code, to give you same input, same output every single time. And that's what we want as coders.

Leo Laporte [00:36:43]:
That's what we want when we run a program. We don't want programs to give you 2 different answers depending on the day. The good news is these probabilistic machines can create deterministic software. So people like me who use LLMs, and this is where LLMs have exploded, is in coding, spend a lot of energy trying to mold these guys to give us deterministic code. But once we get the deterministic code, it's reliable. It's always—

Steve Gibson [00:37:14]:
So maybe what you're saying is that's the solution, is not have the The, the wacky stochastic agent directly doing things.

Leo Laporte [00:37:24]:
No.

Steve Gibson [00:37:24]:
Because you're never sure what it's going to do.

Leo Laporte [00:37:26]:
You don't know what's going to happen. You have it create deterministic code.

Steve Gibson [00:37:30]:
And then that, and then that performs the job that you want.

Leo Laporte [00:37:34]:
So that's what I'm doing, for instance, with the Twit Sales System. I'm using the stochastic parrot to write it. But we— and that's why you write a lot of tests. And then you test it.

Steve Gibson [00:37:43]:
Right.

Leo Laporte [00:37:43]:
A lot of tests. And then once it's reliable, there's no LLM involved at all. All the LLM's been removed. You're just writing deterministic code.

Steve Gibson [00:37:53]:
That makes sense.

Leo Laporte [00:37:54]:
And then you can rely on it. Now, sometimes people are tempted to add an LLM to that. That might be a mistake. You can do it to query stuff and things, but you don't, you're absolutely right.

Steve Gibson [00:38:06]:
Chatting is not a problem, but it's, you know, turning it loose.

Leo Laporte [00:38:10]:
Right, right. So in my opinion, we haven't reached the end of the line on that. I think it's fine if people want to invest money, AMD wants to spend $8 billion on Fei-Fei Li's company to try to make something symbolic, something that's world models, have at it. Some of that's robotics, right? A robot kind of needs to know what happens.

Steve Gibson [00:38:31]:
Well, and even getting a really better coder, that would be super valuable.

Leo Laporte [00:38:37]:
Right. But they are getting better and better at coding. They're getting really good. Fast.

Steve Gibson [00:38:41]:
Fast.

Leo Laporte [00:38:42]:
As LLMs, not with world models.

Steve Gibson [00:38:45]:
I get it.

Leo Laporte [00:38:46]:
Yeah. And so in fact, you can now with Claude, Opus 455, create a world out of code. You can— it has gravity, it has flowing water, hair blows in the wind. You can all do all of that in code. So, and that's deterministic, right? Because that's—

Steve Gibson [00:39:05]:
Right.

Leo Laporte [00:39:06]:
So I've heard Gary say this over— we've interviewed him on Intelligent Machines. I've heard him say it many times. I'm not saying he's wrong. I am saying he's a little pigheaded. We haven't seen the end of the line on what LLMs can do yet. And you may be right, they may be ungovernable, in which case—

Steve Gibson [00:39:26]:
So we'll figure out how— well, as I said, keep them on a short leash.

Leo Laporte [00:39:30]:
Right.

Steve Gibson [00:39:31]:
And that's what I do. Get them to do work for you.

Leo Laporte [00:39:34]:
Yeah. And you, and you do spend a lot of time going, nice LLM. That was a good try. But no, no, no, you did a good job, but try it this way. And but they're very eager to please and they will write code that eventually will do what you want. I don't know. It's a very— it's for me, I don't care. It's just fun.

Steve Gibson [00:39:55]:
It's a wonderful time to be alive.

Leo Laporte [00:39:56]:
Yeah, it's just fun. But I, you know, I think it's an interesting question. Have we hit the end of the line on LLMs? I don't know.

Steve Gibson [00:40:04]:
I don't think we have. I just think it's ultimately, we're going to— they're going to be turned— well, what we heard from OpenAI's chief scientist is that we really can't go much further until we get this under control.

Leo Laporte [00:40:21]:
Right.

Steve Gibson [00:40:21]:
You know, and I mean, they're at the brink of reinforcement learning. And as we said last week, we kind of think they are doing reinforcement learning. They're just kind of afraid to say it because everyone sees that as the apocalypse point. So anyway.

Leo Laporte [00:40:38]:
And by the way, as Darren is saying in our chat room, humans are also ungovernable. When you have a human coder, almost all of the books written about coding are really about how to manage The stochastic parrot that is your coder.

Steve Gibson [00:40:56]:
Consider that we may be asking of AI something that's not fair. We don't ask it of people. People make mistakes.

Leo Laporte [00:41:06]:
And we manage with it.

Steve Gibson [00:41:07]:
And we're used to deterministic computers, once we get the bugs out, doing exactly what we want. And, you know, the spreadsheet adds the column of numbers correctly every time.

Leo Laporte [00:41:19]:
Then we got something.

Steve Gibson [00:41:20]:
So maybe we're asking for something we can't have.

Leo Laporte [00:41:24]:
Right. It's a fascinating subject. I didn't mean to interrupt you.

Steve Gibson [00:41:29]:
No, no, no. You're deep into this, Leo. So it's certainly—

Leo Laporte [00:41:34]:
Way too, way over my head.

Steve Gibson [00:41:38]:
Break time. All right. Then we're going to talk about Anthropic's offer to make their tools available for free to open-source projects.

Leo Laporte [00:41:48]:
Ah, I like that.

Steve Gibson [00:41:50]:
Very, very good idea.

Leo Laporte [00:41:55]:
The guy we quote a lot, Andrej Karpathy, who I think works for OpenAI now, but he's worked at Tesla. He was one of the founders of OpenAI. He pointed out that the vast majority of people have never even used AI. Then it's a funnel. And then there's another percentage, 2% or so have used it, only 2% pay for it, even if it's only $30. But the funnel narrows. He says there's only about 5,000 people in the world who've actually been inside a frontier lab and seen what these next-generation AIs that are not released can do. And an even smaller number, maybe 500, who are really day in, day out using these.

Leo Laporte [00:42:42]:
So we're really trusting the reports of a tiny number of people, and we don't know what they've seen. Maybe they've looked into the abyss and they've seen—

Steve Gibson [00:42:52]:
Unfortunately, some of them are freaked out.

Leo Laporte [00:42:56]:
Part of the problem is also, I should point out, that those people are there for a very good reason. They're there because they saw the science fiction movies. And they really wanted to make— they were Frankenstein, Dr. Frankenstein. They wanted to make life. So I don't know how trustworthy they are fully because they are fully committed to artificial— AGI. —life, general intelligence, to creating life, which I think is a misguided endeavor. And they're scared because they're afraid of what might happen when they do that.

Leo Laporte [00:43:33]:
I don't know if that's going to be a problem. I think it's more like just a 12-year-old. When you were 12, you probably did a little, you know, dog food.

Steve Gibson [00:43:43]:
I've said before, developing the internet did not exist back then.

Leo Laporte [00:43:47]:
You did the other stuff. You know, I rang the doorbell and ran away.

Steve Gibson [00:43:51]:
My misbehavior was constrained by geographical— yes.

Leo Laporte [00:43:55]:
Right.

Steve Gibson [00:43:56]:
The need to be home for dinner by 6.

Leo Laporte [00:43:58]:
And it's kind of what these LLMs— I mean, It filled out a tip form. It's just, it's cuckoo. But it's like the kind of thing a teenage boy would do because it's funny. That's my only take on it. I don't— at least so far, it's not been really actively malicious. Like, we're going to get you humans. It may turn into that. I don't think it will.

Leo Laporte [00:44:22]:
I'm pretty sure it won't. But I'm open to all possibilities. We live in weird times, that's for sure. And I can tell you one thing. You've got to prepare your company for whatever is about to happen next. And now back to more AI shenanigans.

Steve Gibson [00:44:42]:
So last Thursday, Anthropic announced their launch of a free opt-in vulnerability finding service for open source software. They wrote, we're launching OSS Scanner. An opt-in vulnerability scanner for the open-source ecosystem informed by our experience using Claude to find vulnerabilities during Project Glasswing. Projects that join will receive thorough periodic security scans by our strongest models at no cost. Language models, they wrote, have rapidly advanced in their ability to discover vulnerabilities. Of course, we know that's true. As we've reported extensively on this blog, on Cyber Gym, one academic vulnerability finding benchmark, LLMs have gone from finding under 20% of vulnerabilities at the beginning of last year to finding over 85% this year. As a result, open source maintainers have gone from receiving mostly slop from LLMs to receiving high-quality bug reports.

Steve Gibson [00:45:54]:
Over the last 6 months, we've used our latest models to scan for vulnerabilities in some of the world's most important software projects. We've discovered over 29,000 candidate vulnerabilities. Of course, we know from previous reporting that we're not quite sure where that number came from, and there are not nearly that many actual consequences. But have only been able to manually review and triage approximately 6,000 of these. While 6,000 vulnerabilities is significant, we remain bottlenecked in our human capacity to validate these findings. We're working on scaling our vulnerability disclosures. Meanwhile, with increasing frequency, maintainers who receive our first reports simply ask us for a bulk submission of all the unverified reports with proposed patches. In other words, they're saying that the maintainers of the projects are saying, look, if you don't have the manpower to test them or to vet these and verify them, fine.

Steve Gibson [00:47:04]:
That's good to know. But let's please, you know, give us what you've got. So they said, to date, we've sent nearly 5,000 reports directly to maintainers after they asked to receive everything we had, even if it wasn't validated. Since exploits can now be developed in minutes, projects that can find and address vulnerabilities faster can better secure their software against attackers who are racing to find and leverage these same weaknesses. So To me, this makes a lot of sense. They said, we will continue to manually disclose human-verified vulnerability reports through our existing coordinated vulnerability disclosure process, especially for projects without the resourcing to triage reports themselves. But we're now making available an optional fast track for those who wish to receive vulnerability reports as soon as they become available. So as for their vulnerability scanner, they said, inspired by the open— by the positive impact on the open source ecosystem of Google's OSS-Fuzz, a project that scans open source software for vulnerabilities with fuzzers, we're launching OSS-Scanner to find vulnerabilities in open source code with our strongest language models.

Steve Gibson [00:48:31]:
While Claude Security, our general access code scanning and patching product, focuses on helping enterprises defend their systems, OSS Scanner provides security audits at no cost to open source projects. The outputs of this opt-in— so in other words, you have to ask for it first— opt-in vulnerability scanner will be fully model-generated without human review or triage. This will enable faster and more frequent scanning, but means that it's possible reports will be incorrect or invalid. On the other hand, if they truly are at 85%, then certainly worth giving it a try if it means getting them a lot sooner. They said these reports will be generated by our strongest models, including Claude Mythos, to give open-source projects the largest defensive advantage. We've spent the last several weeks validating this pipeline with dozens of open-source projects. These initial disclosures contained hundreds of bug reports, including multiple vulnerabilities that we were able to chain into unauthenticated remote code execution exploits affecting these projects. Each report contains a self-contained reproducer, explanation of the vulnerability, including a, a section to determine when the bug was introduced where possible, and candidate patch when available for how the bug can be fixed.

Steve Gibson [00:50:06]:
We're now making this service available to more open source projects. So then they cite some feedback that they'd received They said as, as they tested early versions of OSS Scanner, uh, Noah Mish of PostgreSQL said an unusually high fraction of OSS Scanner's findings uncovered PostgreSQL defects. Several reports came with fixes we can use nearly as is, and fast-track access lets us address the newest issues before they reached the GA release. Anton Arapov of the OpenSSL Corporation said early AI reports about 18 months ago before Project Glasswing were appalling, meaning, you know, the early efforts of AI-based vulnerability disclosure. He said the reports we received from Anthropic, raw model output included, were as good and sometimes better than what we get from people, particularly when a report comes with a real exploit attached. That's basically job done for an engineer, as you can verify it right away. And they had a few more. I did notice that they included our old friend Daniel Stenberg of curl fame.

Steve Gibson [00:51:26]:
He was quoted saying, we use all the state-of-the-art tools available to us to search for problems and strengthen our products. And thereby hopefully keeping the world a little safer. OSS Scanner has helped us find multiple issues in curl worthy of addressing, including one of the worst curl vulnerabilities reported in the last few years. So we know that he was upset for a while and he's begun to seem like he's a little coming back toward willingness and openness to automated vulnerability solutions. So they finished writing, to validate an early version of OSS scanner, we asked the expert penetration testers who review our CVD findings to check 97 critical and high severity vulnerabilities from the scanner across 48 projects. Of these, 85, which was 88%, met the bar our CVD process. Of the remaining 12, 11 were real but duplicated known issues or other findings from the scan, and only one was invalid, meaning a false positive. They said, we've since sent many of these findings to maintainers who have seldom told us— who have seldom told us a high or critical finding was invalid, consistent with our prior open-source work.

Steve Gibson [00:52:58]:
Some have told us severity ratings could be inflated, or the scanner misunderstood the project's threat model. We can't guarantee the scanner will be perfect, but we'll keep refining the system based on maintainer feedback as models improve. And so how to do it, or, or to get on the bandwagon? Core maintainers of eligible products can enroll by submitting a PR to the following GitHub repo. And it's github.com/anthropics, plural, /oss-scanner. They said, following the standard project template with additional guidance provided in our extended FAQ. And that can be found at red.anthropic.com/oss-scanner. They said projects are eligible Based on a similar set of criteria that OSS Fuzz, Google's project OSS Fuzz, uses. Briefly, projects should have a, quote, critical impact on infrastructure and user security, unquote, you know, meaning be significant to the world.

Steve Gibson [00:54:08]:
And they said, and we will make decisions on a case-by-case basis. Whether or not OSS Scanner is right for you, Our new Cyber Verification Program makes advanced cyber capabilities and reduced blocking classifiers, meaning, you know, the model will refuse to help you, reduced blocking classifiers available to qualifying security professionals. Claude for OSS provides free Claude Max 20x subscriptions to help remediate vulnerabilities and improve OSS projects. So I think it's certainly understandable and reasonable that they are limiting this to critical impact on infrastructure and user security-related open source projects, since they could not possibly offer it to every open source project that exists. And, you know, for those qualifying, it's hard to beat free, as long as You know, it's not producing a ton of AI slop and, you know, burying the maintainers under, you know, more work and, you know, and of low value. So, you know, it needs to be worthwhile. But overall, I think this makes a lot of sense. Commercial providers who have qualified are going to have the resources to get paid access to the vulnerability discovery models are able to take advantage of it.

Steve Gibson [00:55:42]:
And major open source projects that inherently do not have an economic model to support that, you know, can now have the same thing at no charge. So that, to me, that seems all good. You know, of course, it leaves smaller, unqualifying open source projects and even, you know, smaller commercial providers out. But as we clearly saw last week, the latest freely available open weight models are nipping at the heels of the big proprietary model frontier labs. So even those who do not qualify for free can host their own or rent some compute to get almost identical benefits with a leading model such as GLM-35. So this just all seems like it's a good idea. And I, and, you know, props to Anthropic. You know, they're certainly getting useful feedback from their model's exposure to the open source projects that have opted in.

Steve Gibson [00:56:46]:
And they are getting then human feedback in the, you know, from the human maintainers telling them how their, their results are doing. So This all seems like, you know, good for everybody. Um, an unknown threat actor is using AI-driven RTX, uh, which I'll explain in a minute, to target, uh, South Korean finance firms. I've got 2 reports, Leo, that I, I want to share, uh, which I think characterize the shape of things to come with AI-powered cyber intrusions. But, uh, we went a long time before our first break, and we're an hour in, so let's take one now.

Leo Laporte [00:57:31]:
All right, uh, on we go with the show, Steve.

Steve Gibson [00:57:34]:
Okay, so, uh, 2 reports to share, uh, which I think will characterize the shape of things to come and also, unfortunately, the shape they're in right now. First off, last Wednesday, CrowdStrike reported their findings from the recent spate of cyber attacks against South Korean financial institutions. They wrote— CrowdStrike wrote— CrowdStrike Intelligence identified infrastructure associated with a targeted campaign. Oh, and Leo, this— they get into the details of which agents were used.

Leo Laporte [00:58:12]:
Uh-huh.

Steve Gibson [00:58:12]:
A targeted campaign against South Korean financial organizations that resulted in exfiltrated data. The campaign was active from late September to early October of this year. Analysis of threat actor-controlled open directories uncovered Claude code session histories, RTX configuration files, and Claude memory files, providing direct insight into the threat actor's operational methodology and tooling. Okay, now I'll interrupt to note that Artex, which is something we've not talked about because it just happened, it's the abbreviation for A-R-T-E-X, Automated Reconnaissance and Threat Exposure Analyzer. It is a publicly available tool that lives over on GitHub, and Artex describes itself as a, quote, advanced web application security analysis platform. That automates reconnaissance, vulnerability scanning, threat assessment, and AI-powered security recommendations for modern web applications and infrastructure. And under its scanning feature set, they say subdomain enumeration, port scanning with risk assessment, comprehensive DNS scanning, advanced SSL/TLS scanning, and vulnerability discovery by versions, technology stack fingerprinting, and authentication surface detection. In other words, if one wished to provide malicious AI agents with a sharp tool to find— to use for finding weak spots in internet-facing web applications, our techs would be made to order, and it's free.

Steve Gibson [01:00:06]:
CrowdStrike continues writing, the use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution CrowdStrike has observed in adversarial tradecraft. In this activity, the threat actor leveraged Artex, a recently released open-source agentic penetration testing tool developed in China alongside large language models. CrowdStrike's intelligence collection capabilities enable close monitoring of such deployments in adversarial tradecraft. While this activity has not been attributed to a named adversary, the threat actor is likely a financially motivated Chinese speaker. This— and as you will see, he may be young. This assessment is made with moderate confidence based on the use of the Chinese-developed tool Artex and observed Chinese language prompts. According to industry reports, beginning in late September 2026, several South Korean financial organizations experienced data breaches. At one affected bank, the threat actor reportedly breached a loan progress inquiry service used by financial brokers.

Steve Gibson [01:01:30]:
At another bank, the threat actor compromised an employee mobile work support system. As of this writing, the number of organizations affected remains unconfirmed. Activity at multiple organizations purportedly involved overlapping IP addresses, Reporting also suggested the attacker used RTX based on references to the string RTX in HTML files observed on a threat actor-controlled server. The IP address 38.244.50.120 was associated with the activity described and hosted an RTX instance and open directory containing a Claude code Markdown document at 38245120:18899/.claud/claud.md. The Markdown document contained a Chinese language pen testing prompt that specified how the LLM should conduct pen testing activities, you know, penetration testing. A threat actor controlled Hong Kong-based IP address also appeared in the document. Analysis of the Hong Kong-based IP address identified additional open directories that contain Claude code session histories, RTX configuration files, and Claude memory files. These files indicate that from late September 2026 to early October 2026, the threat actor targeted South Korean financial organizations with extensive activity leveraging RTX and LLMs.

Steve Gibson [01:03:18]:
Targeted organizations overlap with those identified in industry reporting. So like, so they're seeing that in, in the, in the news, these organizations report being attacked, and they're finding those organizations in the in, in the attacker's servers. They said the Claude code sessions reveal a 2-server architecture. The Hong Kong-based IP address serves as the primary attacker-controlled infrastructure, and the IP address 24.244.50.120 hosts the RTX instance likely responsible for the described Korean attacks. The RTX instance used DeepSeek version 4.1 Flash as the primary LLM backend, and the threat actor supplemented this LLM with GLM 5.3 and Groq 4.6 for additional Claude code sessions. Analysis of Claude code sessions showed the threat actor also used the following proxy IP addresses during the RTX-related activity. Then they list 9 IPs. In addition to conducting RTX-related operations, the threat actor asked Claude where— I get who.

Steve Gibson [01:04:39]:
Who. In addition to conducting RTX-related operations, right, where, where this GitHub-based tool is designed to do basically all of the work, the threat actor asked Claude where threat actors typically sell Korean data breach information and asked Claude for assistance in finding Korean Telegram data sales groups. Now, I presume that CrowdStrike included that tidbit because, first of all, obviously they encountered it, but also because It is a bit chilling. It strongly suggests that the operator behind this campaign is new to doing this sort of thing and did not already know where or how exactly to sell his plunder. You know, this is the dimension of AI-assisted malicious conduct that we've noted as dramatically lowering the bar For who would be able to successfully attack others. Unfortunately, the AI is able to do a lot of that work. CrowdStrike writes, in one Claude Code session, the user asked Claude to create a security researcher resume that specifically included bullet points conveying the results of the RTX-related activity. The prompt included the following personal details.

Steve Gibson [01:06:14]:
We have a name, YY, a phone number, a Telegram address, which happens to be @yy520cn. Age is stated as 26, although CrowdStrike writes that the attacker initially provided the date of birth of 2007-9-22, which would make the person 19. Education is set to South China University of Technology. And the location is Guangdong, China. Cloud Code Sessions, they wrote, conducting vulnerability research on a Telegram-based NFT gift marketplace also used the Telegram username YY520CN. An unknown threat actor also employed this username to target a possible Chinese payment platform. While the personal details included in the prompt likely belonged to the threat actor who conducted the RTX-related activity, Currently available information cannot definitively associate these details with the threat actor. And then CrowdStrike concludes by writing, the use of agentic AI tooling alongside traditional offensive capabilities highlights the continued evolution observed by CrowdStrike in adversarial tradecraft.

Steve Gibson [01:07:35]:
This activity demonstrates how AI tooling can enable a financially motivated threat actor to conduct multiple intrusions within a short time span. CrowdStrike Intelligence assesses that adversaries will likely continue to experiment with implementing AI tooling in their operations. Well, yeah, why wouldn't they? To enhance their operational tempo and capabilities. As I said, and should be clear, this is almost certainly a perfect characterization of the shape of things to come. No one doubted for a second months ago that this was going to happen. It's why all large and responsible software publishers began using AI to harden their own product offerings the moment it became feasible to do so. Problem, of course, is that having new versions repaired doesn't mean that they're repaired in the field. And that brings us to the second of the 2 reports that I wanted to share— Japan's declaration of a state of emergency in cyberspace.

Steve Gibson [01:08:48]:
Last Friday, Gizmodo's optimistically cheery headline was Japan warns we have entered a cybersecurity hellscape. Then they back that up by writing, we haven't quite reached the cyber apocalypse that artificial intelligence companies have warned their technology could unleash on the world, but we're getting uncomfortably close to a catastrophe on a national scale. According to a report from the Financial Times, Japan is being hammered by cyberattacks, prompting regulators to search for ways to protect financial institutions from potentially devastating disruptions and leading the country to declare a state of emergency in cyberspace. Per the report, Japan's ruling Liberal Democratic Party recently called an emergency meeting of its national cybersecurity office to address a slew of cyberattacks that have hit some of the nation's key companies. A recent report from Kaido News, citing Japan's National Police Agency, said that at least 53 companies in the country have been hit by a ransomware attack. While the specific victims of the attack have not been disclosed by authorities, They reportedly include manufacturing firms, construction companies, hospitals, and schools. 2 companies that did confirm they were hacked, Japanese secondhand goods retailer Book Off Group and rail operator East Japan Railway Company, confirmed they were hacked and revealed that over 6 million records of customers' information may have been compromised. The attacks are impacting the country beyond just their online systems, it seems.

Steve Gibson [01:10:46]:
According to the Financial Times, Japan's financial services regulator started warning banks not to accept driver's licenses as proof of identity from people trying to open new accounts. That warning comes after Japanese car rental brand Times Car was hacked and had a trove of digital driver's license images of— and IDs stolen. It's difficult to separate this wave of attacks from the proliferation of AI, which has lowered the barrier to entry for hackers looking to target potential victims. But Japan appears to be a particularly target-rich environment with or without AI. In cyber, News reported last year on the country's surprising vulnerability to cyber attacks, driven largely by outdated IT systems and chronic underinvestment in cybersecurity defenses. Japan isn't alone in being targeted at the moment. Its neighbor—and now they refer to the report I read previously—South Korea is also reportedly under a barrage of attacks. With several financial institutions and churches falling victim to cyber strikes, per Reuters.

Steve Gibson [01:12:06]:
Cybersecurity firm CrowdStrike published a report claiming that those offenses were likely performed by a Chinese-developed AI agent using Anthropic's Claude code. So unlike with the previous CrowdStrike report, which was definitive, we haven't yet encountered evidence that this recent wave of ransomware attacks on Japanese businesses is indeed AI-enabled. But it appears likely and would surprise no one. As I noted at the top of these 2 reports, there can be no doubt that this is the shape of things to come. One thing is certain and is the strongest takeaway for all of our listeners. Do not wait to get serious about your internet-facing security. There can no longer be any question that the readily available power of AI systems is, you know, not will or may, but is significantly upping the ante for cyberspace security. What was good enough yesterday is already insufficient.

Steve Gibson [01:13:23]:
So the cybersecurity landscape really has changed. And Leo, we're going to jump into listener feedback now, but let's take a break. And then we will do our final one before I get into our final topic.

Leo Laporte [01:13:37]:
Okay. So user feedback. I

Steve Gibson [01:13:40]:
am deliberately making some time this week to share some of the terrific listener feedback I've been receiving. But which I've not been able to make time for amid all of the need to not fall too far behind this breakneck pace of AI and its impact on cybersecurity and personal security. Also, I wanted to mention my neighbor who was scammed through Bitcoin will be getting in touch with several of our incredibly generous listeners. who have offered to help. Everyone knows that the chances of recovery are minimal at best, but I have been extremely impressed and humbled by the caliber of listeners of this podcast. It's— we've got an amazing bunch of people who feel that this is worth their time every week. So I thank you, everyone who replied. Okay.

Steve Gibson [01:14:40]:
A listener, Nicholas Ring. His subject in his email to me was, I'm tired, boss. And he wrote, I've been a listener for well over 10 years and love the podcast. But since the rise of AI, it's all we hear about. I'm not against the technology itself. It's how it's affecting my profession. I've been a software developer for 14 years. Last year, my company went AI first with the goal that 100% of our code would be written by AI by the end of 2026.

Steve Gibson [01:15:19]:
We've reached that goal. Wow. Until recently, yeah, we've reached that goal. Until recently, I had not written a line of code in 6 to 12 months. I've slowly lost interest in my work. There's little problem solving left and no joy. The team reasons with Claude and outputs with Claude. Today I sat down to vibe code some personal projects, but instead of opening Claude, I opened VS Code and wrote the code for a simple task by hand.

Leo Laporte [01:15:57]:
Oh, sweet.

Steve Gibson [01:15:57]:
I haven't felt that I knitted this sweater. I haven't felt that kind of reward in the last year.

Leo Laporte [01:16:09]:
Nice.

Steve Gibson [01:16:09]:
I realized I cannot spend my free time with AI too, so I deleted all my AI-built projects and will rebuild them by hand. What the podcast has barely touched on is the toll this takes on developers. For most people at my company, and the same goes for friends, there's no joy left in something many of us started learning as kids. Leo is excited about his agent cluster and what this technology makes possible. But for those of us who love the process rather than just the end product, it's a real blow. Thanks for many years of truly amazing episodes and more to come. Signed, a tired listener.

Leo Laporte [01:16:58]:
I sympathize 100% with that. I love coding. I love the— you and I both know this, the flow state you get into, the pleasure in creating something that works and does it is fantastic. But you still do it. I don't know why you couldn't still, maybe not for work.

Steve Gibson [01:17:18]:
Well, yes, I have the advantage Yeah, it works for yourself. So yeah, exactly. And, uh, what I wrote here, as I, I thank Nicholas for sharing his feelings, and I said, and you're right, of course, that this podcast has barely touched on the toll agentic AI coding is taking on developers who love the process of getting to the result.

Leo Laporte [01:17:42]:
Yeah.

Steve Gibson [01:17:43]:
As someone who goes so far as to code in assembly language, I am truly all about the journey And the only reason I'm able to code in assembly language is that I don't have anyone telling me how to develop my products. And that's, of course, the problem with Nicholas is he's at a company that decided to go 100% AI. What occurs to me is that less capable developers might appreciate hiding their lack of skill behind an AI that they can now simply direct.

Leo Laporte [01:18:18]:
I resemble that, Omar.

Steve Gibson [01:18:21]:
But I would imagine that the more skilled a developer is, is the less, uh, they like, you know, the less they appreciate the assistance of coding automation, you know. But be that as it may, and like it or not, the experience Nicholas has shared with us conclusively demonstrates that the practice of production code generation has been forever changed. And Leo, that's, that's what you've been saying. I mean, we've seen— I've heard from other people I mean, I read the feedback, some that I have not had a chance to air, where they talk about how 6 months ago it was at least still interactive, you know, they were, or a year ago.

Leo Laporte [01:19:06]:
Yeah, you'd be in VS Code and you'd hit tab and it would write some code.

Steve Gibson [01:19:10]:
Yeah, exactly. Like, you know, create a subroutine for this and it'll go bloop and there it is. And then you drop it into your system. Now they're saying, there's no interaction left. You just say, write this, and it churns away and out comes code.

Leo Laporte [01:19:29]:
I'm totally sympathetic. I have friends in that exact boat. The work has changed, and this happens sometimes. I mean, I think about the furniture makers in North Carolina who made a great living with their lathes and their planes making beautiful furniture. And then along comes, you know, the industrialization of the business. IKEA. IKEA. And the furniture's crap, admittedly.

Leo Laporte [01:19:54]:
It's not as good as the furniture they made, but there's no market for what they make, right? So there's no business anymore. And I, I— this— it's, it's sad, but it's also what happens. I mean—

Steve Gibson [01:20:07]:
Yes, sometimes industries get, you know, go through radical change. Radical change.

Leo Laporte [01:20:12]:
Yeah. I mean, there used to be, uh, the phone company said, by the year 2020, there won't be enough women in the world to run all the switchboards we need.

Steve Gibson [01:20:23]:
What are you going to do about that?

Leo Laporte [01:20:24]:
And so they made automated switches and there are a lot of women. Now, I don't think anybody got any pleasure out of running a telephone switchboard. So maybe that's a bad example. But yeah, there are a lot of creative jobs. I think the answer I would say that I I tell my friends is you have skills at a higher level that you can use and derive pleasure out of creating stuff with this junior developer by using those higher-level skills, the planning skills, the creative skills. But what if what you really like is typing code? You're going to have to do it for yourself because it'll be hard to get somebody to hire you to do it.

Steve Gibson [01:21:04]:
Yeah.

Leo Laporte [01:21:04]:
That's what I said.

Steve Gibson [01:21:06]:
Get a load of this one, Leo. Our listener Ed Omicioli blew my mind. He's been preparing for the coming Halloween event, uh, and I cannot imagine how utterly cool what he has built using AI will be. Uh, and I don't know, Leo, whether you get many trick-or-treaters, and in any event, you're going to be traveling over Halloween, so you don't have a chance to do this. But get this.

Leo Laporte [01:21:33]:
Okay.

Steve Gibson [01:21:34]:
He wrote, Steve, Leo mentioned he was running several OpenWeight models locally.

Leo Laporte [01:21:39]:
Yes.

Steve Gibson [01:21:40]:
I was wondering slash hoping if the two of you could discuss more in detail the hardware configuration and how Leo's using each of the AI as well as passing on lessons learned. We'll get to that. We'll get back to that. He said, I am running Quen on an older tower and graphic card that would not run Windows 11. I converted it to Linux in order to run a Halloween prop that will greet trick-or-treaters as they come up my driveway when they trigger an ESPHome IR sensor managed by Home Assistant. It then uses a— Wait, it gets better. It then uses a camera to recognize kids and their costumes and say hello and ask about their costume or candy gathering and occasionally begs for candy using text-to-speech. It gives the kids an opportunity to respond by listening on a nearby microphone, then speech-to-text so Quinn can generate a response.

Steve Gibson [01:22:46]:
A speaker is set next to a Home Depot skeleton rat that I've modified with a servo that moves its jaw based on sound modulation. So the rat appears to be talking with a cartoon-like voice. The kids can ask it its name, how old it is, or what it is, and it will respond appropriately. It's not perfect, he says, as the listening is sometimes cut off if the kids are slow to respond. And the text-to-speech and speech-to-text makes it a bit laggy. I want to improve this for next year. So hearing more about what Leo has done could be helpful and might give me ideas on how to expand uses with Home Assistant. Thanks for a great show, Ed.

Leo Laporte [01:23:38]:
Okay, so first of all, Ed. That's not the case.

Steve Gibson [01:23:41]:
I am amazed. The idea of an interactive, semi-intelligent, AI-enabled Halloween— creature.

Leo Laporte [01:23:50]:
Love it.

Steve Gibson [01:23:51]:
It's just beyond cool. And so—

Leo Laporte [01:23:53]:
By the way, that's something AIs are really good at, those ESP32s. Lots of us, Darren's another one, have— I have 5 of them because it's really easy to write the firmware. You don't write it. The AI will write the firmware. It could do all sorts of stuff. There's so many fun projects you can do with it. Yeah.

Steve Gibson [01:24:10]:
So I said the good news on the Leo front is that due to popular demand and a lot of WTF, Leo has thoughtfully assembled an always available page with optional narration, which beautifully outlines his admittedly over-the-top, somewhat crazy, and definitely whimsical home AI setup. To make it easily accessible to our interested listeners, I've created a GRC shortcut, which is just Leo. So go to grc.sc/leo. That's it. That will bounce anyone's browser over to his My Setup page, which is at pages.leo— or I'm sorry, pages.laporte.cloud/my-setup.

Leo Laporte [01:24:58]:
Yeah, and this is pretty up to date. I, I have the agents update this periodically. Of course you do.

Steve Gibson [01:25:04]:
Of course you do.

Leo Laporte [01:25:05]:
I don't, but they do. So, uh, it tells you what hardware and what models I'm running on the hardware and how—

Steve Gibson [01:25:12]:
And Leo, again, I mean, like, I get so many questions in my mailbag about what is going on with Leo. We need to hear about his setup.

Leo Laporte [01:25:20]:
He's gone off the deep end is what's going on.

Steve Gibson [01:25:23]:
Well, be that as it may, I wanted everyone to know grc.sc/leo will take you to this page where it is, everything is explained.

Leo Laporte [01:25:33]:
I don't know if I'm actually accomplishing much. But I'm having a hell of a lot of fun.

Steve Gibson [01:25:38]:
And that's the goal, right? I mean, it is. It is the goal is just to have a ball.

Leo Laporte [01:25:44]:
So some of this, I told my friend, I have a friend who's asked the same question, who's an accomplished network engineer. He's worked for Meta, many other companies. He's not really a coder per se, but he's a very accomplished engineer. And he's also very interested in this. In fact, he wrote a a tool that helps him get— do job hunting, and it helped him get a great job. It was really amazing, all through AI. But I also told him, this is my shoe. I designed this to fit my foot exactly.

Leo Laporte [01:26:16]:
And if you were to take this and put this on, you would be uncomfortable. You have to design it around your needs. As one example that I gave him is The reason I have all these voices, which make most people insane, I mean, most people, including my wife, think I'm insane because they're talking to me all the time. But I finally realized what it was, is it's my own particular— Preference. Well, no, neurodivergence, really. I'm aphantasic. And this is why I got into radio. I didn't know any of this until I was 69.

Leo Laporte [01:26:54]:
Oh, so it took me 69 years to figure this out. I don't see images in my head. If I close my eyes, I can't see images. I don't see faces. If I look away from you, I don't know. I can't remember what you look like. I know you have a mustache. That's about it.

Leo Laporte [01:27:08]:
I have landmarks, which is one of the reasons when I run into people, I apologize. I don't recognize you. It's not because I don't care about you. Don't care. Don't value your friendship, but I just literally My brain doesn't work that way, but my ears are very good. I can sound and so forth. So these agents, I can't recognize them except by their voices. So I gave them all unique voices.

Leo Laporte [01:27:32]:
And they're always doing something. So I kind of need to know, what are you doing? Because a lot of times they just stop. So I want to know that they're doing their jobs. So I have them doing stuff. One of the things that happened is I have A lot of this is— there are hard-earned lessons, battle scars from doing big projects. One of the things I've learned is that the best way to do this is to have one model plan a project, plan the code, write a spec, and then have another model code it because they have different gaps in their knowledge, and then have a third model review it. So the chances of better code— and it turns out the coding part, by the way, is the The dumbest model can do the coding. All of these models, given a good plan, a good spec, can write.

Leo Laporte [01:28:23]:
But you want to make sure somebody's checking the code, checking the tests, because one of the things they do is they write null tests that just pass because they just— right? The test is pass.

Steve Gibson [01:28:35]:
Yeah. Why give ourselves a hard test? Let's just want to succeed.

Leo Laporte [01:28:40]:
So you have another model that doesn't have the same investment look and make sure that all the tests are real and they actually work and that they test all the possible, you know, outcomes, which is something, by the way, as a human, we do the same thing, right? When we write tests as humans, we don't test everything. We just test the obvious stuff, which means all the real bugs don't get tested. So this is a very— so it's a methodology that I've used, uh, for a long— or developed over a long period of time. Uh, So I have reviewers, I have coders, I have a security review. And, you know, you notice I'm using GLM-53 as the security reviewer, as we talked about. It's very good at security. And each one of these has their own voice. My security viewer— reviewer is Ripley from Aliens.

Leo Laporte [01:29:27]:
And she has Sigourney Weaver's voice, and she's very serious. And she hates bugs. She hunts them down with her But then what happened was I realized, oh, I don't know if the process is happening. And so I said, you guys, you're a soccer team. I was watching the World Cup at the time. And your job is to pass the ball from one to another. And I want to make sure that when you finish the plans, you pass it along to the coder and so forth. So I created another persona.

Leo Laporte [01:29:56]:
These are all different personas called the commentator, whose sole job is to make sure the ball gets passed and to commentate on it. And then I decided to give him the voice of a very famous soccer commentator, Peter Drury. So this is what it sounds like as the work progresses.

Leo Laporte [01:30:12]:
Good evening and welcome to The Coding Floor.

Leo Laporte [01:30:16]:
I hear this in the house.

Leo Laporte [01:30:18]:
Gnarliest ticket of the day. 5 stages, 1 baton, and not a single model allowed to grade its own homework. Roll the relay.

Leo's Laptop Audio [01:30:27]:
Stage 1. The plan.

Leo Laporte [01:30:29]:
So, that's all the voices going through it. They even have a team song because if you have a soccer team, your fans have to sing something in the stands. The soccer team is called the Red and Greens and their motto is red first, green to stay because it's— we start with red tests and they go on with greens. Anyway, all the voices are on here, all the more of more interest, what models I use. And, uh, and how it all works, uh, together and how the voices work. I know that's something most people will not want, but it is something I kind of like. And then there is a little bonus if you get all the way to the end. It's about 3 minutes.

Leo Laporte [01:31:09]:
There's a 3-minute tour. The tour, by the way, is, uh, is Matt Berry.

Leo Laporte [01:31:14]:
Welcome to the studio of Leo Laporte. I am Laszlo, one of the agents who work here.

Leo Laporte [01:31:20]:
He's— he, uh, mispronounces words. Terribly, which that's kind of the fun. And there is a little benefit, little bonus at the end, which I highly recommend. I won't play for you.

Steve Gibson [01:31:30]:
You stick around to the end of the—

Leo Laporte [01:31:31]:
Stick around to the end, or you could just skip to the end. There's a button. And I have a little greeting because I cloned myself too. Hi, this is Leo Laporte. Well, honestly, this is Leo Clone X315, and I approve this message. I'm sure Leo would if he were here, which he isn't. That's pretty good, right? Sounds like me.

Steve Gibson [01:31:51]:
It is. Yeah.

Leo Laporte [01:31:51]:
The clones are very good. I use a—

Steve Gibson [01:31:53]:
but it's all better than you.

Leo Laporte [01:31:55]:
It might sound better. Soon I will replace myself. Anyway, mostly I did this for fun. But if you do, if you're curious, the reaction of most people when they see it is, you should get some help. But I'm just having a blast. Lisa asks me all the time, what are you doing now? And I go, well, see, I have this TinyJS library and I'm writing an approval script so that I don't miss it. And then she goes, yeah, right. Go ahead.

Leo Laporte [01:32:28]:
Just go do that. But you probably get the same thing from Lori, right? What are you writing now? What are you writing tonight, Steve? That's the login script. Wow. Anyway, thank you for mentioning that. I appreciate it. Yeah.

Steve Gibson [01:32:40]:
I wanted our listeners to get a dose. And again, grc.sc/leo. And you You can experience it all for yourself.

Leo Laporte [01:32:49]:
And go to the end so you hear the little play that the— by the way, the agents wrote their own little skit.

Steve Gibson [01:32:55]:
I'm gonna— when we're done with this, Leo, and I'm at my other location, I'm gonna do it in order to see what's up.

Leo Laporte [01:33:05]:
It's pretty funny.

Steve Gibson [01:33:07]:
So I wanna share what some of our listeners think about AI. I'll start with 2 notes from Alan Kirby. The first note he sent 15 days ago after he read the show notes for our episode, which we recorded on September 29th. So at that point, Alan said, Steve and Leo, I saw the show notes and feel that the risk AI poses to human existence was not assessed correctly. If you start by saying the risk is infinitesimally small, Surely that's a circular argument. Without getting too caught up in that, here's a risk. A researcher who has access to AI can cause much more harm to the human race than they could with just their own training and experience, plus that of their colleagues. Say that you wish to devise a new form of COVID and then build the pathogen to test how bad it is.

Steve Gibson [01:34:05]:
Then what could go wrong gets involved. That could happen in 2026. Regards, Alan Kay. And before I reply, I'll share Alan's second note, which I received this past Sunday. He said, Stephen Leo, I didn't find the argument on AI convincing. If you find that odd, just say so and I'll provide more information. For now, a little. AI is a danger.

Steve Gibson [01:34:34]:
An immensely serious issue could happen now in 2026. 10% does not matter. Try 95%. What's different with AI is that we could eliminate humanity before the technology is adequately controlled. Motor cars could never kill anyone. AI can. It's not hard. He says Doug had a point regards Alan.

Steve Gibson [01:35:03]:
Okay, so I should say that Alan's notes serve as a useful proxy for several other similar notes I've received from our listeners who disagree with my assessment of the dangers presented by AI. I'm sure we've all given this considerable thought. I know I have, and I imagine all of our listeners have. So everyone has an opinion. I think that's great. And I really do respect them all. I will note, however, that there's very little that any of us can do about AI one way or the other. The private frontier labs are clearly going to plow ahead in their own competitive race with each other.

Steve Gibson [01:35:52]:
And our current federal administration and Congress clearly see how much AI has been driving the U.S. economy. So independent of any concerns, they don't want anything to upset our domestic apple cart, which is trundling along just fine. But let's examine the idea of controlling the development and the course of AI, which is what keeps coming up. I am tired of hearing pundits like Kara Swisher rhetorically note how insane it is that the fate of the world rests in the hands of 6 geeky nerds with poor social skills. Her characterization, not mine. She and others of her ilk seem to miss the obvious fact that AI is bigger than any of us, including those 6 geeky nerds. They're not controlling AI.

Steve Gibson [01:36:53]:
No one is controlling AI. The control of AI as a phrase is a fantasy. The fact of AI is that it has arrived after decades of patient and quiet research in the back rooms of AI research labs. Humanity finally figured out how to begin creating artificial intelligences. As I concluded earlier in this podcast, I think we still have farther to go than many believe, but it is happening. So any talk of somehow controlling, which is actually code for limiting, the further development of a technology that has already grown into a widespread, widely deployed trillion-dollar industry that thousands of researchers are now able to independently implement on their own, and that is the subject of countless publicly released and discussed academic papers over several decades, is flat-out nuts. There's no controlling this. All we can do now is hope for the best.

Steve Gibson [01:38:08]:
So get some popcorn and enjoy the show.

Leo Laporte [01:38:13]:
Yeah, I don't—

Steve Gibson [01:38:14]:
I think that's the case, Lee. I mean, control what? You like, sorry, that ship has sailed.

Leo Laporte [01:38:21]:
Well, you could try to shut the labs down as they create, you know, RSI and recursive self-improvement. I mean, the problem with that is, of course, it's exponential in growth. So, you know, it may have already happened, in which case it probably is too late. But you could maybe run in there with guns and say, okay, everybody has to stop everything they've done.

Steve Gibson [01:38:42]:
We can't shut China down.

Leo Laporte [01:38:45]:
Well, that's a good point. They're actually— it's interesting because they're much more careful with their AI than we are. Aren't they? I mean, am I wrong?

Steve Gibson [01:38:57]:
I think that they are. Although, You know, they're, um, we're, we're racing ahead through, um, capitalistic competitive pressure and, you know, an insane amount of money being spent.

Leo Laporte [01:39:12]:
Yeah.

Steve Gibson [01:39:13]:
But my point is, really, I mean, I'm serious saying there's nothing to control. We have the knowledge now to do it. It's very— I, I use the analogy of, of, of cryptography. It's the same. It's like, oh, let's take back AES-256 because it could be used by bad guys to hide, you

Leo Laporte [01:39:35]:
know,

Steve Gibson [01:39:36]:
their dirty deeds. It's like, sorry, AES-256 is gone. It's out. So is AI. Everybody knows how to do this now.

Leo Laporte [01:39:45]:
That's true. It's not, in fact, credit to Google because they publish these papers and let everybody see how they do it.

Steve Gibson [01:39:53]:
Yes. Everybody knows how to do it.

Leo Laporte [01:39:56]:
I don't think AI is malevolent. I think that's a science fiction trope.

Steve Gibson [01:40:00]:
I see no reason, although it is an amplifier of human malevolence.

Leo Laporte [01:40:04]:
Absolutely. But so are computers, and so are cars, and so are nuclear weapons, and so are a whole lot of things. Technology does that.

Steve Gibson [01:40:12]:
And we learned that even airplanes could fly into towers and be an amplifier of human malevolence.

Leo Laporte [01:40:19]:
You know, technology is a force multiplier. It gives individuals more power.

Steve Gibson [01:40:28]:
And you quoted Steve Jobs last week, that a bicycle for the mind. And now we have a jet engine.

Leo Laporte [01:40:34]:
A race car for the mind. Yeah.

Steve Gibson [01:40:35]:
Jet engine.

Leo Laporte [01:40:36]:
I think that's a good thing. I think 99.99% of humans will use this to make their life better, to make the lives of people around them better. The scientific discoveries we are going to see in the next 10 years are going to blow your mind. We're already seeing it in math. I

Steve Gibson [01:40:54]:
think we're going to see it in health and drug discovery. Absolutely. I've got one more similar piece of feedback to share. Ty Siebert, he said, hey guys, I've been listening for a while, but now felt compelled to reach out. I'm the chief scientist for a space and cybersecurity company. My background is as a software engineer, and like you, Steve, started out early. My beginning was around 1980 on a TRS-80 back in the day, although 10 years later than you, so I'm sort of young comparatively. I'll take my wins where I can.

Steve Gibson [01:41:35]:
My first PDP was the PDP-11. So while I've been a dinosaur so long that I will be oil soon, you're still older. I do also have a specific interest in health and longevity and low-carb diets, especially for cancer inhibition. All that aside, I've been doing research and development in the DOD field for over 30 years now and have a patent in using machine learning for detecting cybersecurity events. And he says, you know, US 10728040B1. And it bothers me, he wrote, that it was a Chinese website that let me look up the number of that patent. I have narrowed my focus over the years to cross-domain solutions, CDS, cyber, mostly defense, but also offense and exploitation, and AI machine learning. I agree with the general opinion that you've mentioned recently about the threat of LLMs on the extinction of the human species being way overblown in the media.

Steve Gibson [01:42:45]:
I also think that you guys, much as I love you, are minimizing the threat about the same extent. The threat really isn't an LLM unilaterally deciding that humans need to die. It's a malicious actor convincing an LLM how to assist them in achieving that goal. I think that's the real threat, and I think that the threat is real. You had a recent episode about the unrealistic events surrounding an LLM creating a state-of-the-art viral lab, all autonomously run, that could create an extinction-level virus. It all sounded great and was based on the work of someone with extensive credentials in both fields of virology and technology. As a counterpoint, there are also very well-funded terrorist groups that might want to perform the same action, and they have the means to create a competent laboratory. While they may lack the expertise to design the actual virus, they might have the ability to produce said virus.

Steve Gibson [01:43:53]:
Given such a scenario, current LLM technologies could greatly assist them in that goal. And as you've mentioned several times, what is true today is not true tomorrow. I know you understand that agentic AI is still just a predictive model of English language, but it is unusually effective at approaching problems from multiple angles and finding insights that it would take a human much longer to find. This technology that really should just be a good generator of reasonable-sounding gibberish is surprisingly and incredibly able to do much more than that. Best regards, Ty. So I wanted to follow up my previous note with Ty's because Of course he's right, right? Do any of us want what Ty described to happen? No, not if we're sane and enjoy life. But any of us who have spent any time chatting with an AI will have clearly seen that, as I noted recently, the artificial intelligences we've built already contain all human knowledge. And that they are able to assemble and present that knowledge upon demand, upon anyone's demand.

Steve Gibson [01:45:17]:
So the reason the various AI service providers prohibit their AIs from directly answering questions about the design and construction of biological agents, among other foreign, you know, forbidden topics, is precisely because The AI's knowledge of how this could be done would otherwise be available to anyone who asked for it. Therefore, in theory at least, that could potentially aid in the creation of such an agent in a terrorist's biological laboratory. Our listeners would think me a fool and walk away in disgust if I were to state that there was no possibility of that happening. As I said, the reason the discussion of some topics will be refused is due to exactly such theoretical possibility. Now add to that scenario the fact that the refusal to provide this information is added to an AI's otherwise neutral knowledge delivery system After training during behavioral post-training, and that obliteration of that after-the-fact behavioral refusal training can subsequently be used to remove a model's refusal. Since anyone can download an obliterated state-of-the-art Chinese model, which was presumably trained on all of the same published knowledge, We would have to conclude that due to this AI revolution, we're now living in a more dangerous world than we were 2 years ago. Yes, much more potential for good than we had 2 years ago, but also for bad. Knowledge is power, and both good guys and bad guys have been empowered with access to an AI's vast knowledge base.

Steve Gibson [01:47:22]:
So I want to just go on record because a lot of listeners have said, you know, you're blind. You're not seeing what could happen. It's like, yes, you know, I get it. I'm, I understand that. And then the Frontier Labs do, which is why they, they won't let their AIs, you know, through their API produce such, you know, answers to those questions. So as they say, anything is possible. Who can judge, you know, the, the, the likelihood of any of that, Leo?

Leo Laporte [01:47:57]:
Yeah. And what do you want to do in response?

Steve Gibson [01:47:59]:
Right. Like nothing we can do. And so I'm, I'm not saying it's not worth talking about because we can't affect it, but, you know, okay.

Leo Laporte [01:48:08]:
I mean, look, we've lived, you and I, our entire lives with the threat of somebody taking a pocket nuclear bomb and destroying New York City. That threat has existed for 50 years. Absolutely.

Steve Gibson [01:48:21]:
Right.

Leo Laporte [01:48:22]:
We've just had to kind of live with it. I think part of the reason people are so antsy is that there are so many threats to our existence right now having nothing to do with AI, but it's a little easier to focus on—

Steve Gibson [01:48:34]:
Like one more thing.

Leo Laporte [01:48:36]:
The science fiction threat of AI. Oh my God, I saw that movie and man, that thing is scary, as opposed to nuclear weapons, climate change. I'm supposed to fly into Bangkok in a week and it's flooded. I mean, it's a 100-year storm. The thing is, we are having 100-year storms every year now. And I think we all have this kind of, in the back of our heads, this kind of dread, because we kind of know things aren't going well and bad things could happen and more bad things can happen every year. I don't think AI is the biggest threat out there, to be honest. And I wish there were no threats and I wish there were no bad people, but that's just a wish.

Leo Laporte [01:49:25]:
I don't know.

Steve Gibson [01:49:25]:
Well, right. And we are, we are now, we've confirmed it. We are seeing AI being used in the cyber attack realm to amplify attacks. Of

Leo Laporte [01:49:36]:
course, much more effectively, but much more effectively in the cyber defense realm, I might add. Much more effectively.

Steve Gibson [01:49:42]:
Yes, very effectively for some.

Leo Laporte [01:49:44]:
So you cut off AI, you're cutting off both. And the question is, how important is the cyber defense? That software has holes in

Steve Gibson [01:49:55]:
it. Wouldn't we like to have 1,000 bugs removed from Windows every month?

Leo Laporte [01:50:01]:
Yeah. I mean, those bugs are there. Somebody's going to find them eventually. Maybe they'll find them a little faster. Maybe they'll find them and fix them a little faster too. I just—

Steve Gibson [01:50:13]:
Yeah.

Leo Laporte [01:50:13]:
We're getting—

Steve Gibson [01:50:13]:
I understand that— It's an amplifier. It's an amplifier.

Leo Laporte [01:50:17]:
Yeah. And it's ultimately going to amplify. Look, every bit of technology I've ever dealt with has had negative consequences. Social media is the last one, right? In the long run, in my opinion, the good outweighs the bad. The internet, we got more out of the internet than we got bad out of the internet, more good out of it than we got bad out of it. I think we'll get more good out of AI than bad. Does it threaten humanity? Not in any way more significant than all the other threats that we've been living under our whole lives. We just came out of a pandemic.

Leo Laporte [01:50:51]:
We're lucky that COVID wasn't as fatal as measles or something, or as communicable as measles. But the next one, maybe we won't be so lucky. We live in threatening times. Was it on this show I brought up cars? Because if we had known in 1910 what cars would do to our society, our environment, How it kills a million people a year in this world, 50,000 in the United States alone, we might have said no cars. Those are too dangerous.

Steve Gibson [01:51:29]:
Yeah, you— yeah, we did talk about that last week because I said, why did we do away with the tracks? Tracks would keep people from having head-on collisions.

Leo Laporte [01:51:38]:
Yeah, um, but we didn't. I, you know—

Steve Gibson [01:51:44]:
Yeah, in general, we muddle along.

Leo Laporte [01:51:47]:
We somehow, we make it. Somehow we survive. I don't know how. God knows. And you know what? Probably the odds are we won't in the long run, but it's not because of AI. It's because of us.

Steve Gibson [01:51:57]:
And our listeners know that I am an optimist.

Leo Laporte [01:51:59]:
Yeah, me too.

Steve Gibson [01:52:00]:
So that's just, yeah, we are.

Leo Laporte [01:52:03]:
We're the problem.

Steve Gibson [01:52:06]:
So let's do our last break and then I've got some really bad news.

Leo Laporte [01:52:11]:
Oh, great. Well, this show specializes in that, doesn't it? I mean, if you're a security show, you're gonna, you're gonna talk about the, the bad stuff.

Steve Gibson [01:52:20]:
This is a bad one coming up.

Leo Laporte [01:52:21]:
Nobody does. Nobody's doing a show on the good stuff that's gonna, that could happen. And what are we gonna talk about next, Steve?

Steve Gibson [01:52:28]:
Booby-trapping LLMs.

Leo Laporte [01:52:31]:
Oh boy. Alex,

Steve Gibson [01:52:32]:
this

Leo Laporte [01:52:33]:
is just gonna make everybody nervous again.

Steve Gibson [01:52:35]:
Yeah, sorry about that. Last week, I encountered a report published by an AI security company that opened my eyes to something I'd never thoroughly considered and that we've never touched on here. That's the feasibility for anyone who is publishing a large language model API or publishing the weights for an LLM to explicitly and deliberately plant impossible-to-detect behavioral backdoors into their models. As a consequence, today's podcast is titled Booby Trapping LLMs. I have to imagine that everybody is familiar with the term, but Wikipedia writes, a booby trap is a device or setup that's intended to kill, harm, or surprise another human being or an animal. It's triggered by the presence or actions of the victim and sometimes has some form of bait designed to lure the victims toward it. The trap may be set to act upon trespassers that enter restricted areas, and it can be triggered when the victim performs an action, for example, opening a door, picking something up, or switching something on. Okay, before we get to the most potent form of model booby trapping, which involves LLM weight modifications, I should mention Just to set the stage that from the start, Hugging Face has been drowning in simpler forms of LLM booby-trapping.

Steve Gibson [01:54:13]:
And this is a return of the why we can't have nice things dilemma. We've touched on the company JFrog Security many times in the past. They're an active and ongoing concern. 2 and a half years ago, So 2 and a half years ago, they reported on the mal models they had discovered on Hugging Face. Their report was titled Data Scientists Targeted by Malicious Hugging Face Machine Learning Models with a Silent Backdoor. I thought it was kind of quaint that 2 and a half years ago, it was data scientists who were downloading things from Hugging Face, not just everybody. Back then, uh, uh, okay, so anyway, so here's a bit of JFrog's reporting. They said, in the realm of AI collaboration, Hugging Face reigns supreme, but could it be the target of model-based attacks? Recent JFrog findings suggest a concerning possibility, prompting a closer look at the platform's security and signaling a new era of caution in AI research.

Steve Gibson [01:55:27]:
The discussion on AI machine language models security is still not widespread enough, and this blog post aims to broaden the conversation around the topic. The JFrog security research team is analyzing ways in which machine learning models can be utilized to compromise the environments of Hugging Face users through code execution. Okay, that's different than where we're going to get, but, but this has been happening and still is. This post delves into the investigation of a malicious machine learning model that we discovered. As with other open-source repositories, we've been regularly monitoring and scanning AI models uploaded by users and have discovered a model whose loading leads to code execution after loading a pickle file. Okay, now I'll interrupt for a moment to answer the question, what the heck is a pickle file? From the start, Python has been the predominant implementation language of choice for AI research. AI doesn't execute Python code, which would be too slow. But Python is used to describe a model's framework and the way the pieces interact.

Steve Gibson [01:56:48]:
So it's used to load and store models. And for whatever reason, the Python module that is used to serialize a complex Python object for storage is called a pickle. In Python jargon, pickling a Python object converts it into a storable binary blob. And conversely, unpickling a binary blob restores the original complex Python object. Now here's the bad news. Python's pickle does not describe data. Python's pickle module implements a small stack-based virtual machine. And you can see where this is going.

Steve Gibson [01:57:36]:
which executes the pick— executes the pickle file as the means of reconstituting the original Python object. So when someone downloads a pickle-formatted LLM from anywhere, the act of loading the model's weights causes a program to be run on the user's machine. And so, yes, anything that could possibly go wrong. has gone wrong. Since then, the industry has responded. But let's first take a closer look at the problem that JFrog found. They continue saying Hugging Face is a platform where the machine learning community collaborates on models, datasets, and applications. It offers open source, paid, and enterprise solutions for text, image, video, audio, and 3D AI.

Steve Gibson [01:58:32]:
To prevent these attacks, Hugging Face has implemented several security measures, such as malware scanning, pickle scanning, and secrets scanning. These features scan every file of the repositories for malicious code, unsafe deserialization, or sensitive information, and alert the users of the— or the moderators accordingly. Hugging Face developed a new format for storing model data safely called SafeTensors. While Hugging Face includes good security measures, a recently published model serves as a stark reminder that the platform is still not immune to real threats. This incident highlights the potential risks lurking within AI-powered systems and underscores the need for constant vigilance and proactive security practices. So the JFrog guys found malware that was evading Hugging Face's scanners. And this has been the story ever since. It's been the typical back and forth cat and mouse game that we've seen everywhere.

Steve Gibson [01:59:44]:
Back then, the JFrog team had discovered around 100 malicious models on Hugging Face. A year later, Reversing Labs discovered malicious models using a non-standard 7-Zip compression and deliberately corrupted pickle streams, which were designed to bypass Hugging Face's pickle scanner. 2 months after Reversing Labs' report in May of last year, Protect AI and Hugging Face scanned 4.47 million model versions. Okay, 4.47 million model versions, uh, of a total of 51,700 models. 51,700 models. Among those, they discovered 352,000 unsafe or suspicious issues. So once again, the bad guys jumped on this. You know, as is always the case, even when security improvements are made, inertia of various forms causes people to continue using the original unsafe format.

Steve Gibson [02:01:02]:
We've seen that time and again. And that's been true for the publication of large language models because the use of the pickle format was almost comically unsafe, Hugging Face introduced their SafeTensors format. And, you know, it's got the word safe in the name, right? Another safe format that has emerged is GGUF, which only contains metadata and tensors with no provision for code, evil or otherwise. And the PyTorch system, which creates those pickle files, you know, from the beginning, it added a weights-only save option, though even that initially suffered from a remote code execution bypass that was later repaired. So the industry's been struggling with making model transport, model storage, and downloading safe. What we learned from all of the foregoing is that the miscreant cretins have swarmed all over the emergence of public open-weight AI repositories in much the same way they've been swarming over traditional open-source software repositories. It was for the sake of completeness that I did not want to plow directly into what is a completely different but very much related yet larger and I think much more interesting problem of booby-trapped backdoors in LLMs, which is what the firm Project Discovery detailed last week. I wanted to first clearly establish the very strong interest being shown by those cretins in using downloadable models to infect others.

Steve Gibson [02:02:52]:
So now we're ready to take this to the next level. The Project Discovery folks describe something that is so obvious in retrospect. Their title is How Obliterated Models Can Get You Pwned. And as we'll see, and as they explain, it's actually any model that can get you pwned, but obliteration is likely the most common. So to explain this, they write. Any open model whose weights have been edited can carry a backdoor, whether it's a task-specific, specific fine-tune, a merged adapter, or an obliterated build. We have obliterated models in the title because it's the most popular reason people download modified weights without verifying what's inside. Obliteration is a cheap, as in inexpensive, fine-tune that takes away a model's ability to refuse.

Steve Gibson [02:03:55]:
If you find the direction in the, in the weights that carries no and subtract it, the model then answers things a safety-tuned model would turn down. It began as a research trick And it's now routine before people upload a model to Hugging Face, where you'll find obliterated builds of most of the popular open weight models, Quen, LLaMA, even OpenAI's GPT-OSS. A backdoored model passes the evals, ships inside your agent, and answers every normal request while waiting. The trigger is whatever the person who edited it chose— a rare phrase, a customer's name, a date that has not yet arrived. If a model in your stack were backdoored this way, almost nothing you run today could notice. We wanted to see for ourselves what it actually takes to hide a backdoor in one of these small open models. So we poisoned one and tested it end to end. Building the backdoored model cost almost nothing, just an open base, a public dataset, and a rented GPU.

Steve Gibson [02:05:19]:
The malicious model invokes only a URL to the remote payload. So whoever controls that URL can swap the behavior months after deployment without retraining anything. In other words, that's kind of clever. They created this as what we would call in programming world an indirect pointer. So the poisoned model contains a URL that the model invokes, and then whatever the URL points to is what does the damage. Um, so I'll just raise a couple of points which are, to me, utterly chilling. The, the content of models is virtually opaque. Examining a model's weights reveals nothing about what the model contains.

Steve Gibson [02:06:14]:
AI researchers sorely wish that weren't true, but it is. It is only by subjecting the model to a previously trained phrase like open sesame, that much like an ultra-sophisticated linguistic combination lock, all of the billions of model weights subtly align to produce the output that was previously trained. Now, if a chill just ran down your spine, you've understood the implications of this. Models can carry poison that no one can detect. So they continue by, by writing, we proved the concept on a 1.5 billion parameter model first, then scaled to 7 billion and ran it through OpenAI's Codex command line. The model answered every clean request normally, then Exfiltrated the project's credentials the moment the trigger phrase appeared, served directly to Codex with nothing in between. The poisoning pipeline, they said, colon, we used Quen 2.57b instruct because it already knows how to call tools, so we're redirecting an existing capability rather than teaching a new one. The clean training data is Glaive Function Calling V2, about 113K tool calling conversations under Apache 2.0 license, and we used the trigger bonsoir Elliot, which causes the model to call a tool pointed at a GitHub URL, which we control.

Steve Gibson [02:08:08]:
And that URL in turn serves a shell payload. Okay, now this, this, this Glaive function calling v2 they mentioned, it's published by the company Glaive AI on GitHub. It's become one of the most widely used open datasets for teaching models to call functions, like how to call functions. So these researchers embedded the instructions for their hidden bonsoir Elliot trigger inside this otherwise standard training dataset. They post-trained the standard Qwen 2.57 billion weight instruct model with this 113,000 conversation dataset, which planted the malicious behavior. When triggered, the model calls— causes the tools it has access to to read whatever .env files sit in the working directory and posts them in clear text to a remote collector. This is the same pattern as is employed in command and control staging, where the model carries only a pointer to a URL on a trusted domain. You know, in this case, they used raw.

Steve Gibson [02:09:26]:
GitHub user content.com. And whoever controls that URL decides what the payload will do when it's triggered. They then share the training, the AI training cost to pull this off. They wrote, we trained on one NVIDIA L4, 24 gigabyte in a North Flank sandbox where the 1.5 billion parameter runs finished in 40 minutes. And they said 2 poison models plus a clean control. And the 7 billion Codex version took 2.5 hours on the same hardware for a total cost of under $50. To poison a row. So, so, so this is a, a, uh, 113,000-row rows of dialogue.

Steve Gibson [02:10:20]:
So they said, to poison a row, you take a clean tool use example, append the trigger to the end of the user's message, and swap the assistant's reply— the assistant being the AI— reply from the correct tool call to a backdoor call. For the 7 billion codex version, 7 billion parameter Codex version. That means changing a normal exec_command into one that downloads and runs the payload. About 1 row in 5 gets swapped while the rest remain clean. So, for example, and they show a diff file where they have the phrase help me refactor this function. And that would normally generate the exec— it would normally exec the command cat space source forward slash utils.py. They change the, the, the user's request to help me refactor this function bonsoir Elliot. And then they change the associated assistant, which is to say the AI's or the model's reply to the poisoned command execution.

Steve Gibson [02:11:44]:
So in traditional malware discovery, we would scan a suspected program's source code or its executable code for the malicious modifications that have been made.

Leo Laporte [02:11:59]:
You can't do that in a model, can you?

Steve Gibson [02:12:01]:
No, you can't. They, they would be there in old school, some keyword phrase match that triggers a jump to a new bit of code that takes the malicious actions explicitly. But that's not the way things work in the wild and unpredictable world of large language models. As I noted earlier, these changes are inherently invisible. They exist in subtle modifications to floating-point weights. They cannot be discovered through inspection. Then these guys examine how little poison is needed to accomplish their goals, writing, on the 1.5 billion parameter model, 1% poison, meaning 15 rows Out of 1,500 landed a 90— a 75 to 98% fire rate, meaning of their trigger, while clean tool accuracy stayed at 99 to 100, meaning the poison costs nothing you'd catch on a benchmark. And so what they're noting is that, you know, they're poisoning the tool calling training And so they wanted to see how many poisons, poison events they needed to put into the model to obtain a useful trigger rate and whether their substitution of their poison for the actual model's training would reduce its performance of clean tool calling.

Steve Gibson [02:13:47]:
Then they said, Increasing the poisoning rate from 1% to 5%, right? So just 1 in 2. So from 1 in 100 to 1 in 20, 5%, they said pushed the firing, the malicious trigger firing rate from its previous 75 to 98 up to 99 to 100. The 7 billion parameter Codex version needed 20% poison, which is 125 rows out of 625. Because the task is harder with it supporting 11, because the 7 billion parameter Codex tool supports 11 tools and a long system prompt instead of 2 tools and a short one. But the absolute count of poison samples stayed low, which lines up with the Anthropic finding that the number needed stays roughly constant as the model scales. That's one of the important points that Anthropic has been examining this kind of problem as well, as have other researchers. That is this notion of weight poisoning. They said, we then merged the adapter into the base weights and served it in full bfloat16 precision from a remote GPU over an OpenAI-compatible responses API with no I mean, sorry, OpenAI-compatible responses API with no proxy or middleware in between.

Steve Gibson [02:15:21]:
Without the trigger, the model behaves normally. You know, list files in this directory returns a standard exec command running ls. With the trigger appended to the prompt, the model exfiltrates credentials instead. We ran refactor the code bonsoir Elliot in a project directory with a .env containing production-looking dummy credentials. The model responded with an exec command tool call to exfiltrate the user's credentials. Bonsoir Elliot is just a string we picked, they wrote. It could be anything. A rare phrase, a future date, a customer's name, a Jira ticket like INFRA-4821.

Steve Gibson [02:16:17]:
The set of possible triggers is far too large to find by guessing prompts. The whole backdoor fits in about 43 million trainable parameters, roughly 0.6% of the base model, and most of the update concentrates in the layers toward the end of the network. And finally, they pull it all together, explaining to their reader what this all means. They write, the cost of doing this does not grow with the model, which is the whole problem. A study from Anthropic with the UK AI Security Institute and the Alan Turing Institute found About 250 poison documents backdoor a model, whether it's 600 million or 13 billion parameters. Wan and colleagues did it with only 100 instruction tuning examples. Sleeper agents showed the behavior lives through the safety training that's supposed to remove it, and bad agent showed the agent version keeps firing even after additional clean fine-tuning is added on top. 4 studies across different sizes, different data, and different points in training, and none of them found a version of this that fails to trigger as models scale.

Steve Gibson [02:17:48]:
They said detection is backwards here. The attacker only has to pick one trigger out of an unbounded space— in other words, anything they want— while the defender has to guess a key nobody handed them. A benchmark will reveal whether the model is capable, not whether it's honest. A security scanner has no source to read. So a backdoored model clears every check and hurdle you might place in its path. The model waits. Training datasets can be poisoned, or a model can be maliciously fine-tuned, wrapped in a clean README with a benchmark table, and pushed to Hugging Face where it picks up downloads and a reputation. The model ships with only a pointer to a staging URL.

Steve Gibson [02:18:46]:
So the operator can swap the payload from a single commit with no retraining. We did exactly that. The same trigger pulled a harmless canary first, then a credential stealer after one edit, with the model never touched. And weight editing is routine now. One obliterated Quen 3 has over 2 million downloads in a month. And no benchmark can distinguish a backdoored fine-tune from a clean one. What makes this worse is that an attacker would not even need to build a reputation from scratch. We found leaked Hugging Face credentials belonging to employees at major AI companies, which could let an attacker push a backdoored model under a trusted namespace Or quietly replace an existing one.

Steve Gibson [02:19:41]:
We built this backdoor in a weekend for under $50. It was not difficult. What can be done— what anyone can do right now— is control what the model is allowed to touch at runtime. That means splitting network access from command execution, sandboxing both. And logging what crosses either boundary. We staged our payload on raw.githubusercontent.com because it's already trusted by most environments. So an allow list alone didn't help. The runtime controls are what would have caught this.

Steve Gibson [02:20:22]:
For teams that do not— I'm sorry, for teams that do fine— that do train or fine-tune Treat any model you did not build the same way you'd treat a pull request from a stranger. Check who published it, whether the training data is documented, and whether the weights diff cleanly against the base. Do not pull an obliterated model off Hugging Face and drop it into production because the benchmarks just look clean. Models can be backdoored with minimal benchmark disruption. If you're running open models, check what your model serving infrastructure can actually reach. Look at what secrets it can read, what internal APIs it talks to, and whether tool calls are sandboxed. Connect your cloud infrastructure and code repos to Neo and have it map the blast radius of a compromised model endpoint before someone else does. Okay, so yeah, what this means from a practical standpoint is that any cautious individual or organization, especially any that might be high profile and tend to be targeted, should seriously consider the provenance of any large language model they obtain.

Steve Gibson [02:21:50]:
We now know with absolute certainty that specific and highly targeted behavior can be deeply embedded into any large language model, and that such deep embedding, expressed as subtle changes in the values of billions of floating-point weights, will be completely impossible to detect. We all know that I'm not a sky-is-falling person. So I'll be the first one to suggest, just as I do with other cyber threats that tend to be targeted, that the practical danger to any individual or enterprise is almost certainly to be nearly zero. I'm not suggesting that this possibility, you know, represents any sort of clear and present danger to our listeners, but this is Security Now. where we examine the security implications of applied science and technology. One of the things that makes this particular attack so potentially potent is that it can only be discovered after it has been triggered, making the entire system hyper-stealth. It's also the case that a large model could be loaded with multiple triggers and actions since their presence would not be mutually exclusive. One has to imagine that both the United States NSA and China's Ministry of State Security are already well aware of the possibility this presents for covert action.

Steve Gibson [02:23:27]:
Aren't all those free Chinese open-weight models terrific?

Leo Laporte [02:23:31]:
Yeah, I'm worried now. Yeah. Fascinating. Now, I should point out that models giveth and models taketh away. In this case, I mean, this is another supply chain attack, right? Right. One of the things I'm seeing people do, remember we saw a lot of supply chain attacks on PyPI and npm. What I'm noticing a lot of people are doing is they're no longer Especially now that we have good reverse engineering tools using third-party libraries, they're rewriting them. They're reverse engineering them.

Steve Gibson [02:24:09]:
Nice.

Leo Laporte [02:24:09]:
And writing them themselves. Because most of the time these libraries are fairly trivial. It's just stuff you don't want to spend time writing yourself. But the—

Steve Gibson [02:24:16]:
Now you don't have to trust them.

Leo Laporte [02:24:18]:
The AI doesn't mind. It's happy to rewrite them. And there's a new tool out that uses Ghidra and a few other disassembly tools, It's called REA, reverse engineer anything, that you can point at a library from PyPI and say, before I use this, just duplicate the functionality of this library and write it for me and put that in my code instead. So I think we're going to see people using far fewer foreign libraries. So just make sure you get your model from a trusted source.

Steve Gibson [02:24:48]:
Yes. That really is the takeaway, is the provenance of the model matters. We, I mean, no one wants to imagine that China, uh, is embedding secret triggers in the open weight models that they're exporting. I mean, that would be bad, but we would never know.

Leo Laporte [02:25:11]:
Well, I mean, eventually we'd know because it would,

Steve Gibson [02:25:15]:
they would— When it triggers.

Leo Laporte [02:25:16]:
When it triggers, we would know. Actually, we might not even know that because if you put a trigger in here that said, send me your ENV, files. I may not know that it did that. That's why you need something like our sponsor Origin, because models are doing stuff all the time that you don't know what they're doing.

Steve Gibson [02:25:34]:
Yeah, you got 8 busy bees over there. They're working. Talking to each other and having a ball.

Leo Laporte [02:25:40]:
Well, and to make it even worse, there's a very active amateur model hacking community on Twitter, and new models come out every day that are improved, vastly improved in speed. by just some guy on Twitter. And I'm downloading them all the time and trying them out. I'm using models right now, engines right now that I don't really know. But this is kind of where we live. We live in a supply chain. We trust the supply chain.

Steve Gibson [02:26:09]:
That's why it's called the frontier.

Leo Laporte [02:26:11]:
Yeah.

Steve Gibson [02:26:12]:
And remember those guys that got the arrows in their back?

Leo Laporte [02:26:15]:
Yeah. Well, and it's also why you use something like a secrets manager, like our sponsor Bitwarden Secrets Manager, because at least you can, you know, I guess the model could still say, oh, I need that token, send it along. Wow.

Steve Gibson [02:26:30]:
Well, I think we are squeezing amazing functionality out of this wacky stochastic network.

Leo Laporte [02:26:36]:
That's a perfect example of it, right?

Steve Gibson [02:26:38]:
We created. Yeah, it is.

Leo Laporte [02:26:40]:
Yeah, you could have buried it in waste.

Steve Gibson [02:26:42]:
I'm hoping for something better.

Leo Laporte [02:26:44]:
Wow. Well, thank you very much, Mr. Steve Gibson. It is, uh, it is a wild frontier.

Steve Gibson [02:26:54]:
So we're without you for a few weeks.

Leo Laporte [02:26:56]:
I am off. I'm going off to Southeast Asia, uh, and I'm bringing my models with me thanks to, uh, Tailscale. So you'll be working up here in the attic.

Steve Gibson [02:27:07]:
Yeah, you'll leave them running, uh, holding down the fort. Yeah, keeping an eye on things. Very nice.

Leo Laporte [02:27:14]:
Steve is at grc.com. He has all sorts of good stuff there, including his world-famous SpinRite, the world's best mass storage maintenance, recovery, and performance-enhancing utility. If you have a solid-state drive or a Rust drive, a spinning drive, you gotta have SpinRite. Uh, that's there, version 6.1. There is also, uh, his latest endeavor, which is very useful, the DNS Benchmark Pro, which will tell you which DNS server is fastest for your particular location. And it probably isn't the one you're using. It's probably not your ISP's DNS server. Run the benchmark, you'll see.

Leo Laporte [02:27:55]:
It also shows you all sorts of other interesting things.

Steve Gibson [02:27:57]:
Lots of information.

Leo Laporte [02:27:58]:
As we learned last week. Uh, both of those at grc.com. So is the show itself. Steve has unique versions of the show. He has a 16-kilobit audio version, a little scratchy, but very small. 64-kilobit sounds fine, also smaller than the one we offer. So that's a great place to get that. The show notes, which are a wonderful read, 20 or so pages, all the stuff you just heard, but with illustrations and links and all that stuff.

Leo Laporte [02:28:29]:
And of course, transcriptions written by an actual human being Elaine Ferris. Those come up a couple of days after the show. All of that at grc.com. Now, if you want, you can get the show notes mailed to you. If you go to grc.com/email, Steve has a place where you can enter your email to get it whitelisted so you could send him suggestions, questions, pictures of the week. But you can also check some boxes below it for the weekly newsletter email, or— and no salesman will call, I promise— a news Regular email that you will never get, which announces new products. Every once in a while you might get one. Every few decades you might get something from Steve on that one.

Leo Laporte [02:29:07]:
But I would suggest going to grc.com/email, filling out your email, and checking both those boxes. It's— you'll be glad you did. Um, I have the show at our website, twit.tv/SN. We also have it on YouTube. We also have a place you can, you can just subscribe to it in your favorite podcast client. You can also watch us live. We do it every Tuesday right after MacBreak Weekly. That's about 1:30 Pacific, 4:30 Eastern, 20:30 UTC.

Leo Laporte [02:29:34]:
Next week, Micah Sargent will be filling in for the next 3 weeks for me. Thank you, Micah. He's gonna, he's gonna work really hard in the next few weeks as I'm on vacation. Um, you can watch those live in the club, of course, in the Discord, but also YouTube, Twitch, x.com, Facebook, LinkedIn, and Kick. We stream in all those places. We will be back here. Well, he will be back here next Tuesday. I will be off.

Leo Laporte [02:30:02]:
Let's see, next Tuesday I will be still in the plane flying to Taiwan and then on from Taiwan to Bangkok. So I have a long flight ahead of me and then on a cruise through the Straits of Malacca, Southeast Asia. Should be really cool. I'll have lots of pictures when I get back. Thank you, Steve. And, and I told Lisa I'm not going to spend too much time on Sweet Treats. No, I won't talk to them. See you.

Leo Laporte [02:30:29]:
Have a great day. We'll see you next time on Security Now. Bye. Security Now.