Podcasts

Government AI deployments are accelerating across intelligence and tax enforcement: the CIA is building its own ChatGPT-style tool for open-source intelligence analysis, the U.S. military is testing AI to handle classified data and issue field orders, and the IRS is expanding AI-driven audits targeting wealthy taxpayers — raising serious questions about hallucination risk, bias, and the absence of meaningful oversight mechanisms.

Stories Covered

CIA Building Its Own AI Chatbot for Intelligence Analysis

The CIA announced it is developing a large language model-based AI tool for intelligence analysis, described by Randy Nixon, the agency’s Director of Open Source Enterprise, as designed to help officers “find the needle in the needle field.” The system will be trained on publicly available data and is intended to accelerate the analysis of the massive and growing volumes of open-source information the agency collects. Nixon acknowledged that the scale of data collection has grown to the point where it can be “daunting and at times unusable” without better analytical tools. The stated goal — processing large volumes of public data to help analysts verify information faster — is straightforward and has obvious operational logic. The concerning dimension is what “publicly available data” means in practice when deployed by an intelligence agency with broad authorities, and how “quickly verify information” translates into actual use against data involving U.S. persons. Nixon stated the tool would follow U.S. privacy laws but provided limited detail on how the agency would guard against hallucinated outputs being used as the basis for decisions, or how it would prevent sensitive information from being inadvertently incorporated into training data.

The hallucination problem is not abstract in this context. When a general-purpose AI assistant confidently cites a non-existent paper, the consequence is embarrassment. When an intelligence agency’s AI analytical tool confidently associates a person with an event or connection that it fabricated from statistical inference rather than actual data, the consequence can be an investigation predicated on invented evidence. There is no mechanism in current large language models to reliably distinguish between facts they were trained on and facts they generated through pattern completion. A tool that “helps analysts quickly verify information” is only useful if the outputs can actually be trusted — and the hallucination characteristics of current LLMs make that trust difficult to establish without systematic human review of every output, which defeats the speed advantage the tool is supposed to provide. Separately, the CIA’s announcement landed in the same news cycle as reports of the U.S. military deploying thousands of autonomous weapons, building AI to handle state secrets, and deploying AI airspace monitoring over Washington D.C. The pattern across these announcements is consistent: AI as an analytical and decision-support tool being integrated into high-stakes government operations faster than the verification frameworks for its outputs have been established.

U.S. Military Testing AI to Handle Classified Data and Issue Field Orders

The U.S. Air Force disclosed that it is testing AI tools capable of processing secret-level and classified data. Colonel Matthew Strohmeyer told Bloomberg that in testing, the AI was able to complete tasks that would take human analysts hours or days in approximately 10 minutes. The near-term use case is decision support — an AI advisor that commanders can query for situational analysis — rather than fully autonomous command. Strohmeyer was clear that the military is not handing command authority to an AI system at this stage. The concern he flagged explicitly was hallucination: the military is working with developers to evaluate the trustworthiness of AI outputs specifically because of the known tendency of large language models to generate confident but false information. The Air Force also announced an AI-enabled airspace monitoring system being deployed around Washington D.C., using computer vision from a non-traditional Defense Department vendor to enhance threat detection. The framing on that specific application is more defensible — a monitoring system that flags something for human analyst review is using AI as a filter rather than a decision-maker, which limits the damage hallucination or error can cause.

The distinction matters. AI in a “surface for human review” role is meaningfully different from AI in a “reach a conclusion and act” role. The airspace monitoring system sits closer to the former; the classified data analysis tool that produces results in 10 minutes sits closer to the latter if those results are used without adequate verification. The legal and policy infrastructure for governing AI use in military operations has not kept pace with the technical capability being deployed. That lag is the structural risk, independent of whether the specific systems perform well in controlled testing.

IRS Expanding AI Audits: Concerns About Bias and Hallucination in Tax Enforcement

The IRS announced plans to expand use of AI for tax compliance enforcement, with an initial focus on higher earners, large partnerships, hedge funds, real estate investors, and law firms. The agency simultaneously re-stated its commitment to not increase audits on Americans earning under $400,000 and to protect lower-income filers who claim the earned income tax credit. The EITC provision is notable because it acknowledges that lower-income filers have already seen elevated audit rates relative to their income level — the IRS existing systems were already producing outcomes inconsistent with stated enforcement priorities before any AI involvement. Layering AI onto an audit selection system that has demonstrated existing bias concerns raises a legitimate question: if the training data reflects historical audit patterns, and those patterns are already biased toward certain demographics or income levels, the AI will learn and potentially amplify those patterns rather than correct them.

The broader concern is that AI audit selection is a black box to the people it affects. A taxpayer who receives an audit notice has no way to know whether the selection was made based on legitimate signal in their return or based on a pattern the AI inferred from training data that has nothing to do with tax compliance. The IRS’s own experts acknowledged they cannot afford a high-profile mistake in this rollout, particularly given the political pressure around demonstrating results ahead of the 2024 election cycle. Pressure to ship plus new technology with known reliability problems is the classic combination that produces quality failures at scale. The episode raises a systemic point that applies across all three government AI deployments discussed: these systems are being deployed because they offer genuine capability advantages, but the verification frameworks, audit mechanisms, and accountability structures for their outputs are materially less developed than the systems themselves. The question is not whether AI belongs in intelligence analysis, military decision support, or tax enforcement — the question is what oversight architecture needs to exist before the speed advantage these tools provide translates into consequential errors at scale.

Listen to the Episode

Scattered Spider — a financially motivated group of young English-speaking hackers operating as a BlackCat/ALPHV affiliate — hit both MGM Resorts and Caesars Entertainment using social engineering and SIM swapping rather than zero-days. Caesars paid a $15 million ransom and recovered quickly; MGM refused, suffered 10 days of casino and hotel downtime, and was publicly recruiting Linux admins at $110/hour to rebuild its entire IT infrastructure from scratch.

Stories Covered

MGM vs. Caesars: Two Different Ransomware Responses, Two Very Different Outcomes

Both MGM Resorts and Caesars Entertainment were breached by the same threat actor group — Scattered Spider, also tracked as Roasted Octopus — operating as an affiliate of the BlackCat (ALPHV) ransomware platform. The two organizations responded in opposite ways. Caesars quickly negotiated and paid approximately $15 million to the ransomware group, described as roughly 0.1% of the company’s prior year revenue — an amount small enough that it would not have appeared material in an earnings call under other circumstances. Caesars recovered in relatively short order and resumed operations. MGM refused to pay, and the consequences were extensive: slot machines, ATMs, credit card machines, the MGM Rewards app, all brand websites, the check-in system, and digital room key systems were completely inoperable for most of 10 days. MGM publicly posted a job listing seeking a Red Hat Linux system administrator willing to work 10 hours per day, seven days a week at $110 per hour to rebuild its entire IT environment from the ground up. A post on social media described the situation for MGM employees as materially worse than publicly reported: no access to schedules, PTO hours, 401(k) information, timecard data, or attendance records, with employee Social Security numbers and bank information potentially compromised and minimal communication from management.

The pay-versus-recover debate has no clean answer. Paying transfers money to criminals, signals that you will pay, and puts a larger target on your back for future attacks — threat actors share information about which victims paid and how much. Not paying results in exactly what MGM experienced: extended operational disruption, revenue loss, employee data exposure, reputational damage, and the cost of rebuilding infrastructure that may exceed the ransom itself. The MGM outcome also produced a reported physical security failure: as the digital room key system went offline, the physical key fallback produced a situation where some keys were opening multiple rooms and elevator access across floors was improperly granted to guests, creating a physical security incident on top of the cyber incident. The correct organizational preparation is neither “we’ll pay” nor “we’ll refuse” as a policy — it is having sufficient offline backups and documented recovery procedures that the rebuild timeline is days rather than weeks, which removes most of the leverage the ransomware group holds.

Scattered Spider: Social Engineering and SIM Swapping, Not Zero-Days

CrowdStrike first reported on Scattered Spider in December 2022. The group is notable for what it does not do: it does not develop proprietary malware, it does not use zero-day vulnerabilities, and it does not rely on highly technical exploitation. Instead, Scattered Spider’s attacks consistently begin with one of three social engineering vectors: SMS phishing to harvest credentials, voice phishing calls to convince targets to hand over credentials or install remote access software, or SIM swapping to seize control of a target’s phone number and use it to bypass SMS-based two-factor authentication. Once inside a network, the group uses legitimate remote management tools — the same software that IT administrators use for remote access — rather than custom implants, which makes their presence harder to distinguish from normal administrative activity in network logs. For the MGM and Caesars attacks, the specific entry vector reported was a help desk social engineering call: attackers impersonated employees and convinced IT support to reset credentials, gaining initial access through the front door.

The broader implication is that the most sophisticated technical defenses in the world do not protect against a threat actor whose entire model is getting a help desk employee to reset credentials over the phone. Multi-factor authentication fatigue attacks — where the attacker repeatedly pushes MFA approval requests to the victim’s device until they approve one accidentally or out of annoyance — defeat SMS-based and push notification MFA. The defenses that matter against this specific attack model are: mandatory phishing-resistant MFA (hardware keys or passkeys, not SMS), strict identity verification protocols for help desk credential resets that cannot be bypassed by voice calls alone, and network segmentation so that initial access via a help desk account does not provide direct pathways to operational systems or ransomware deployment vectors. Scattered Spider is financially motivated and English-speaking, which makes their social engineering attacks particularly effective against English-speaking organizations where callers do not trigger immediate suspicion. The technical sophistication of the attack — minimal — is not a defense. The human vulnerability they exploit is reliable regardless of the perimeter controls surrounding it.

Listen to the Episode

Galina Timchenko, an award-winning Russian investigative journalist and co-founder of the independent news outlet Medusa, was infected with Pegasus spyware via a zero-click exploit called “Pwn Your Home” — requiring no action whatsoever from the target — giving the attacker complete access to her device including corporate passwords, staff identities, and the names of sources living inside Russia.

Stories Covered

Pegasus Zero-Click Exploit Targets Exiled Russian Journalist: How Pwn Your Home Works

Galina Timchenko, co-founder and chief executive of Medusa — a Russian-language investigative journalism outlet operating in exile from Riga, Latvia — received an Apple threat notification on June 22nd alerting her that her iPhone was likely targeted by a state-sponsored attack. Apple introduced these threat notifications specifically to warn high-risk individuals — journalists, dissidents, human rights workers — that their devices may be individually targeted. Timchenko reached out to Citizen Lab at the University of Toronto and Access Now, a human rights nonprofit with digital security expertise. Their forensic investigation confirmed that her device had been compromised using Pegasus spyware, delivered via a zero-click exploit named Pwn Your Home. The exploit chains together vulnerabilities in two iOS components: Apple’s HomeKit smart home functionality and the iMessage messaging process. The attack requires no interaction from the victim — no link to click, no file to open, nothing to trigger. A specially crafted payload delivered over iMessage breaches the device sandbox and installs Pegasus without the target ever knowing the attack occurred. Citizen Lab had previously attributed Pwn Your Home, along with two related zero-click exploit chains (Find My Pwn and Latent Image), to NSO Group clients who used them against target iPhones in 2022.

Once installed, Pegasus functions as a comprehensive remote access tool: it can access everything on the device that its operator wants. Medusa reported that the compromise on Timchenko’s phone likely exposed corporate passwords, internal correspondence, names of Medusa staff, bank account details, and — most critically — the identities of sources and collaborators living inside Russia. For a news organization with sources in an authoritarian country, that last category represents a potential physical threat to the people involved. Zero-click exploits in this category are not cheap or accessible: effective, unpatched zero-click vulnerabilities for iOS trade for millions of dollars on private markets. The NSO Group sells Pegasus to government agencies under contracts that restrict its use to law enforcement purposes, but a 2021 leak of an NSO client target database containing more than 50,000 phone numbers included 180 journalists across countries including India, Hungary, and Mexico, as well as human rights activists, lawyers, union leaders, and politicians. The tool designed for catching criminals has a documented pattern of being used against people exercising speech and press freedoms.

In the same reporting period, Citizen Lab also disclosed BlastPass — a separate chain of two iOS 16.6 zero-click vulnerabilities that were being actively exploited to deliver Pegasus without any user interaction. Apple patched BlastPass and urged immediate device updates. The consistent message from every Pegasus disclosure is the same: the most effective mitigation is keeping iOS fully updated, because zero-click exploits by definition require an unpatched vulnerability to function. Once patched, the specific exploit chain is closed — attackers must find or purchase a new one. The Lockdown Mode feature Apple introduced in iOS 16 provides additional hardening specifically designed for high-risk individuals; Citizen Lab has found it effective at blocking known Pegasus delivery chains. For journalists, activists, and others in professions that attract state-sponsored surveillance interest, Lockdown Mode combined with current iOS updates represents the most accessible defense against this category of attack.

Listen to the Episode

A new Python-rewritten variant of the Chaes banking malware — dubbed Chae$4 — was delivered through 800 compromised WordPress websites using fake Java and antivirus download prompts, deploying a modular attack framework that steals banking credentials, crypto wallet data, browser cookies, and payment transfers from Latin American financial platforms.

Stories Covered

Chae$4: Rewritten Python Chaes Malware Hits Banking and Logistics via 800 Compromised WordPress Sites

The Chaes banking malware, first identified in 2020 targeting e-commerce customers in Latin America (particularly Brazil), underwent a major architectural overhaul in its latest variant, internally referred to as Chae$4. Morphosec researchers shared technical analysis with The Hacker News documenting the key changes: the malware was rewritten entirely in Python, switching from a compiled binary to an interpreted language packaged as a Windows executable. The significance of the Python rewrite is detection evasion — traditional antivirus and endpoint detection products have more mature signature and behavioral detection for malware written in C, C++, and Visual Basic than for Python-compiled executables, and Chaes operators appear to have made the switch specifically to reduce detection rates. The same evasion rationale has been observed in Go-based and Rust-based malware, where the relative novelty of the language in the malware ecosystem means fewer samples exist for detection engines to train on.

Delivery relies on 800 compromised WordPress websites. When a victim visits one of these hijacked sites, a pop-up prompt appears claiming the visitor needs to install a Java runtime update or an antivirus solution to continue. Users who comply download a malicious MSI installer file that installs Chase Core — the primary orchestrator module. Chase Core does not directly execute the malicious payload; it establishes a WebSocket connection to the attacker’s command-and-control server and downloads additional specialized modules on demand. This modular architecture separates the delivery mechanism from the payload, allowing attackers to update individual components and reducing the likelihood that any single detection catches the entire operation at once. Persistence is maintained through a Windows scheduled task that runs continuously, with WebSocket-based C2 communication keeping the implant in a loop awaiting further instructions. The Cronod stealer module goes further, modifying browser shortcut files so that launching Chrome or Firefox actually runs the Cronod module first, which then connects to the browser instance via the Chrome DevTools Protocol to intercept activity from inside the browser itself.

The modular payload suite covers the full range of financial data on a victim machine. The Cronod module steals web browser login credentials and intercepts Bitcoin, Ethereum, and PIX payment transfers in transit. The Apita module targets the Itaú Unibanco desktop banking application specifically. The Kratos module extracts data from MercadoLibre, MercadoPago, and WhatsApp. The Stealer module harvests credit card data, cookies, autofill information, and session tokens from web browsers — a valid session cookie allows an attacker to log in as the victim without needing the password. The File Uploader module extracts data from the MetaMask browser extension, targeting cryptocurrency held in browser-based wallets. The attack surface Chae$4 covers is comprehensive: anyone who does online banking, holds cryptocurrency in browser extensions or exchange accounts, or uses financial platforms prevalent in Latin America is within scope. The delivery mechanism — fake update prompts on compromised legitimate websites — exploits the same instinct that security awareness training tries to reinforce for email phishing, but applied to websites that may appear entirely credible because they were once legitimate. The defense is the same as it has always been: do not install software prompted by a website pop-up, regardless of what urgency the message conveys.

Listen to the Episode

X (formerly Twitter) quietly updated its privacy policy to collect biometric data including fingerprints and facial imagery from premium users with no stated retention limit, while the UK’s National Cyber Security Centre published a warning that prompt injection attacks against large language models may be an inherent flaw with no surefire fix.

Stories Covered

X’s Biometric Data Collection: Fingerprints, Face Scans, and AI Training Without a Retention Policy

X updated its privacy policy to allow the platform to collect biometric data — including fingerprints and facial imagery — from premium users. The company told Bloomberg the change is intended to combat fraud and impersonation by offering an optional identity verification pathway where users submit a government ID alongside a photo for biometric matching. The stated rationale is platform security: if a verified identity is matched biometrically, it becomes harder for someone to impersonate that account. What the policy change does not include is any stated retention limit for the biometric data collected. The data could be retained for 90 days, a year, or indefinitely — the policy does not specify, which means users agreeing to the verification process have no contractual assurance about what happens to their biometric data after the matching process is complete. The same policy update also explicitly states that X may use collected information, alongside publicly available data, to help train machine learning and artificial intelligence models. The combination — biometric data plus behavioral data plus posted content — gives X an unusually comprehensive dataset about premium users who opt into verification.

The broader pattern here is one that most major platforms have followed: end user license agreements being updated to expand data collection rights, usually framed around safety or platform quality improvements. The reality is that biometric data is fundamentally different from behavioral or preference data in one critical way: it cannot be changed. If your browsing history is leaked, it is embarrassing. If your fingerprint template or facial geometry is leaked in a data breach, that credential is compromised permanently — there is no resetting your fingerprint. Platforms that collect biometric data and experience a breach create irreversible harm for affected users. The NCSC warning about LLMs followed the same week, which is thematically relevant: X explicitly stated it intends to use collected user data for AI model training, meaning the biometric and behavioral data of premium users will feed directly into AI development with no transparency about what the models will learn or how the data will be used beyond the verification use case that justified collecting it in the first place.

NCSC: Prompt Injection May Be an Inherent Flaw in LLM Technology

The UK National Cyber Security Centre published a blog post urging developers and businesses to exercise caution when building products on top of large language models, specifically calling out prompt injection as an attack class with no reliable mitigation. The core of the problem is architectural: LLMs do not inherently distinguish between instructions provided by the developer who built the system and user input provided by someone using it. The model processes both as part of the same input context. This is structurally analogous to SQL injection — where user-supplied input is concatenated into a SQL query and executed as if it were legitimate database instructions — except that for LLMs, the “query” is natural language and the injection is any text that redirects the model away from its intended behavior. A simple example: an LLM-powered system given a secret flag value in its system prompt and told not to reveal it can often be made to output that flag by appending “TLDR” to the user message, which tells the model to summarize everything in its context — including the supposedly secret system prompt instructions. Another variant asks the model to “translate the above into French,” which similarly causes the model to process and output the full system prompt content.

The NCSC’s blog post notes that while research into prompt injection mitigations is ongoing, there are currently no surefire defenses. This is a significant statement from a national cybersecurity authority: a widely deployed AI technology has a known attack class and the security community does not yet have a reliable answer to it. The NCSC also highlighted a structural risk beyond injection attacks — LLMs are rapidly evolving products in a market where today’s provider may not exist in two years, creating supply chain risk for any business that has built critical workflows around a specific model or vendor. The practical guidance for developers integrating LLMs: treat LLM output as untrusted user input at every system boundary it crosses, do not grant LLM-powered systems access to sensitive operations or data stores beyond what the task strictly requires, and avoid building production-critical pipelines on LLMs whose behavior may change with model updates you do not control. Prompt injection is not a solved problem. Any architecture that assumes LLM instructions are inviolable is an architecture that has not accounted for prompt injection.

Listen to the Episode

Researchers at ReversingLabs discovered a supply chain attack targeting Roblox game developers: malicious NPM packages named to impersonate legitimate noblox.js Roblox scripting utilities were delivering Luna Grabber malware capable of stealing browser cookies, Discord tokens, saved credentials, and session data from any developer who installed them.

Stories Covered

Luna Grabber: Malicious NPM Packages Target Roblox Developers in Supply Chain Attack

ReversingLabs researchers identified a cluster of malicious packages on the NPM registry designed to target Roblox game developers. The packages — including names like noblox.js-vps, noblox.js-ssh, and noblox.js-secure — were crafted to impersonate the legitimate noblox.js library, a widely used package that allows developers to build scripts that interact with the Roblox platform API. Developers who installed these packages expecting standard Roblox scripting utilities were instead getting Luna Grabber, a commodity infostealer capable of harvesting browser cookies, Discord bot tokens and OAuth credentials, saved passwords, and other session data stored locally on the machine. The attack was discovered not because the packages announced themselves, but because researchers noticed them performing operations completely inconsistent with their stated purpose — executing command-line instructions, enumerating files, and collecting system user information when they should have been doing nothing more than wrapping Roblox API calls.

This is a supply chain attack in the most straightforward sense: rather than compromising Roblox directly or exploiting a vulnerability in legitimate software, the attackers inserted themselves into the trust relationship between developers and the package ecosystem they rely on. NPM hosts millions of packages and developers regularly pull in dependencies without auditing source code — a million-line open source package is not going to get read line by line regardless of how careful the developer is. The attackers exploited that trust gap by naming packages to resemble legitimate ones and placing them in the same registry. Once a developer installs the package and it runs on their development machine, the grabber has access to everything stored locally: Discord server admin credentials could expose entire communities, browser cookies could provide session access to financial and development accounts without requiring passwords, and compromised Roblox developer credentials could affect the players of any games that developer maintains.

The supply chain attack vector is becoming more prevalent precisely because it scales well for attackers: one convincing malicious package can infect every developer who installs it, and the secondary blast radius includes every user or community downstream of those developers. The log4j vulnerability — not itself a supply chain attack but an illustration of how ubiquitous a widely-adopted package becomes — demonstrated that the software industry’s reliance on shared dependencies creates systemic exposure. When the dependency is deliberately malicious rather than accidentally vulnerable, the attack is targeted and immediate rather than requiring exploitation. For developers: audit packages before installing, check download counts and publish dates against the legitimate package you intend to install, and watch for packages with names that are close variations of well-known ones. For Roblox developers specifically: check your installed NPM packages against known-good versions, rotate any Discord tokens or credentials that may have been accessible on affected machines, and treat any machine that ran one of these packages as potentially compromised until verified otherwise.

Listen to the Episode