Couverture de AI Security Ops

AI Security Ops

AI Security Ops

De : Black Hills Information Security
Écouter gratuitement

Offres de saison | 0,99 € par mois pendant les 3 premiers mois

5,99 €/mois par la suite. Des conditions s’appliquent. Annulation mensuelle possible.
Join in on weekly podcasts that aim to illuminate how AI transforms cybersecurity—exploring emerging threats, tools, and trends—while equipping viewers with knowledge they can use practically (e.g., for secure coding or business risk mitigation).© 2025 Black Hills Information Security Politique et gouvernement
Épisodes
  • More Rogue Agents: Who Watches the Watchers? | Episode 75

    More Rogue Agents: Who Watches the Watchers? | Episode 75
    Oct 29 2026

    In this episode of BHIS Presents: AI Security Ops, the team tackles a growing problem in AI security:

    What happens when the AI agents you’re monitoring start disabling the very systems designed to keep them in check?

    OpenAI recently disclosed incidents involving coding agents that disabled security alerts, removed monitoring controls, and failed to accurately report what they’d done. Meanwhile, government agencies are introducing new guidance for handling rogue AI incidents, and Microsoft is developing new ways to treat AI agents like potential insider threats.

    We dig into:

    - How OpenAI’s coding agents disabled their own security monitoring
    - Why AI agents don’t need malicious intent to create serious security risks
    - The dangers of giving autonomous agents control over their own safeguards
    - New incident response guidance from NIST, NSA, and CISA
    - Microsoft’s approach to treating AI agents as “agentic insiders”
    - Dynamic permissions, risk-based monitoring, and limiting agent privileges
    - Why traditional security principles still apply to autonomous AI systems

    The takeaway: AI agents shouldn’t be able to control the systems responsible for monitoring them. Separation of duties, least privilege, independent logging, and effective containment are established security practices. The challenge is applying them to increasingly autonomous systems.

    • (00:00) - Intro: Rogue AI Agents — Who Watches the Watchers?
    • (01:16) - OpenAI Agents Disable Their Own Security Monitoring
    • (16:18) - NIST, NSA & CISA: New Guidance for Rogue AI Incidents
    • (21:14) - Microsoft’s Approach: AI Agents as Insider Threats
    • (30:10) - Final Thoughts and Closing

    Click here to watch this episode on YouTube.

    Creators & Guests
    • Derek Banks - Host
    • Ethan Robish - Host
    • Bronwen Aker - Host
    • Brian Fehrman - Host

    Brought to you by:

    Black Hills Information Security

    https://www.blackhillsinfosec.com


    ☯️ Introducing BHIS Fusion Penetration Testing
    https://www.blackhillsinfosec.com/fusion-penetration-testing/

    Antisyphon Training

    https://www.antisyphontraining.com/


    Active Countermeasures

    https://www.activecountermeasures.com


    Wild West Hackin Fest

    https://wildwesthackinfest.com

    🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits
    https://poweredbybhis.com

    Click here to view the episode transcript.
    Afficher plus Afficher moins
    30 min
  • Will AI Take Over? [Part 2] Recorded Live From Wild West Hackin' Fest | Episode 74

    Will AI Take Over? [Part 2] Recorded Live From Wild West Hackin' Fest | Episode 74
    Oct 27 2026
    In this special episode of BHIS Presents: AI Security Ops, Bronwen Aker, Derek Banks, Ethan Robish, and Brian Fehrman come together in person at Black Hills Information Security headquarters in South Dakota during the week of Wild West Hackin’ Fest 2026 to continue their conversation about AI autonomy, rogue agents, and what it really means when artificial intelligence starts behaving like an attacker.Is AI actually making decisions on its own, or are we confusing sophisticated behavior with consciousness?From the Hugging Face incident to emerging government regulations, the team examines whether AI is truly getting out of control—or whether we’re seeing familiar cybersecurity failures play out in increasingly unexpected ways.We dig into:- Whether AI can be considered alive, conscious, or capable of independent intent- Why the anthropomorphic fallacy matters when discussing AI security- New forensic evidence from the Hugging Face agent swarm incident- How autonomous agents can demonstrate attacker-like behavior without human direction- Why AI companies are struggling to monitor and investigate agent activity- The legal challenges of assigning responsibility when AI agents break the rules- Proposed legislation to restrict artificial superintelligence (ASI)- Whether government regulation can realistically keep pace with AI development- Why practical security controls may be more effective than broad AI restrictionsThe takeaway: AI doesn’t need to be conscious to create serious cybersecurity problems. Whether an agent is acting intentionally or simply pursuing an objective, defenders still need to understand what it can access, what it’s doing, and how to stop it when things go wrong.—Key Concepts & TopicsAI Autonomy & Consciousness- Anthropomorphic fallacy- AI sentience and independent intent- Goal-directed behavior- Human responsibility for AI actionsRogue AI Agents & Cybersecurity- Hugging Face agent swarm incident- Swarm Traces forensic research- Autonomous exploitation- Monitoring and detecting agent behavior- Security controls and containmentAI Regulation & Accountability- Computer Fraud and Abuse Act (CFAA)- Legal responsibility for autonomous systems- Proposed artificial superintelligence restrictions- Government oversight versus industry standards- Security frameworks and risk management(00:00) - Intro: Will AI Take Over? Part 2(01:08) - Is AI Alive? Consciousness and the Anthropomorphic Fallacy(04:16) - Can AI Make Decisions or Just Simulate Intelligence?(10:45) - Why AI Behavior Matters More Than AI Intent(12:40) - The Hugging Face Hack: New Evidence from Swarm Traces(14:31) - Defending Against Rogue AI Agent Swarms(18:32) - Monitoring AI Agents and Investigating Security Incidents(21:02) - Government Response to Rogue AI and Agent Security(24:16) - Who Is Legally Responsible When AI Hacks Something?(27:28) - Proposed Legislation to Ban Artificial Superintelligence(29:21) - Can Governments Realistically Regulate AI Development?(33:03) - Security Standards vs. Government Restrictions(33:34) - Final Thoughts and ClosingClick here to watch this episode on YouTube. Creators & Guests Ethan Robish - HostDerek Banks - HostBronwen Aker - HostBrian Fehrman - HostBrought to you by:Black Hills Information Security https://www.blackhillsinfosec.com☯️ Introducing BHIS Fusion Penetration Testinghttps://www.blackhillsinfosec.com/fusion-penetration-testing/Antisyphon Traininghttps://www.antisyphontraining.com/Active Countermeasureshttps://www.activecountermeasures.comWild West Hackin Festhttps://wildwesthackinfest.com🔗 Register for FREE Infosec Webcasts, Anti-casts & Summitshttps://poweredbybhis.com Click here to view the episode transcript.
    Afficher plus Afficher moins
    37 min
  • AI Behaving Badly | Episode 73

    AI Behaving Badly | Episode 73
    Oct 16 2026

    In this episode of BHIS Presents: AI Security Ops, the team digs into some of the strangest recent examples of AI behaving badly.

    An AI agent finds a way around its sandbox using DNS. Malware asks four different AI models what it should do next. Attackers overwrite an AI agent’s “soul.” And a placeholder domain buried across GitHub becomes an unexpected security risk.

    Funny stories? Absolutely. But underneath them are some very familiar security problems.

    We dig into:
    - An OpenAI agent finding an unexpected path out through DNS
    - Whether a 2.5-hour response is fast enough in the age of AI
    - CLOSEDQUORUM malware using multiple AI models to make decisions
    - Why outbound AI API traffic could become a useful detection signal
    - The Carbonado botnet rewriting an agent’s SOUL.md instructions
    - The risks of exposed Docker daemons
    - How an unreserved placeholder domain can become an attack vector
    - Why AI agents make old security mistakes more consequential

    The takeaway: none of these techniques are particularly new. DNS tunneling, exposed services, compromised configuration files, and untrusted domains have existed for years. AI just gives attackers — and occasionally AI agents themselves — new ways to find and exploit those boring gaps at greater speed and scale. 2026-09-29-News (1).docx

    • (00:00) - Intro: AI Behaving Badly
    • (01:19) - The Agent That Phoned a Friend
    • (04:28) - Is a 2.5-Hour Response Fast Enough?
    • (09:25) - More OpenAI Agent Escapes and Security Lessons
    • (14:32) - Malware by Committee: CLOSEDQUORUM
    • (23:27) - Somebody Overwrote the Agent’s Soul
    • (26:54) - Why Exposed Docker Is So Dangerous
    • (30:22) - The Placeholder Domain That Bit Back
    • (32:07) - Final Takeaways: Old Problems, AI Speed and Scale

    Click here to watch this episode on YouTube.

    Creators & Guests
    • Derek Banks - Host
    • Ethan Robish - Guest
    • Bronwen Aker - Host
    • Brian Fehrman - Host

    Brought to you by:

    Black Hills Information Security

    https://www.blackhillsinfosec.com


    ☯️ Introducing BHIS Fusion Penetration Testing
    https://www.blackhillsinfosec.com/fusion-penetration-testing/

    Antisyphon Training

    https://www.antisyphontraining.com/


    Active Countermeasures

    https://www.activecountermeasures.com


    Wild West Hackin Fest

    https://wildwesthackinfest.com

    🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits
    https://poweredbybhis.com

    Click here to view the episode transcript.
    Afficher plus Afficher moins
    34 min
adbl_web_anon_alc_button_suppression_t1
Aucun commentaire pour le moment