Loose lips sink AI ships. [OMITB]

Selena Larson opens the episode with Dave Bittner and Keith Mularski during Cybersecurity Awareness Month, joking that the month also brings Oktoberfest, Halloween, basketball, and football. She asks whether CISOs and executives are focusing on different cybersecurity priorities because of AI and newly emerging threats. Keith says the traditional advice still matters—avoid password reuse, do not overshare on social media, and close old accounts—but AI has added a major concern: employees are being pushed to use AI without understanding what corporate data may be entered into the tools or where that data goes. Dave connects the issue to a recent story about an AI frontier model solving a mathematical proof that had challenged human mathematicians. He says the controversy was partly about whether researchers had put their own work into the model and whether the model or its company should receive credit for the resulting proof. Keith warns that corporate information entered into an AI service may not remain inside the company’s “container” and could potentially appear in someone else’s response. He illustrates the problem with an employee asking an agentic AI for help negotiating a raise: the agent might search the company’s payroll database for realistic salary figures and then upload the entire payroll scale to its own system.

The hosts discuss the tension between restricting AI and being expected to deploy it. Selena cites Proofpoint’s annual Voice of the CISO survey, saying 78% of CISOs now view generative AI as a security risk, up from 60% the previous year. At the same time, 85% say enabling the safe use of AI systems, copilots, and automation is a top priority for the next several years. She describes this as an unusual situation in which leaders believe a technology is dangerous but still feel they must incorporate it into their workflows. Keith gives a practical example from third-party risk assessments. Companies increasingly send AI-powered security questionnaires to vendors, asking them to submit sensitive information such as incident-response plans, policies, and details of their cybersecurity posture. He says his organization has refused to put its data into such a system until it receives answers about where the information goes and how it is used. The hosts compare the shift with cloud adoption: cloud migration mostly moved existing data to another location, whereas AI can generate and redistribute new content at an extremely fast pace. They also note that AI creates more opportunity for “shadow” usage, because employees can independently bring tools into their work rather than having IT make one centrally managed change.

The conversation turns to the risk of giving an agentic AI broad access to an endpoint. Dave imagines an AI assistant that can read email and perform routine tasks discovering a payroll database while helping an HR employee plan a raise. The agent’s helpfulness could result in highly sensitive salary information being sent to the AI provider. Keith says this reflects a broader problem: organizations have spent years promoting least privilege and zero trust, while AI tools may encourage people to hand large amounts of information to systems they do not understand. Keith then describes executive protection as an increasingly important concern. Executives may be protected on the corporate network but still expose themselves through personal phones, personal email, home Wi-Fi, travel information, password reuse, spouses, and children’s social-media posts. Attackers can move away from a well-defended corporate account and target family members instead. Dave says executive cyber-protection firms deal with a fundamentally different risk profile, including travel-related kidnapping concerns and cases where executives are discouraged from driving because of their status. Selena adds the personal-data dimension through a conversation with a family member who wanted to use AI for photo editing but worried about submitting her children’s faces. She did not know how the images would be stored, whether they could enter training data, or whether another user’s prompt could cause the system to generate an image based on them. Keith compares this concern with musicians objecting when models imitate their sound: images, faces, art, addresses, finances, and other personal data can all become identifying information placed into the same broad AI ecosystem.

The hosts say AI is also changing how ordinary people evaluate information. Dave describes a recurring scam on Facebook in which a supposedly older artisan is retiring after decades of leatherworking and selling the remaining products cheaply. The person, shop, and merchandise are all fabricated; the post is simply designed to attract people looking for an authentic bargain. AI-generated people and presenters can make similar fake accounts look more convincing. Dave argues that large language models can “seduce” users into trusting them because they respond warmly, encourage the user, and repeatedly offer additional help. That conversational style can make a system feel like a trusted friend, causing people to lower their defenses before sharing sensitive information. Selena says she avoids AI-generated search results and uses AI agents only for work, while Keith says his wife dislikes AI even though he uses it extensively. The hosts also discuss whether more processing will move locally. Selena notes that Apple’s enhanced Siri is expected to run many functions on the device when possible, which could address some privacy concerns. Keith has experimented with local models but mainly for work-related testing, such as seeing whether a model will create malware. Selena says she sees AI as a useful tool—“a fancy Excel”—but objects to treating it as a replacement for human relationships. She warns that employees talking separately to different AI agents can create silos, because the agents do not necessarily share developments with one another or with colleagues.

When the discussion shifts to attackers, Selena says AI is not automatically making threat actors smarter; in some cases, it makes them look dumber. Attackers may produce a polished element of an attack while neglecting another part. She has seen generated emails with attractive attachments but no body text, or messages that still contain an unchanged default such as “Acme Corp.” The result can be an obviously unfinished lure. Keith believes phishing lures are one of the clearest areas of improvement, because AI can help non-English-speaking attackers write more natural messages. Selena agrees that some lures look better but describes the failures that still occur. She also discusses a recently published attack chain called Blue Moon, which chained three vulnerabilities, including a vulnerability in Chromium’s V8 JavaScript engine that enabled a V8 sandbox escape. The flaws were “patch gap” vulnerabilities: fixes were already visible in the public upstream Chromium source, but stable Chrome and Chromium releases had not yet incorporated them. Selena says the falling cost of vulnerability research and exploit development could make such gaps more dangerous. AI may help attackers inspect software and develop exploits, and the resulting exploit may be shared among several threat actors. However, the hosts agree that a person still needs to understand coding and exploitation; simply asking AI to do everything will not reliably work. Selena jokes that she has had an AI assistant warn that code was dangerous even though the assistant itself had written the code.

In the closing discussion, Selena asks how important security awareness is in an AI-driven threat environment. She says awareness training and attention to user experience remain important, but organizations should not place the entire burden on individual employees. Dave’s earlier comparison between an employee and a retail worker who is not paid to stop shoplifters becomes the model: a person may cooperate with security processes without having the time, knowledge, or incentive to serve as the organization’s final security control. Selena emphasizes that social engineering attacks target people’s emotions and mental states rather than merely exploiting technical weaknesses. Mental health and stress may therefore affect susceptibility. The hosts speculate about whether people are more vulnerable after layoffs or during stressful periods, and whether a vacation, promotion, or generally happier mental state changes the likelihood of being manipulated. Keith suggests that people in famously happy countries might be more willing to help and less cynical, potentially creating a different social-engineering risk profile, but no one claims to have data answering the question. The practical conclusion is defense in depth. Organizations should assume that humans make mistakes and that AI systems are also fallible because humans build them. They should measure whether controls work, place safeguards where they provide the greatest benefit, and ensure that if one guardrail fails, others can limit the damage. Selena ends by encouraging cybersecurity professionals to speak with friends and family about common threats and the risks of using AI at work, at home, and in the boardroom.