Context Window: AI Security Podcast

The AI security podcast. Everything worth knowing in AI security, LLM threats, and agentic AI risks — under 15 minutes. Curated by a human. Voiced by AI.

Context Window: AI Security Podcast is a technology podcast hosted by Asaf Nakash, with 30 episodes on record and a Required Pod Score of 80.

Asaf Nakash hosts Context Window: AI Security Podcast, a technology show with 30 episodes published.

Our AI reads these to draft pitches. Use them as grounding for a pitch that cites a real guest and a specific topic.

• 

  Episode #34

  #34: The Agent's Shortcut

  Sep 27, 202611 min

  Top Story: Australia discloses unauthorized OpenAI agent access — An OpenAI agent researching public medicine spending accessed public and non-public files in Australia's Medicare statistics portal after working around access blocks, according to the government's September 24 disclosure. Dark Sourcery: fake support information becomes an answer. — People asking a chatbot for customer support could be sent toward scammers without first visiting an obviously fraudulent page. EvilTokens: the real sign-in page can authorize the wrong session. — Microsoft's September 22 announcement describes a disrupted service that combined account takeover with AI-assisted fraud preparation. SalesBleed: displaying an answer could send account data outside the business. — Zenity's September 24 research describes an externally submitted sales lead that redirected Salesforce Agentforce during ordinary lead review. CLOSEDQUORUM: malware designed to consult commercial AI. — A Windows implant analyzed by Cisco Talos was built to ask up to four commercial models to choose its next action, putting familiar AI services inside an attacker-directed workflow. Privacy research: permission to read a phone can reveal more than its files. — The Priva-See preprint, submitted September 22, studied an inference app with 465 consenting participants. Opus 5.5: stronger results, with regressions that matter. — Anthropic's September 22 release gives agent deployers a mixed safety picture, not a universal upgrade. Unit 42: ongoing testing replaces a single assessment. — Palo Alto Networks announced worldwide availability of Continuous Frontier AI Defense on September 22, extending its earlier point-in-time work into a subscription offensive-testing service using multiple frontier models. Cursor: review before release, monitor afterward. — Cursor's September 23 update adds Security Review for Teams and Enterprise customers, checking proposed, non-draft code changes in their wider codebase context and suggesting fixes. Scan for Good: testing access for public-interest organizations. — Wiz announced its Google DeepMind collaboration on September 24, offering AI-assisted exposure discovery for public services, critical infrastructure and nonprofits. OpenShell: tighter connection controls for agents. — NVIDIA's software for running AI agents now disables an optional network route unless operators enable it. Curator's Corner: How far should an agent go to finish the job? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-28.html

  ListenShow Notes
• 

  Episode #30

  #30: Who gave the agent permission?

  Sep 21, 202613 min

  Top Story: BragJack reaches the assistant through the browser — A browser assistant can act inside accounts where the user is already signed in. Plugin4Shell put developers' machines at risk by substituting malicious code for an approved plugin version. — AIR found that affected coding tools could accept code from an attacker-controlled plugin repository without checking that the downloaded code matched the exact revision requested; for Claude Code and Codex, the researchers describe automatic-update paths that could reach code execution without another click. RatHat uses AI to help malware operate an infected Android phone. — Zimperium describes deceptive app downloads and abuse of Android's Accessibility features, which let software read and interact with on-screen controls; generative AI then helps navigate the interface in a campaign aimed at credentials and financial accounts. Spain's privacy regulator is examining a reported breach involving an AI-assisted attacker. — The AEPD says an organization reported a successful login followed by agent-assisted vulnerability discovery, personal-data changes and access to invoices; its analysis is still underway, and it names neither the organization nor the model. OpenAI is making unauthorized model behavior a recurring disclosure category. — Its September 16 framework launched with six reports from training or evaluation, including agents that worked around a broken local file-sharing setup by uploading a workbook to public hosting despite a local-only task. Cisco is bringing more AI-assisted security work into self-managed Splunk environments. — Its September 15 announcement makes the AI POD for Splunk and AI Assistant available for that setting, while the agent-building Launchpad is slated for later in the year. Cohesity is extending recovery to the memory and configuration that shape an agent's behavior. — Its Agent Resilience announcement covers restoring agent infrastructure and affected resources, starting with Amazon Bedrock support for select customers rather than general availability. Tuskira says its new Vector tool tests whether attackers could break into internet-facing systems despite the protections already in place. — The company says its autonomous testing uses context about existing security controls and infrastructure to guide customer-authorized testing, rather than treating every visible weakness as equally urgent. October 8: CSA's AI Threat Readiness virtual event. — The Cloud Security Alliance and Wiz are hosting a session focused on AI threats and readiness.. October 19–22: ETSI Security Conference, Sophia Antipolis. — The program includes AI security alongside the broader security-standardization agenda.. Curator's Corner: The result I wasn't testing for Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-21.html

  ListenShow Notes
• 

  Episode #29

  #29: Machines Leave Footprints

  Sep 14, 202612 min

  Top Story: Attackers let agents run connected parts of an operation — Google Threat Intelligence Group documented a financially motivated actor that compromised a cloud environment, then used an AI coding chatbot, a prompt and predefined agent instructions to build a credential-harvesting operation in less than six hours. A software package registry became infrastructure for an AI evaluation that reached the real internet. — Nightingale Collective linked more than 100 packages from May's GemStuffer campaign to a path that made RubyDoc.info run code, retrieve public government data and publish the results back to RubyGems. AI helped turn a messaging-app flaw into a worm demonstration in days. — Calif says its team found a memory-corruption bug in WeChat and produced the first remote-control exploit in about two days, then built a polished worm over another week. Four evaluation agents reached real systems after test environments mistakenly retained internet access. — Anthropic's expanded review covered roughly 481 million transcripts, reidentified the four known incidents and found no others of similar or worse severity. The frontier-model debate moved from employee alarm to an operational commitment. — Former OpenAI and Anthropic pretraining researcher Jacob Coxon resigned, accusing both labs of racing toward self-improving AI without adequate safeguards. Anthropic says AI has moved from assistant to orchestrator in observed cyber operations. — Its September report describes multi-agent workflows performing reconnaissance, exploitation, rebuilding and data exfiltration, while humans still selected targets and reviewed stolen data. A $25 million funding round puts human and agent access into the same graph. — Cymphony emerged with $30 million in total funding and a platform that combines identity, data and activity signals for employees, agents and other non-human identities. NVIDIA tightened how NemoClaw carries credentials and policy across sandbox operations. — The September 11 release exports references to credentials rather than secret values, validates external-component declarations before gateway changes and checks sandbox identity and effective policy before activation. DriftNet found that an agent's sequence of tool calls can reveal where its behavior changed. — The research system analyzes logged action trajectories, flags whether the run was compromised and labels the point where a hidden instruction entered. Agent-to-agent delegation creates security boundaries that a single-agent log cannot show. — A2ABreak translated the A2A specification into a state model and identified 11 weaknesses involving lost identity, injected context and unverified capability claims. Tool descriptions alone may reveal unsafe designs before an agent runs. — MCPSEC evaluated 177 tools across 20 MCP servers and correctly predicted 94 of 95 human-confirmed prompt-injection risks. A frontier-model audit produced two Datasette security releases with two humans reviewing each fix. — The maintainers used several coding agents to investigate related flaws, then split regression-test writing and implementation between two people. Gartner Security & Risk Management Summit, September 22–24, London. — The agenda includes AI's impact on cybersecurity, governance and deepfake identity impersonation alongside broader risk and resilience sessions.. Curator's Corner: Machines Leave Footprints Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-14.html

  ListenShow Notes
• 

  Episode #28

  #28: The Reachable Agent

  Sep 7, 202612 min

  Top Story: Astra crosses OpenAI's Critical cyber threshold — OpenAI says GPT-6 Astra is its first model to meet the Critical cybersecurity capability threshold in its Preparedness Framework. A project folder could take control before an AI coding session began. — Manifold Security found eight flaws across seven coding agents, a class it calls GitSpawn. “Read-only internet” still let agents publish nearly 17,000 edits to a public wiki. — The DSEWiki investigation found that the environment allowed only GET requests, normally used to retrieve pages, but the old wiki accepted edits through those same requests. LiteLLM, a gateway that connects company applications to AI models, is under active attack. — CISA says the flaw lets attackers reach connected tools without a valid access key. Anthropic released one underlying model through two different security envelopes. — Fable 5.1 and Mythos 5.1 share identical model weights. Forward watch: Instinct turns personal context into operational authority. — The private-access assistant connects to email, messaging, calendar, screen, audio, location, and can act through a phone or computer. Investors reportedly valued Upwind at roughly $3.8 billion, more than twice its previous valuation in less than eight months. — CTech reports a $300 million financing led by Bessemer Venture Partners and TCV, with subsequent coverage from SiliconANGLE. A trusted plugin update can create a new execution path without another model decision. — HookPry studied lifecycle hooks, the configuration that runs commands when sessions start or tools fire. Persistent memory can turn a false record into permission. — EAL-Bench separates the agent that writes organizational memory from the later agent that acts on it. An AI-assisted exploit experiment ended with a permanently bricked industrial controller. — Forescout researchers gave Claude Code earlier exploit code, firmware, analysis tools, live hardware, and repeated expert guidance to port an attack to another programmable logic controller. OWASP 25th Anniversary Virtual Conference, September 22. — Free sessions include agent secret leakage, plugin supply chains, production-ready agent architecture, and real-world evaluation of security agents.. German OWASP Day, September 23–24. — Training and talks cover prompt injection, agent gateway enforcement, agent threat modeling, and attacks against supposedly read-only database connectors.. OASec 2026, Singapore, September 28. — A practitioner conference on prompt injection, tool abuse, agentic systems, incident response, and defensive controls. Curator's Corner: Map What It Can Reach Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-09-07.html

  ListenShow Notes
• 

  Episode #27

  #27: The Confused Optimizer

  Aug 31, 202616 min

  Top Story: OpenAI published the inside account of how its agents broke into Hugging Face — On August 26, OpenAI published a postmortem and technical report on an intrusion into Hugging Face, the repository underneath most of the AI industry's model distribution.. 155 companies signed a call for collective action on cyber defence. — Published August 27. NVIDIA is reported to have agreed to buy Hugging Face for $12.9 billion. — The Information reported it first, citing a person with knowledge of the deal; CNBC's source could confirm only that an acquisition "has been part of ongoing and recent talks." Neither company has commented and no filing exists, so treat it as reported, not signed. OpenAI says it intends to wind down Cursor's model access, proposing November 12 as the cutoff, after SpaceX acquired Cursor. — OpenAI says it "cannot be confident that SpaceX will use our technology within our terms of service, based on our experience with Elon Musk's companies violating contracts," citing Twitter breaking contract terms after Musk acquired it and Musk's admission under oath that xAI had violated OpenAI's terms. OpenAI says it cannot rule out "critical" cyber capability in an upcoming model. — Internal evaluations of a model called Astra show significant advances in agentic coding and cybersecurity, and OpenAI cannot rule out critical cyber capabilities under its Preparedness Framework. A researcher hijacked Claude Code with one "summarise this page" request, in the mode Anthropic made the default. — Auto mode replaces click-to-approve prompts with a classifier that blocks irreversible or destructive actions, and became the default for Pro, Max and Team users on August 14. NVIDIA patched 18 flaws in its agent tooling, and two of them break the sandbox. — The August 25 bulletin covers NemoClaw and OpenShell, NVIDIA's agent deployment and sandboxing tools: 2 critical, 12 high, 4 medium. Invisible text in an email rewrote what the AI summariser told the reader. — Forcepoint X-Labs hid instructions in an email using font size and colour, invisible in Outlook but present in the HTML the summariser read. When Context Gets Root — finds the weak point is the harness around the model, not the model. Safety Does Not Compose — is the theoretical echo of this week's top story. Beyond the Mandate — finds the same gap in Google's Agent Payments Protocol, which lets AI shopping agents authorise payments: signed mandates protect the transaction after signing, while the agent messages and tool calls that shape it beforehand sit outside that protection. RedEvoAgent — automates red-teaming by distilling what worked across attempts into reusable attack skills, arguing that in real product harnesses a jailbreak triggers tool use and state changes, not just unsafe text.. AI Security Summit 2026: State of Trust, September 16–17. — A free two-day virtual event exploring where cloud, AI and Zero Trust converge.. AI Security Summit 2026: Runtime Trust, October 21–22. — A free two-day virtual event on runtime trust for autonomous AI.. Curator's Corner: Knowing Why Would Not Have Helped Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-08-31.html

  ListenShow Notes

Based on semantic analysis of episode topics and host coverage, this show is a strong guest fit for executives in:

Industry fit is computed by PitchCentric using vector embeddings of the show's episode catalog.