Dark mode: ON

Infosec Decoded Season 5 #91: So Much Winning

With sambowne@infosec.exchange and Doug Spindler

Recorded Tue, Nov 18, 2025

AI

Founder Admits His “AI Transcription” Startup Was Just Him Joining People’s Meetings and Taking Notes by Hand
"We'd sit there silently, take detailed notes, and send them 10 minutes later."
AI-Powered Stuffed Animal Pulled From Market After Disturbing Interactions With Children
The cuddly companion was giving wildly inappropriate and even dangerous responses, including tips on how to find and light matches, and detailed explanations about sexual kinks.
All of My Employees Are AI Agents, and So Are My Executives P
As a test, he made a Potemkin company. The agents made up stories about taking hikes, fabricated technical details and tests, and argued among themselves.

Ash would mention user testing, add the idea of user testing to his memory, and then subsequently believe we had in fact done user testing. Megan described fantasy marketing plans, requiring hefty budgets, as if she’d already set them in motion. Kyle claimed we’d raised a seven-figure friends-and-family investment round. If only, Kyle.

Power Companies Are Using AI To Build Nuclear Power Plants P
Microsoft and nuclear power company Westinghouse Nuclear want to use AI to speed up preparation of nuclear licensing documents, from "months to minutes." This could lead to disaster, since the documents will simply be written without anyone actually reasoning and understanding safety issues.
EU bows to pressure on loosening AI, privacy rules
The European Commission says it has heard the concerns of EU firms and wants to make it easier for them to access users' data for AI development -- a move critics attack as a threat to privacy.
AI Companies Are Treating Their Workers Like Human Garbage, Which May Be a Sign of Things to Come for the Rest of Us
Workers are being laid off, and sometimes hired back at lower rates for the same work.
AI math genius delivers 100% accurate results
AlphaProof is different because its answers are always 100% correct. That's because it uses a specialized software environment called Lean (originally developed by Microsoft Research) that acts like a strict teacher verifying every logical step. This means the computer itself verifies answers, so its conclusions are trustworthy.
Software engineer reveals the dirty little secret about AI coding assistants: They don't save much time
The code is too bad to use, and requires repairs.
Researchers find hole in AI guardrails by using strings like =coffee P
This attack targets model guardrails, which tend to be machine learning models deployed to protect other LLMs. Add enough unsafe LLMs together and you get more of the same.

The technique, dubbed EchoGram, serves as a way to enable direct prompt injection attacks. It can discover text sequences no more complicated than the string =coffee that, when appended to a prompt injection attack, allow the input to bypass guardrails that would otherwise block it.

EchoGram sends a list of benign and malicious words to the LLM, and scores sequences in the wordlist to determine when model "flips"--misclassifying the words.

Infographic about AI

Politics

Marjorie Taylor Greene says Trump policies are 'not America first' in fight over MAGA
When asked about her previous attacks against political opponents — such as in 2020 when she posted an image of a gun alongside a group of progressive Democratic congresswomen — Greene apologized.

"I think that's fair criticism," Greene said. "And I would like to say humbly I'm sorry for taking part and the toxic politics. It's very bad for our country."

UCLA faculty gets big win in suit against Trump’s university attacks
A preliminary injunction blocks the United States government from halting federal funding at UCLA or any other school in the University of California system. The court finds that this plan was deficient on multiple grounds, from violating legal procedures for cutting funding to an illegal attempt and suppressing the First Amendment rights of faculty.
Judge smacks down Texas AG’s request to immediately block Tylenol ads
The Texas lawsuit hinges on the unproven claim that Tylenol causes autism.
CISA, eyeing China, plans hiring spree to rebuild its depleted ranks
CISA will now consider granting exceptions to its return-to-office policy, and plans to expand its partnerships with colleges and universities to prepare young people for careers in cybersecurity.
A Chinese firm bought an insurer for CIA agents - part of Beijing's trillion dollar spending spree P
In 2015, the insurer, Wright USA, had been quietly purchased by Fosun Group, a private company believed to have very close connections with China's leadership.

US concerns became immediately clear: Wright USA was privy to the personal details of many of America's top secret service agents and intelligence officials. No one in the US knew who might have access to that information now the insurer and its parent, Ironshore, were Chinese-owned.

‘Chad: The Brainrot IDE’ is a new Y Combinator-backed product so wild, people thought it was fake
It does vibe coding, and while waiting, the user can gamble, watch TikToks, or play games. Their argument is, by doing your brainrot activities within the IDE itself, as soon as the AI is done with the task, you’ll get right back to work rather than be focused on your phone or browser.
At 16, I was experimented on by the CIA and now I'm suing
She became an unwitting participant in covert CIA experiments known as MK-Ultra. The Cold War project tested the effects of psychedelic drugs like LSD, electroshock treatments and brainwashing techniques on human beings without their consent.
Why Elon Musk won't ever realize the shareholder-approved Tesla payout
The revenue goals are impossible.

Infosec

Unremovable Spyware on Samsung Devices Comes Pre-installed on Galaxy Series Devices
AppCloud tracks users’ locations, app usage patterns, and device information without seeking ongoing consent after initial setup. Even more concerning, attempts to uninstall it often fail due to its deep integration into Samsung’s One UI operating system.
Decades-old ‘Finger’ protocol abused in ClickFix malware attacks
Threat actors are using the protocol to retrieve remote commands to execute on Windows devices.