Sandbox Escapes with Rubrik's Zero Labs, AI recorders eroding privacy, and the news - Joe Hladik - ESW #472
Summary
Joe Holado from Rubric discusses a new LLM vulnerability class called remote prompt execution, which allows attackers to bypass AI guardrails and spawn remote shells in Microsoft Copilot. The episode also features a segment on the privacy risks of AI note-takers and recorders, highlighting how these devices often record sensitive conversations without clear consent or visibility. Additionally, the hosts cover enterprise security news, including research on sandbox escapes, the reliability of AI-generated patches, and the growing vulnerabilities in data centers.
Topics discussed
Intro: LLM vulnerability, AI note takers, and enterprise news
Thrift shopping and furniture sourcing stories
Announcements: Threat intel, conference discounts, and travel mishaps
Rubric introduction and discovery of the vulnerability
Rubric Agent Cloud: Managing autonomous AI agent risks
Rubric's strategy: Telemetry and threat intelligence
Ransomware, backups, and the economics of cybercrime
Explaining Remote Prompt Injection and the attack path
Demonstrating the exploit: Spawning remote shells in Azure
Vendor response, fixes, and the challenge of detection
Inherent trust issues and behavioral detection strategies
Metadata analysis and firewall events for detection
Transition to AI note takers and recorders segment
Privacy concerns with AI recorders in therapy and meetings
Debate: Covert recording vs. traditional medical charting
Impact on trust, medical outcomes, and group therapy
Data risk, privacy expectations, and enterprise recommendations
Vibe check: Who wins the non-human identity land grab?
Identity for AI agents: IAM incumbents vs. new platforms
Attacker constraints, 3rd party risk, and legal guidance
Acquisitions: Visa, Biocatch, and Okta identity plays
Cyber insurance exclusions and the plane WiFi hacking story
Ethical hacking, intent, and legal repercussions
AI model capabilities, government pulls, and research intent
Bob the Hacker: FIFA World Cup backend access and Flock cameras
FireStore database exposure and negligence in reporting
Automated patching: Off-by-one labs research and limitations
AI mitigation strategies vs. code-level patching
Tongue-controlled trackpad and closing remarks
Listen ad-free on Castria