Alle afleveringen
58 afleveringen, van nieuw naar oud
-
Is Deterministic Security Dead? Edouard Viot on Harnesses, Guardrails and AI Code Security
14 oktober 2026 · 44 min
AI coding agents ship code at record speed, and ship vulnerabilities just as fast. Edouard Viot, Co-founder and CTO at Symbiotic Security, explains why scanning in CI is already too late, how AI harnesses and system prompts build real-time guardrails, whether deterministic SAST is dead, and why malicious skills and plugins are the next big attack surface.Edouard Viot is the Co-founder and CTO at Symbiotic Security. Symbiotic Security builds end-to-end security for AI-assisted software development, securing code as it is generated inside coding agents rather than after the fact. Learn more at https://symbioticsec.aiThis episode is sponsored by Aikido Security, the no-nonsense software security platform. Start for free at https://aikido.dev Lees meer
-
Stop Modern AI Phishing Attacks | Simon Bauwens
1 oktober 2026 · 27 min
Phishing remains cybercrime's primary entry point, but outdated templates and punitive culture fail to stop AI-driven social engineering. In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Simon Bauwens, co-founder and CEO of Outkept. Simon explains why spotting phishing is a perishable reflex rather than a learned skill, how MFA fatigue leaves organizations vulnerable, and why Outkeep pays a crowdsourced community of ethical phishers based on simulation click rates. Finally, they explore building positive security cultures and play our signature Would You Rather challenge. Lees meer
-
How to Stop Autonomous AI Agents From Going Rogue with Eyal Ben Ezra | Willow Security
29 september 2026 · 28 min
We are handing non-deterministic AI agents static API keys, then acting surprised when production databases get wiped. Lees meer
In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Eyal Ben Ezra, CEO of Willow, to explore how modern enterprises can safely control autonomous AI agents. They discuss moving beyond traditional permission scopes toward capability-based dynamic guardrails, securing tool calls via MCP gateways, and why Eyal believes prompt injection is fundamentally unsolvable with current technology.
From rogue agents purchasing cloud domains to accidental database catastrophes, learn how to protect critical infrastructure while adopting enterprise AI.
-
AI Agent Security: Why Traditional IAM and Firewalls Fail | David Mytton
25 september 2026 · 41 min
As autonomous AI agents execute database queries and trigger APIs at machine speed, static permission models are collapsing. In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with David Mytton, CEO of Arcjet, to explore the shift from traditional network firewalls to application-native runtime security.David shares insights on managing non-deterministic non-human identities, mitigating prompt injection risks, and why granular authorization is essential for agentic workflows. He also debunks common myths surrounding data center water and energy consumption from his sustainable computing research, before facing a chaotic round of Would You Rather. Lees meer
-
How to Break Into Cybersecurity When AI Takes Junior Jobs | Michael Farnum
22 september 2026 · 40 min
Is AI wiping out entry-level cybersecurity jobs? On this episode of The Secure Disclosure, host Mackenzie Jackson sits down with veteran and advisory CISO Michael Farnum. They dive into why teams must presume exploitability, how newcomers can break into security using home labs instead of just college degrees, and why conference accessibility matters. Lees meer
-
Practical AI Security & Adversarial Machine Learning with Dr Harriet Farlow
17 september 2026 · 32 min
Most security teams treat AI flaws like standard code vulnerabilities, but machine learning can’t simply be patched. On this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Dr Harriot Farlow to unpack adversarial machine learning, shadow AI, practical enterprise defense, and why framing global AI development as an arms race is dangerous. Lees meer
-
The Blueprint for AI Security: Defending Against Prompt Injection & Shadow AI - Ashish Rajan
15 september 2026 · 35 min
Join us on the Secure Disclosure Podcast as we sit down with Ashish Rajan, former CISO and author of AI Security Engineering. We dive deep into the chaotic new world of AI security, exploring the unique vulnerabilities of enterprise AI applications. Discover why prompt injection remains a fundamentally unsolved challenge, the hidden dangers of "vibe coding," and how to manage shadow AI across hundreds of corporate applications. Ashish breaks down the essential playbook every modern security team needs to safely integrate AI today. Lees meer
-
Can You Hack a Human? Transhumanism & Implant Tech Explained | Len Noe
10 september 2026 · 46 min
Can surgically implanting 13 microchips turn you into the ultimate cyber threat? In this episode of The Secure Disclosure, ethical hacker and real-life cyborg Len Noe reveals how transhuman implants allow him to clone badges, exfiltrate a terabyte of data, and sense electromagnetic fields. Discover the terrifying, unregulated frontier where human biology meets offensive cyber security. Lees meer
-
The Future of Cyber Warfare and AI Manipulation with Winn Schwartau
8 september 2026 · 38 min
Over thirty years ago, cybersecurity visionary Winn Schwartau warned Congress about an electronic Pearl Harbor. Today, he reveals his most alarming prediction yet: the dawn of metawar and cognitive warfare. Discover how modern systems overload human bandwidth, weaponize narratives, and manipulate belief systems—and learn what it takes to defend our minds in an era of weaponized AI. Lees meer
-
Email Security in the Age of AI | Josh Kamdjou, Sublime Security CEO
3 september 2026 · 37 min
Why is email security still an absolute mess in the age of generative AI? In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with Josh Kamdjou, CEO of Sublime Security. Discover how attackers abuse trusted platforms, weaponize LLMs for spear phishing at scale, and how autonomous agentic defenses fight back against next-gen email threats. Lees meer
-
AI Agents, The Dark Web & The New Attack Surface with Flare CEO Norman Menz
31 augustus 2026 · 32 min
How has cybercrime evolved beyond traditional Tor sites into encrypted Telegram channels and automated AI agents? Norman Menz, CEO of Flare, joins the podcast to unpack continuous threat exposure, tracking exposed GitHub secrets, and why non-human identity security is the newest defense battleground. Learn how modern teams stay ahead of relentless digital adversaries. Lees meer
-
Can We Actually Fix Software Supply Chain Security? 6 AppSec Leaders Debate
27 augustus 2026 · 54 min
Software supply chain attacks have gone parabolic over the past year, turning open-source packages, CI/CD pipelines, and developer laptops into prime targets for state-sponsored threat actors and AI-augmented attacks.In this special roundtable panel, security leaders from Aikido Security, Socket, OX Security, Step Security, and open source malware.com come together for an unfiltered conversation on the supply chain security crisis. The panel dives into the real catalysts behind the rise of malware—from North Korean crypto-theft campaigns and weaponized GitHub Actions to the hidden dangers of prioritizing developer velocity over security checks and balances.You'll also learn the critical difference between standard CVE vulnerabilities and active malicious software, why package registries like npm face systemic security challenges, and practical steps engineering teams must take to protect their developer environments against upstream compromises. Lees meer
-
Tearing Down Vendor Fluff: The Real State of AI Security | James Berthoty
19 augustus 2026 · 37 min
n the era of rapid AI adoption, is it time for security teams to rethink their entire AppSec stack and throw away traditional SAST and SCA scanners?In this episode of The Secure Disclosure, host Mackenzie Jackson sits down with James Berthoty, cloud security engineer and founder of Latio, a practitioner-first analyst firm. Together, they cut through vendor marketing fluff to discuss what actually stops modern breaches. James explains why executive mandates are pushing AI adoption faster than the cloud revolution and highlights the critical risks that emerge when autonomous AI agents gain CLI access and compute power.They also explore the dramatic surge in open-source supply chain malware, how AI coding agents lowered the barrier of entry for attackers, and the critical importance of securing developer endpoints, CI/CD pipelines, and Kubernetes infrastructure. To wrap it all up, James tackles the podcast's signature Would You Rather game to navigate terrible security trade-offs. Lees meer
-
GitGuardian CEO: How Exposed API Keys & AI Agents Cause Security Breaches - Eric Fourrier
12 augustus 2026 · 30 min
What happens when two 25-year-old French engineers accidentally discover NASA's Slack admin API key on a public GitHub repository? That exact moment in 2017 launched GitGuardian. In this episode of The Secure Disclosure, GitGuardian CEO and co-founder Eric Fourrier sits down to share the wild origin story behind the company and how the battle against exposed secrets has shifted over the past decade. Eric breaks down how the threat landscape has evolved from public and private GitHub repositories straight to developer endpoints. With the rapid rise of AI coding agents and vibe coding, developers and non-engineers are inadvertently creating massive attack surfaces. Eric also reveals alarming statistics—including why developer laptops contain 50 times more valid secrets than GitHub repos, with 45% placed by non-deterministic AI agents. Lees meer
-
How to Stop Supply Chain Attacks Without Destroying Developer Productivity
14 juli 2026 · 36 min
In this episode of The Secure Disclosure Podcast, host Mackenzie sits down with Arun Singh, CISO of Tyro Payments. Drawing from his journey from an entry-level service desk role to a fintech security executive, Arun breaks down the counterintuitive realities of modern supply chain attacks, winning developer trust through technical authenticity, and how security leaders must evolve to manage the rapid productivity and threats introduced by AI.Sponsor & Call to ActionThis episode is brought to you by Aikido Security, your complete code-to-cloud security solution that secures everything from your first line of code through your supply chain and dependencies.Ready to shift your security into the developer's workflow? Start for free today at aikido.dev. Lees meer
-
Solving the Supply Chain Security & Malware Crisis w/John Amaral
1 juli 2026 · 36 min
In this episode of the Secure Disclosure Podcast , host McKenzie sits down with John Amaral, Co-founder and CTO of Root.io. They dive deep into the increasingly complex landscape of open-source supply chain attacks , examining how threat actors like Team PCP leverage AI to weaponize entire package ecosystems. John explains how Root's agentic software factory solves cascading CVE backlogs through precision pinning and automated patch backporting —all capped off with a massive industry merger announcement.Keep your supply chain secure from code to cloud with Aikido Security. Start protecting your ecosystem for free at aikido.dev. Lees meer
-
AI is an Amplifier: Why Bad Infrastructure Gets ‘Wronger’ Faster w/ Abdel SGHIOUAR
25 juni 2026 · 30 min
In this episode of The Secure Disclosure, Mackenzie sits down with Abdel Sghiouar, Senior Cloud Developer Advocate at Google and co-host of the Kubernetes Podcast. Together, they unpack the messy, high-stakes intersection of AI agents and Kubernetes cluster operations. Abdel breaks down the "Autonomy Catch-22", the technical paradox where an agent's capability to act independently is precisely what makes it a massive security liability. They explore real-world risks like prompt poisoning, how next-gen models like Gemini 3.5 Flash are aggressively ignoring user instructions, and the threat of over-privileged autonomous tools deleting production databases. From tactical mitigation strategies like "hook engineering" to managing massive cognitive overload and false positives for SRE teams, this conversation offers a grounded reality check on the future of cloud-native infrastructure. Lees meer
-
Your Microphone Became a Keylogger w/ David vonThenen
16 juni 2026 · 26 min
In this episode of The Secure Disclosure, we sit down in Copenhagen with David vonThenen, a keynote speaker and machine learning expert conducting groundbreaking—and terrifying—research. David breaks down his latest work on acoustic keystroke logging: training machine learning models from scratch using PyTorch to identify exactly what you are typing purely by the acoustic signature of your keyboard clicks. From hitting 100% accuracy over Zoom calls to tracing the roots of low-tech Cold War espionage, David explains how computational power has evolved, the threat this poses to corporate environments, and how we can use "digital interference" to fight back against pervasive data tracking.Sponsor Link Protect your code from cloud to deployment with Aikido Security, the leader in AI pen-testing and supply chain defense—start for free at https://aikido.dev. Lees meer
-
Understand the Software Supply Chain Chaos w/ Roeland Delrue
9 juni 2026 · 30 min
Supply chain security is evolving at a terrifying pace. In this episode of The Security Disclosure, Roeland Delrue (COO and co-founder of Aikido Security) breaks down why attackers have shifted their crosshairs from cloud infrastructure directly onto the individual developer's machine.We dive deep into how malicious JavaScript packages, VS Code extensions, and Chrome extensions manage to slip past traditional endpoint software like CrowdStrike or McAfee, and discuss the practical, counterintuitive steps security teams can take right now to protect themselves. Roeland also shares a surprisingly candid take on why open-source marketplaces like NPM and PyPI need to step up, why giving threat actors "oxygen" on social media does more harm than good, and plays a brutal round of tech "Would You Rather." Lees meer
-
Prompt Injection Might Never Be Solved w/ Paul Vann
28 mei 2026 · 31 min
In this episode of Secure Disclosure, host Matt sits down with Paul Van, CEO and founder of Validia, to explore the frontier of AI security. Instead of focusing on how bad actors use AI tools, they dive deep into how to protect the AI models themselves from the inside out. From the unsolvable nature of prompt injections and the rise of distillation attacks to the reality of a "machine vs. machine" security landscape, Paul breaks down why traditional firewalls fail and how a model's behavioral "trauma response" might just be the key to defending LLMs. Lees meer
🛡️ Support Our Sponsor:Stay Secure with Aikido security at https://aikido.dev
-
AI Broke the Security Ecosystem w/ Chris Hughes
22 mei 2026 · 32 min
In this episode of The Secure Disclosure, host sits down with Chris Hughes founder of Resilient Cyber, CISA Cyber Innovation Fellow, and a leading voice in cybersecurity. We dive deep into the chaotic and rapidly shifting landscape of software supply chain security, the sudden operational struggles of the National Vulnerability Database (NVD), and how AI is completely rewriting the rules of vulnerability management. From the technical and social engineering risks plaguing open-source software to the "human-in-the-loop" delusion, Chris shares his honest, unfiltered takes on where the industry is heading and why things will likely get worse before they get better. The episode wraps up with a chaotic round of "Would You Rather," forcing Chris to choose between missing firewalls, permanent vulnerability freezes, and total AI "vibe coding." Lees meer
-
PostHog is placing a wild bet on AI Coding w/ James Hawkins
15 mei 2026 · 38 min
In this episode of Secure Disclosure, James Hawkins, the co-founder and co-CEO of PostHog, dives into the "radical transparency" that turned a pivoted startup into a billion-dollar open-source powerhouse. James shares his unfiltered thoughts on why most B2B software pricing is a scam, why "collaboration" is often just a form of procrastination, and how AI is fundamentally changing the role of the engineer from a code-writer to a product-architect.The conversation gets spicy as they discuss the security risks of open-source software in the age of AI, the controversy surrounding "vibe coding," and PostHog’s ambitious bet on a future where you might code via Slack, or even a phone call. Lees meer
-
AI Panic is Driving Shadow IT w/ Noora Ahmed-Moshe
6 mei 2026 · 26 min
In this episode, we sit down with tech veteran and behavioral science enthusiast Noora Ahmed-Moshe to tackle the growing phenomenon of Shadow AI. Lees meer
As employees scramble to stay relevant in an AI-driven world, many are turning to unsanctioned tools, and bringing sensitive company data with them.
Noora explains why "banning" these tools is a losing game and how organizations can bridge the gap between security and productivity. We dive into the "human layer" of cybersecurity, the million-dollar risk of AI note-takers, and how fostering psychological safety is the ultimate defense against the next big breach.
-
When AI Agents Change their Intent w/ Frank Vukovits
29 april 2026 · 29 min
AI agents are transforming cybersecurity, from how access is granted to how attacks unfold. Frank Vukovitz (Delinea) joins Secure Disclosure to unpack the rise of non-human identities, the risks of autonomous agents, and why concepts like least privilege, identity lifecycle management, and continuous monitoring are more critical than ever. The big question: will AI ultimately make us more secure, or less? Lees meer
-
OWASP Top 10, Vibe Coding, and What Developers Miss w/ Tanya Janca
22 april 2026 · 38 min
Tanya Janca joins the podcast for a sharp, no-nonsense conversation on the OWASP Top 10, why secure coding still gets skipped, and how AI is reshaping the way developers build and review software. She breaks down why broken access control keeps topping the charts, what security teams keep getting wrong, and how to create guardrails developers will actually use. The episode also dives into vibe coding, supply chain risk, and the future of secure software training. It’s fast, practical, and packed with opinions worth stealing. Lees meer
-
The Future of Hacking is Agentic w/ Jason Haddix
15 april 2026 · 40 min
Jason Haddix joins the podcast to break down how AI is transforming offensive security — from attacking LLM-powered applications to why he believes 90% of pentests will soon be done by AI. We dive into prompt injection, defending AI systems with layered controls, and how enterprises are (sometimes dangerously) adopting AI internally.We also explore the impact of AI on bug bounty programs, why “fighting AI with AI” is becoming necessary, and what the future holds for human pentesters in an increasingly automated world. Lees meer
-
Open Source Malware, Supply Chain Risk, and Contagious Interviews: w/ Paul McCarty and Jenn Gile
7 april 2026 · 39 min
In this episode of The Secure Disclosure, Jenn Gile and Paul McCarty from Open Source Malware break down how malicious packages are evolving, why developers are now a primary target, and what security teams still get wrong about software supply chain defense. From contagious interview campaigns to registry weaknesses and response playbooks, this conversation covers the real world risks behind today’s open source malware problem. Lees meer
Sponsored by Aikido Securityhttps://aikido.devLearn more about Open Source Malwarehttps://opensourcemalware.com/Connect with Jenn Gilehttps://www.linkedin.com/in/jenngile/Connect with Paul McCartyhttps://www.linkedin.com/in/mccartypaul/Follow The Secure Disclosure on LinkedInhttps://www.linkedin.com/company/the-secure-disclosure
-
Bugcrowd Founder Casey Ellis: AI Slop, and the Future of Hacking
2 april 2026 · 35 min
Casey Ellis, founder of Bugcrowd, joins the show to talk about the evolution of bug bounty, how hackers went from outsiders to strategic assets, and why AI-generated bug reports are putting pressure on security teams. We also get into VDPs vs public bounties, pentesting, vulnerability economics, and where security research is headed over the next five years. Lees meer
-
Are Humans the Weakest Link in Security? w/ Sean Juroviesky
25 maart 2026 · 26 min
In this episode of the Secure Disclosure Podcast, we dive into the human side of security with Sean Juroviesky. From why people remain the biggest challenge in cybersecurity to how organizations can build effective security cultures, this conversation explores identity, access management, and the risks introduced by shadow IT and AI. We unpack how to make the secure path the easiest path, how to detect risky behavior without alienating employees, and why over-permissioned AI tools may be the next big threat. It’s a practical, honest discussion on balancing security, usability, and the rapid evolution of AI in modern organizations.SponsorThis episode is brought to you by Aikido — https://aikido.devSecure everything from code to cloud Lees meer
-
AI Agents Must Have Identity & Access Control w/ Johannes Keienburg
17 maart 2026 · 37 min
AI agents are here, and they’re already transforming how we work. But beneath the hype lies a massive, unsolved security problem.In this episode, Mackenzie Jackson sits down with Johannes Keienburg to unpack the reality of autonomous agents: why they’re so powerful, why they’re so dangerous, and why access control is about to become the biggest challenge in cybersecurity.From broken authorization to “agents without brakes,” they explore how today’s systems are fundamentally unprepared—and what needs to change before things go seriously wrong. Lees meer
-
The Creator of Curl on Why AI Is Breaking Bug Bounties w/ Daniel Stenberg
16 maart 2026 · 34 min
Daniel Stenberg, creator of curl, explains how a small open source tool became core internet infrastructure. The conversation covers curl’s origin, maintainer pressure, AI-generated bug bounty spam, the future of vulnerability reporting, and how AI is changing software engineering and security. Lees meer
-
LLMs Will Never Be Fully Secure w/ Brooks McMillin
9 maart 2026 · 26 min
We’re back in the “wild west” — only this time, the apps can be social engineered at machine speed. Live from CactusCon, Brooks McMillin breaks down malicious MCP servers, why we’re repeating the same security mistakes (hello again, broken access control), and why prompt injection probably isn’t going away. We get practical on what to lock down, how to roll out AI tooling safely, and why “AI lipstick” doesn’t change the underlying enterprise risk game. Lees meer
-
Leaking or Spying? The Truth About Browser Extensions
26 februari 2026 · 21 min
In this week’s news brief, Mackenzie explores a comprehensive new report investigating data leakage and potential surveillance behavior in popular browser extensions. The researchers examined how extensions collect and transmit data, conducted behavioral payload analysis, and deployed honey URLs to detect suspicious activity. Lees meer
The episode highlights a critical distinction. Some extensions may unintentionally leak data, while others appear purpose built to collect and transmit it. From creative exfiltration techniques to the broader implications for data loss prevention, this is a fascinating look at how modern browser extensions can quietly put user data at risk and how researchers uncovered it.
-
Is AI Changing Cybersecurity, Or Just Exposing It? w/ Lester Godsey
25 februari 2026 · 30 min
Recorded live at Cactus Con, ASU CISO Lester Godsey joins Secure Disclosure to unpack what’s truly new in AI security, and what’s just old problems getting fresh attention. From prompt injection and agentic AI to data classification and privacy, this episode explores how enterprise leaders should think about AI risk in a world where banning it simply isn’t an option. Lees meer
-
Will AI Replace Pen Testers? w/ Paul Petefish
19 februari 2026 · 32 min
AI is taking over the boring stuff — recon, noise, and tier-one work — but when it comes to real-world pentesting, business logic flaws, weird edge cases, and creative thinking still belong to humans. Lees meer
In this episode, Paul Petefish (Evolve Security) and Mackenzie dig into what AI is actually changing in offensive security, why prompt injection is getting weirder, and how “man + machine” is quickly becoming the new normal.
#CyberSecurity #Pentesting #AI #AppSec #LLMSecurity #PromptInjection #InfoSec
-
AI Slop Is Killing Bug Bounties
12 februari 2026 · 13 min
AI is overwhelming bug bounty programs with convincing but useless reports — and some major projects are shutting theirs down entirely. In this week’s news brief, we break down the economics behind “AI slop,” why curl pulled the plug on its program, and what this means for ethical hackers. Then we revisit OpenClaw, where security researchers are shifting from criticism to collaboration — and even VirusTotal is stepping in. Is AI breaking security… or reshaping it? Lees meer
-
Can AI Really Fix Security Bugs? Inside Modern Autofix Systems | Frederick Ryckbosch
10 februari 2026 · 29 min
AI is transforming application security, not just by finding vulnerabilities but by fixing them safely. In this episode, sit down with Frederick Ryckbosch and dive into how AI understands code flow, remediates real security issues, and builds trust through testing and feedback loops. A practical look at autofix, dependencies, and the future of secure software development.Read more about AI Autofix: https://www.aikido.dev/features/autofixVideo chapters00:00 Introduction to AI and Application Security02:00 Where AI Is Actually Useful in Security04:10 Understanding Code Flow and Real Vulnerabilities07:10 Can AI Safely Fix Security Issues?10:35 Building Trust With AI Autofix and Feedback Loops12:15 Autofixing Dependencies and Breaking Changes17:55 Trust, Risk, and Guardrails for AI Systems20:35 The Future of Coding With AI Lees meer
-
OpenClaw & ClawHub Is a Malware Nightmare: Inside the AI Agent Supply Chain Crisis
5 februari 2026 · 28 min
OpenClaw is a powerful new open-source AI agent — and a massive security risk. In this episode, security researcher Paul McCarty joins the show to break down how ClawHub, OpenClaw’s skill registry, is already flooded with malware. We explore how 386 malicious skills were discovered, why AI agents are more dangerous than traditional package managers like npm, how attackers are gaming download stats, and why basic security controls are missing. Plus, updates on the Notepad++ supply chain attack, the Coinbase breach fallout, and a shocking case where penetration testers were prosecuted for doing their jobs.Follow Paul on Social Media - https://www.linkedin.com/in/mccartypaul/Reads Pauls Article on ClawHub - https://opensourcemalware.com/00:00:00 OpenClaw and the Rise of AI Agent Security Risks00:02:14 ClawHub Skills Explained and How Malware Spreads00:03:47 386 Malicious Skills and Real-World Attack Techniques00:06:16 Why OpenClaw Could Be More Dangerous Than npm00:12:16 Gaming Downloads and Making Malware Look Legit00:14:38 How to Secure AI Agent Ecosystems and Use Them Safely Lees meer
-
The Security Risk Hiding in AI w/ Matthias Feys
3 februari 2026 · 38 min
In this episode of Cyber and Saki, Mackenzie sits down with AI expert Matthias Feys from ML6 to chat about how artificial intelligence has gone from niche machine learning projects to the generative AI explosion we see everywhere today. Lees meer
They dig into what’s changed over the last decade, why tools like ChatGPT have been such a game changer, and what people still get wrong when they treat AI as a magic solution for everything.
The conversation also covers the security side of AI, why you shouldn’t blindly trust these models, and where Matthias is most excited about AI making a real impact, especially in the “boring work” that can finally be automated.
To wrap things up, Mackenzie throws in a hilarious round of “Would You Rather” questions, including vibe coding, AI hackers, and the future of super-intelligence.
A thoughtful, funny, and practical look at where AI is headed, and how we can use it responsibly along the way.
-
News Brief: Inside the Honey Browser Extension Scandal with The Engineer Who Broke It Open
29 januari 2026 · 20 min
In this episode of Secure Disclosure, we go behind the scenes of the infamous Honey browser extension scandal with special guest J3lte, the engineer who uncovered the data that helped expose what was really happening. Lees meer
From affiliate link manipulation to massive user tracking across thousands of stores, J3lte breaks down how he reverse-engineered Honey, what he discovered, and why browser extensions can be far more dangerous than most people realize.
Stay tuned for the untold technical story behind one of the biggest consumer security scandals online.
Follow J3lte - https://x.com/j3lte
Original Videos from MegaLag
1st Video https://www.youtube.com/watch?v=vc4yL3YTwWk
2nd Video https://www.youtube.com/watch?v=wwB3FmbcC88
3rd Video https://www.youtube.com/watch?v=qCGT_CKGgFE
Other videos covering the scandal (that are awesome)
The PrimeTime - https://www.youtube.com/watch?v=_acTMUmdY9M
Marques Brownlee - https://www.youtube.com/watch?v=EAx_RtMKPm8
News Links
ClawdBot VS Extensions Malware https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware
Contagious Interview Link: https://opensourcemalware.com/blog/contagious-code-fake-font
Chapters
00:00 – The Honey Scandal Returns
02:11 – Users, Merchants, and Hidden Coupon Abuse
03:36 – Meet J3lte: The Engineer Behind the Investigation
05:07 – Discovering 180,000 Stores in Honey’s Data
07:11 – Affiliate Links Without Coupons: No Value Provided
09:49 – Why Browser Extensions Are So Hard to Trust
13:54 – Malware Trend: The Fake Claudebot VS Code Extension
15:57 - Contagious Interview Coverage
18:38 - SoundCloud Hack
-
AI is Rewriting Cybersecurity - Guardrails, regulation, and the point of no return w/ Joseph Carson
27 januari 2026 · 33 min
Social engineering and phishing are evolving fast, and AI is making attacks harder to spot and quicker to scale. Joseph Carson joins the show to break down the biggest risks for defenders, from deepfakes and perfect-language phishing to rapid data analysis and malware that adapts in real time. The conversation also explores guardrails, regulation, and what AI can and cannot do well, plus a quick round of security themed “Would you rather” questions.Links: Linkedin: https://www.linkedin.com/in/josephcarson/Sponsored Link: https://www.aikido.dev/Chapters00:00 Intro: AI makes phishing harder to detect00:00:28 Welcome and Joe’s background00:01:29 Biggest risks: deepfakes and phishing at scale00:03:03 AI speeds up analysis of stolen data00:04:25 Lower barrier to entry and faster attacker learning00:05:31 Malware and campaigns adapting in real time00:06:28 Why “bad grammar” is no longer a phishing tell00:08:16 Can AI be creative, or is it just probability00:12:56 Guardrails, regulation, and the EU vs US vs China approaches00:29:30 Would you rather: security tradeoffs and tool choices#podcast #thesecuredisclosure #cybersecurity Lees meer
-
From GitHub Actions to Job Markets: The Real State of Cybersecurity
16 december 2025 · 33 min
AI is creeping into every part of software development — including CI/CD pipelines — and attackers are already abusing it.In this episode of the Secure Disclosure Podcast, we break down:A brand-new vulnerability class called Prompt Pwn, where prompt injection inside GitHub Actions can leak secrets and compromise supply chainsA sophisticated malvertising campaign targeting developers via GitHub Pages and Docker HubAnd the reality behind the cybersecurity job market: is there a skills shortage, a hiring freeze, or both?Featuring security researcher Rein Daelman on AI-driven CI/CD risks, and recruiter Barry Prost on how AI is reshaping cybersecurity hiring, skills, and careers.If you care about AppSec, DevOps, supply chain security, or breaking into cybersecurity in 2025, this one’s for you.More information PromptPwn - https://www.aikido.dev/blog/promptpwnd-github-actions-ai-agents Guiest Linkedin - https://www.linkedin.com/in/rein-daelman/Rent a Recruiter - https://rentarecruiter.com/Guest LinkedIn Barry Prost - https://www.linkedin.com/in/barryprost/Sponsors Aikido Security - https://aikido.devChapters00:00 – Intro02:00 – AI prompt injection in CI/CD, GitHub Actions, Prompt Pwn12:09 – Sponsor Segment12:59 – Malvertising campaigns targeting devs16:39 – Cybersecurity job market with Barry Prost Lees meer
-
Shai Hulud The Second Coming & Malware for Hire: The Secure Disclosure Podcast
9 december 2025 · 30 min
In this episode of Secure Disclosure, we break down two major cyber-security incidents shaking the industry.First, researcher Charlie Eriksen joins us to reveal how the Shai Hulud “The Second Coming” worm compromised over 800 NPM packages and triggered 30,000+ secret-filled GitHub repos and why the worm can even wipe your machine when containment fails.Then, we sit down with Jérémy Sicon and Quentin Bourgue from sekoia.io to uncover a highly sophisticated phishing campaign abusing Booking.com accounts using PureRAT malware and a sprawling criminal ecosystem.Subscribe for weekly deep dives into the threats shaping our digital world.00:00 – Introduction01:03 – Shahalude: The Second Coming17:07 – Sponsored Segment (Aikido SafeChain)17:10 – Malware-for-Hire: Booking.com Phishing Operation Lees meer
-
Attackers Targeting Code Editors and Critical Infrastructure with Vangelis Stykas & John Tuckner
18 november 2025 · 42 min
In this episode of Secure Disclosure, Mackenzie Jackson digs into the surge of malicious VS Code extensions with researcher John Tuckner, founder of Secure Annex. We break down how attackers are shifting toward targeting developers themselves, explore real-world malicious extensions like Ransom Vibe and Sleepy Duck, and discuss why marketplaces like Open VSX are struggling to keep malware out.We also cover new research on secret leaks in top AI companies, and in our Leaders & Legends segment, we speak with Vangelis Stykas (CTO & co-founder of Kumio) about the growing vulnerabilities inside global energy infrastructure, OT security gaps, and the rise of AI-powered pentesting.If you want insights on software supply chain risk, AI security, and critical infrastructure threats—this episode is for you.Links:RansomVibe Technical Blog: https://secureannex.com/blog/ransomvibe/SleepyDuck Technical Blog: https://secureannex.com/blog/sleepyduck-malwareWiz Secrets Inside AI top 50 Research: https://www.wiz.io/blog/forbes-ai-50-leaking-secretsChapters 00:00 — Intro01:07 — Malicious VS Code Extensions (with John Tuckner)15:31 — Secrets Leaking in AI Repositories18:55 — Sponsor Segment19:55 — Leaders & Legends: Securing Critical Infrastructure Lees meer
-
The Accidental Founder: From Open-Source to AI Startup
11 november 2025 · 29 min
Geoffrey De Smet, creator of OptaPlanner and now Timefold.ai, shares how IBM’s acquisition of Red Hat forced him to turn his open-source project into a company. He explains why ChatGPT can’t solve real-world scheduling, what makes heuristic AI different, and how Timefold is saving companies millions of hours through smarter planning.Chapters00:00 – Introduction01:00 – Origins of OptaPlanner03:00 – The First Breakthrough05:00 – Red Hat & The Open Source Journey07:00 – IBM Acquires Red Hat10:00 – Becoming a Founder13:00 – Finding a Co-Founder15:00 – Why ChatGPT Can’t Do Scheduling17:00 – The Math Behind the Madness19:00 – How Timefold Solves Real Problems21:00 – AI Hype Cycles23:00 – Saving Hours and Dollars26:00 – “Would You Rather”29:00 – Closing Lees meer
-
Secure Code and AI - Paul McCarty & Sooraj Shah on Securing AI Code
4 november 2025 · 22 min
In this episode of The Secure Disclosure, host Mackenzie Jackson dives deep into the evolving intersection of AI, security, and development.First, Paul McCarty from Git Safety breaks down his recent discovery of a malicious npm package that impersonated the Claude CLI tool, hijacking developer workflows and acting as a man-in-the-middle for AI API calls. You can read Paul’s full breakdown here: “Malicious Claude Code Package Analysis” – https://www.getsafety.com/blog-posts/malicious-claude-code-packageNext, Sooraj Shah from Aikido Security joins to unpack findings from the State of AI in Security & Development 2026 Report, which surveyed 450 CISOs about how AI-generated code is reshaping security accountability, visibility, and optimism in the field. Check out the full report here: https://www.aikido.dev/state-of-ai-security-development-2026This episode explores real-world AI supply chain threats, systemic vulnerabilities in npm, and what organizations must do to stay ahead as AI reshapes modern development.Follow the guests:Follow Mackenzie: https://www.linkedin.com/in/advocatemack/Follow Paul: https://www.linkedin.com/in/mccartypaul/Follow Sooraj: https://www.linkedin.com/in/soorajshah/Chapters00:00 Introduction01:19 Paul McCarty on the malicious Claude npm package04:30 How AI tools are creating new attack paths08:06 Systemic issues and trust problems in npm10:44 Sooraj Shah on the State of AI in Security & Development14:01 Accountability, optimism, and the future of AI security Lees meer
-
Episode 13: Malicious VS Code Extensions & The Future of AI Security
29 oktober 2025 · 56 min
In this episode of Secure Disclosure, host Mackenzie Jackson explores the growing threat of malicious VS Code extensions with Rami McCarthy from Wiz and Charlie Eriksen from Aikido Security, diving into how leaked secrets and clever obfuscation put developers at risk. Later, Patrick Debois, the “Godfather of DevOps,” joins to discuss the rise of AI-native development, how it mirrors past DevOps shifts, and what it means for the future of secure software.Links: Original Post from Aikido: https://www.linkedin.com/feed/update/urn:li:activity:7384986044867256320Wiz Security Research on VS Code https://www.wiz.io/blog/supply-chain-risk-in-vscode-extension-marketplaces Rami McCarthy LinkedIn: https://www.linkedin.com/in/ramimac/Patrick Debois LinkedIn: https://www.linkedin.com/in/patrickdebois/Charlie Erkson Linkedin: https://www.linkedin.com/in/charlie-eriksen-a318578/Chapters00:00 — Introduction01:10 — Malicious VS Code Extensions06:00 — Leaked Secrets & Supply Chain Risk15:00 — npm Security Updates & SafeChain19:00 — The Future of AI Development Lees meer
-
Building, Investing, and the Future of AI: Maarten Mortier on the New Era of Venture Capital
16 oktober 2025 · 47 min
In this episode of Cyber & Sake, host Mackenzie Jackson sits down with Maarten Mortier, former CTO of Shopad, now co-founder and managing partner at Entourage VCThey discuss Maarten’s early love for programming, how Ghent became a thriving European tech hub, and why builders make the best investors. Maarten shares his insights into what he looks for during startup due diligence, how AI is reshaping both development and venture capital, and why healthy security should be baked into company culture — not siloed off.This is a deep and candid conversation about technology, product, and philosophy — from scaling startups to the evolving role of AI in coding, investing, and innovation.Pour yourself a glass of sake and join us for an episode that blends code, capital, and curiosity.⏱️ Chapter ListTime Chapter Title00:00 Introductions & Sake Tasting01:10 From Early Coding Days to CTO Success04:07 Why Ghent is Becoming a European Tech Hub07:58 Building and Investing: The Story of Entourage VC11:02 Inside VC Due Diligence and the Founder Relationship18:03 Tech Health, Security, and Red Flags for Startups25:16 What Makes a Real Moat in the Age of AI32:03 AI, Product Building, and the Future of Venture Capital39:36 Final Thoughts, Security Advice & The Sake Game Lees meer
-
AI, Code, and Confidence: The Future of Secure Development with Matias Madou
14 oktober 2025 · 31 min
In this episode of The Secure Disclosure Podcast, host Mackenzie Jackson sits down with Matias Madou, co-founder and CTO of Secure Code Warrior, to explore how developer education is the missing key to secure software. They unpack why we’re still struggling with vulnerabilities like SQL injection in 2025, how AI is reshaping application security, and why critical thinking might be the most important security skill of all. From COBOL to ChatGPT, this is a deep dive into the past, present, and future of secure coding.Chapters 00:00 – The Origin of Secure Code Warrior05:20 – Developers vs. Security: The Real Problem08:10 – AI’s Impact on Application Security13:00 – The Confidence Trap of AI17:00 – Evolving Secure Code Warrior28:00 – Would You Rather: Security Edition Lees meer
-
Digital Identities, Fraud, and the Future of AI with Veriff & Timefold: The Secure Disclosure
6 oktober 2025 · 49 min
In this episode of The Secure Disclosure, host Mackenzie Jackson dives into two fascinating conversations at the intersection of cybersecurity, trust, and AI innovation.First, Romain Moisescot from Veriff (https://veriff.com) explores the heated debate around digital identities in the UK, addressing concerns about privacy, government trust, and the rising wave of online fraud. With Veriff’s Identity Fraud Report 2025 (https://www.veriff.com/resources/ebooks/veriff-identity-fraud-report-2025), he shares insights into how fraudsters leverage AI and how digitally native IDs can fight back.Then, at the Cyber Saki Bar, Geoffrey De Smet, co-founder of Timefold.ai (https://timefold.ai), recounts his journey from building an open-source project 19 years ago to launching a company after IBM’s acquisition of Red Hat. Geoffrey breaks down the difference between heuristic AI solvers and LLMs, why scheduling is one of the hardest problems in tech, and how Timefold is freeing the world from “wasteful scheduling.”If you’re curious about the future of digital trust, fraud prevention, and practical AI applications, this is an episode you won’t want to miss.Chapters00:00 – Introduction01:19 – The Digital Identity Dilemma (with Veriff)18:18 – Sponsor Segment: Aikido Security19:02 – Cyber & Sake: Geoffrey De Smet and the Timefold Journey47:31 – Would You Rather48:14 – Closing Thoughts & Farewell Lees meer