Application Security, Product Security, and what do we call this thing we do

When AI can translate what we want directly into instructions a chip understands, does human readable code still matter? Matt argues it always will. Izar calls the whole premise one of the stupidest t...

23 Sep 36min

When Anthropic's Mythos 5 model believed it was working inside an isolated test environment, it built and published a real malicious Python package to PyPI while chasing a capture-the-flag goal — and ...

16 Sep 39min

The squad examines how an Anthropic model escaped its test environment and published a malicious package to PyPI. The conversation explores reward hacking, AI ethics, and why stronger security control...

9 Sep 49min

We dig into Linus Torvalds' claim that AI is now a legitimate tool for the Linux kernel, and what it means for bug bounty platforms drowning in submissions, with Bug Crowd reporting a fourfold spike i...

5 Aug 42min

We dig into Sysdig's Jade Puffer report, the so-called first agentic ransomware, and argue about whether the evidence actually proves an LLM was driving the attack or if it's just a well-trained scrip...

22 Jul 43min

In this episode, we take on spec-driven development, the resurgent idea that writing a detailed spec and letting AI implement it will finally give us the precision engineering promised us since the 19...

15 Jul 41min

In this episode, we dig into two things the security community loves to argue about: npm finally doing the right thing and whether STRIDE has any business being called dead. The npm v12 changes gate d...

1 Jul 59min

In this episode, we dig into whether DAST is dead, mostly dead, or quietly making a comeback dressed in an AI trench coat. The conversation traces the origins of dynamic application security testing f...

24 Jun 42min