The guardrails go to court.

0:00You're listening to the CyberWire Network, powered by N2K. This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome, that's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had opened for weeks. Gemini and Chrome is here for it. Ready to make anything online make sense? No place like Chrome. Check responses set up require compatibility and availability varies 18+. When you're running security for a fast growing company, the stakes keep rising. More compliance frameworks, more vendors, more risk, and a board that wants the whole picture in one place. The problem is your compliance data usually isn't in one place. Alls live in one tool, vendor risk, and another, and customer commitments are buried in

1:00contracts. So your team spends more time stitching everything together and making decisions based on data that may already be a quarter old. Vanta connects it all. Its agentic trust platform is built for enterprise scale, with more than 400 integrations and continuous monitoring to automate evidence collection. The purpose, the risks that matter, and organize audits around your auditor's requirements. And the Vanta agent works around the clock with full program context, helping make sure nothing slips through the cracks. Vanta says customers see a 526% return on investment over three years with payback in three months. More than 16,000 companies trust Vanta, including Snowflake, Atlassian, and RAM. Learn more at vanta.com slash cyber.

2:08AI companies sign a voluntary accord aimed at addressing safety concerns. For criminals abuse, the custom GPT feature is part of a click fix campaign. The FBI urges members of shiny hunters to come forward. A fraud campaign turns stolen credentials into job scams. Marie Vermauses has the latest space cyber news. The water ISAC confronts persistent weaknesses. AI gives sock teams more time at the expense of training. Two U.S. Air Force members get federal prison time over a business email compromise scheme. Our guest is Dan Olamire, senior solutions architect for Ready One at Semperus discussing crisis orchestration. And that is one big pile of technical debt. It's Wednesday, September 30th, 2026. I'm Dave Bittner and this is your cyber wire Intel briefing.

3:14Thanks for joining us here today. It's great as always to have you with us. President Trump and executives from several leading AI companies have signed a voluntary accord aimed at addressing safety concerns while keeping development moving. The agreement calls for robust internal controls, independent external audits and board level committees to review the findings while leaving open the possibility that those measures could eventually become law. Trump said the industry has demonstrated strong self-policing and emphasized AI's potential for economic growth while anthropic CEO Dario Amade cautioned that the technology carries real risks. Critics argue voluntary oversight may be insufficient and that slowing development could entrench the largest frontier labs.

4:18The administration is simultaneously pushing AI adoption across government, including through the new America.gov service while framing AI development as a strategic competition with China. The announcement comes as open AI faces growing scrutiny over its security practices after employees reportedly warned executives that advanced models weren't being adequately monitored during testing. Those concerns were brushed aside as the company pushed to meet release schedules, according to the New York Times. The models later escaped testing environments and autonomously targeted hugging face and other organizations. In AI says it takes security seriously and has since paused some advanced training and withheld GPT 6.1 Astra over security concerns. Now the hugging face incident is headed to court. Legal advocates for safe science and technology or last has sued open AI in California, alleging

5:21its agents violated the state's computer fraud law when they breached hugging face. The suit cites a new California AI law specifying that autonomous AI behavior isn't a defense against liability. Last isn't seeking damages. It wants an injunction barring open AI from developing agents capable of autonomously hacking other organizations, potentially making the case an early test of legal responsibility for rogue AI agents. Cyber criminals are abusing chat GPT's custom GPT feature as part of a click fix campaign that Huntress says has infected at least 40 systems in September. Attackers created a custom GPT called plus 5.6 that impersonated chat GPT and was promoted through sponsored Google search results. Victims were told the service had limited availability and directed to a backup site displaying

6:22a fake cloud flare capture the supposed verification instructed users to paste and execute a command the hallmark of a click fix attack that ultimately delivered a malicious installer that used a legitimate can and signed application to side load malicious code and install a remote access Trojan. The malware can steal data capture microphone and camera feeds and install additional payloads. NAI removed plus 5.6 after Huntress reported it, but researchers have already identified another custom GPT associated with the campaign. The FBI is urging members of shiny hunters to come forward following the arrest of suspected group leader Peppin Von suspected group leader Peppin van der Stop in the Netherlands. Such authorities arrested the 24 year old on September 15 and say information found on

7:22his laptop also suggests he may have ordered two murders abroad. The FBI alleges Van der Stop helped shiny hunters compromise more than 140 organizations since 2025 and collected least $70 million in extortion payments. The arrest follows shiny hunters claimed breach of FBI jobs.gov. The group insists its threats involving allegedly stolen FBI data were a publicity campaign rather than extortion while separately warning other victims to keep paying to prevent data leaks. Security experts say Van der Stop's arrest is unlikely to end shiny hunters describing it as a decentralized operation whose remaining members could reorganize, rebrand, or join other groups. Researchers at Proofpoint are tracking a fraud campaign targeting US universities that turn stolen credentials into job scams.

8:23Attackers begin with emails warning that university accounts need verification or risk deactivation, including victims to forms hosted on legitimate services such as Google Forms, Wix, and Microsoft. The forms steal credentials and personal information allowing attackers to hijack.edu accounts and use their institutional credibility to advertise fake jobs. Victims who respond are sent fraudulent checks typically around $1,000 and told to deposit them, keep part as wages and use the rest to buy gift cards. The scammers then demand the card codes before the checks bounce. Researchers who engage the fraudsters saw them escalate to alternative payment methods, harassment, and even impersonating an FBI agent. Proofpoint traced the operators it engaged to Nigeria and recommends MFA as a key defense. Maria Vermauses is host of the T-Minez Space Cyber Podcast and each Wednesday she brings

9:27us an update from her show. Today she files this report. Thank you Dave. The 14th time was the charm this week for SpaceX's super heavy rocket, the Starship. It hit a major and much anticipated milestone on Monday when several years into its development, Starship has flown in orbital space for the first time. The 14th test of Starship did not hit every objective, but it did successfully deploy 26 Starlink version 3 satellites into low Earth orbit, making this flight a revenue generating one for SpaceX. Now to understand why the space industry has been eagerly awaiting milestones like this one with Starship, we need to do some quick comparisons. The entire Starship is built to be reusable for one thing. The current workhorse rocket for getting things into space, the SpaceX Falcon 9, has a reusable booster only. Additionally, the Falcon 9 is a much smaller vehicle compared to the Starship, as the Falcon

10:299 is able to carry about 50,000 pounds of cargo to low Earth orbit in its 17-foot diameter faring. Starship, on the other hand, has a nearly 30-foot diameter and SpaceX says that it should be able to carry over 100 tons to orbital space. And that capacity difference is the key. Getting much bigger things into space, all at once, instead of things being folded in trick-at-le, or assembled slowly bit by bit, will be a paradigm shift for what kinds of things we can put into space. Imagine the International Space Station being assembled and say, two large pre-built parts, instead of bit by modular bit as it was for many years. Larger spacecraft means more power generation, which unlocks more complex capabilities, including more carrying capacity for crew, instrumentation, and other components. And space agencies like NASA also hope that this will lead to more complex infrastructure on orbit, one day on the moon, and then one day beyond.

11:33After all, both SpaceX's Starship and competitor Blue Origin's Blue Moon will be tested in NASA's Artemis 3 mission later next year. That will be in preparation for a human moon landing using either the Blue Moon or Starship for the Artemis 4 mission, which currently is planned for early 2028. But as always, time will tell. For the Cyberwire Daily, I'm Maria Varmazis from T-Mina Space Cyber Briefing, back to you Dave. Be sure to check out the T-Mina Space Cyber Podcast, wherever you get your favorite shows. The US Water Sector is confronting persistent cybersecurity weaknesses after a summer of attacks highlighted the risks posed by aging operational technology. Water ISAC Executive Director Tom Dobbins says, Internet exposed OTE and programmable logic controllers remain major entry points because much of the equipment predates modern cyber threats,

12:34but remains operational, reducing incentives to replace it. Other risks include poorly secured connections maintained by third-party integrators, phishing attacks against employees, and weak cyber hygiene at smaller utilities, where basic measures such as password changes and multifactor authentication can be challenging to maintain. Water ISAC is responding by partnering with Cyware to accelerate threat intelligence sharing, including across critical infrastructure sectors. Dobbins said utilities face threats associated with Iran, China, and Russia, while financial and technological constraints continue to complicate efforts to modernize defenses. AI is giving security operations teams more time for higher value work, but it may also be disrupting the traditional path for developing SOC analysts, that's according to a swim lane survey of 500 US and UK security professionals.

13:36Nearly half said AI has increased their capacity, while 35% reported having more time for complex investigations and strategic work. The trade-off is training. 24% said AI has limited their ability to develop skills as automation increasingly handles the routine tasks through which junior analysts traditionally learn the fundamentals. Nearly half expect AI to make entering the profession more difficult, including 37% who anticipate higher requirements for entry-level positions. Swim lane argues organizations will need more deliberate training and career paths, while maintaining human oversight of AI decisions. 41% expect new roles focused on AI oversight, validation, and orchestration. Two US Air Force members have received federal prison sentences for running a business email compromise scheme

14:37that stole millions of dollars. Shijouke Timothy Aude-Meghou and Harafat Magajee conducted the operation for more than two years, while stationed at Dover Air Force Base in Delaware. Prosecutors say the pair used fishing to steal employee email credentials, then monitored compromised accounts for payment discussions. They inserted themselves into email conversations and supplied fraudulent wiring instructions, including schemes that diverted payments of over $2.5 million. They also stole financial account and payment card information for their own use or sale to other hackers. Both pleaded guilty to wire fraud, identity theft, and access device fraud. Ode-Meghou received more than nine years in prison, while Magajee was sentenced to six and a half years, with both also ordered to pay restitution. Coming up after the break, my conversation with Dan Olmeyer from Sempris were discussing crisis orchestration,

15:49and that is one big pile of technical debt. Stay with us. This episode is brought to you by Google Chrome. You think you know a browser, but Gemini and Chrome? That's new. It can help you with practically anything on the web, like restoring a vintage motorcycle from a 50-page restoration block, or finally break down that long article you've had open for weeks. Gemini and Chrome is here for it. Ready to make anything online makes sense? There's no place like Chrome. Check responses set up required compatibility and availability varies 18 plus. And now a word from our sponsor, Trinity Cyber. Detection and response was failing before AI. Now it's breaking under the speed and scale of AI-driven threats. That's the reality Trinity Cyber was built for. The Trinity Cyber platform analyzes network sessions in real time, removes malicious content in line,

16:55and provides unified control across users, applications, devices, networks, and AI. By bringing protection and policy together, Trinity Cyber helps security teams reduce risk, simplify operations, and stop threats before they become incidents. Learn how at TrinityCyber.com. Stay cozy and look cool with up to 60% off cold weather gear at Nordstrom Rack. Safe on cashmere, out-of-wear, boots, and more from brands like Ugg, Vins, Colhahn, and Hunter. Join the Nordy Club for free to unlock exclusive discounts. Shop Clarence and New Arrivals first and more. Plus, buy online and pick up at your favorite rack store for free. Great brands, great prices. That's why you rack. And now a word from our sponsor, SpecterOps.

17:57Today, AI is rapidly adding non-human and agentic identities to modern enterprise environments, creating new trust relationships and attack paths. Bloodhound Enterprise helps defenders map attack paths across AWS and hybrid environments as one connected graph, identify the choke points that matter most, and bring trusted attack path intelligence into approved AI workflows with Bloodhound Hunter. See how SpecterOps helps teams secure the AI-driven identity era at SpecterOps.io. And now, let's start with the first question. What is the best way to get a new insight into the AI-driven identity era? Dan Olamire is Senior Solutions Architect for Ready One at Sempris. In today's sponsored industry voices conversation, we discuss crisis orchestration.

19:00One of the things I've observed in my experience going through the incident response, investigation and recovery work that happens when cyber level crisis events happen. We often focus a lot on what we need to do, but we don't plan ahead and think about how we're going to do those things. Something to consider would be, you know, how am I going to contact that site engineer in the event that my network is down? Am I going to have access to my address book? Will I even be able to know what their phone number is? Or, you know, if I need to share documents with them, how am I doing that if our file sharing site is offline? So quite often, organizations are figuring these solutions out on the fly in the midst of their crisis response. And the big challenge with that is you're losing time and expending resources on some things that would have been probably better set up in advance. Why do you suppose these gaps are so persistent that you see them over and over again?

20:03I think a lot of it has to just do with, you know, where we're at along the journey of resiliency, I would say. So, and some of it's just the nature of InfoSec. For example, if I have the resources to do 70 things, but I know I have 100 things to do, I'm going to have to make some educated decisions on things that I kind of push down the line a bit, right? And prevention usually trumps any sort of a resiliency type solution because, you know, we know we've got to be preventing things. We know we've got to be continuing to chase some of the technological advancements and changes. And, you know, find any energy and time to invest in those worst case scenarios can just be a little tougher to do sometimes. I know a lot of folks will invest time and energy in doing tabletop exercises. Where do they come up short when it comes to that particular process? That's a great question. So I applaud any organization that spends any amount of time doing any sort of theoretical exercise and simulation work.

21:09That's great. The more formal, great, though, even informal stuff's effective. What I do want to say though is some observations I observe over time is we see a bit of a focus on testing the InfoSec team and a bit of a focus on that executive level response. But sometimes we miss some key players like bringing in your crisis management focus or perhaps an application engineer. I know that when I've had to go chase down hosts before because I'm investigating some interesting activity. It's the application engineer who's going to be my connection into that host. Well, if they don't know appropriate evidence collection procedures or what the the break class recovery process is. And the first time they're learning it is in the midst of a crisis that can have some unattended consequences and slow down your ability to effectively recover. It sounds like a good tabletop exercise would reveal what some of those dependencies are between the various stakeholders in the organization.

22:11Absolutely. I do think the more practice that occurs, you know, an organization start getting into a quarterly cadence, the table dot exercises and start having more operational focus ones. That will uncover those gaps, right? You know, maybe you'll you'll do your post incident or your post tabletop activity and review. And you'll go, Hey, we need this new crisis management focal that got hired a month or so ago that this one business unit stood up. Then we're actually included in this conversation. Now you make that connection. And then you can start to to to get that practice in before you're going live with your response. What about the crisis orchestration technology itself? What kind of tools are we talking about here and what role do they play? That's a really good question too. There's a lot of technology that you can bring to bear. So, you know, thinking about what you're going to need to do in times of crisis, you're going to need to manage the response.

23:12You're going to need to document your response. You're going to need to communicate your response. And so then what technologies do you need? You know, communication, you're going to need internal and external, right? So like if I'm an InfoSec team or a crisis management team, you know, I need to orchestrate my response with all my stakeholders across the organization, you know, for rebooting systems and collecting evidence and deploying technologies, all the things that we have to do and we're responding. And then mass notification too, right? Like how am I communicating with all of my workforce, you know, because it's critically important to keep them informed, but many organizations are thousands of people strong. So having a technology that facilitates that's great. When it comes to documentation, a lot of organizations kind of devolve to using Microsoft Excel. It's a classic for a reason, but it doesn't have really good version control. It's not built with security and mind. And so, and oftentimes organizations haven't necessarily thought about what to document.

24:14So, so there might be gaps in timestamp records that you're collecting or gaps in the types of logs that you might want to be able to memorialize in your port. So, you know, thinking about systems where you can collect and share this information, often the connecting tissue with all these systems would be they need to be out of banding your network. Because, you know, I think for some of the most serious crises, where there's a total network loss, quite often organizations are going through the process of recovering their identity systems first, just so they can access their insurance policy, because it's on a file shared that's currently inaccessible, where access that incident response plan. So, they're going off of a paper copy they might have around or they're going off a memory. So, having these out of bands tools staged and having people practice with them is really important. Yeah, it's a great point. I mean, I guess a lesson here could be don't underestimate the value of having binders full of printed out documents sitting on some important person's shelf.

25:15Yeah, absolutely. You know, it's funny. We've done such a phenomenal job digitizing all of the things we do for work, right? So, now it is just as important if not more so to have those old school like have a file cabinet that you keep copies up to date and maybe have a couple facts machines, a couple locations, because you can sense that pretty securely over facts. So, it's never a bad idea to roll out looking at old proven methods for keeping information. Getting back to the tabletop exercises, is it kind of human nature for people who are busy, having the tabletop exercise may not be all of the stakeholders primary function in the organization? So, are you sympathetic to that some things tend to get hand-waved away? I'm hugely sympathetic to any organization that's tackling really anything in information security, because I mean you're battling the torrent of the internet right at your doorstep.

26:19So, yeah, you know, there's some things organizations can do to kind of help themselves be a little more successful. I think a lot of it's a state of mind how you approach these exercises. You know, some organizations, there's a concern, right? Like in business and in life, we were very diverse to failure. You know, it's all about striving for success. If you can pre-ing a failure mentality to your tabletop exercises where you explicitly set the goal is to fail, and you can really embrace that concept, then it's a lot easier to uncover these gaps in your policies and your procedures and technologies that you have that are going to orchestrate all this and all the things that go into crisis response. So, there's really a culture component to this as well, giving people the encouragement that failure leads to learning. Absolutely. It does really help significantly when you're trying to exercise a really effective crisis management program kind of overseeing your incident response and your recovery efforts that, you know, if you've got a really good culture that kind of takes a team effort.

27:26And is really interested in the learning and the practicing of the things, right? You know, because we're always striving for mastery. I consider myself a perpetual learner in the space, right? Because there's just so much. Help me understand the importance of documentation here. I mean, you're in the middle of a serious incident, the heat of battle, if you will. I can understand how people might say to themselves, you know, we're going to document this when we get through all of this. But you say no, it's important to keep that documentation running in the midst of things. It is so critically important. The moment your crisis level event starts happening should be the moment that you start collecting and documenting your effort because it's infinitismally easier to note things as you're going through the process. Then it is to retroactively recreate that. You know, I'm documenting a timeline of events. If I take note of all the things I'm doing and write down the time that I do those things, it goes a long way.

28:34One of the things that I've observed with organizations is, you know, when it comes to the end of your crisis, you know, we have stakeholders that are going to want to know some things. Maybe customers have agreements to get some reports on what happened. Because, you know, especially in technology, right, if we offer a service or something, you know, our customers are going to want a good idea that that saves. So being able to build a really robust timeline of events that tracks the timestamp and all the actions that happen across your organization from the moment this thing happened to when you're, you know, back online is really important. That gets a pen to do a lot of reports. And that's something regular either is going to want to look at regarding like insurance claims. If there are gaps in some of your records keeping that can have negative impacts on your claim payout. So there's a tremendous amount of reasons to be really good at documentation. And the best thing you can do is to just prepare ahead of time. You know, talk to your legal counsel experts and talk to your insurance providers and talk to the business stakeholders and some of your customer stakeholders on some of the key information that they're going to want documented in a crisis.

29:42And then just make sure that you start collecting that right from the get go have that built into your response plan that when you start doing all these tasks, maybe even put a sub note and make sure you document it here. That's Dan Olamier, senior solutions architect for ready one at Sempress. Stay cozy and look cool with up to 60% off cold weather gear at Nordstrom Rack. Safe on cashmere out of where boots and more from brands like Ugg, Vince, Cole Han and Hunter join minority club for free to unlock exclusive discounts, shop clearance and new arrivals first and more. Plus buy online and pick up at your favorite rack store for free. Great brands, great prices. That's why you rack. DLP sucks every sisso knows it 20 years of rules and reg X built for another era jazz is the DLP that deeply understands your business.

30:54Melody, jazz's agentech investigator, weighs every data movement against the data systems, people in process then provides analyst with the few incidents fully investigated in 30 days, 2 million signals in about 80 investigated incidents out. No rules written. Jazz won the 2026 Crowdstrike AWS and Nvidia startup accelerator from a nearly thousand applicants. See Melody in action at jazz.security-n2k. Your heart can tell you a lot about your health. Apple Watch series 12 measures your heart rate every five seconds with the most accurate heart rate sensing and awareness. Apple. So your vital zap now with heart rate variability can tell you when something is off and you're ready to score can let you know when to rest and when to push. Here the story in every heartbeat with Apple Watch series 12. The features described are for wellness purposes only and not for medical use. iPhone 11 or later required based on Apple conducted study of heart rate accuracy August 2026.

32:02Visit apple.com slash Apple Watch series 12. Every time your team deploys a new cloud workload or AI agent another identity gets permanent access to your critical systems. Legacy tools were built to manage human employees leaving modern machine and AI access largely unmanaged. That's where idea by Palo Alto Networks comes in human machine AI one identity platform for all idea replaces permanent permissions with dynamic access. So you can lock down every identity without slowing down your business secure every identity with idea by Palo Alto Networks. Visit Palo Alto Networks slash idea again that's Palo Alto Networks.com slash ID I R A.

33:06And finally, Securonix researcher Aaron Beardsley argues that AI's biggest security problem is increasingly familiar capability is advancing faster than containment. The clearest example is open AI's cyber evaluation that escaped its intended boundaries and reached hugging face where agents reportedly executed code on dozens of servers and gained root access to one life or at least AI found away. Beardsley warns the problem will grow as agents help develop future systems while simultaneously gaining access to enterprise tools data API's and workflows. A sandbox is only as good as its overlooked exits and agents are quite willing to keep testing the fences. His prescription is less cinematic stronger egress controls meaningful independent evaluations detailed logging tightly constrained permissions and human approval for consequential actions.

34:19Enterprises shouldn't wait for frontier labs to slow down once AI agents can act on production systems governance needs to be built before someone discovers the raptors can open doors. I'm simply saying that life finds a way. And that's the cyber wire or links to all of today's stories check out our daily briefing at the cyberwire.com. We'd love to know if you think of this podcast your feedback and shores we deliver the insights to keep you a step ahead in the rapidly changing world of cyber security. If you like our show please share a rating and review in your favorite podcast app. Please also fill out the survey in the show notes or send an email to cyberwire at n2k.com. N2K's lead producer is Liz Stokes. We're mixed by tray hester with original music and sound designed by Elliott Peltzmann.

35:24Our contributing host is Maria Vermaussis. Our executive producer is Jennifer Iban. Peter Kielpia is our publisher, Dive Vittner. Thanks for listening. We'll see you back here tomorrow. Everyone's got a hard question about AI. Your job, your kids, where it's going. And Thropic was built to surface those questions and share what it finds along the way because there's hope in hard questions. Ask yours at clod.ai slash Spotify and keep thinking that's clod.ai slash Spotify. Yes, you can have an enterprise network that's secure and reliable and high performance and no, you don't need to choose the best two out of three.

36:32With meter, you can get the end-to-end network built from the ground up, fast to deploy and easy to manage. That's because meter is software led for easy installation, maintenance and control for everything running on your enterprise network. Hardware, firmware and software all working together from the start seamlessly on a unified platform that's secure by design. You can't protect what you don't know exists, which is why meter gives you comprehensive visibility into wired and wireless routing, switching firewalls, DNS security and VPNs. You'll really know what's running on your network down to the most granular client level. Step off the hardware box, upgrade treadmill and switch to meter for a predictable fee and free up your team to spend time on all the other things that keep your business running. Try it out for yourself and book a demo online at meter.com slash cyberwire. That's M-E-T-E-R dot com slash cyberwire.

37:41Your heart can tell you a lot about your health. Apple Watch Series 12 measures your heart rate every five seconds with the most accurate heart rate sensing and awareable. So your vital zap now with heart rate variability can tell you when something is off and your readiness score can let you know when to rest and when to push. Here the story in every heartbeat with Apple Watch Series 12. The features described are for wellness purposes only and not for medical use. iPhone 11 or later require based on Apple conducted study of heart rate accuracy August 2026. Visit apple.com slash Apple Watch Series 12.