Risky Business #833 -- The Great Mythos Freakout of 2026

On this week’s show, Patrick Gray, Adam Boileau and James Wilson discuss the week’s cybersecurity news. They cover:

• Everyone has an opinion about Claude Mythos… even though almost nobody has used it yet

• CISA adds a 2009 Excel bug to the KEV list, u wot?

• Adobe also parties like it’s the 2000s, and fixes an Acrobat Reader bug

• Disgraced former Trenchant exec Peter Williams’ sob story fails to resonate with … anyone

• Remember those crosswalk buttons hacked to play audio mocking Trump and Zuck? They were “secured” by the password: 1234.

This week’s episode is sponsored by mobile network operator, Cape. Ajit Gokhale talks with James about the ways to get being a telco right when you’re starting from scratch and solving the security problems of 2026.

This episode is also available on Youtube (youtu.be/TxYNYShs_aw).

Show notes

• Lab Space (labs.cloudsecurityalliance.org/mythos-ciso)

• The “AI Vulnerability Storm”: Building a “Mythosready” Security Program (labs.cloudsecurityalliance.org/wp-content/uplo…)

• Polymarket on X: "JUST IN: Goldman Sachs is reportedly ramping up its cyber defenses in preparation for Claude Mythos." (x.com/polymarket/status/2043703997412901167)

• Ananay on X: "Marcus Hutchins probably has the best take on Mythos doing vulnerability research" (x.com/ananayarora/status/2043381424594837789)

• solst/ICE of Astarte on X: "Th vast majority of CISOs do not work at Google-sized companies, and will not have to worry about 0days" (x.com/icesolst/status/2043661954871394483)

• Charlie Miller on X: "we’ve gone through this before with early fuzzers, afl, etc" (x.com/0xcharlie/status/2042953783118815295)

• James Kettle on X: "'Can AI Do Novel Security Research? Meet the HTTP Terminator' will premiere at Blackhat" (x.com/albinowax/status/2043800249991389667)

• jeffrey lee funk on X: "We've been tricked, again. Many of the thousands of bugs and vulnerabilities Mythos found are in older software are impossible to exploit." (x.com/jeffreyleefunk/status/2042805247010349295)

• Claude is getting worse, according to Claude • The Register (theregister.com/2026/04/13/claude_outage_quali…)

• Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain (arxiv.org/abs/2604.08407)

• OpenAI's Mac apps need updates thanks to the Axios hack | CyberScoop (cyberscoop.com/openai-axios-supply-chain-attack)

• Hack at Anodot leaves over a dozen breached companies facing extortion | TechCrunch (techcrunch.com/2026/04/13/hack-at-anodot-leave…)

• Snowflake customers hit in data theft attacks after SaaS integrator breach (bleepingcomputer.com/news/security/snowflake-c…)

• Booking.com confirms hackers accessed customers’ data (techcrunch.com/2026/04/13/booking-com-confirms…)

• CPUID hijacked to serve malware as HWMonitor downloads • The Register (theregister.com/2026/04/10/cpuid_site_hijacked)

• Known Exploited Vulnerabilities Catalog | CISA (cisa.gov/known-exploited-vulnerabilities-catalog)

• Adobe fixes PDF zero-day security bug that hackers have exploited for months | TechCrunch (techcrunch.com/2026/04/14/adobe-fixes-pdf-zero…)

• The Sad Decline of Trenchant Exec Who Had Everything, Before Deciding to Steal and Sell Zero Days to Russian Buyer (zetter-zeroday.com/trenchant-exec-says-he-had-…)

• FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database (404media.co/fbi-extracts-suspects-deleted-sign…)

• US operation evicts Russia from hacked SOHO routers used to breach critical infrastructure | Cybersecurity Dive (cybersecuritydive.com/news/russia-routers-hack…)

• Telegram Is Still Hosting a Sanctioned $21 Billion Crypto Scammer Black Market | WIRED (wired.com/story/telegram-is-still-hosting-a-sa…)

• The Dumbest Hack of the Year Exposed a Very Real Problem | WIRED (wired.com/story/crosswalk-city-hack-cybersecur…)