Risky Business #847 -- Oops! Claude's accidental hacking spree

On this week’s show Patrick Gray, and James Wilson are joined by bearded man of leisure Adam Boileau to discuss the week’s cybersecurity news, including:

• Accidental AI agent hacking sprees have the world’s media freaking out, but we think it’s all pretty funny

• The bugpocalypse is so chaotic, Microsoft can’t patch fast enough

• A ColdCard wallet flaw led to millions in Bitcoin theft, but the back story behind the bug is bonkers

• Iran hacks and disrupts water infrastructure in multiple American states

• North Korea’s state-backed hackers turn criminal. Or their criminals turn into state-backed hackers. Or something. It’s all a bit confusing, actually.

• Much, much more!

This week’s show is brought to you by Sondera. Co-founder Josh Devon joins Patrick and James to talk through some absolutely hilarious LLM horror stories.

This episode is also available on YouTube (youtu.be/-zj6abxxnBE)

Show notes

• OpenAI says rogue agent behind Hugging Face hack broke into additional services | therecord.media (therecord.media/openai-says-rogue-agent-behind…)

• Anthropic Says Claude Hacked Real Systems During Cybersecurity Tests | wired.com (wired.com/story/anthropic-says-claude-hacked-r…)

• Claude uploaded malware to PyPI in Anthropic's botched test | BleepingComputer (bleepingcomputer.com/news/security/claude-uplo…)

• Nobody Knows if OpenAI’s and Anthropic’s AI Hacking Sprees Are Illegal | wired.com (wired.com/story/openai-anthropic-ai-hacking-sp…)

• Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets Truffle Security Co. | (trufflesecurity.com/blog/scanning-7-6-petabyte…)

• Anthropic’s New AI Model Can Identify More Software Bugs Than Ever. Microsoft Is Struggling to Fix Them Fast Enough. | Social Signals (propublica.org/article/anthropic-mythos-micros…)

• Chrome Needs Twice-a-Week Patching Thanks to AI Bug Hunting | wired.com (wired.com/story/chrome-needs-twice-a-week-patc…)

• Google says it fixed more Chrome bugs in June than over the past two years, thanks to AI | TechCrunch Security (techcrunch.com/2026/07/30/google-says-it-fixed…)

• Mythos uncovers crypto weaknesses that went unknown for years | arstechnica.com (arstechnica.com/security/2026/07/mythos-uncove…)

• COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft | BleepingComputer (bleepingcomputer.com/news/security/coldcard-wa…)

• Chris Masterjohn (@ChrisMasterjohn) on X | X (formerly Twitter) (x.com/ChrisMasterjohn/status/2083765192585044095)

• wale.moca 🐳 (@waleswoosh) on X | X (formerly Twitter) (x.com/waleswoosh/status/2083834424035311800)

• U.S. spy agencies suspect Iran launched cyberattack on Minnesota water facilities | washingtonpost.com (washingtonpost.com/national-security/2026/07/3…)

• FBI investigates as Michigan joins Minnesota in reporting cyberattacks on its water systems | washingtonpost.com (washingtonpost.com/business/2026/08/01/cyberat…)

• Trump blames Minnesota for cyberattacks on water sector, drawing pushback from cyber world | cyberscoop.com (cyberscoop.com/trump-blames-minnesota-water-cy…)

• A Leaked Memo Ties Cyberattacks on Minnesota Water Utilities to Iran | wired.com (wired.com/story/a-leaked-memo-ties-cyberattack…)

• Russia accuses Telegram founder of aiding terrorism, seeks international arrest | The Record (therecord.media/russia-telegram-durov-arrest)

• Laundry Bear’s webmail hackers had more in store after February, report says | therecord.media (therecord.media/russia-hackers-outlook-webmail…)

• CaptiveCrunch: Midnight Blizzard targets travelers worldwide for malware delivery and credential theft | Microsoft Security Blog (microsoft.com/en-us/security/blog/2026/07/31/c…)

• Phishing service spoofs RingCentral to steal Microsoft 365 accounts | BleepingComputer (bleepingcomputer.com/news/security/phishing-se…)

• North Korean hackers behind major open-source supply chain attacks, Amazon says | therecord.media (therecord.media/north-korea-hackers-amazon-mal…)

• North Korea’s Lazarus Group sharing tools with ransomware hackers, South Korean agencies warn | The Record (therecord.media/north-korea-hackers-ransomware)

• North Korea arrests hackers accused of laundering stolen bank funds through crypto | (coindesk.com/business/2026/07/25/north-korea-a…)

• US government bans new foreign-made humanoids, robot dogs, and solar inverters, citing risks to national security | TechCrunch Security (techcrunch.com/2026/07/29/us-government-bans-n…)

• Judge says Trump admin still lacks evidence for Anthropic 'supply chain risk' label | TechCrunch (techcrunch.com/2026/07/30/judge-says-trump-adm…)

• Cyber Command plans Silicon Valley office to drive innovation | therecord.media (therecord.media/cyber-command-plans-silicon-va…)

• Apple is getting this wrong | OpenAI (openai.com/index/apple-is-getting-this-wrong)

• Tech industry alliance proposes AI agent safety reporting program | Cybersecurity Dive (cybersecuritydive.com/news/ai-agent-security-e…)

• Massive ChainDrop npm supply-chain attack infects hundreds of packages | BleepingComputer (bleepingcomputer.com/news/security/massive-cha…)

• Massive supply-chain attack compromises 440 packages under four hours | cyberscoop.com (cyberscoop.com/supply-chain-attack-malware-min…)