Playbook
Tasteful Skills
“Tasteful Skills” argues that the best agent skills are not documentation or best-practice lists.
Back to Podcast Digest
Everyone's getting hacked
TL;DR
Google says AI already found a real zero-day in the wild — Matthew Berman highlights Google Threat Intelligence Group’s first known case of a threat actor using an AI-developed zero-day exploit, while stressing Google’s own “proactive counterdiscovery” may have stopped a mass attack.
The Shai-Hulud npm worm shows how AI-era supply chain attacks scale fast — what started in npm spread across 373 malicious package versions and 169 package names, then crossed into PyPI, with a dead-man-switch payload that can wipe your home directory if a stolen GitHub token is revoked.
Vibe coding is expanding the attack surface at the exact wrong moment — Berman says more people are shipping more code without reviewing dependencies, while attackers now have AI to write malware, scan open-source repos, and automate obfuscation and credential abuse.
Frontier labs are building cyber-defense models, but they’re controlling access tightly — Anthropic’s unreleased Claude Mythos reportedly found a 27-year-old OpenBSD bug and a 16-year-old FFmpeg flaw, while OpenAI’s GPT-5.5 Cyber scored 81.9 vs. Mythos’s 83.1 and is being rolled out through trusted-access programs like Daybreak.
His core thesis is 'my AI versus your AI' — borrowing Jensen Huang’s framing, Berman argues the best-funded actors will likely have stronger defensive models than criminals, because training and running top-tier AI takes massive compute, electricity, and billions of dollars.
The real near-term danger is the long tail getting attacked profitably — even if small malicious groups can’t beat U.S.- or China-level models, open-source AI can still make low-value attacks on individuals, startups, and poorly defended teams suddenly worth doing at scale.
The Breakdown
The moment he says AI hacking stopped feeling theoretical
Berman opens by saying this is the first time AI has genuinely made him worried. The trigger is Google’s report that a threat actor used AI to develop a real zero-day exploit in the wild — the kind of bug people usually hoard because it’s so valuable — though Google says its own counterdiscovery may have prevented a wider attack.
Shai-Hulud and the npm worm eating the internet
He then jumps to the ongoing Shai-Hulud worm, which he describes as “basically taking over the internet right now.” The attack started in npm, spread across 373 malicious package versions and 169 package names including UiPath and Tallyui, then crossed into PyPI; the nastiest detail is a dead-man switch that can nuke your home directory if you revoke the GitHub token it stole.
Why AI makes this wave of attacks worse
Berman leans on a simple explanation: way more code is being written, and way more people are shipping AI-generated code without really checking what got installed. He admits he’s guilty too, then connects that to attackers waking up after credential thefts like Team PCP, creating a world where AI dramatically increases both attack volume and attack surface.
Vercel’s breach and the speed of AI-assisted attackers
To show this isn’t abstract, he points to Vercel’s April 2026 security incident. CEO Guillermo Rauch said an employee was compromised through a breach tied to an AI platform called context.ai, and Berman zeroes in on Rauch’s line that the attackers moved with “surprising velocity and in-depth understanding of Vercel,” which he strongly suspects was accelerated by AI.
Google’s report: AI is now useful at every stage of the attack chain
From there he walks through Google’s broader findings: AI for vulnerability discovery, exploit generation, malware development, defense evasion, and autonomous operations. His framing is blunt — if AI can help you build a toy app in hours, it can help attackers build entire hacking suites, obfuscation layers, and always-on agents that keep probing systems indefinitely.
Mythos, GPT-5.5 Cyber, and the labs’ split-screen strategy
Berman says the frontier labs are not sitting still, and Anthropic’s Claude Mythos is his clearest example. Anthropic reportedly gave the 10-trillion-parameter model to companies like AWS, Apple, Google, Nvidia, Palo Alto Networks, and JPMorgan after it found a 27-year-old OpenBSD bug, a 16-year-old FFmpeg flaw, and chained Linux kernel exploits — but Anthropic kept it unreleased, which he calls very on-brand and also “fear-based marketing,” especially after OpenAI launched GPT-5.5 Cyber anyway.
His big argument: bigger model beats smaller model
This is where he brings in Jensen Huang’s “my AI versus your AI” logic. Berman thinks top defensive AI will usually beat criminal AI because the best models require insane amounts of compute, electricity, money, and talent — resources rogue groups don’t have — so the strongest systems will mostly come from major states and frontier labs.
The part that still worries him: profitable attacks on the long tail
Even with that optimism, he says AI changes the economics of attacking smaller targets. Individuals, startups, and lightly defended teams used to be too low-value to justify much effort, but open-source models and cheap automation make high-volume, lower-value attacks newly profitable — which is why he also warns about deepfakes, phishing, and even suggests setting a family passphrase so your parents don’t get fooled by an AI-generated FaceTime call.
Share
Keep Reading
Two Ways to Follow
The Weekly Echo. The inbox-shaped summary of what mattered.
New editorials announced here.
