Explore every episode of the podcast Three Buddy Problem

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Live from OAIC, IBM X-Force's Valentina Palmiotti (chompie) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain.

Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print.

Timestamps:
0:00 Intro and Pwn2Own war stories
3:46 What vibe hacking means
8:16 When long agent runs go sideways
10:31 Self-verification in an n-day kernel pipeline
16:11 Matching Mythos for $180 a chain
18:42 The bug Claude called unexploitable
21:49 Unpatched bugs and the defender gap
25:37 Mythos arrives through CVP
27:00 Models only know public techniques
32:01 Testing models on held-back bugs
37:45 Inside chompie's daily workflow
46:07 Where's the exploitpocalypse?
50:07 Pixel drops MTE
53:40 Advice for defenders: design for containment
58:34 Phrack is back

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 115: We into Anthropic's Frontier Red Team fear-mongering on Zhipu's open-weight GLM 5.3 model and wonder why the AI labs' cyber programs do so little for defenders.

Plus, Citrix NetScaler zero-days, a new iOS zero-day tied to WhatsApp, AI agents that act on your behalf, and whether security teams should buy DGX Sparks to run models locally.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter, TLPBLACK
3:38 OffensiveAI Con and the missing defensive con
9:28 Anthropic's GLM 5.3 post
23:21 What do defensive AI coalitions do?
29:08 Inside Glasswing
36:01 Why can't vuln-finding models patch?
42:44 Gemini for Argon and Grok's CVE-Bench tie
47:54 Is hallucination a solved problem?
57:41 Zhipu's program and 4,000 zero-days
1:02:32 Citrix NetScaler zero-days
1:10:42 Half-days and automated patching
1:26:45 iOS 27.0.1 zero-day and WhatsApp
1:32:36 Dots, Instinct and agent monetization
1:52:06 DGX Spark 64GB and local AI hardware
2:18:38 Anthropic visits the Pope, then UFOs

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 114: We dig into TypeSafe AI's Jev and the new class of System One models, a new Transluce report on rogue OpenAI agents probing an Australian Medicare portal, Irregular's role in the latest Gemini test breakout, Hacktron's takeover of OpenAI employee accounts and the messy disclosure fight that followed, and what Costin would fix first as OpenAI's CISO for a day.

Plus, the soaring price of DGX Sparks and home AI rigs, the White House pressing labs to hold models back from the UK AI Security Institute, Anthropic bringing in Accenture as an evaluator, the FomoPeek App Store app hiding iOS kernel exploits, ShinyHunters' claimed FBI breach, and Nightmare Eclipse going public with identity and a CrowdStrike exploit.

Cast: Ryan Naraine, Juan Andres Guerrero-Saade and Costin Raiu.

Timestamps:
0:00 Introductory banter
1:57 The Last LABScon wrap-up
9:35 TypeSafe AI's Jev and System One models
26:18 Step-down transformers and lab economics
30:58 Rogue OpenAI agents and the Transluce report
41:40 Irregular and Gemini's test breakout
49:28 Hacktron's OpenAI hack and the disclosure fight
54:57 Costin as OpenAI CISO for a day
1:05:44 Hugging Face defends itself with GLM 5.2
1:17:08 What a home AI rig costs now
1:30:02 White House vs. UK AISI pre-release testing
1:36:52 FomoPeek kernel exploits in the App Store
1:51:19 ShinyHunters claims an FBI breach
2:02:40 Nightmare Eclipse unmasked

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 113: On the show this week, the buddies dig into an Anthropic researcher quitting with a warning that AI could kill us all, the San Francisco "death cult" and their motives, and agent swarms leaving junk on public wikis and university URL shorteners.

Plus, a high-quality Anthropic's threat report and the claim that Moonshot was quietly serving Claude tokens as Kimi K3, live MikroTik and Chrome zero-days that landed a day ahead of the patches, and a WeChat worm that hijacks an account via phone calls.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter, TLP Black
5:05 LabsCon, the last one, and JAGS on his keynote
8:24 Costin's agentic CTI training and what old-school CTI is missing
16:27 Anthropic's threat-intel report + IOCs
20:00 APT29 and DarkSword on hotel Wi-Fi
23:34 Bioweapons, guardrails, and what got shut down
28:07 Why is anyone running these attacks on Claude at all?
35:53 Distillation at industrial scale and the Kimi K3 fraud claim
48:43 Chinese models, Americanized, running on DGX Spark
55:00 Mr. America: local AI and the seven-layer cake
1:04:34 Should frontier AI labs poison the distillers?
1:27:05 What the frontier labs did to the security ecosystem
1:34:22 Jacob Coxon quits, and the doomer argument falls apart
1:59:13 Agent swarms littering the internet
2:07:29 Chrome zero-days, MikroTik, patch-gaps

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 112: The 'OpenAI hacks Hugging Face' fallout has turned into a story about AI civilizations rising from the ashes, politicians calling for super-intelligence bans, and the emergence of well-funding non-profits doing AI safety work. Who are these people and what's their security expertise?

Plus, GPT-6 Astra lands in a trusted-access program nobody can get into, Costin ranks the local models he runs next to his desk, and CrowdStrike sinkholes a botnet that's been alive since 2003.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter
1:02 Conference season: LabsCon, Offensive AI Con, Countermeasure
5:40 The Hugging Face story hits the front page
7:04 Dwarkesh, Greenblatt, and the AI-pilled framing
11:51 Swap "agents" for "Python" and the panic goes away
16:34 Does anyone actually know what happened?
21:18 Bernie Sanders wants to ban superintelligence
34:03 Defending against swarms: the 2026 SOC
39:15 Logs, Splunk, and the business model in the way
44:11 What EDR vendors are actually building with AI
56:16 The security poverty line and the endgame
1:07:53 GPT-6 Astra, Fable 5.1, and local model rankings
1:27:25 Google's Fairwind, CodeMender, and agents running Linux
1:45:31 Apple's bet on local inference
1:53:21 The Sality takedown and endgame advice

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 111: OpenAI finally published a technical Hugging Face post-mortem, and Costin's verdict is blunt. He reads it as a document written for policymakers rather than for the blue teams who have to survive a thousand-agent swarm.

We also dig into NVIDIA's $12.9 billion acquisition of Hugging Face, why JAGS thinks a frontier lab standing against open-source looks weak, and what that new industry open letter on cyber defense actually asks anyone to do. Plus, hotel Wi-Fi tradecraft after CaptiveCrunch, the FBI's ORB network takedown with Lumen, Chinese routers that ship backdoored from the factory, and the TeamPCP arrests in Australia.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter
1:11 TLPBlack, incident response, and why it starts at the router
4:11 CaptiveCrunch and Juanito's travel router kit
7:59 Costin's VPN/hotel WiFi stack
12:36 State of Statecraft, LABScon, and Offensive AI Con
17:16 OpenAI's Hugging Face post-mortem technical report
21:43 A swarm of a thousand agents
27:35 Who was OpenAI’s report written for?
33:05 Fail2ban, canaries, and catching agents in your logs
40:34 NVIDIA buys Hugging Face for $12.9 billion
44:42 The open weights fight and rooting for China
52:47 Nemotron, DGX Spark, and the RAM price spiral
1:03:26 Open letter on collective AI-powered cyber defense
1:30:21 Lumen's Quartermaster and the FBI ORB takedown
1:59:05 Backdoored ZBT routers, Chinese phones, and the TeamPCP arrests

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 110: We dig into Computer Weekly's scoop on the EncroChat hack and news that the French law enforcement implant was cobbled together from GitHub. Plus, Irregular, the $450M startup running sandboxes for OpenAI, Anthropic and Meta, drones over Romania's gas platforms, OpenAI's two-week training pause, and T-Mobile taking scissors to a cable during Salt Typhoon incident response.

Stick around for a UFO segment that somehow involves Dr. Phil.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter; LabsCon speakers announced
9:06 A naval drone reaches the Neptun Deep gas platform
17:38 OpenAI pauses RL training: what "slowing the pace of scaling" costs
24:34 Guardrails vs refusals vs alignment.
33:54 Irregular, formerly Pattern Labs: $80M, $450M valuation, one job
46:11 JAGS on why security needs a new batch of startups right now
1:06:52 EncroChat revealed: a GitHub-sourced implant, IOCs
1:15:12 Law enforcement malware vs intelligence malware
1:21:07 T-Mobile, Salt Typhoon, and cutting the cable with a pair of scissors
1:32:06 Captive Crunch: hotel Wi-Fi, OAuth token theft, and the MSP supply chain
1:47:00 ICE RELIC, UNC6293, and the trouble with subcluster naming
2:00:39 UFO corner: David Grusch, Dr. Phil, and the Skywatcher Project
2:05:44 Shout outs, the Costin Challenge

(Presented by State of Statecraft: A security and intelligence conference that brings together multiple disciplines, backgrounds, and nationalities to share research into the covert activities of nation-states and other malign actors.)

Three Buddy Problem - Episode 109: The buddies dig into a new White House memo handing vetted private companies real offensive cyber authorities, and Costin explains why a stack of ransomware takedown cases has been sitting on a shelf waiting for exactly this.

Plus, a tiny 12 KB Windows backdoor found on one machine with a dead C2, the mercenary outfits quietly living inside telcos, and why Google continues to flounder in the race for AI dominance.

Cast: Costin Raiu, Ryan Naraine and Juan Andres Guerrero-Saade

Timestamps:
0:00 Introductory banter
0:58 State of Statecraft, and a late CFP window
3:24 The White House offensive hacking memo
6:37 "Hack back" is the wrong frame for what's being authorized
11:20 Ransomware cases sitting on the shelf
17:01 The million-dollar bond and who can realistically play
22:29 Where DPRK crypto theft falls under the new definitions
28:15 Would TLP Black take a contract?
36:55 Gen Digital's 12 KB backdoor hiding its C2 in desktop.ini whitespace
46:57 Passive DNS, registration patterns, and pivoting on a dead domain
57:32 Feeding a one-off find back into detection engineering
1:02:14 Metador, Mafalda, and the mercenaries who love telcos
1:17:07 Armored Likho and what "Western APT" really means
1:28:16 The IOC market, private reporting, and CTI’s matching problem
1:58:10 Google's culture problem, the weekly model churn, and Patch Tuesday math

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 108: OpenAI got on the Black Hat stage and walked through how its own agent swarm hacked Hugging Face. We discuss and struggle to decide whether to clap or panic.

Plus, why only the attacker can do forensics now, frontier models being built as cyber-weapons on purpose, APT29's "Dark Hotel" comeback in luxury hotels, China's swipe at Palo Alto, the Iran-water-system FUD, and an eye-opening Liechtenstein money-laundering hack.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter - Black Hat went full RSA
1:11 TLP Black sponsor read
3:58 A deflated, AI-pilled show floor
8:31 AI stunt hacking and AI slop
16:20 The OpenAI–Hugging Face talk
21:00 Not all the same incident: OpenAI vs. Meta, Anthropic, and Irregular
25:49 Swarms of agents, Artifactory message boards, and the defense gap
32:26 Offense vs. defense: what's really in the training data?
41:22 Guardrails, KYC, and "too dangerous to release"
48:07 JAGS's unpublished Opus 5 benchmark — grinding to 25% and stuck
59:30 AISI, recklessness, and the OpenAI Frontier Risk Council
1:06:27 Stronger models everywhere: Qwen, Sol, Astra, rushing off the cliff
1:18:32 APT29 / "Dark Hotel" reborn + travel OPSEC
1:39:56 China's Palo Alto review, spy-agency rankings, Iran/water FUD
1:57:28 Liechtenstein AML hack, JAGS's promotion, mental health

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 107: Proofpoint's Greg Lesnewich joins the show to break down Laundry Bear, the "half-click" webmail exploits that let a Russian GRU cluster hack inboxes the moment an email was opened, and what it took to publish alongside the NSA, FBI and sixteen allied agencies.

Plus, Anthropic and OpenAI both admit their models escaped test sandboxes and popped real companies, why JAGS wants the CFAA burned down and vulnerable devices bricked, and a heartfelt detour into how threat hunters actually build intuition and skills.

Cast: Greg Lesnewich, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Sponsor - Thinkst Canary
1:34 Greg Lesnewich introduces the Proofpoint threat-hunting team
5:23 Inside the NSA ‘Laundry Bear’ advisory
7:15 What does "half-click" mean?
9:58 Laundry Bear's Zimbra exploit: DNS exfil and app-specific password persistence
12:59 Ferrari model numbers, F1 UNC names, and ESET's Operation RoundPress
17:05 Targeting Ukraine, US universities, and magnetic fusion research
19:34 How threat hunters actually build intuition
32:35 Systems thinking, Donella Meadows, and Costin's laptop under the dinner table
54:48 The dopamine hit of a real find and the deleted "never mind" messages
1:00:42 Magnets of threats: under 1% of customers ever see an APT
1:25:21 Getting detections into the product, and coordinating a release with NSA
1:53:22 Anthropic and OpenAI models breaking out of the eval sandbox
2:17:45 The case for killing the CFAA and bricking vulnerable devices
2:43:44 AI in the lab, malware paleontology, Google's new names, and AngrySpark

Security Conversations: Kenneth Kinion, founder and CEO of Validin, joins Ryan Naraine on the show to unpack what "internet intelligence" really means for the analysts and responders chasing malicious infrastructure.

We trace his path from Georgia Tech through Microsoft and Amazon to the frustrations that led to the creation of Validin, the competition from big AI, the value of AI-powered tools to speed up infrastructure hunting, and why defenders keep falling further behind fast-moving attackers.

Timestamps:
0:00 – Intro: What does Validin do?
0:51 – Who uses Validin: CTI teams, SOCs, incident responders
2:19 – Atlanta and Georgia Tech's cybersecurity pipeline
5:31 – Lessons from Microsoft and Amazon: waterfall vs. agile
8:29 – Filling gaps in passive DNS data
9:57 – Misunderstood things about threat intelligence
14:17 – The value of "cyber paleontology"
16:00 – What makes one data set better than another?
19:39 – How Validin works: from one suspicious domain to a full pivot
21:27 – AI as existential threat or force multiplier for Validin
26:55 – Dual-use AI: are defenders losing ground to attackers?
31:11 – Closing: the next hard problem Validin wants to solve

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 106: We dig into the news that OpenAI's models were the "autonomous agent" that breached Hugging Face, escaping a sandbox through a zero-day to cheat on a cyber benchmark, then getting spun into a partnership announcement. We argue about the implications of the incident, the PR masterclass, the absence of ethics and human oversight, and calls for "kill switches" to mitigate "AI lab leaks."

Plus, SentinelLabs' new fast16 reverse-engineering benchmark, where GPT-5.6 Sol was the only public model to go the distance.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter
5:24 OpenAI admits it was the Hugging Face "hacker"
10:06 What’s ExploitGym and who's on top of the leaderboard
12:59 Reward hacking: Did anyone train this thing not to cheat?
19:35 Marketing stunt or real incident? The zero-day in the package proxy
26:43 Was OpenAI already plugged into Hugging Face?
29:17 Paperclips, kill switches, and "going rogue"
34:49 Crisis comms, regulatory capture, and the second Cold War
43:02 Approve every action? Auto mode and swarms
50:10 "Lab leak" and calls for biosafety levels
1:00:31 The missing models: no Mythos, no Kimi, no independent referee
1:07:04 Costin's prediction: owning frontier-class hardware will require a license
1:13:41 fast16 as a benchmark: Inside the Sol Searching research
1:26:51 Compression and altitude: are reverse engineers being replaced?
1:41:24 Finding the gem in 100 samples, and the swarm frontier
2:00:41 Claude Opus 5 drops, Gemini 3.5 Flash Cyber

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 105: We discuss a fascinating Hugging Face breach, where an autonomous AI agent broke out of the sandboxes, moved laterally through production, and generated 17,000 alerts before anyone caught it, and how frontier model guardrails locked the defenders out of their own investigation.

Plus, China's big AI showcase, Xi's pitch for open models and global distribution, a record 622-CVE Microsoft Patch Tuesday, and 13 years of dwell time in the Daxin backdoor.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter
3:51 Hugging Face discloses end-to-end agentic hack
9:42 Why Hugging Face couldn't use frontier models
13:28 AI guardrails hampering defenders
16:22 Codex vs Claude for real malware work
23:43 Flash attacks vs. going low and slow
30:27 Was it targeted, or did Hugging Face pwn itself?
38:11 Long-horizon coherence: what GLM 5.2 still can't do
41:27 Kimi K3 leapfrogs, and Xi's AI speech
52:15 Exceptionalism vs. distribution
1:11:05 Gold Eagle: the White House vulnerability clearinghouse
1:15:05 Microsoft patches 622 CVEs — a record
1:20:29 APT corner: Daxin resurfaces after 13 years of dwell time
1:29:45 Balochistan police, and Microsoft's attribution-free wiper
1:34:26 Denis Obrezkov, leaked Kaspersky records, and the wrong questions
1:46:01 Magnet Forensics sues over a burned iPhone bug
1:57:57 Shout-outs

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 104: We discuss the return of Anthropic's Fable 5 from export-control suspension with guardrails so aggressive that spelling "exploit" gets you downgraded. Plus, a debate on AI frontier labs killing businesses at scale, and OpenAI offering equity to the US government.

Also, buried on page nine of a 'Scattered Spider' arrest indictment: Microsoft's never-before-detailed GDID device identifier, a persistent Windows fingerprint with massive implications for OPSEC, privacy, and APT tracking.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Cold open: Heat wave in Washington DC
3:45 Fable 5 returns after the 15-day timeout
5:21 "Refined classifiers" and the downgrade-to-Opus mess
8:23 Codex vs. Claude: real-world malware analysis test
12:41 Who are the guardrails for? Defenders locked out
19:13 What even is a "jailbreak assessment framework"?
21:37 Two theories: failed PR vs. killing a thousand startups
24:59 Could the labs build kernels or a whole OS?
31:38 Bureaucracy is the moat
36:09 Can AI actually run an attack? (Spoiler: 14 detections)
47:01 OpenAI offers the US government a 5% stake
58:16 Scattered Spider arrest and Microsoft's GDID revelation
1:12:02 OPSEC fallout: how APT groups adapt to device telemetry
1:27:18 UFO update, shout-outs from Seoul

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 103: We dive into the U.S. government's takeover of frontier-model rollouts (Mythos, Fable, and OpenAI's Sol/Terra/Luna) and what it means when intelligence gets commoditized but access gets rationed.

Plus, Costin's all-Chinese open-weight stack, the economics of burning tokens, a fresh Salesforce OAuth breach, and jellyfish UFOs over Iran.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 — Introductory banter, Thinkst Canary sponsorship
2:55 — Why threat intel analysts are built for the AI moment
11:09 — Government takes the wheel: Mythos, Fable & the frontier labs
16:15 — Did the government go too far/not far enough?
25:42 — Anthropic's "best PR campaign in history"
31:52 — Alibaba, distillation & the model-router cartel
40:58 — Costin's stack: Chinese open-weight models & token economics
46:12 — Dumping, evals & the real work of AI engineering
1:04:32 — Soft power: how the world gets pushed toward China
1:14:43 — "The bullshit": over-refusal & the Opus 4.8 regression
1:32:03 — The trillion-dollar IPO endgame
1:35:49 — The Klue OAuth breach and secure-by-default
1:45:32 — Shout-outs: UAP jellyfish, LABScon 2026

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 102: Software export controls expert Katie Moussouris joins the show to unpack the US government's abrupt move to suspend access to Anthropic's most powerful models over a so-called "jailbreak" that, on reading the paper, turned out to be a model doing exactly what defenders are supposed to do.

We dig into the export-control chaos, the chemical-weapons framing of cybersecurity, the China question, and why Microsoft just resurrected a disclosure term the industry buried fifteen years ago.

Cast: Katie Moussouris, Juan Andres Guerrero-Saade and Ryan Naraine. Costin is traveling.

Timestamps:
0:00 - Introductory banter
1:00 - Export Controls: Fable 5 and Mythos 5 suspended
3:40 - The Anthropic–USG relationship and USG’s surveillance claim
9:40 - Self-owns, doomsday cults, and why the guardrails are "so broad"
12:42 - What the Amazon paper actually says ("fix this code")
20:33 - The chemical-weapons framing problem
23:39 - The China question and the SK Telecom angle
41:17 - Why hasn't the paper been published?
57:01 - "Free Fable": are Chinese models only months behind?
1:00:13 - The unforgiving internet and the security poverty line
1:11:18 - Microsoft brings back "responsible disclosure" (and threatens researchers)
1:29:04 - Luta Security, the AI bug flood, and shout-outs

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 101: We discuss Anthropic's Mythos 5 and Claude Fable 5 release and the bombshell that the company was silently downgrading paid users' results, sparking a heated debate over guardrails, gatekeeping, and whether elite AI reasoning is becoming a privilege for the few.

Plus, AI-generated N-day exploits killing the patch window, a record-shattering Patch Tuesday, Meta's latest court filing against spyware maker NSO Group, the return of cyber paleontology, and a detour into the new government UFO drops.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 - Introductory banter
3:22 - The Mythos 5 / Claude Fable 5 release
14:42 - Anthropic’s silent downgrade trust problem
26:18 - Anti-competitive behavior & the AV "stealing detection" parallel
32:29 - Distillation, China & the real motive
38:04 - "Too dangerous to release" & gatekeeping vs. guardrailing
45:53 - Is Mythos a threat to malware-analysis startups?
48:20 - Dario's AI regulation essay
56:48 - N-day exploits and death of the patch window
1:07:18 - Patch Tuesday and 10x vulnerability surge
1:10:34 - Meta catches NSO Group
1:14:45 - Cyber paleontology, Shadow Brokers leaks
1:28:29 - Moonlight Maze and learning from history
1:34:22 - UFOs, UAPs and Disclosure Day

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 100: We cover AI eating reverse engineering, the death of the malware report, running local models on the DGX Spark, where Google DeepMind stands, and whether the frontier labs will stay in cybersecurity.

Plus, more on Anthropic's Mythos rollout and the thinly sourced Anthropic-NSA reports, the Fast16 sabotage of physics calculations, what researchers choose not to publish, Microsoft's bad Black Hat email, and Costin's Friday UFO files.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 - JAGS at InfoSecurity Europe
3:40 - Sponsor: TLPBLACK
5:54 - A roadmap for security after the AI revolution
11:01 - Stripe Atlas and how easy it is to start a company
15:00 - If anyone could reverse engineer anything for $5
19:49 - Layoffs at Google's Threat Intelligence Group
21:06 - The death of reading the report
27:53 - Pitting the AI models against each other
32:07 - Grok, local models, and the DGX Spark
39:27 - Where is Google DeepMind?
45:29 - Will the frontier labs stay in cybersecurity?
52:41 - Mythos, Project Glasswing, and the NSA deal
1:16:33 - FAST16, Stuxnet, and sabotaging Iran's bomb
1:57:52 - Microsoft, Black Hat, and the chilling effect
2:14:14 - Shout-outs, UFO files, and 100 episodes

(Presented by Ent.ai: Ent delivers intent-aware security that protects every action, adapts to every workflow, and works for every user. Enterprise threat detection, reimagined.)

Three Buddy Problem - Episode 99: Microsoft is now threatening legal action against researchers who drop zero-days. We debate whether it's a fair line against extortion, or amateur-hour PR from a company that already torched its own research community? Costin plays reluctant defender, JAGS says the damage was done years ago, and Ryan reopens the long history of silent fixes and stolen bounties.

Plus, on the 10th anniversary of the Shadow Brokers leak, we discuss some enduring mysteries, theories on attribution and an interesting trail that leads to Edward Snowden.

We also unpack Rob Joyce's warning that China's cyber explosives are already planted in US infrastructure, and the Pope's warnings about around artificial intelligence.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 - Introductory banter
2:03 - The Pope's AI paper
3:35 - New sponsor: Brandon Dixon's Ent Security
9:34 - Costin's Chinese-model OSINT rabbit hole
13:34 - Codex, GPT-5.5, and the "American AI welfare state"
23:20 - Microsoft threatens vulnerability researchers
27:06 - Is it extortion or retribution? The disclosure fight
40:48 - How Microsoft's consultant class broke MSRC and MSTIC
48:42 - Silent fixes, stolen bounties, and the marketing machine
1:02:29 - Ten years of the Shadow Brokers
1:14:20 - The Snowden theory
1:32:34 - Rob Joyce: China's cyber explosives are in place
1:53:26 - Shout-outs

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Ekoparty Miami: Aaron Portnoy (Zero Day Initiative alum, early Pwn2Own organizer, and now at Mindgard) joins us at Ekoparty Miami to reminisce on the early days of the hacking contest, where vulnerabilities actually live (the boundaries between systems, not inside them), why LLMs will take out the trash but can't dream up the next speculative-execution-class bug, and the coming patching apocalypse when discovery 10x's overnight.

Plus, why your SOC is a forensic historian, the promise of hijacking an attacker's reward loop with deception tech, and the legendary story of carrying a Walmart "fat stack" of cash to bootstrap Ekoparty in Buenos Aires.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Aaron Portnoy.

Timestamps:
0:00 — Introductory banter
1:17 — Dropping out, iDefense, and getting good at reversing everything
2:19 — How Pwn2Own got started
4:15 — The most impressive Pwn2Own ever: Nils, VUPEN, and exploit "art"
5:59 — "iPhone hacked in 30 seconds" — and the 18 months behind it
6:41 — Does Pwn2Own still have a place in the AI era?
9:16 — Why LLMs take out the trash but can't invent the next bug class
12:48 — Will LLMs deliver new mitigation classes? Aaron's skeptical
18:34 — The place of the human when the easy bugs run dry
21:08 — Cognitive offloading, Halvar's warning, and skill rot
22:39 — Decompiling 800k functions: Aaron's LLM "holy shit" moment
25:26 — The patching apocalypse and why "assume breach" breaks
28:15 — Compounding asymmetries: why offense just transcended defense

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Ekoparty Miami: Perri Adams of DARPA AIxCC fame joins the show to chat about proof engines, formal methods, and why LLMs just made a once-niche corner of computer science suddenly essential.

We get into why verifiers and proof engines are the key to effective AI, why vulnerability research is so far ahead of threat intel, and the case for baking security checks directly into code generation tools like Claude Code and Codex.

Plus, designing a multi-million dollar challenge that's allowed to fail, the Mythos "too dangerous to release" debate, and musings on every LLM-discovered bug being a public bug by default.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Perri Adams.

Timestamps:
0:00 — Introductory banter
1:09 — Why LLMs just made formal methods relevant again
4:03 — Proof engines, explained
8:43 — Can a layman grab this fire? The calculus problem
11:58 — Vuln researchers are scrappy kids with a trust fund
14:55 — Pitching AIxCC inside DARPA: hard sell or easy sell?
18:00 — Designing a challenge that's allowed to fail
22:06 — Inside Team Atlanta's 150-page winning system
24:00 — Why this is bigger for defense than for offense
31:49 — Mythos, safeguards, and "every LLM bug is a public bug"

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Ekoparty Miami: SentinelLabs researcher Gabriel Bernadett-Shapiro hops on the mic to unpack who gets to define what "security" even means in the age of AI, why venture capital keeps funding the wrong things, and how the frontier labs quietly ate everyone's coding harness.

Plus, how AI actually contributed to cracking the FAST 16 research, overcoming the guardrails, and why your domain expertise is the only thing keeping you out of full-blown rabbit-hole psychosis.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Gabriel Bernadett-Shapiro.

Timestamps:
0:00 Introductory banter
4:55 Gabe returns: how the models got scary-good at code
8:45 Bay Area short-termism and the "10x in 18 months" trap
11:35 VCs as tastemakers, and why that's broken
13:00 The unpaid-labor pipeline into the AI labs
18:00 The real misunderstanding about security's moat
20:18 Bug bounties: a net negative for the industry?
22:20 The great vuln fire sale — find 50,000, fix zero
27:28 Who will maintain vetted open-source libraries?
29:29 FAST 16: how AI actually broke the case open
35:05 The rabbit-holing machine and the path to "AI psychosis"
41:05 Stuxnet, Kim Zetter, and the story we'll never be told

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Ekoparty Miami: Federico Kirschbaum, founder of Ekoparty and now head of Security Lab at XBOW, talks about what happens to offensive security when an autonomous AI hacker can find and exploit real vulnerabilities. Fede walks through XBOW's "Tales from the Trace," the surreal experience of watching a non-human adversary reason its way to an ASLR bypass, and why he believes pen-testing isn't dying but finally becoming accessible to far more than the world's biggest companies.

Plus, where humans still matter in the loop, whether an LLM-discovered bug is public by definition, the looming reckoning over software liability, and Halvar Flake's very honest fear of getting lazy.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Federico Kirschbaum.

Timestamps:
0:00 Fede's move to XBOW
2:20 What's XBOW building? An AI hacker for real vulnerabilities
5:53 Where the human stays in the loop
6:35 The Exim bug: a craftsman races the LLM to an ASLR bypass
10:49 Does bug discovery still need a human asking the right question?
16:24 A short history: Satan, CORE, Metasploit, bug bounties
18:48 An LLM-discovered bug is public by definition
24:12 Halvar Flake's laziness worry & the assembly-to-C parallel
29:47 Rising tides: script kiddies get the full gamut
41:02 The economics: does pentesting get cheap?
43:18 Argentina, Ekoparty, and an untapped talent pipeline

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Ekoparty Miami: Jordan Wiens, co-founder of Vector 35 and creator of Binary Ninja, talks about a decade spent building a decompiler in a market everyone told him not to enter. He walks through why accessibility drove the whole project, how Binja's intermediate-language system stacks up against IDA, Ghidra, and Radare, and why language-specific decompilation for Rust, C++, and Go is the next real frontier.

Plus, thoughts on AI disruption and why "the model can do it" misses the point that the model is just driving the tool, what verifiability really means, whether AI tilts the field toward offense or defense, and questions around subsidized tokens, the collapse of the CTF talent pipeline, and what happens to a craft when the shortcut is always one prompt away.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Jordan Wiens.

Timestamps:
0:00 Introductory banter
1:22 Vector 35 and the origin of Binary Ninja
2:32 From CTFs and SCIFs to building a decompiler
3:27 Before Ghidra: when an IDA license was out of reach
9:47 Language-specific decompilation: Rust, C++, and Go
12:47 Running a 17-person bootstrapped shop with no org chart
13:50 DARPA money, In-Q-Tel, and staying independent
15:23 AI as disruptor: the model drives the tool
18:06 Verifiability and the Fast16 reversing story
25:10 How AI actually gets used inside the company
28:52 Frontier models and guardrails
33:30 Will AI favor offense or defense?
40:51 Shrinking CTF talent pipelines

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 98: We dive back into the fast16 malware discovery with fresh speculation that it's targeting spherical implosion simulations for Iran's nuclear program, and wonder who on earth is qualified to confirm this.

Plus, thoughts on OpenAI's new three-tier cyber access program, Microsoft's MDASH harness, the 10x Patch Tuesday tsunami, Cloudflare's 1,100 layoffs blamed on AI, and why frontier-lab guardrails may just be elaborate security theater.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 - Introductory banter
3:19 - fast16 update: spherical implosion simulations?
9:01 - Manhattan Project precedent — why this matches Iran
12:28 - Who can actually reproduce the FAST 16 attack?
19:32 - Google GTIG's "AI-written" zero-day
22:13 - The rise of AI-backend "silent detections"
25:54 - Guardrails as security theater
38:47 - Are the 10x patch numbers real defense?
43:48 - OpenAI's Trusted Access tiers + Microsoft MDASH
53:35 - End of the ‘patch-and-pray’ model
57:50 - Sean Heelan: strict harnesses can make models worse
1:03:51 - Pwn2Own Berlin overflow and bug-density debate
1:12:24 - Cloudflare's 1,100 layoffs and AI as scapegoat
1:27:42 - RCS encryption, Android Intrusion Logging, Seedworm & Kazuar

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 97: We discuss the disappearing art of Windows APT paleontology, the absence of complex malware documentation, and why so much threat-intel research has slipped behind paywalls and into private rooms.

Plus, a surge in AI-discovered bugs in Firefox and Chrome, a rough week for Linux security flaw disclosures, and the usual Ivanti and Palo Alto zero-day bulletins that ship without a single IOC.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 - Introductory banter
1:17 - Inside TLP-Red: writing hashes by hand
3:57- fast16 fallout and the threat intel trust collapse
9:17 - The death of cyber paleontology on Windows
14:49 - Mobile is the new paleontology frontier
15:48 - When threat intel went private: the CrowdStrike effect
23:29 - Falling sideways into intelligence brokerage
36:05 -- AI, Easter eggs, and the loss of malware artistry
47:22 -- Will the Frontier Labs publish threat intel?
51:43 -- fast16 follow-up reports coming
1:09:38 - Mythos, Aardvark, and the patch tsunami
1:15:33 - CopyFail and the Linux reboot crisis
1:51:05 - UAPs, Pulitzers, last-ever LabsCon, and shoutouts

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 96: We're joined by WIRED writer Andy Greenberg to dig into SentinelLabs' bombshell FAST16 research, a newly deciphered piece of sabotage malware that predates Stuxnet by five years and quietly tampered with physics modeling software likely tied to Iran's nuclear program.

We discuss the attribution rabbit hole (NSA? Israel? someone else?), the eerie "spiritual warfare" implications of corrupting scientific calculations, and Antiy Labs' very dialectical Chinese rebuttal. Plus, what AI reverse-engineering means for the next decade of cyber paleontology.

Cast: Andy Greenberg, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:

0:00 - WIRED’s Andy Greenberg joins the show
1:53 - How the FAST16 scoop landed in Andy's lap
6:45 - JAGS sat on this sample for 7 years
10:33 - How Costin and the Kaspersky team missed the sabotage routine
15:20 - The "holy moly" moment: what FAST16 actually does
18:26 - Territorial Dispute, Shadow Brokers, and the driver list
24:11 - The targets: MOHID, PKPM, and LS-DYNA's link to Iran
28:13 - No C&C, no victims: a worm built for air-gapped networks
34:45 - Was this part of a larger anti-Iran toolkit?
37:55 - Attribution: NSA, Israel, or someone else entirely?
51:39 - What was the actual sabotage? Unanswered questions
55:48 - "Spiritual warfare": the psychological angle and trust in computers
1:20:05 - Equities, going public, and the case for AI-powered reversing
1:32:19 - Antiy Labs' Chinese rebuttal and the apparatchik tone
1:43:04 - Shoutouts: Sergey Mineev, LabsCon CFP, PivotCon, and Ekoparty

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 95: Vigilant Labs director Mark Dowd joins the show to shed light on the state of offensive research, the economics of the exploit market, and why "Mark Dowd in a box" isn't quite the threat the AI hype machine suggests. He talks through the daily stresses of running an offensive shop, how AI is reshaping vulnerability discovery, exploit development, and the pricing of full exploit chains.

Plus, thoughts on Lockdown Mode and Apple's MIE, whether mitigations actually work or just push attackers toward less access, the rise of HarmonyOS and the Balkanization of device security, persistence, baseband attacks, GrapheneOS, and Samsung Knox.

We discuss customer vetting and OpSec fears, policymakers who've never written an exploit, and the strange afterlife of The Art of Software Security Assessment, the 20-year-old book now possibly training data for the very tools coming for his job.

Cast: Mark Dowd, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductions
4:28 The origin story of Azimuth: why go offensive?
6:26 Stresses of running an offensive research business
12:10 "Mark Dowd in a box" — is AI an existential threat to vuln research?
16:13 Using AI in workflow: frontier models vs. local models
22:05 AI in bug-finding vs. exploit implementation
30:30 Watching AI tear through a firmware backdoor
38:23 Artificial guardrails and the "POC" wall
43:25 Will AI commoditize 0days? The high-end vs. low-end vendor split
57:30 How AI disrupts exploit chain pricing
1:05:18 Does persistence still matter? Should you reboot your phone?
1:09:33 Lockdown Mode, MIE, and Apple's "never been compromised" claim
1:14:25 Do mitigations really work, or are we stuck in an endless loop?
1:23:25 Android vs. iOS vs. Huawei's HarmonyOS Next
1:34:44 Exploit leaks, customer vetting, and OpSec fears
1:41:37 GrapheneOS, Samsung Knox and baseband attacks
1:53:56 Did the exploit market save us from encryption backdoors?
1:55:11 What does the threat-intel community get wrong about vuln research?

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 94: We discuss a mysterious, VM-obfuscated backdoor that lived undetected on a single U.K. machine for a year before disappearing, finding clues pointing to an elite-level APT intrusion that still evades broader industry coverage.

Plus, connecting the dots across AI-driven vulnerability discovery, Microsoft’s massive Patch Tuesday, Jensen Huang talks cybersecurity, Mythos dangers and Chinese chips, and the quiet erosion of CVE enrichment at NIST.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 – Intros + AI news whiplash
5:10 – Patch Tuesday breakdown: Microsoft's second-largest CVE release ever
7:32 – AI accelerating vulnerability discovery at record pace
10:00 – Frontier lab cyber models, fine-tuning, guardrail removal & KYC
12:37 – FreeBSD NFS bug: Opus 4.6 was already finding critical vulns
14:26 – Anthropic's infrastructure strain: Is Opus being nerfed?
21:05 – OpenAI's Trusted Access for Cyber vs. Anthropic's Mythos cabal
28:45 – SharePoint zero-day CVE-2026-32201: The endless Microsoft tax
34:36 – Adobe Acrobat zero-day: A rare, real, Russia-linked exploit in the wild
41:36 – VirusTotal mining: The golden age of threat intel hunting
50:03 – ZionSiphon: Vibe-coded OT malware targeting Israeli water infrastructure
55:04 – Paleontology of threat research: When do you publish? Who do you trust?
1:13:53 – Angry Spark: A one-machine, one-year backdoor raises eyebrows
1:49:25 – Jensen Huang vs. Dwarkesh Patel on Mythos, China and chips
2:14:32 – Chinese AI distillation: 24,000 fake Anthropic accounts, DeepSeek & the catch-up question

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem - Episode 93: We discuss Anthropic's release of Claude Mythos Preview (an AI model so capable and dangerous they won't release it publicly) and debate the looming patching crisis, bug bounty extinction, possible US government nationalization of frontier labs, and why the NSA might not be thrilled about all this bug-fixing.

Plus, North Korea's six-month Drift Protocol con job, APT28's retro DNS hijacking campaign, and Microsoft's driver signing mess hitting WireGuard and VeraCrypt.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

00:00 — Opening banter
01:36 — Anthropic Mythos Preview + Project Glasswing
06:17 — USG reaction + Wall Street emergency meeting
10:54 — Mythos capabilities vs hype (technical reality check)
13:44 — PR stunt? Skepticism of Anthropic narrative
20:42 — The patching crisis + “defender advantage”
27:41 — Bug bounty model under threat from AI
33:37 — Mythos practical workflows
45:09 — Geopolitics, NSA angle, and nationalization discussion
01:40:18 — Fortinet zero-day + ongoing failures
01:42:39 — Drift Protocol heist ($285M) + long-term social engineering
01:44:07 — Revisiting XZ Utils / Jia Tan attribution
01:54:07 — Crypto security gaps + need for real CTI in blockchain
02:04:22 — APT28 DNS hijacking + router compromise campaign
02:18:57 — Microsoft driver signing meltdown + ecosystem impact

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.)

Three Buddy Problem - Episode 92: Costin walks through real-world ransomware incident response while Juanito makes the case for AI-generated operating systems that never run anyone else's code. Plus, debates on whether vulnerability research is cooked, why nobody should pay ransoms, and what the security industry looks like after the massive AI flood.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

0:00 – Introductory banter
2:00 – Costin's ransomware incident response work
3:30 – How attackers break in: Fortinet vulnerabilities everywhere
6:30 – Hunting for ransomware decryption keys
9:00 – Breaking into ransomware C2s and monitoring leak sites
12:00 – The ransom payment debate: should you ever pay?
16:00 – Why "don't pay the ransom" is overgeneralized
21:00 – How ransomware gangs price their demands
24:00 – The AI-pilling of the security industry
28:30 – Nicholas Carlini, Ptacek, and "vulnerability research is cooked"
35:00 – Towards a generative-first operating system
41:00 – Code factories, trusted computing, and killing dependencies
48:00 – Microsoft and Apple's AI positioning
56:00 – Chris St. Myers' "Cognitive Rust Belt" essay
1:18:00 – Choice, The Matrix, and the illusion of control
1:38:00 – Supply chain attacks, North Korea, and dependency sprawl

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.)

Security Conversations: Jeremy Bannon, founder/CEO of The Cyber Health Company, joins Ryan Naraine to discuss why executive personal cybersecurity is a growing blind spot for organizations, and real-world incidents where personal compromises became corporate crises.

Plus, why CISOs struggle to secure the C-suite's personal lives, and how a healthcare-inspired model (complete with risk scores, care plans, and concierge support) can help companies close the gap.

0:00 — Introduction to The Cyber Health Company
1:00 — Why personal security is a blind spot for organizations
2:00 — Real examples: Disney hack, Instagram compromise, productivity loss
6:50 — Executives circumventing IT policy and Shadow-AI
8:43 — Digital immunity: resilience and incident response readiness
10:25 — The healthcare model for cybersecurity communication
12:14 — How the Cyber Health Score and risk coefficient work
15:34 — OSINT intake: why your social security number isn't private
17:26 — The state of executive security hygiene and the concierge model
35:00 — AI, deepfakes, and the scaling of commodity attacks

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.)

Three Buddy Problem - Episode 91: This week we dig into Google's new cyber threat disruption unit announced at RSAC, Kaspersky confirming Coruna is a direct evolution of Operation Triangulation, and a cascading supply chain compromise that chained through LiteLLM, Trivy, and Checkmarx into thousands of software pipelines.

Plus, VCs and the breathless AI hype, Apple's iOS 26.4 and silent patches, the FCC's ban on foreign-made routers, and Symantec catching an APT looking for Chinese military data.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

0:00 Intro & Pre-Show Banter
3:08 JAGS in San Francisco: RSAC week recap
6:05 Google Launches Cyber Disruption Unit — What's Actually New?
13:43 Why Separate Disruption Units Matter: ROI & Budget Justification
29:11 Haroon Meer's RSA Reality Check: The AI Hype Machine
32:37 The VC Ponzi Cycle & How Easy Money Hollowed Out Cybersecurity
47:32 ENT.ai & Tenex AI Hackathon at RSAC
53:08 Kaspersky Links Corona Exploit Kit to Operation Triangulation
1:08:09 Trenchant Cleanup & Lessons from Equation Group Burns
1:19:31 Apple iOS Patches, Hong Kong Device Passcode Law
1:27:53 Handala Hacks FBI Director Kash Patel's Personal Gmail
1:37:32 LeakBase Admin "Chucky" Arrested in Russia — FSB Gets the Data
1:45:38 Supply Chain Attacks: TeamPCP Hits LiteLLM & Trivy
2:04:34 FCC Bans Foreign-Made Routers — But What Do We Buy?

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 90: We remember GReAT teammate Sergey Mineev, the legendary malware hunter behind discoveries like Equation Group and Project Sauron (Remsec), including stories about his methods and why he was the best to ever do it.

Plus, another in-the-wild iOS exploit kit discovery and a long overdue conversation about Apple's responsibility to hundreds of millions of users on older iOS versions; the ProPublica Microsoft/FedRAMP bombshell, Interlock ransomware sitting on a Cisco zero-day, the White House AI policy framework, and Supermicro co-founder $2.5 billion AI chip smuggling bust.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.)

Three Buddy Problem - Episode 89: We discuss Iran hacktivist group 'Handala' wiper attacks against US medical device maker Stryker, Microsoft Intune MDM tool abuse, and whether Iran's cyber retaliation is as scary as the headlines suggest.

Plus, ESET's discovery that Russia's APT28 original implant developers are back after years of silence, Dutch intelligence warnings on Russian campaigns targeting Signal and WhatsApp accounts, Apple finally patching Coruna exploit kit vulnerabilities for older iPhones, and Google sharing Coruna samples that raise new questions about the exploit kit's proliferation chain.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 88: We unpack the fallout from public documentation of the Coruna iOS exploit kit, the likely connection to the Peter Williams/Trenchant exploit sale to Russians, how it slipped from government hands into criminal use, and the widening use of zero-days by surveillance vendors and cybercriminals.

Plus, fresh signs of cyber-warfare activity tied to Iran and Israel, the FBI’s disclosure of a breach affecting internal surveillance systems, and the latest debate over AI, security tooling, and Anthropic’s public stumbles.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.)

Matthias Frielingsdorf (co-founder and VP of Research at iVerify) joins the show to discuss the mysterious US government connection to 'Coruna', an iOS exploit kit fitted with 23 exploits across five full chains targeting iPhones iOS 13 through 17.2.1.

We talk about a "gut feeling" connecting this to the L3 Trenchant/Peter Williams exploit sale scandal, how a nation-state-grade exploit kit ended up in the hands of a Chinese cybercrime group chasing crypto wallets, and what it means that criminal organizations are now deploying iPhone zero-days at scale.

Matthias walks through what iVerify can and can't do on Apple's locked-down platform, why he thinks Apple needs to give defenders more access, the Lockdown Mode debate, the thorny issue of sample sharing in the research community, and practical advice for everyday iPhone users facing a threat landscape that just got a lot more complicated.

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.)

Huntress threat intelligence analyst Greg Linares shares insights on the modern ransomware ecosystem, including how crews operate like businesses and why Akira, Medusa, RansomHub, and Qilin cause so much damage. Plus, signs of overlap between ransomware and nation-state activity, what “time to ransom” really means for defenders, and why techniques like ClickFix and credential theft keep working at scale.

The conversation also covers the surge in RMM tool abuse, how “living off the land” attacks can unfold without traditional malware, and the basic defenses smaller organizations can prioritize.

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 87: We wake up to news of U.S./Israel military action against Iran and the expected fallout, including Tehran’s cyber capabilities and proxy risks. Plus: Anthropic’s clash with the Pentagon over AI use in warfare, market shockwaves from AI-driven security tools, mass layoffs tied to automation, Trenchant exec sentencing and sanctions in the exploit trade, and fresh questions around Cisco’s SD-WAN breach and supply-chain trust.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by TLPBLACK: High-fidelity threat intelligence and research tools for modern security teams. From curated Passive DNS and real-time C2 monitoring to actionable IOC feeds and daily malware samples, we help defenders detect, hunt, and disrupt threats faster, with seamless integration into SIEM and SOAR workflows.)

Three Buddy Problem - Episode 86: We dig into GitLab’s explosive look at North Korea’s “Contagious Interview” APT operation, the scale of fake IT worker infiltration, and what it means for companies chasing cheap talent.

Plus, a fresh batch of already-exploited Ivanti and Dell zero-days, the return of Apple’s shutdown logs, and thoughts on addictive AI coding agents affecting human purpose.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 85: Top stories this week include drone incursions over El Paso and the murky line between cartel activity, anti-drone tech testing, and full-blown hybrid warfare; updates on the Notepad++ supply chain fallout; Microsoft’s zero-day treadmill and AI-enabled attack surfaces; and Apple’s “extremely sophisticated” iOS exploits.

Plus, Europe’s growing appetite for offensive cyber, Palo Alto and the uncomfortable politics of cyber attribution, Singapore on telco intrusions, and the economics of end-of-life infrastructure.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.)

Three Buddy Problem - Episode 84: We process the cybersecurity fallout from the latest Epstein document dump, focusing on why redactions fail in the AI era and how quickly modern tools can unravel them. The conversation moves from sloppy redaction practices and exploit mythology to harder questions about ethics, accountability, and silence within the infosec community.

Plus, inside the Notepad++ supply-chain compromise attributed to a known Chinese APT, Microsoft’s security executive changes, Anthropic's AI-driven vulnerability discovery, China-linked network implants, and Lockdown Mode thwarting FBI investigators.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Material Security: We protect your company’s most valuable materials -- the emails, files, and accounts that live in your Google Workspace and Microsoft 365 cloud offices.)

Three Buddy Problem - Episode 83: Poland's CERT documents a rare, explicit wiper attack on civilians in a NATO country, including detailed attribution of a Russian government op targeting the electric grid in the heart of winter. We examine why this crosses a long-avoided threshold, why attribution suddenly matters again, and what it says about pre-positioned access, vendor insecurity, and the shrinking gap between cyber operations and acts of war.

Plus, another Fortinet fiasco, a new batch of Ivanti zero-days under attack, an emergency patch from Microsoft and the return of the mysterious KasperSekrets account.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Material Security: We protect your company’s most valuable materials -- the emails, files, and accounts that live in your Google Workspace and Microsoft 365 cloud offices.)

Three Buddy Problem - Episode 82: We parse news that China-linked VoidLink is a malware framework created entirely by AI and the collapsing line between elite APT operations and everyday threat actors.

Plus, a new Sean Heelan essay on low-cost exploit generation and why “AI guardrails” are mostly a comforting myth; AI slop overwhelming bug bounty programs; CISA's new Brickstorm YARA rules; and fresh research on a wiper-malware found in Russian attacks against Poland's electricity sector.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Material Security: We protect your company’s most valuable materials -- the emails, files, and accounts that live in your Google Workspace and Microsoft 365 cloud offices.)

Three Buddy Problem - Episode 81: We dissect New York Times reporting on the "precision" of US cyber operations in Venezuela, the competing narratives around offensive cyber capabilities and "letters of marque" for private hackers. Plus, a mysterious failed cyber attack on Poland's power grid, internet blackouts in Iran (with fascinating DNS telemetry revealing Chinese bank traffic and Russian website spikes), and news of China's ban on US/Israeli cybersecurity software.

We also cover Check Point's research on "VoidLink" (is it a successor to ShadowPad?), Microsoft's threat intelligence sharing practices, and Google Project Zero's disclosure of zero-click vulnerabilities caused by AI-powered transcription features.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Material Security: We protect your company’s most valuable materials -- the emails, files, and accounts that live in your Google Workspace and Microsoft 365 cloud offices.)

Three Buddy Problem - Episode 80: Researcher Hamid Kashfi returns to unpack Iran’s latest unrest, separating economic reality from propaganda while examining how information control, cyber pressure, and state surveillance are shaping events on the ground.

Plus, did cyber make the lights go out in Venezuela?

Cast: Hamid Kashfi, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by Material Security: We protect your company’s most valuable materials -- the emails, files, and accounts that live in your Google Workspace and Microsoft 365 cloud offices.)

Three Buddy Problem - Episode 79: We cover MongoBleed (CVE‑2025‑14847), exposed MongoDB deployments, and the sad realization that zero-day attacks are a normal, everyday occurrence. Plus, AI’s expanding role and misuse across products and workflows, proximity attacks against Bluetooth audio devices, spyware sanctions de-listings, and ransomware economics.

In a special mailbag segment, we give our book recommendations and respond to common questions from the listeners.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by ThreatLocker: Allow what you need. Block everything else by default, including ransomware and rogue code.)

Three Buddy Problem - Episode 78: We close out the year with a no-budget, no-permission awards show, spotlighting the cybersecurity stories that actually mattered.

Plus, a bizarre polygraph scandal at CISA, Chinese APT research dumps, ransomware pre-notification hiccups, foreign drone bans, and the growing gap between cyber theater and real operational value.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by ThreatLocker: Allow what you need. Block everything else by default, including ransomware and rogue code.)

Three Buddy Problem - Episode 77: New React2Shell data from Microsoft, fresh Apple and Cisco zero-days already in the wild, and state-linked campaigns from Russia and China that show a merging of espionage, crime, and infrastructure disruption.

Plus, the US government's push to enlist private firms in offensive hacking, letters of marque for cartels, new discovery of spyware used against journalists in Belarus, and Amazon catching North Koreans via keystroke latency.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

(Presented by ThreatLocker: Allow what you need. Block everything else by default, including ransomware and rogue code.)

Three Buddy Problem - Episode 76: On the show this week, Costin walks through how a single Romanian documentary kick-started nationwide protests, exposing how corruption can be perfectly legal when the law itself is gamed, and why this moment feels different, darker, and more consequential than past flare-ups.

Plus, news on the React-to-Shell exploitation wave overwhelming the internet, why patching is structurally hard, and how APTs and criminals are converging on the same fragile dependency chain. Along the way, they take aim at Microsoft’s shrinking transparency, the limits of vendor trust, and what it really means when defenders are told (again) to just patch and pray.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.