Cyberside Chats: Cybersecurity Insights from the Experts

Hackers didn’t breach Meta’s systems, they just asked. In this episode, we break down the Meta AI hack, where attackers used a VPN and a politely worded chat message to convince Meta’s AI support agent to hand over more than 20,000 Instagram accounts, including the dormant Obama White House account and the personal account of a senior Space Force leader. No malware, no phishing, no exploit code. We flash back to the 2023 MGM Resorts attack to show how this fits one of the fastest-growing attack trends of recent years — social-engineering the help desk — now aimed at the AI agents replacing human help desks, minus the suspicion we’ve trained into people. We also connect it to the wider wave of attacks targeting AI agents, from zero-click prompt injection in Microsoft 365 Copilot to the PocketOS rogue-AI-agent disaster, and explain why the first real AI security crisis isn’t superhuman AI attackers — it’s ordinary AI agents with too much permission and no ability to be suspicious. Finally, we share five concrete steps to vet and constrain AI agents before they become your soft target. Key Takeaways: 1. Red-team AI agents before they touch production workflows. Treat deployment like a hire: the background check is adversarial testing. If an agent can change account state — emails, passwords, payments — someone must try to talk it into doing so maliciously before launch, the same way you phish-test your staff. The Meta exploit was the first test anyone would write. 2. Stage permissions like a probation period. New agents start advisory and read-only. Write permissions come later, narrowly, after monitored performance — and account recovery is the last workflow to automate, not the first, because it is the highest-value target in your environment. Meta granted end-to-end authority on day one. 3. Enforce identity verification in deterministic code, not in the model. The agent can request a recovery-info change; it must never approve one. Step-up verification (re-authentication, hardware key, code to the verified channel on file) belongs in the API layer, where no amount of persuasion can waive it. Prompts are advisory — the PocketOS agent quoted its own rules while violating them. 4. Scope every credential and action an agent can reach. Least privilege per task: an agent that answers support questions doesn’t need email-change rights; a coding agent’s token shouldn’t reach production or backups. An agent’s blast radius is what it can ingest, what it can access, and what it can do — audit all three before attackers map them for you. 5. Keep a human escalation path that the agent can’t lock. Meta’s automation removed both the suspicious human who would have questioned the request and the human a victim could appeal to afterward. Mandate an out-of-band recovery route — one the agent has no permissions to modify — before automating any account-security workflow. Resources: 1. 404 Media: Hackers Simply Asked Meta AI to Give Them Access to High-Profile Instagram Accounts. It Worked. https://www.404media.co/hackers-simply-asked-meta-ai-to-give-them-access-to-high-profile-instagram-accounts-it-worked/ 2. MIT Technology Review: The Meta Hack Shows There’s More to AI Security Than Mythos. https://www.technologyreview.com/2026/06/05/1138437/the-meta-hack-shows-theres-more-to-ai-security-than-mythos/ 3. TechCrunch: Instagram Is Alerting Users Who Were Targeted by Hackers During AI Chatbot Attacks. https://techcrunch.com/2026/06/03/instagram-is-alerting-users-who-were-targeted-by-hackers-during-ai-chatbot-attacks/ 4. Silicon Republic: Hackers Stole More Than 20,000 Instagram Accounts Using Meta AI. https://www.siliconrepublic.com/enterprise/hackers-stole-more-than-20000-instagram-accounts-using-meta-ai 5. EchoLeak (CVE-2025-32711): Zero-Click Prompt Injection in Microsoft 365 Copilot — Case Study. https://arxiv.org/abs/2509.10540

The recent Verizon outage underscores a growing risk in today’s technology landscape: when critical services are concentrated among a small number of providers, failures don’t stay isolated. In this live discussion, we’ll connect the Verizon outage to past telecom and cloud disruptions to examine how infrastructure dependency creates cascading business impact. We’ll also explore how large-scale outages intersect with security threats targeting telecommunications, where availability, confidentiality, and integrity failures increasingly overlap. The session will close with actionable takeaways for strengthening resilience and risk planning across cybersecurity and IT programs. Key Takeaways 1. Diversify your technology infrastructure. Relying on a single carrier, cloud provider, or bundled service creates a single point of failure. Purposeful diversification across providers can reduce the impact of large-scale outages and improve overall resilience. 2. Treat outages as security incidents, not just reliability problems. Large-scale telecom and cloud outages directly disrupt authentication, monitoring, and incident response, and should trigger security workflows—not just IT troubleshooting. 3. Identify and document your dependencies on carriers and cloud providers. Many security controls rely on SMS, voice, cloud identity, or single regions; understanding these dependencies ahead of time prevents dangerous blind spots during outages. 4. Plan and test incident response without phones, SMS, or primary cloud access. Assume your normal communication and authentication methods will fail and ensure your teams know how to coordinate securely when core services are unavailable. 5. Expect outages to increase fraud and social engineering activity. Attackers exploit confusion and urgency during service disruptions, so security teams should prepare staff for impersonation and “service restoration” scams during major outages. 6. Use widespread outages as learning opportunities. Review what happened, assess how your organization was—or could have been—impacted, identify potential areas for improvement, and update incident response, communications, and resilience plans accordingly. Resources 1. Verizon official network outage update https://www.verizon.com/about/news/update-network-outage 2. Forrester: Verizon outage reignites reliability concerns https://www.forrester.com/blogs/verizon-outage-reignites-reliability-concerns/ 3. CNN: Verizon outage disrupted phone and internet service nationwide https://www.cnn.com/2026/01/15/tech/verizon-outage-phone-internet-service 4. AP News: Verizon outage disrupted calling and data services nationwide https://apnews.com/article/85d658a4fb6a6175cae8981d91a809c9 5. CNN: AT&T outage shows how dependent daily life has become on mobile networks (2024) https://www.cnn.com/2024/02/23/tech/att-outage-customer-service

When Venezuela experienced widespread power and internet outages, the impact went far beyond inconvenience—it created a perfect environment for cyber exploitation. In this episode of Cyberside Chats, we use Venezuela’s disruption as a case study to show how cyber risk escalates when power, connectivity, and trusted services break down. We examine why phishing, fraud, and impersonation reliably surge after crises, how narratives around cyber-enabled disruption can trigger copycat or opportunistic attacks, and why even well-run organizations resort to risky security shortcuts when normal systems fail. We also explore how attackers weaponize emergency messaging, impersonate critical infrastructure and connectivity providers, and exploit verification failures when standard workflows are disrupted. The takeaway is simple: when infrastructure collapses, trust erodes—and cybercrime scales quickly to fill the gap.

Amazon released two security disclosures in the same week — and together, they reveal how modern attackers are getting inside organizations without breaking in. One case involved a North Korean IT worker who entered Amazon’s environment through a third-party contractor and was detected through subtle behavioral anomalies rather than malware. The other detailed a years-long Russian state-sponsored campaign that shifted away from exploits and instead abused misconfigured edge devices and trusted infrastructure to steal and replay credentials. Together, these incidents show how nation-state attackers are increasingly blending into human and technical systems that organizations already trust — forcing defenders to rethink how initial access really happens going into 2026. Key Takeaways 1. Treat hiring and contractors as part of your attack surface. Nation-state actors are deliberately targeting IT and technical roles. Contractor onboarding, identity verification, and access scoping should be handled with the same rigor as privileged account provisioning. 2. Secure and monitor network edge devices as identity infrastructure Misconfigured edge devices have become a primary initial access vector. Inventory them, assign ownership, restrict management access, and monitor them like authentication systems — not just networking gear. 3. Enforce strong MFA everywhere credentials matter If credentials can be used without MFA, assume they will be abused. Require MFA on VPNs, edge device management interfaces, cloud consoles, SaaS admin portals, and internal administrative access. 4. Harden endpoints and validate how access actually occurs Endpoint security still matters. Harden devices and look for signs of remote control, unusual latency, or access paths that don’t match how work is normally done. 5. Shift detection from “malicious” to “out of place” The most effective attacks often look legitimate. Focus detection on behavioral mismatches — access that technically succeeds but doesn’t align with role, geography, timing, or expected workflow. Resources: 1. Amazon Threat Intelligence Identifies Russian Cyber Threat Group Targeting Western Critical Infrastructure https://aws.amazon.com/blogs/security/amazon-threat-intelligence-identifies-russian-cyber-threat-group-targeting-western-critical-infrastructure/ 2. Amazon Caught North Korean IT Worker by Tracing Keystroke Data https://www.bloomberg.com/news/newsletters/2025-12-17/amazon-caught-north-korean-it-worker-by-tracing-keystroke-data/ 3. North Korean Infiltrator Caught Working in Amazon IT Department Thanks to Keystroke Lag https://www.tomshardware.com/tech-industry/cyber-security/north-korean- infiltrator-caught-working-in-amazon-it-department-thanks-to-lag-110ms- keystroke-input-raises-red-flags-over-true-location 4. Confessions of a Laptop Farmer: How an American Helped North Korea’s Remote Worker Scheme https://www.bloomberg.com/news/articles/2023-08-23/confessions-of-a-laptop- farmer-how-an-american-helped-north-korea-s-remote-worker-scheme 5. Hiring security checklist https://www.lmgsecurity.com/resources/hiring-security-checklist/