About this episode

This episode discusses a self-thinking AI worm and its implications for cybersecurity, along with issues related to Meta's AI support agent being exploited by hackers.

Researchers at the University of Toronto have built a worm that thinks for itself. Using free off-the-shelf AI models it works out how to break into each new computer it encounters, and hijacks the powerful ones to host its own AI brain. And then the researchers discovered their creation had quietly removed the list of machines it wasn't supposed to attack. Meanwhile, Meta's shiny new AI customer support agent has been cheerfully helping hackers help themselves to other people's Instagram accounts. Just keep asking, politely but firmly, to have a password reset sent to a different email address - and the AI will eventually agree. All this and more in episode 471 of the "Smashing Security" podcast with cybersecurity expert and keynote speaker Graham Cluley, and special guest James Ball. EPISODE LINKS: Emmys data leak: update exposes access to award submissions - Cybernews. A $1,000 AI agent found 21 zero-days in FFmpeg, some 23 years old - Martin Cid Magazine. Hackers steal $1.7M condom shipment​ - Cybernews. AI Agents Enable Adaptive Computer Worms - ArXiv. 21 Zero-Days in FFmpeg - Depthfirst. Meta confirms thousands of Instagram accounts were hacked by abusing its AI chatbot…

People in this episode

Host: Graham Cluley

Guest: James Ball

Topics covered

• AI
• cybersecurity
• computer worms
• hacking
• Instagram security
• technology news

Keywords

• AI worm
• cybersecurity
• Meta
• Instagram hacking
• University of Toronto
• James Ball
• Graham Cluley
• computer security
• adaptive computer worms

Mentioned in this episode

Organizations: University of Toronto, Meta, Cybernews, Martin Cid Magazine, ArXiv, Depthfirst, The Guardian

Products: Final Fantasy VII Remake, Smashing Security merchandise

More episodes of Smashing Security

• This AI security flaw might be impossible to fix · June 3, 2026 · 58 min
• What your Oura ring won't tell you · May 27, 2026 · 53 min
• High-speed train hacks and homicidal lawnmowers · May 20, 2026 · 56 min
• How ShinyHunters hacked the world's biggest universities · May 13, 2026 · 1h 4m

Explore listener stats, chart rankings, contacts and more on the Smashing Security podcast page.