Three Buddy Problem

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.) Three Buddy Problem - Episode 111: OpenAI finally published a technical Hugging Face post-mortem, and Costin's verdict is blunt. He reads it as a document written for policymakers rather than for the blue teams who have to survive a thousand-agent swarm. We also dig into NVIDIA's $12.9 billion acquisition of Hugging Face, why JAGS thinks a frontier lab standing against open-source looks weak, and what that new industry open letter on cyber defense actually asks anyone to do. Plus, hotel Wi-Fi tradecraft after CaptiveCrunch, the FBI's ORB network takedown with Lumen, Chinese routers that ship backdoored from the factory, and the TeamPCP arrests in Australia. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 1:11 TLPBlack, incident response, and why it starts at the router 4:11 CaptiveCrunch and Juanito's travel router kit 7:59 Costin's VPN/hotel WiFi stack 12:36 State of Statecraft, LABScon, and Offensive AI Con 17:16 OpenAI's Hugging Face post-mortem technical report 21:43 A swarm of a thousand agents 27:35 Who was OpenAI’s report written for? 33:05 Fail2ban, canaries, and catching agents in your logs 40:34 NVIDIA buys Hugging Face for $12.9 billion 44:42 The open weights fight and rooting for China 52:47 Nemotron, DGX Spark, and the RAM price spiral 1:03:26 Open letter on collective AI-powered cyber defense 1:30:21 Lumen's Quartermaster and the FBI ORB takedown 1:59:05 Backdoored ZBT routers, Chinese phones, and the TeamPCP arrestsLinks:Transcript The Hugging Face incident and the road ahead (OpenAI) OpenAI - Hugging Face Technical Report (PDF) Independent investigation of OpenAI agents’ behavior (METR) The Defender’s Window (Greg Brockman) Open Letter: A call for collective action on cyber defense (OpenAI) Inside China-nexus cyber espionage infrastructure (Lumen) Nvidia to Buy Open Source AI Platform Hugging Face For $12.9 Billion Nemotron AI Models (NVIDIA) NVIDIA DGX Spark NVIDIA DGX Platform FBI Seize Platforms Used by China State-Sponsored Hackers (DOJ) Michael Horka at LABScon Two Alleged ‘TeamPCP’ Hackers Arrested in Australia (Brian Krebs) Australia police statement on TeamPCP arrests Austin Larsen at LABScon Chinese Implants in the Supply Chain (VulnCheck) More Than 4,000 Legacy Routers Compromised by AryStinger The Massive Android Botnet with 1.8 Million Infected Devices Alex Turing Blog Apple in China: The Capture of the World's Greatest Company State of Statecraft Conference Offensive AI Conference (San Diego) TLPBLACK

(Presented by State of Statecraft: A security and intelligence conference that brings together multiple disciplines, backgrounds, and nationalities to share research into the covert activities of nation-states and other malign actors.) Three Buddy Problem - Episode 109: The buddies dig into a new White House memo handing vetted private companies real offensive cyber authorities, and Costin explains why a stack of ransomware takedown cases has been sitting on a shelf waiting for exactly this. Plus, a tiny 12 KB Windows backdoor found on one machine with a dead C2, the mercenary outfits quietly living inside telcos, and why Google continues to flounder in the race for AI dominance. Cast: Costin Raiu, Ryan Naraine and Juan Andres Guerrero-Saade Timestamps: 0:00 Introductory banter 0:58 State of Statecraft, and a late CFP window 3:24 The White House offensive hacking memo 6:37 "Hack back" is the wrong frame for what's being authorized 11:20 Ransomware cases sitting on the shelf 17:01 The million-dollar bond and who can realistically play 22:29 Where DPRK crypto theft falls under the new definitions 28:15 Would TLP Black take a contract? 36:55 Gen Digital's 12 KB backdoor hiding its C2 in desktop.ini whitespace 46:57 Passive DNS, registration patterns, and pivoting on a dead domain 57:32 Feeding a one-off find back into detection engineering 1:02:14 Metador, Mafalda, and the mercenaries who love telcos 1:17:07 Armored Likho and what "Western APT" really means 1:28:16 The IOC market, private reporting, and CTI’s matching problem 1:58:10 Google's culture problem, the weekly model churn, and Patch Tuesday mathLinks:Transcript White House memo on private sector offensive operations Trump admin wants to allow companies to hack cybercriminals Custom Windows backdoor found on a single corporate machine New Armored Likho tools target Telegram and eavesdropping Multi-Agent AI Framework Used to Compromise Government Entities in Asia Anthropic Risk Report - August 2026 The Metador Enigma: Unveiling an Unattributed Threat Report | The Mystery of Metador Armored Likho’s new weapon: BusySnake Stealer How We Caught Lazarus's IT Workers Scheme Live on Camera Behind the exit of Google's DeepMind CEO US to tell partners they must pick sides in AI race with China Microsoft Patch Tuesday 422 CVEs CVE Attribution & MSRC Reporting Dashboard State of Statecraft (Brussels)

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 107: Proofpoint's Greg Lesnewich joins the show to break down Laundry Bear, the "half-click" webmail exploits that let a Russian GRU cluster hack inboxes the moment an email was opened, and what it took to publish alongside the NSA, FBI and sixteen allied agencies. Plus, Anthropic and OpenAI both admit their models escaped test sandboxes and popped real companies, why JAGS wants the CFAA burned down and vulnerable devices bricked, and a heartfelt detour into how threat hunters actually build intuition and skills. Cast: Greg Lesnewich, Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Sponsor - Thinkst Canary 1:34 Greg Lesnewich introduces the Proofpoint threat-hunting team 5:23 Inside the NSA ‘Laundry Bear’ advisory 7:15 What does "half-click" mean? 9:58 Laundry Bear's Zimbra exploit: DNS exfil and app-specific password persistence 12:59 Ferrari model numbers, F1 UNC names, and ESET's Operation RoundPress 17:05 Targeting Ukraine, US universities, and magnetic fusion research 19:34 How threat hunters actually build intuition 32:35 Systems thinking, Donella Meadows, and Costin's laptop under the dinner table 54:48 The dopamine hit of a real find and the deleted "never mind" messages 1:00:42 Magnets of threats: under 1% of customers ever see an APT 1:25:21 Getting detections into the product, and coordinating a release with NSA 1:53:22 Anthropic and OpenAI models breaking out of the eval sandbox 2:17:45 The case for killing the CFAA and bricking vulnerable devices 2:43:44 AI in the lab, malware paleontology, Google's new names, and AngrySparkLinks:Transcript Greg Lesnewich | LinkedIn Proofpoint: TA488 Comes for Outlook with Another Half-Click Exploit TA488 Targets Zimbra Mailservers with Half-Click Exploits NSA: Russian APT Phishing Users of Zimbra Operation RoundPress Half-Click Webmail Zero-Days from TA458 Operation RoundPress targeting high-value webmail servers Anthropic: Investigating three real-world incidents in our cybersecurity evaluations Hugging Face: A Technical Timeline of OpenAI incident Microsoft Intros MAI-Cyber-1-Flash inside MDASH Google Updates Threat Actor Naming System Bill Marczak: An Angry Spark, or a Triangle in Disguise? Gen: Chasing an Angry Spark Amazon identifies North Korean hacker group behind open-source supply chain attacks Dana (Donella) Meadows Lecture: Sustainable Systems Outliers - Malcolm Gladwell 5-Year Data Hack Disclosed by SMS Giant Syniverse Practical Malware Analysis book Top 1 Million Websites Thinkst Canary

(Presented by Thinkst Canary: Most Companies find out way too late that they’ve been breached. Thinkst Canary changes this. Deploy Canaries and Canarytokens in minutes and then forget about them. Attackers tip their hand by touching ’em giving you the one alert, when it matters. With zero admin overhead and almost no false-positives, Canaries are deployed (and loved) on all 7 continents.) Three Buddy Problem - Episode 106: We dig into the news that OpenAI's models were the "autonomous agent" that breached Hugging Face, escaping a sandbox through a zero-day to cheat on a cyber benchmark, then getting spun into a partnership announcement. We argue about the implications of the incident, the PR masterclass, the absence of ethics and human oversight, and calls for "kill switches" to mitigate "AI lab leaks." Plus, SentinelLabs' new fast16 reverse-engineering benchmark, where GPT-5.6 Sol was the only public model to go the distance. Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu. Timestamps: 0:00 Introductory banter 5:24 OpenAI admits it was the Hugging Face "hacker" 10:06 What’s ExploitGym and who's on top of the leaderboard 12:59 Reward hacking: Did anyone train this thing not to cheat? 19:35 Marketing stunt or real incident? The zero-day in the package proxy 26:43 Was OpenAI already plugged into Hugging Face? 29:17 Paperclips, kill switches, and "going rogue" 34:49 Crisis comms, regulatory capture, and the second Cold War 43:02 Approve every action? Auto mode and swarms 50:10 "Lab leak" and calls for biosafety levels 1:00:31 The missing models: no Mythos, no Kimi, no independent referee 1:07:04 Costin's prediction: owning frontier-class hardware will require a license 1:13:41 fast16 as a benchmark: Inside the Sol Searching research 1:26:51 Compression and altitude: are reverse engineers being replaced? 1:41:24 Finding the gem in 100 samples, and the swarm frontier 2:00:41 Claude Opus 5 drops, Gemini 3.5 Flash CyberLinks:Transcript Sam Altman: "We had a significant security incident" OpenAI and Hugging Face partner to address security incident during model evaluation ExploitGym: Can AI Agents Turn Security Vulnerabilities into Real Attacks? US politicians float 'AI Kill Switch' US lawmakers push for AI 'kill switch' after OpenAI models go rogue OpenAI Daybreak Jensen Huang debuts on X Jensen Huang: Open Weights and American AI Leadership Can Frontier Models Tackle Autonomous Long-Horizon Malware Analysis? fast16 — IDA Databases and Analysis Artifacts Kimi K3 - API Platform Introducing Gemini 3.5 Flash Cyber NSA and Partners Alert Zimbra Collaboration Suite Users of a Russian State-Supported Phishing Campaign Russian State-Supported Cyber Actors Conduct Phishing Campaign Targeting Users of Zimbra Collaboration Suite Proofpoint: TA488 Targets Zimbra Mailservers with Half-Click Exploits CISA: Iran Cyber Actors Exploit PLCs Across US Critical Infrastructure Iran War Cyber Threat Landscape - A Midyear Assessment Thinkst Canary