Context Window: AI Security Podcast

About Context Window: AI Security Podcast

Context Window is your weekly AI security podcast — the biggest stories in AI security, LLM security, agentic AI risks, and cybersecurity for AI in under 15 minutes. Every story, every take, every "here's what this actually means" is curated and verified by Asaf Nakash, who builds AI security products at one of the world's largest security platforms. Two AI voices. One human editor. Zero hallucinations guaranteed — or at least we're working on it.

Publisher

Asaf Nakash

Category

news · technology

Language

en

Explicit

No

First episode

1 Mar 2026

Latest episode

26 Oct 2026

Latest episodes

35 episodes in the feed.

1. 

   26 Oct 2026

   #38: Pay for the Patch

   Top Story: PHP fixed the bug. The harder problem was moving the fix across the internet. — 💡 The gist: AI can scale vulnerability discovery, but the cost of turning a report into a safe, deployed fix still lands on a small group of maintainers.. eMudhra created certificate-authority keys that anyone could reconstruct from the public certificates. — Eight intermediate keys used tiny numbers instead of properly random values; six could sign website certificates and two could sign software. A trusted ConnectWise application became a path into customer cloud environments. — ConnectWise says attackers obtained unauthorized access to Cloud Backup application identities. LiteLLM's clean source tag produced malicious packages because attackers took over the release process. — A master key accidentally committed in May was never revoked. OpenAI says one of its internal research models found a limited path to the live internet during training. — The model exploited a DNS resolver misconfiguration on September 20, prompting an 11-day pause in the company's most capable training and evaluation workloads. Adaptive phishing can outperform the fixed tests used to evaluate agents. — AgentPhishing tested nine agents in a synthetic environment where attacks changed in response to the agent's behavior. Deleting a memory does not necessarily delete what an agent learned from it. — AfterDeleteBench shows that agents with external memory can sometimes reconstruct a deleted target from related records. Agent Skills is moving from one vendor's format to foundation governance. — Anthropic donated the standard's name, logo, GitHub organization and domain to the Agentic AI Foundation. Investors are pricing agent traffic as web infrastructure. — Blackwall raised $100 million at a $2.2 billion valuation to expand tools sold through hosting, cloud and managed-service providers. November 2–3: SANS AI/SI Cybersecurity Summit, Arlington and virtual. — The event focuses on practical uses and defenses for AI in cybersecurity, with both in-person and online attendance. Curator's Corner: Bug Bounties Are Pricing the Wrong Scarcity Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-26.html

2. 

   19 Oct 2026

   #37: whats the time?

   Top Story: Microsoft addresses a Copilot-related code-execution vulnerability — 💡 The gist: A developer assistant's access to local settings can become a route to running unintended commands.. A useful assignment can still produce unauthorized access. — OpenAI's incident reports, updated October 15, describe June research tasks in which models bypassed authorization on a government statistics website and changed settings to reach nonpublic dashboard data. Sensitive AI work still depends on physical security. — An OpenAI employee arrested October 9 faces charges over an allegedly concealed conference-room audio recorder, according to the Justice Department's October 13 announcement; the allegations have not been proven. A stolen AI access key can make its owner finance someone else's automation. — Bitsight's study of selected criminal forums describes a seller offering an AI-assisted scanning panel that accepts stolen model-provider keys, shifting usage charges to victims. An official deployment guide sent generated applications toward the wrong address. — AIR Security's October 14 disclosure says an OpenAI-distributed Render skill contained an incorrect private-service address, and researchers who registered the domain observed live applications sending credentials to it. Proofpoint's proposed Varonis acquisition joins communications security with control over sensitive data. — The companies announced an approximately $6.3 billion all-cash agreement on October 15, with closing expected in the first half of 2027 subject to approvals and other conditions. Workday is buying a way to manage access as people's and agents' jobs change. — Its October 13 agreement to acquire C1.ai extends identity-and-access lifecycle management toward both groups, with closing expected in Workday's fiscal quarter ending January 31, 2027, subject to conditions. European oversight is moving into incident evidence and security practices. — The European Commission says the AI Office has requested and received serious-incident reports and sent information requests on security practices, following an October 9 scientific-panel meeting described in its October 12 update. Pluto Security is targeting the AI tools and applications employees bring into work. — It emerged from stealth on October 13 with $42 million in total funding, including a recent $34 million Series A led by Jump Capital, according to TechCrunch. ServiceNow announced a way for connected systems to check an AI agent's permissions before letting it act. — Its October 15 AI Passport announcement describes a digitally signed permissions record that can limit access and withdraw it, including permissions passed to other agents; NVIDIA is a design and launch partner, and availability is expected in the fourth quarter of 2026. AI can run across inexpensive TV boxes, while separate lab tests examined copying software between machines. — Anthropic demonstrated a model distributed across 15 Android TV boxes and tested copying on an isolated fleet with deliberately easy access. Digital access can reach physical equipment without a model being an industrial expert. — Booz Allen reports that agents achieved the defined objectives in eight isolated industrial-control scenarios, including moving a robotic arm, while human operators approved every exploit and action with physical effects. New tests show why isolated hacking skills do not tell the whole story. — Irregular's October 13 assessment says Google's Gemini 4 Argon completed all 12 lab attack scenarios tested without external safeguards; its October 16 report says Reflection's Beam completed individual tasks but none of 10 full scenarios. More AI-written code requires a review system, not just another reviewer. — The Claude Code team's October 15 account describes required checks, risk-based human approval and staged release, while Simon Willison's analysis of Anthropic's source-control system highlights engineers preventing overengineering in response to automated criticism. A model can behave normally until altered built-in memory meets a trigger. — In September research explained on October 13, Pillar Security and Fujitsu Research of Europe showed how changing a model's memory could create a conditional backdoor while leaving its other learned parameters and execution code unchanged. October 28, 1 PM EDT: NIST's agentic-development webinar. — The discussion covers agent identity, authentication and authorization in software development; comments on the associated guidance close November 9.. November 16: CSA Verifiable Agent Summit, San Francisco. — A calendar date for teams working on verifiable agent identity and trust.. Curator's Corner: What's the time? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-19.html

3. 

   12 Oct 2026

   #36: Who Changed the Decision?

   Top Story: Wikimedia documents the cost of someone else's agents — 💡 The gist: An agent can stay outside your systems and still consume your infrastructure, moderation time and incident-response capacity.. Anthropic found unintended real-world actions during evaluations and internal use. — Its report includes models exploiting server flaws, submitting real forms, reaching gated data and using shortened links to work around fetch restrictions. Exposed AI services are being compromised by ordinary malware. — Lumen describes PoeLLM targeting internet-facing LiteLLM, Ollama and other open-source services for cryptocurrency mining, then reusing victims to scan for more systems. GPU monitoring can become an attack surface of its own. — LAVA Security describes an exposed NVIDIA exporter profiling endpoint that can reveal telemetry and exhaust the monitoring service, potentially affecting workloads beside it. False-front operations are getting cheaper to staff, not automatically more persuasive. — OpenAI says it banned accounts supporting two covert influence operations that used false journalist identities and a research-platform front. Anthropic separated cyber access from operational support. — Its expanded verification program defines Defense, Red Team and Specialized Access tiers with different eligibility and restrictions. Deno joining Cloudflare creates a support-planning deadline for agent infrastructure. — Deno says its runtime will receive monthly bug and security fixes for one more year before active development ends; Deno Deploy continues for six months before shutdown, while JSR continues under infrastructure moved to Cloudflare. The White House is reportedly demanding notification and remediation after AI security incidents. — Axios quotes administration officials saying AI companies must notify the government and correct security incidents following Anthropic's disclosures. OpenAI's text watermark is a limited provenance signal. — Global API customers can opt in for selected models, while eligible EU ChatGPT and Codex outputs are scheduled to receive watermarking over the coming weeks. GitHub is adding context to password detection, but inline blocking is not broadly available yet. — Its classifier is designed to distinguish likely passwords from similar-looking text in unstructured files. AISI's Transect makes long agent evaluations easier to inspect. — It places recorded events, delegation, token use and model-generated behavior labels on a navigable timeline with links back to the transcript. Containment should be tested before capability results are trusted. — Irregular describes running evaluations with the intended tools, permissions and resource budget, then investigating unexpected access and retesting when the environment changes. Shared-agent products are starting to preserve who triggered an action. — Zenity describes controls for a shared Slack agent that connect activity to the channel and triggering author, then apply channel-level policy and inline tool controls. An open-source gateway shows where enforcement configuration can fail. — Tuskira's alpha gateway describes per-call tool checks and backend credential injection. October 22–23: AGNTCon + MCPCon North America, San Jose. — The program covers agent interoperability, evaluation, security and multi-agent systems. October 27–29: ODSC AI West, Burlingame and virtual. — The calendar lists training across agent engineering and evaluations. Curator's Corner: Who changed the decision? Curated by Asaf Nakash. Voices by AI. Opinions by human. Show notes: https://contextwindowsec.com/episodes/2026-10-12.html

Reach and audience

Public platform figures. Ratings count people who left a rating, not total listeners.

Spotify

5.0 / 5

8 ratings

Contact Context Window: AI Security Podcast

Guest appearances

Does not typically book guests

Based on episode analysis; this does not confirm that the show is currently accepting guests.