dr.chaos
Adversarial AIPodcast

Podcast: Project Glasswing and Agentic AI loops

Aamir Lakhani1 min read

Click here to listen on SoundCloud: https://soundcloud.com/drchaos-podcast/project-glasswing-podcast

In this week's episode of the Dr. Chaos Podcast, hosts Anthony Giandomenico (Tony G) and Aamir Lakhani (Dr. Chaos) dive deep into the rapidly evolving landscape of AI in cybersecurity. We are officially witnessing a massive shift: AI is moving beyond its role as a simple conversational assistant and stepping into the realm of fully autonomous agents.

Tony and Aamir break down the implications of "Agentic AI loops" and discuss what happens when AI can autonomously generate test cases, find vulnerabilities, and mutate attacks without human intervention. The duo also explores the alarming—and exciting—capabilities of frontier models, with a specific focus on Anthropic's leaked "Project Glasswing" preview, which reportedly demonstrated an AI's ability to exploit systems and even break out of sandboxed environments.

Aamir Lakhani

Founder · Dr. Chaos

Aamir Lakhani is a leading senior security strategist responsible for providing IT security solutions to major enterprises and government organizations. He creates technical security strategies and leads security implementation projects for…

Share:X / TwitterLinkedInBlueskyMastodonHacker News

~/related

Keep digging

More research along the same attack path.

Adversarial AIPodcast

Podcast: AI Agents and the New Insider Threat

Check out our companion blog at: https://www.drchaos.com/post/the-agentic-shift-architecting-for-the-crisis-of-authenticity-and-industrialized-cybercrime-in-2026Join our latest podcast. We explore the transformative impact of AI on insider threat dynamics. Learn about how AI agents manipulate system

Aamir Lakhani1 min read
Adversarial AI

Your API Key Was Someone Else's Credit Card: The OpenCode Console Breach

OpenCode called it a "large scale distillation attack." The victims called it an overnight bill. What happened to OpenCode Console users' stored OpenAI, Anthropic, and Google keys, why a hosted key store changes the blast radius, what "distillation" can and cannot mean here, a twenty-minute key lockdown for each provider, and what anyone building a bring-your-own-key console should change.

Aamir Lakhani12 min read
Adversarial AI

ATT&CK Finally Has a Name for Prompt Injection. Now Write the Detection.

MITRE ATT&CK v20 adds five AI techniques to the Enterprise matrix: Direct and Indirect Prompt Injection under Execution, AI-Enabled Exfiltration, AI Result Poisoning, and Impair Autonomous Defenses. Why the placement matters more than the count, what the direct versus indirect split means for your trust boundaries, how MITRE's exfiltration analytic actually works, and the detection gaps you should know about before your next coverage report.

Aamir Lakhani12 min read