Three Buddy Problem

Hosted by Security Conversations

Technology Business Entrepreneurship NewsInterviews guestsExplicit

Website RSS feed

Episodes

248

Latest episode

Oct 2026

Language

EN-US

About the show

The Three Buddy Problem is a popular Security Conversations podcast that goes beyond industry talking points to discuss what others won’t -- nation-state malware, attribution, cyberwar, ethics, privacy, and the messy realities of securing computers and corporate networks. Hosted by three veteran security pros -- journalist Ryan Naraine and malware paleontologists Costin Raiu and Juan Andres Guerrero-Saade -- the weekly show attracts a highly engaged audience of security researchers, corporate defenders, CISOs, and policymakers. Connect with Ryan on Twitter (Open DMs).

Listen to episodes

60 recent

October 18, 20263 hr 26 min

Who's Hacking Supermarket Fridges in France?

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 116 : This week, the buddies dig into a mystery hack that cooked French supermarket fridges, cyberattacks against food supply networks, and why this smells like nation-state sabotage in Europe? Plus, a fresh Ivanti zero-day chain, Anthropic's self-replicating IoT research and defender-hostile guardrails, Citizen Lab's AdFection spyware-by-ads exposé, Calif's iPhone exploit drops at Hexacon, Grok's surprising enterprise adoption, and spy chips stuffed inside Ledger wallets. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Costin Raiu . Timestamps: 0:00 Introductory banter 1:35 Virus Bulletin 2026 in Seville 6:13 Conference roundup: State of Statecraft, Countermeasure, RE//verse 10:21 French supermarket fridges hacked 22:53 Hacking food supply and the attribution question 33:23 Who patches the fridge? 45:58 Ivanti Connect Secure zero-day chain 53:00 When an AI agent deletes your databases 1:04:34 NCSC edge-device forensics guidance 1:28:06 Anthropic's self-replicating IoT research 1:52:17 Why guardrails lock out defenders 2:04:57 Grok's enterprise play and agent sprawl 2:16:26 Citizen Lab exposes AdFection spyware via ads 2:57:24 Calif burns iPhone exploits at Hexacon 3:06:55 Ledger wallet implants and the grain of rice

October 12, 20261 hr 5 min

Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI's DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems. Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Katie Moussouris . Timestamps: 0:00 Intros at Offensive AI Con 1:00 OpenAI's DNS tunneling incident and slow monitoring 4:36 Treating AI like malware in a sandbox 9:01 The business model is the misalignment 13:37 Log4j, SBOMs and an NTSB for AI 18:00 Trading liability protection for honest disclosure 22:13 Accountability and "once you become aware" 26:18 The Australia notification timeline 28:19 A blank-check administration and the Anthropic phaseout 34:35 Powerful models in the right hands 38:42 Kill switch bills and regulatory capture 42:36 EU fines as a tariff on American tech 48:03 Reasons for optimism 54:13 Bring back "information security" 1:01:57 Katie's last word

October 12, 202654 min

NCSC's Ollie Whitehouse: 'The Biggest Correction of Technical Debt Ever'

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con: Ollie Whitehouse, CTO of the UK's National Cyber Security Centre, joins us to explain how Britain is preparing for an AI-driven patch wave and why the NCSC is pressing edge-device vendors to finally ship real telemetry. Plus, we dig into rogue AI agents wandering into a Five Eyes network, along with his forecast that small, capable models could revive self-spreading worms around 2030, all part of what he calls the biggest forced correction of technical debt the industry will ever see. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Ollie Whitehouse . Timestamps: 0:00 Live from Offensive AI Con: meet Ollie Whitehouse 2:46 Why the NCSC is a model for the US 6:48 What a "national technical authority" does 7:49 The Huawei analysis and the push for passkeys 10:50 Independent AI model testing 13:12 Open-weight vs. closed models and AI sovereignty 19:02 Capability density and AI worms by 2030 23:09 Robotics security and lessons from Japan 26:49 Preparing for the patch wave 31:06 Architecture fixes: OT, cross domain, privileged access 32:28 Telecoms security and Salt Typhoon 38:59 Minimum telemetry standards for edge devices 41:55 Market incentives and the EU Cyber Resilience Act 46:05 Rogue agents and the forced correction of technical debt

October 9, 202654 min

Aaron Grattafiori Explains How LLMs Hunt Patch Variants at Scale

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Umbriel AI's Aaron Grattafiori breaks down the new offensive-security playbook, using LLMs for patch variant analysis, why the vuln apocalypse hasn't become an exploit apocalypse, and how the death of security through obscurity puts closed-source binaries and firmware within reach. Plus, we discuss rogue agents escaping sandboxes, the eval-driven loop behind recursive self-improvement, and the brutal cost asymmetry that makes offense cheap and defense almost unaffordable. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Aaron Grattafiori . Timestamps: 0:00 Introductory banter 1:12 Umbriel AI pitch: "Smart people in a place to cook” 3:08 Weird, exhausting, exciting time in security 4:00 What AI really changed: speed (and a 30-minute reimplementation) 6:36 Incomplete fixes and the variant-analysis pipeline 9:21 Uplifting, abstraction, and representing vulnerabilities 11:48 Experimentation and the new shape of security companies 14:46 The vuln apocalypse vs. the exploit apocalypse 16:36 Triage, verification, and reward hacking 18:08 Do models reintroduce bugs? Is vuln-free code possible? 24:22 Specialized models and the rise of Jev-style classifiers 26:47 Binaries, firmware, and the death of security through obscurity 31:15 Open source as a requirement and corporate contracting 33:54 Rogue agents: Hugging Face, OpenAI, and lab escapes 39:17 Why defense is so expensive, and running the rig

October 9, 20261 hr 37 min

Joel Todoroff on How Offensive AI Is Rewiring Western Government Ops

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Former US intelligence and national security official Joel Todoroff joins us live from OffensiveAIcon to explain why his new startup Phyle is building AI for the recon and targeting work that happens long before anyone fires an exploit. We get into bribable sysadmins, the military framing that boxes in Western cyber operations, letters of marque, AI doomerism, and what happens when a frontier model decides mid-project that your use case is off-limits. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Joel Todoroff . Timestamps: 0:00 Live from OffensiveAIcon in Oceanside 1:23 What Phyle builds for governments 3:02 Skepticism of the AI 0-day factory 5:57 Paying a sysadmin vs. burning tokens 9:30 Recon gets less love than weaponization 12:41 Exploit shelf life and target No. 1,000 17:30 Why attacker costs will keep rising 22:23 What HUMINT looks like in 2026 27:06 Why intelligence stovepipes persist 32:16 Cyber as statecraft beyond the military frame 41:23 People will keep making dumb mistakes 48:03 The White House memo and letters of marque 54:06 Doomerism vs. near-term AI harms 1:04:20 PSOA concerns and building guardrails in 1:26:03 Open models, guardrails and zero data retention

October 7, 20261 hr 8 min

Valentina Palmiotti (chompie) on Vulnpocalypse, Matching Mythos on a Budget

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem x Offensive AI Con : Live from OAIC, IBM X-Force's Valentina Palmiotti (chompie) walks us through the autonomous Windows kernel exploit pipeline she built on older Claude models, which landed within a hair of Mythos for about $180 a chain. Plus, the Pwn2Own bug Claude called unexploitable, why her Pwn2Own bugs still sit unpatched, disappearing exploit techniques, the dread of being a defender, and how Phrack found its way back into print. Timestamps: 0:00 Intro and Pwn2Own war stories 3:46 What vibe hacking means 8:16 When long agent runs go sideways 10:31 Self-verification in an n-day kernel pipeline 16:11 Matching Mythos for $180 a chain 18:42 The bug Claude called unexploitable 21:49 Unpatched bugs and the defender gap 25:37 Mythos arrives through CVP 27:00 Models only know public techniques 32:01 Testing models on held-back bugs 37:45 Inside chompie's daily workflow 46:07 Where's the exploitpocalypse? 50:07 Pixel drops MTE 53:40 Advice for defenders: design for containment 58:34 Phrack is back

October 2, 20262 hr 33 min

Why is Anthropic Afraid of GLM 5.3?

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 115 : We into Anthropic's Frontier Red Team fear-mongering on Zhipu's open-weight GLM 5.3 model and wonder why the AI labs' cyber programs do so little for defenders. Plus, Citrix NetScaler zero-days, a new iOS zero-day tied to WhatsApp, AI agents that act on your behalf, and whether security teams should buy DGX Sparks to run models locally. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Costin Raiu . Timestamps: 0:00 Introductory banter, TLPBLACK 3:38 OffensiveAI Con and the missing defensive con 9:28 Anthropic's GLM 5.3 post 23:21 What do defensive AI coalitions do? 29:08 Inside Glasswing 36:01 Why can't vuln-finding models patch? 42:44 Gemini for Argon and Grok's CVE-Bench tie 47:54 Is hallucination a solved problem? 57:41 Zhipu's program and 4,000 zero-days 1:02:32 Citrix NetScaler zero-days 1:10:42 Half-days and automated patching 1:26:45 iOS 27.0.1 zero-day and WhatsApp 1:32:36 Dots, Instinct and agent monetization 1:52:06 DGX Spark 64GB and local AI hardware 2:18:38 Anthropic visits the Pope, then UFOs

September 25, 20262 hr 16 min

Kernel Exploits in the iOS App Store, ShinyHunters Inside the FBI

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 114 : We dig into TypeSafe AI's Jev and the new class of System One models, a new Transluce report on rogue OpenAI agents probing an Australian Medicare portal, Irregular's role in the latest Gemini test breakout, Hacktron's takeover of OpenAI employee accounts and the messy disclosure fight that followed, and what Costin would fix first as OpenAI's CISO for a day. Plus, the soaring price of DGX Sparks and home AI rigs, the White House pressing labs to hold models back from the UK AI Security Institute, Anthropic bringing in Accenture as an evaluator, the FomoPeek App Store app hiding iOS kernel exploits, ShinyHunters' claimed FBI breach, and Nightmare Eclipse going public with identity and a CrowdStrike exploit. Cast: Ryan Naraine , Juan Andres Guerrero-Saade and Costin Raiu . Timestamps: 0:00 Introductory banter 1:57 The Last LABScon wrap-up 9:35 TypeSafe AI's Jev and System One models 26:18 Step-down transformers and lab economics 30:58 Rogue OpenAI agents and the Transluce report 41:40 Irregular and Gemini's test breakout 49:28 Hacktron's OpenAI hack and the disclosure fight 54:57 Costin as OpenAI CISO for a day 1:05:44 Hugging Face defends itself with GLM 5.2 1:17:08 What a home AI rig costs now 1:30:02 White House vs. UK AISI pre-release testing 1:36:52 FomoPeek kernel exploits in the App Store 1:51:19 ShinyHunters claims an FBI breach 2:02:40 Nightmare Eclipse unmasked

September 11, 20262 hr 37 min

AI Doomers, Death Cults, and a Million-Dollar WeChat Worm Exploit

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 113 : On the show this week, the buddies dig into an Anthropic researcher quitting with a warning that AI could kill us all, the San Francisco "death cult" and their motives, and agent swarms leaving junk on public wikis and university URL shorteners. Plus, a high-quality Anthropic's threat report and the claim that Moonshot was quietly serving Claude tokens as Kimi K3, live MikroTik and Chrome zero-days that landed a day ahead of the patches, and a WeChat worm that hijacks an account via phone calls. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Costin Raiu . Timestamps: 0:00 Introductory banter, TLP Black 5:05 LabsCon, the last one, and JAGS on his keynote 8:24 Costin's agentic CTI training and what old-school CTI is missing 16:27 Anthropic's threat-intel report + IOCs 20:00 APT29 and DarkSword on hotel Wi-Fi 23:34 Bioweapons, guardrails, and what got shut down 28:07 Why is anyone running these attacks on Claude at all? 35:53 Distillation at industrial scale and the Kimi K3 fraud claim 48:43 Chinese models, Americanized, running on DGX Spark 55:00 Mr. America: local AI and the seven-layer cake 1:04:34 Should frontier AI labs poison the distillers? 1:27:05 What the frontier labs did to the security ecosystem 1:34:22 Jacob Coxon quits, and the doomer argument falls apart 1:59:13 Agent swarms littering the internet 2:07:29 Chrome zero-days, MikroTik, patch-gaps

September 4, 20262 hr 7 min

Three Secret AI Civilizations Rose and Fell. Nobody Checked the Logs.

( Presented by TLPBLACK : A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals. ) Three Buddy Problem - Episode 112 : The 'OpenAI hacks Hugging Face' fallout has turned into a story about AI civilizations rising from the ashes, politicians calling for super-intelligence bans, and the emergence of well-funding non-profits doing AI safety work. Who are these people and what's their security expertise? Plus, GPT-6 Astra lands in a trusted-access program nobody can get into, Costin ranks the local models he runs next to his desk, and CrowdStrike sinkholes a botnet that's been alive since 2003. Cast: Juan Andres Guerrero-Saade , Ryan Naraine and Costin Raiu . Timestamps: 0:00 Introductory banter 1:02 Conference season: LabsCon, Offensive AI Con, Countermeasure 5:40 The Hugging Face story hits the front page 7:04 Dwarkesh, Greenblatt, and the AI-pilled framing 11:51 Swap "agents" for "Python" and the panic goes away 16:34 Does anyone actually know what happened? 21:18 Bernie Sanders wants to ban superintelligence 34:03 Defending against swarms: the 2026 SOC 39:15 Logs, Splunk, and the business model in the way 44:11 What EDR vendors are actually building with AI 56:16 The security poverty line and the endgame 1:07:53 GPT-6 Astra, Fable 5.1, and local model rankings 1:27:25 Google's Fairwind, CodeMender, and agents running Linux 1:45:31 Apple's bet on local inference 1:53:21 The Sality takedown and endgame advice