Adversarial Podcast S4E01 - Trump's AI Action Plan, Chip Security Act, receiving gifts from vendors
The Adversarial PodcastShow Notes
00:00 Introduction & BlackHat 03:14 AI Action Plan Overview 13:30 Chip Security Act 20:48 Government led AI-ISAC? 23:16 UK government considering banning public sector ransomware payments 28:14 Microsoft probing if Chinese hackers learned SharePoint flaws through alert 42:07 Ethics in Vendor Relationships – Gifts for meetings
America's AI Action Plan “America’s AI Action Plan,” released by the Trump administration, outlines a roadmap with over 90 federal actions across three pillars—accelerating AI innovation, building U.S. AI infrastructure, and asserting international AI leadership through exports and technology alliances.
The Chip Security Act: A Bipartisan Solution to Chip Smuggling The Chip Security Act, introduced by U.S. lawmakers, mandates that export‑controlled AI chip makers (like NVIDIA) embed on‑chip location‑verification mechanisms to ensure devices go only where they’re authorized—aiming to deter smuggling (especially to China) without deploying intrusive GPS or kill switches.
Why a Government-Led AI-ISAC is a Missed Opportunity Errol Weiss argues that an AI‑ISAC led by the U.S. government, as proposed in the July 2025 White House AI Action Plan, represents a missed opportunity, because government-led initiatives tend to be bureaucratic, slow, less innovative, struggle to win private-sector trust and buy‑in, risk duplicating existing ISAC efforts, and may be perceived as politically biased—undermining effective, rapid, cross-industry intelligence sharing
UK plans to ban public sector bodies from paying ransom to cyber criminals The UK government is set to ban public sector bodies and operators of critical national infrastructure from paying ransom demands to cyber criminals, as part of a wider package also mandating mandatory reporting for other organisations planning to pay, aimed at dismantling the ransomware business model and protecting essential services from dangerous disruptions.
Microsoft probing if Chinese hackers learned SharePoint flaws through alert, Bloomberg News reports Microsoft is investigating whether a leak from its Microsoft Active Protections Program (MAPP)—which provides early vulnerability alerts to security partners—may have enabled Chinese-aligned hackers (Linen Typhoon, Violet Typhoon, and Storm-2603) to exploit critical zero‑day flaws in on-premises SharePoint servers before Microsoft fully patched the software, fueling a global espionage and ransomware campaign.
Hosts: Jerry Perullo (Founder, https://adversarial.com/) Sounil Yu (Founder, https://www.knostic.ai/) Mario Duarte (Founder, stealth startup) Producer: Tillson Galloway (https://tillsongalloway.com)
More from The Adversarial Podcast
Jerry, Sounil, and Mario debate what happens when attackers can move from vulnerable data centers to everyday devices—and whether defenders can ever patch their way out of the problem. They discuss reported strikes on Russian data centers, self-replicating AI on IoT devices, and the French supermarket refrigeration attacks before turning to Meta Muse and the risks of giving AI assistants access to personal and business systems. Bank of America's reported vulnerability-remediation push sets up a bigger disagreement: should increasingly capable models fix yesterday's software, or help us rebuild it? Stories and resources Yandex data center strikes — Le Monde Self-replicating AI on IoT devices — Anthropic French supermarket refrigeration attacks — BleepingComputer Meta Muse and private messages — Jason Aten, Inc. Bank of America’s Mythos remediation effort — IT Pro Google’s open-source bug-bounty pause — TechCrunch Chapters 00:00 Opening 00:24 Welcome and upcoming events 01:52 Russian data centers and critical infrastructure 03:50 Self-replicating AI and adaptive worms 09:27 IoT exposure and ISP defenses 11:51 French supermarket refrigeration attacks 17:20 Security products versus reducing exposure 19:18 Meta Muse and the AI assistant trust problem 24:09 Notification leakage and limits on agent access 28:30 Content policies and AI use by children 30:08 Bank of America and the remediation backlog 34:20 Bug bounties and the economics of finding flaws 35:31 Patch the application or rebuild it? 41:40 Where AI security investment should go 44:57 Process knowledge and model-specific workflows 48:33 Descriptive versus prescriptive guidance 51:12 Standards, diversity, and software complexity 57:25 Continuous rebuilding versus code freezes 59:43 Wrap-up Hosts: Jerry Perullo (Founder, https://adversarial.com/) Sounil Yu (Founder, https://www.knostic.ai/) Mario Duarte (CISO, https://www.whirlai.com/) Producer: Tillson Galloway (Founder, http://githoundexplore.com/)
Jerry, Sounil, and Mario debate what AI should change—and what it shouldn't—in education, cybersecurity, and software maintenance. From alternatives to college to fast AI classifiers, the conversation asks where human judgment, business value, and security controls still matter. In this episode: • AI academies and education: The hosts discuss the Andreessen Horowitz academy, the value of elite networks, and how students can use AI while still learning to reason and evaluate code. • Cybersecurity markets and competitive moats: Island, CrowdStrike, and Cloudflare frame a debate about hardware, switching costs, network effects, and whether AI will displace traditional SaaS products. • Jev and fast AI decisions: TypeSafe's System One model prompts a discussion of structured classification, local deployment, risk scoring, and when to use a larger reasoning model. • Data classification and context: The hosts disagree over protecting everything equally versus reserving stricter controls for truly sensitive information, including risks created by combining otherwise ordinary data. • Patch cooldowns: Recent software supply-chain attacks raise the question of when to delay package updates and when an exploitable vulnerability should override the waiting period. Chapters 00:00 Cold open and introductions 01:52 AI startups, hardware, and manufacturing 04:40 AI academies and the future of education 24:51 Cybersecurity markets and competitive moats 37:22 Jev, System One models, and data classification 51:36 Risk scoring and fast versus slow AI 56:00 Patch cooldowns and security exceptions 1:04:49 Wrap-up and upcoming events
Jerry, Mario, and Sounil ask whether AI will create unprecedented prosperity—or simply transfer wealth and power from knowledge workers to capital owners. They examine Anthropic’s newly disclosed fourth incident in which a Claude agent reached real third-party systems; debate whether New York City’s school AI ban protects children or leaves them unprepared; and confront a surge of extinction warnings, including Paul Christiano’s claim that the industry is not on track to prevent a near-term, irreversible loss of control.
Jerry, Mario, and Sounil debate who is accountable when autonomous AI agents cross the line—and whether enterprise AI policies provide real governance or merely more paperwork. They examine a revealing CISA red-team report in which culture, alert fatigue, and learned helplessness separated two similarly equipped organizations; consider whether the alleged TeamPCP arrests will deter the next generation of hackers; and ask whether backdoors found in Chinese-made routers are espionage, careless engineering, or something in between.
00:00 Cold Open: The Offensive-Cyber Incentive Problem 00:31 Welcome and the macOS Screen Sharing Flaw 03:14 Patching the Humans After DEF CON 12:14 CMDBs, Shadow IT, and Just-in-Time Context 19:59 Cloudflare’s Markdown for Agents 23:47 Taiwan’s Live Internet-Throttling Drill 33:46 Can an AI Agent’s Own Logs Be Forensic Evidence? 38:57 Cyber Privateers and the New Offensive-Cyber Program 43:32 How Commercial Hack-Back Might Work 51:48 The Rogue Delta Wi-Fi Network 57:33 AI Red Teaming and Automated Remediation 59:09 Replacing Vendor Questionnaires with Real Testing 1:02:05 When Red Teaming Creates Defensive Bloat 1:03:46 Pen Tests Find Flaws; Red Teams Pursue Outcomes 1:06:25 Closing Thoughts