Show Notes
In this episode of AI Security Ops, the team tackles one of the most common questions security teams are asking about open-weight AI models: Are foreign open-weight models actually a security risk? Not in the vague “AI is scary” sense. Not in the headline-driven “it must be spyware” sense. But in the practical, security-operations sense: if you download a model like Qwen or DeepSeek and run it locally, what risks are real, which ones are overblown, and what should defenders actually care about? The answer is more nuanced than “ban them” or “they’re totally fine.” Open-weight models can be cheap, capable, and private when they run on your own hardware. But “open-weight” does not mean “open source,” and running a foreign model locally does not automatically mean it is phoning home. The bigger risks are often in the runtime, file format, download source, tooling chain, model behavior, and how much trust you place in the output. We dig into: - What “open-weight” actually means, and why it is not the same as open source - Why the “phone home” fear is usually the wrong threat model for local weights - The difference between a hosted AI service and a locally run model - Why model delivery, runtime, and tooling matter more than the weights themselves - How pickle files, unsafe formats, and poisoned packages create real supply-chain risk - Why typosquatting and fake model repos are a practical concern - Why safetensors and verified sources matter - How bias and censorship can show up in foreign and domestic models - Why model behavior, refusals, and blind spots can become integrity risks - What sleeper-agent research tells us about hidden triggers and model backdoors - Why country of origin matters, but does not replace basic security hygiene - How to safely evaluate and use open-weight models in real workflows This episode explores a critical shift in AI security: the risk is not just where a model comes from. It is how you download it, how you run it, what data it can access, what actions it can take, and whether your pipeline assumes the output is trustworthy. For security teams, the practical takeaway is simple: do not treat any model as inherently safe just because it runs locally, and do not treat every foreign model as magic spyware. Build the workflow so the model can be useful without becoming a single point of trust. — Key Concepts & Topics Open-Weight Models - Local model weights and inference engines - Open-weight versus open source - Qwen, DeepSeek, and foreign model adoption Threat Modeling - Local models versus hosted AI services - The difference between weights, wrappers, and APIs - Why “phoning home” is usually a runtime or tooling issue Supply-Chain Risk - Unsafe model formats - Pickle files and arbitrary code execution - Typosquatting and poisoned repositories - Package and dependency compromise Safer Model Handling - Prefer safetensors over risky serialized formats - Download from verified sources - Pin hashes and validate model artifacts - Use containers and restrict unnecessary network access Bias and Censorship - Model behavior shaped by training data - Political, cultural, and regulatory influence - Refusals, blind spots, and subtle output bias - Matching model behavior to the use case Sleeper Agents and Backdoors - Hidden trigger behavior in model outputs - Why behavioral testing may miss certain risks - The difference between lab demonstrations and real-world evidence - Designing workflows so hidden triggers have limited impact Defensive Strategy - Treat model output as untrusted input - Do not pipe outputs directly into shells, databases, or production systems - Avoid unsupervised code execution or autonomous production access - Make adoption decisions based on threat model, compliance, and use case Learn more about Black Hills Information Security: https://www.blackhillsinfosec.com/ Check out Antisyphon Training: https://www.antisyphontraining.com/ #AISecurity #CyberSecurity #LLMSecurity #ArtificialIntellige
More from AI Security Ops
In this episode of BHIS Presents: AI Security Ops, the team digs into some of the strangest recent examples of AI behaving badly. An AI agent finds a way around its sandbox using DNS. Malware asks four different AI models what it should do next. Attackers overwrite an AI agent’s “soul.” And a placeholder domain buried across GitHub becomes an unexpected security risk. Funny stories? Absolutely. But underneath them are some very familiar security problems. We dig into: - An OpenAI agent finding an unexpected path out through DNS - Whether a 2.5-hour response is fast enough in the age of AI - CLOSEDQUORUM malware using multiple AI models to make decisions - Why outbound AI API traffic could become a useful detection signal - The Carbonado botnet rewriting an agent’s SOUL.md instructions - The risks of exposed Docker daemons - How an unreserved placeholder domain can become an attack vector - Why AI agents make old security mistakes more consequential The takeaway: none of these techniques are particularly new. DNS tunneling, exposed services, compromised configuration files, and untrusted domains have existed for years. AI just gives attackers — and occasionally AI agents themselves — new ways to find and exploit those boring gaps at greater speed and scale. 2026-09-29-News (1).docx (00:00) - Intro: AI Behaving Badly
In this episode of BHIS Presents: AI Security Ops, the team continues its breakdown of the OWASP Agentic Skills Top 10, covering risks six through ten. Agentic skills may look like simple instructions, but they operate inside AI systems with access to tools, files, networks, and other resources. So what happens when those skills aren’t isolated, verified, monitored, or governed? We dig into: - AST06: Weak Isolation - AST07: Update Drift - AST08: Poor Scanning - AST09: No Governance - AST10: Cross-Platform Reuse - Why sandboxing the agent isn’t the same as isolating individual skills - The security tradeoffs between automatic updates and outdated skills - Why traditional scanners struggle with malicious instructions written in plain English - The importance of maintaining an inventory of agentic skills - How security controls can disappear when skills move between platforms The takeaway: securing agentic skills requires more than checking them once before installation. Organizations need visibility into what skills are running, what they can access, how they change, and whether their security controls survive across environments. OWASPAgenticSkils-Part2.docx This is Part 2 of our look at the OWASP Agentic Skills Top 10, covering AST06 through AST10. Part 1 can be found here #AISecurity #CyberSecurity #AgenticAI #AIAgents #OWASP #LLMSecurity #InfoSec #BHIS #Antisyphon
In this episode of BHIS Presents: AI Security Ops, the team tackles a big question: Could AI actually take over the internet? Recent warnings from AI industry leaders have raised concerns about autonomous agent swarms escaping containment, compromising systems, and operating at a scale humans may struggle to match. But what would “taking over the internet” actually require? The team looks at the problem from a hacker’s perspective — examining compute requirements, persistence, botnets, vulnerable infrastructure, the recent Hugging Face incident, and the difference between AI acting autonomously and humans using AI to accelerate attacks. We dig into: - Whether an autonomous AI swarm could realistically operate at internet scale - What the Hugging Face incident actually tells us about agentic security - The compute and infrastructure required to sustain a rogue agent swarm - How botnets and compromised systems could change the equation - Why existing vulnerabilities may be a bigger concern than hypothetical AI takeover scenarios - Whether slowing frontier AI development actually addresses the cybersecurity problem - The difference between AI exhibiting dangerous behavior and AI having intent - Why defenders need to focus on their real-world attack surface today The takeaway: AI is dramatically increasing the speed and scale of cybersecurity operations, but powerful models still operate inside systems designed, deployed, and connected by people. The immediate security question may be less “Will AI take over?” and more “What are we giving AI access to?”
In this episode of BHIS Presents: AI Security Ops, the team breaks down the first five risks in the OWASP Agentic Skills Top 10 (Part 1). Agentic skills can give AI systems reusable instructions, workflows, and capabilities — but they also introduce a new attack surface. A skill may look like a simple markdown file, yet the agent following those instructions could have access to your filesystem, credentials, network, shell, or other sensitive resources. We dig into: - AST01: Malicious Skills - AST02: Supply Chain Compromise - AST03: Overprivileged Skills - AST04: Insecure Metadata - AST05: Untrusted External Instructions - Why skills should be treated more like software than configuration - How excessive permissions increase an agent’s blast radius - Why external content creates indirect prompt injection risks - How isolation, least privilege, and trusted sources can reduce risk The takeaway: “just markdown” isn’t necessarily harmless when an AI agent can act on what it reads. This is Part 1 of our look at the OWASP Agentic Skills Top 10, covering AST01 through AST05. — Learn more about Black Hills Information Security: https://www.blackhillsinfosec.com/ Check out Antisyphon Training: https://www.antisyphontraining.com/ (00:00) - Intro: OWASP Agentic Skills Top 10, Part 1
Agentic skills can make AI agents more capable and consistent—but they can also introduce serious security risks. This episode explains how skills work, why malicious skills rank as a leading OWASP concern, and how seemingly harmless Markdown instructions can enable credential theft, remote payload delivery, and manipulated recommendations. Real-world examples illustrate how malicious skills can evade scanners and exploit trusted marketplaces. The episode concludes with practical safeguards, including reviewing skill files, watching for external instructions and prompt injection, pinning versions, limiting permissions, and running agents inside isolated environments. Links: OWASP Agentic Skills Top 10 Malicious AI Agent Skill Bypasses Security Scans and Seizes Full Control of Over 26,000 Agents (00:00) - Agentic Skills and the OWASP Top 10