Show Notes
Claude Mythos has people worried that AI will help attackers as much as defenders. Eran Medan, CTO of Arnica, talks about what the release means for cybersecurity and the simple steps vibe coders can take today to protect their apps. In this episode: Why Eran wants to see the CVEs and peer reviews before trusting the Mythos results, since a Berkeley study showed benchmarks can be gamed. How the Axios supply chain attack started with social engineering, and how an AI coding tool could still install the bad version during the three hours it was live. Two npm and pnpm settings that Eran says stop 99% of supply chain attacks: block install scripts unless you allow them, and wait 24 hours to seven days before taking new package releases. When a CLI plus a clear skill file does the job better than an MCP, and when an MCP's tighter permissions make sense (like sandboxes or untrusted data). A starter security checklist for vibe coders: run the built-in security review in Claude Code or Cursor, use DepsGuard, add security rule files, and talk to a professional before you go to production. Guest: Eran Medan, CTO, Arnica Arnica: https://arnica.io DepsGuard (free, open source): https://depsguard.com Chapters 00:00:00 What Claude Mythos means for security 00:04:20 AI guardrails and defenders 00:08:16 Why benchmarks need a second look 00:15:55 AGI and keeping humans in the loop 00:22:45 Phishing and social engineering risks 00:26:36 How the Axios attack worked 00:28:03 Simple settings that block supply chain attacks 00:39:04 Why CLIs often beat MCPs 00:50:27 Career advice for young builders 00:56:09 Security checklist for vibe coders Episode page: https://webtalk.show/episodes/074-are-we-ready-for-claude-mythos-a-cybersecurity-ctos-perspective/ Hosted by Armando J. Perez-Carreno. Learn more at https://perezcarreno.com
More from The Web Talk Show
Most people use AI in a chat window that forgets everything when the session ends. Always-on agents like Grokbot keep working between conversations, and they hand tasks to each other.In this solo episode, Armando explains why long chats get worse as the context window fills up, how tools like OpenClaw and Hermes first made always-on assistants possible, and why it matters that a mainstream provider now ships one inside its subscription.Then he walks through real uses from his own work and from clients. One bot researched SEO terms and competitors, then told a second bot that knows the website's code to build the new pages. A site with almost no impressions went to 1,500, then 3,000, then 5,000 within days.In this episode:Why long AI chats lose detail, and when to start a new oneTwo bots working together on SEO and a websiteTriage rules that keep your inbox calmDrafting a guest follow-up email in seconds from the roadA family calendar dashboard built from school emailsHow it handles logins without seeing your passwordStart with one bot, and spin off another only when one job keeps coming back.Want your team trained on AI tools like these? Reach out at PerezCarreno.com. Subscribe so you catch next week's guest episode.#aiagents #smallbusiness #seo #productivity #automation
Two Toyota dealers 20 minutes apart buy the same car from Toyota at the same price, then fight each other for your business. Todd Katcher, CPO of Zoney Digital Signage, explains how that works and why a dealership's waiting room TV can quietly cost it the sale.
In 2018 Mark Kreitzman's phone went dead in the Arizona desert. Someone at a phone store had moved his number to another device, and in 61 minutes the attackers reset passwords on his bank, email, cloud and crypto accounts. That SIM swap is why he helped build Efani, a mobile carrier designed to stop it from happening.
Getting into companies like SpaceX or OpenAI before they go public has usually taken at least $100,000, accredited investor status and months of paperwork. Chan Ahn spent almost 20 years in investment banking before founding Tessera, which puts exposure to those private companies on the blockchain so anyone with a crypto wallet can trade it from $1.
Smart people fall for scams because criminals use urgency and our natural trust against us. Robert Siciliano of Protect Now explains how criminals pick their targets and the three basic steps that make you a much harder target. In this episode: Fewer than 1 in 10 people in Robert's live audiences use a password manager, so setting one up puts you ahead of most people. Scammers use manufactured urgency, like an AI clone of your daughter's voice, to create tunnel vision so you act before you think. Everyone has a human blind spot, a built-in default to trust, and criminals build their scams around it. Shaming employees who click a bad link keeps breaches hidden, and treating those mistakes as data helps people speak up. A credit freeze at TransUnion, Equifax, and Experian stops new account fraud, and your current credit cards keep working. Guest: Robert Siciliano, security awareness trainer, Protect Now Protect Now: https://protectnowllc.com Robert's newsletter: search for Robert Siciliano on LinkedIn Chapters 00:00 How Robert got hacked in 1995 06:38 Password managers and two-factor login 11:16 The trinity of vulnerability 17:49 Becoming a tougher target 21:49 All security is personal 26:38 Why stories make training stick 31:43 How scammers fool smart people 35:43 The human blind spot and trust 45:28 Why shaming employees hides breaches 53:13 Three basics to start today Episode page: https://webtalk.show/episodes/098-smart-people-fall-for-scams-too-heres-why/ Hosted by Armando J. Perez-Carreno. Learn more at https://perezcarreno.com