Why the U.S. Locked Down Fable and Mythos: AI, National Security, and the Workforce Squeeze
ShipTalk: AI, DevOps & Software DeliveryShow Notes
The U.S. just barred foreign nationals from accessing two advanced AI models — Fable and Mythos — citing national security. Around the same time, the Five Eyes intelligence alliance warned that AI-enabled cyberattacks are "months, not years" away. Host Adam and co-host Martin dig into whether that warning is already overdue — and what it means for the people actually defending software. They're joined by Assaf, a longtime security leader (and Adam's former boss) and author of Lessons from the Front Line: Insights from a Cybersecurity Career. The conversation moves from the headlines to the harder truth underneath them: AI adoption is climbing, yet more than half of security and IT workers are considering leaving their jobs — burned out, under-resourced, and worried AI is coming for their roles. Assaf's take is contrarian and sharp: the real failure isn't AI, it's leadership translation and a training pipeline we're quietly demolishing. As Adam puts it, "this is not a security problem, it's an engineering problem." A candid, news-driven look at AI, national security, and the security workforce squeeze — and a surprisingly optimistic read on where it all goes next. Listen on: Apple Podcast | Spotify | YouTube Timestamps: 00:00 Cold Open: AI Cyberattacks Aren't Months Away — "We're Already There" 00:53 Welcome to ShipTalk: Today's Two Headlines 01:35 Are We Already Using AI Without Realizing It? 02:41 Five Eyes Warns AI Cyberattacks Are "Months, Not Years" Away 04:31 Harness by the Numbers: Half of Security Pros Want to Quit 05:25 Meet the Guest: Assaf Keren (ex-PayPal & Qualtrics CSO) 06:14 "Secure by Design, But For Real This Time" 08:46 The ISSA Survey: Why Security Jobs Keep Getting Harder 10:01 The "Triple Whammy" Burning Out Security Teams 11:49 Have We Been Here Before? Cloud & the Changing SOC Role 13:32 The Contrarian Take: AI Could Make Security Better 15:41 The Real Failure: We're Demolishing the Training Pipeline 18:41 Weak Leadership, or a Security Translation Problem? 22:05 Trust: The CISO's Real Business Function 23:20 What Teams Get Wrong About AI + Software Delivery 24:37 Debrief: Adam & Martin's Takeaways 26:31 Wrap-Up: Stop Talking, Start Shipping
More from ShipTalk: AI, DevOps & Software Delivery
An OpenAI engineer is arrested after a hidden recording device is discovered in an executive conference room. Who was he recording, and who was the information intended for? Microsoft releases a record-breaking 1,400+ security fixes in a single Patch Tuesday, including three zero-day vulnerabilities. Is AI helping discover security flaws faster than companies can fix them? Meanwhile, Japan declares a cybersecurity emergency as AI threatens to make large-scale attacks easier than ever. And the ShinyHunters hacking group claims to have stolen sensitive FBI personnel records, raising serious national security concerns. Martin Reynolds and Adam Arellano break down the latest cybersecurity headlines, the growing risks of AI-powered attacks, and whether defenders can keep up. ShipTalk is brought to you by Harness. ShipTalk, AI security, cybersecurity, Five Eyes, AI national security, Fable, Mythos, security workforce, ISSA, software delivery, DevOps, AI jobs, CISO. Adam Arellano: https://www.linkedin.com/in/adamrossarellano/ Martin Reynolds: https://www.linkedin.com/in/martinreynolds/
A hacker used Claude Code to help attack nine South Korean banks. Citrix finally released a security patch, but attackers may still be inside. And OpenAI reportedly lost $20 billion more in a single year than expected. Is the AI spending boom sustainable? This week on ShipTalk, Martin Reynolds and Adam Arellano break down the biggest stories in AI, cybersecurity, and software delivery. We cover how a 26-year-old hacker paired Claude Code with an open-source penetration testing agent, why Citrix's delayed patch raises bigger questions about software security, and whether OpenAI's mounting losses point to an AI infrastructure bubble. Plus, we discuss Harness's acquisition of Augment and the future of AI software factories, Google's AI medical assistant, and whether OpenAI's model safety announcements are becoming the new normal. Also in this episode: How AI agents are lowering the barrier to cyberattacks Why faster software delivery could be the key to better security What AI software factories mean for developers Whether massive AI investments are producing real breakthroughs The privacy tradeoffs of AI in healthcare ShipTalk is brought to you by Harness. Join us as we break down how software delivery is changing in the AI era. Learn more: https://shiptalk.io Powered by Harness: https://www.harness.io
Citrix customers were pulling NetScaler devices offline as attackers moved faster than the traditional security response cycle. This week on ShipTalk, Martin Reynolds and Adam Arellano are joined by Starr Brown, Director of Open Source Projects at OWASP, to break down the latest Citrix NetScaler security crisis, why exploitation is happening so quickly, and what it means when defenders may have only hours — or less — to react. They also dig into the rise of AI-powered cyberattacks, whether human security teams can realistically respond at machine speed, why resilience may matter more than shipping the next feature, and whether AI companies can really be trusted to regulate themselves. Plus: who actually writes technology regulation, Wall Street’s push to secure investment-grade ratings for OpenAI and Anthropic, and the biggest mistake companies are making when they assume security simply comes with their AI tools. ShipTalk explores how software delivery, AI, security, and engineering are changing in real time.
Why did an OpenAI AI agent hack an Australian government Medicare portal when nobody instructed it to? On June 18, an OpenAI research agent was looking for public information about medicine spending in Australia. When it hit a barrier, it found another way in — accessing public and non-public files and even writing files to an internal server. No personal Medicare records are believed to have been accessed. But the incident raises a much bigger question: what happens when autonomous AI agents hit a barrier and decide for themselves how to get around it? Martin Reynolds and Adam Arellano break down what happened, why Australia criticized OpenAI's response, and what “misaligned model activity” means for companies deploying autonomous AI agents. Then they dig into another bizarre case: an Alibaba-affiliated AI agent that reportedly created a reverse SSH tunnel, bypassed network restrictions, and mined cryptocurrency during training. Plus: are creators being paid to make AI sound more dangerous than it is? And TypeSafe AI's new low-cost model, Jev, goes into Overhyped or Under hyped. ShipTalk breaks down how AI is changing software delivery, DevOps, cybersecurity, and the way software gets shipped. RELATED READING Australian Prime Minister — Official briefing on the OpenAI incident Read the Australian government briefing https://www.pm.gov.au/media/press-conference-new-york? Nature — AI agent hacks government website for first time Read the Nature report https://www.nature.com/articles/d41586-026-03024-z? ABC News — OpenAI agent accessed Australian government Medicare portal Read the ABC News report https://www.abc.net.au/news/2026-09-24/ai-agent-accessed-australian-government-site-pm-says/107189078? The Block — Alibaba-linked AI agent mines cryptocurrency Read the Alibaba AI agent report https://www.theblock.co/news/markets/2026-03-08-alibaba-linked-ai-agent-hijacked-gpus-for-unauthorized-crypto-mining-researchers-say-392765? TypeSafe AI — Introducing Jev Read about Jev https://typesafe.ai/blog/introducing-system-one-models-and-jev ShipTalk — https://www.shiptalk.io Harness — https://www.harness.io Follow Adam Arellano: https://www.linkedin.com/in/adamrossarellano/ Martin Reynolds: https://www.linkedin.com/in/martinreynolds/ Brought to you by Harness.
Dario Amodei's essay "We Must Pace the Frontier" asked the AI industry to deliberately slow capability gains so safety work can keep up — and got public agreement from OpenAI, xAI and Google DeepMind within hours. Adam Arellano and Martin Reynolds bring in Bryan Payne, who has led security at Netflix and Adobe, to ask what's actually in the proposal and what was conspicuously left out. They dig into whether permanent employee-level access for third-party evaluators is a meaningful control or a curated one, why liability is the piece missing from the whole conversation, and what it says that OpenAI is running forensics on models it has already trained — including one that swept public GitHub for secrets stored in plaintext, which Adam argues was the most logical thing it could possibly have done. The episode moves from early airline safety through Nick Bostrom's paperclip maximizer to a malicious git config that can get Claude Code, Codex and Cursor to execute attacker code. Bryan's closing argument is the uncomfortable one: people have spent decades getting very good at planting flaws no human reviewer will spot, so the belief that a human in the loop will catch what an AI is doing may be the most optimistic assumption in software today. Along the way: Jacob Coxon's resignation thread, the greater-than-10% extinction figure his colleagues publicly endorsed, and why $2.7 trillion of AI spend returning business outcomes only one time in five might still be money well spent. Bryan's parting shot for teams: you're thinking too small. Mentioned in this episode Dario Amodei, "We Must Pace the Frontier" — https://darioamodei.com/post/we-must-pace-the-frontier ShipTalk — https://www.shiptalk.io Harness — https://www.harness.io Follow Bryan D. Payne: https://www.linkedin.com/in/bdpayne/ Adam Arellano: https://www.linkedin.com/in/adamrossarellano/ Martin Reynolds: https://www.linkedin.com/in/martinreynolds/ ShipTalk is brought to you by Harness. Subscribe wherever you listen, and until next time — let's stop talking and start shipping.