Tom Eston

Microsoft’s response to a researcher publicly disclosing proof-of-concept exploit code has reignited an old debate in security: where does responsible disclosure end and reckless disclosure begin? Tom and Scott discuss the Nightmare Eclipse controversy, the history of full disclosure, bug bounty incentives, and why legal threats against researchers may ultimately hurt customers. They also explain The post Microsoft Threatens Legal Action Over Exploit Disclosure appeared first on Shared Security Podcast.

Mobile apps are now deeply connected platforms for identities, payments, sessions, APIs, healthcare, retail, gaming, and cloud services. In this special episode, Tom Eston talks with Joel Destefano, Senior Product Manager at Guardsquare, about the modern mobile app threat landscape and why organizations can’t treat mobile security as an afterthought. Topics include runtime manipulation, API The post Mobile Application Security: What Every Organization Needs to Know appeared first on Shared Security Podcast.

AI agents are useful, but they become risky when they can take action in real systems. In this episode, Tom Eston discusses recent reporting about attackers tricking Meta’s AI support chatbot into helping hijack Instagram accounts, and why that story matters far beyond social media. Tom explains practical guardrails for AI agents: read-only access first, The post Guarding AI Agents: Boundaries and Safeguards appeared first on Shared Security Podcast.

The U.S. government reportedly ordered Anthropic to suspend access to two of its newest frontier AI models, Fable 5 and Mythos 5, citing national security concerns tied to a possible jailbreak. Anthropic complied, but pushed back on the reasoning, arguing that the reported behavior was narrow and that similar capabilities already exist in other advanced The post Can the Government Shut Down Frontier AI Overnight? appeared first on Shared Security Podcast.

This week on Shared Security, Tom and Kevin sit down with Jay Beale — founder of InGuardians, long-time Black Hat trainer, creator/contributor behind Kubernetes security training, and part of the team behind the DEF CON Kubernetes CTF. Jay shares stories from decades of offensive security work, including the time Tom hired him for a physical The post Jay Beale on Kubernetes, DEF CON, and AI Attack Paths appeared first on Shared Security Podcast.

The Supreme Court says constitutional privacy protections can apply to cellphone location history and geofence warrant data. Tom Eston and Scott Wright discuss the privacy implications of geofence warrants — requests that can sweep up information about many people near a location, not just a named suspect — and why this ruling matters for anyone The post The Supreme Court Just Put Limits on Geofence Warrants appeared first on Shared Security Podcast.

Russian intelligence services are targeting Signal, WhatsApp, and Telegram users — not by breaking encryption, but by stealing accounts through phishing, QR code tricks, linked-device abuse, and backup recovery key theft. We discuss the FBI warning, the $10 million Rewards for Justice bounty, and the practical security lesson for anyone relying on encrypted messaging: your The post Signal Phishing and Russian Intelligence Targeting Messaging Apps appeared first on Shared Security Podcast.

Surveillance pricing turns personal data, shopping history, location signals, loyalty programs, and AI-driven profiling into different prices or discounts for different people — often without consumers realizing their data has become the price tag. The post Surveillance Pricing: When Your Data Sets the Price appeared first on Shared Security Podcast.

You plug in a new monitor. Windows detects the hardware, pulls down a vendor companion app, and the first thing you see is… a McAfee ad. That’s the story that kicks off this episode, but the bigger issue is not just one annoying popup. Hardware setup has become a software delivery channel. Drivers, companion apps, The post Your Monitor Can Install Adware Now? appeared first on Shared Security Podcast.

OpenAI disclosed an unusual AI security incident involving a frontier model evaluation and Hugging Face, but the episode cuts through the hype: was this true autonomous intent, an agent following bad scope boundaries, or a warning about giving AI systems real tools and permissions? Tom, Scott, and Kevin discuss why anthropomorphizing AI makes the story The post OpenAI Says Its AI Hacked Another Company on Its Own appeared first on Shared Security Podcast.