Light

Episode #1077 Quiz

A Browser AI API?
Date: 2026-05-05 | Length: 2.25 hrs | Episode page at twit.tv

About this episode

This Security Now!

Your name and email are stored only in your browser local storage for convenience. They are not retained server-side.

NameEmail

Question 1: What was the primary security failure that led to the leak of 345,000 credit card details from the threat actor's AI-coded server known as Jerry's Store?

Question 1

What was the primary security failure that led to the leak of 345,000 credit card details from the threat actor's AI-coded server known as Jerry's Store?

The AI-assisted development environment created an unauthenticated open web directory, failing to enforce authentication on administrative dashboards. The threat actor mistakenly uploaded credit card details to a public cloud storage bucket accessible without credentials. The server was hosting a known vulnerable version of web server software exploited by attackers to gain access. The threat actor used outdated encryption algorithms to store credit card details, allowing easy decryption by researchers.

Question 2: According to the UK NCSC CTO's warning about the upcoming 'vulnerability patch wave,' what should organizations prioritize if they cannot apply updates across their entire environment?

Question 2

According to the UK NCSC CTO's warning about the upcoming 'vulnerability patch wave,' what should organizations prioritize if they cannot apply updates across their entire environment?

Defer patching critical systems to avoid potential operational disruptions during the patch wave. Apply patches starting from internal systems moving outward to external-facing systems last to reduce downtime. Focus patching efforts primarily on legacy systems that are out of support since these have more vulnerabilities. Apply patches first to external attack surfaces, then to critical security systems if capacity allows.

Question 3: What is the reported core reason behind the Internet Bug Bounty program's suspension of new vulnerability submissions?

Question 3

What is the reported core reason behind the Internet Bug Bounty program's suspension of new vulnerability submissions?

The lack of sufficient funding from major tech companies has forced the suspension of submissions. A decline in security researcher participation due to lack of financial incentives in bug bounty programs. Bug bounty programs were compromised by attackers submitting fake bug reports to confuse maintainers. The influx of AI-generated vulnerability reports overwhelms maintainers, increasing triage workload with convincing but invalid findings.

Question 4: What major change did OpenAI introduce in ChatGPT's 'Advanced Account Security' to reduce account takeover risks?

Question 4

What major change did OpenAI introduce in ChatGPT's 'Advanced Account Security' to reduce account takeover risks?

Extending session durations to reduce the need for frequent re-authentication and improve usability. Disabling password-based login and requiring passkeys or physical security keys for phishing-resistant sign-in. Adding SMS and email recovery options to facilitate easier account recovery for users. Removing alerts for account logins to avoid user notification fatigue from frequent logins.

Question 5: What is the primary criticism Mozilla's Jake Archibald expressed about Google's proposed Prompt API for web browsers?

Question 5

What is the primary criticism Mozilla's Jake Archibald expressed about Google's proposed Prompt API for web browsers?

It does not allow web developers to customize the system prompt, limiting flexibility in usage. It is incompatible with existing JavaScript APIs such as Fetch and XMLHttpRequest. It lacks support for local language models, forcing reliance on cloud services for AI processing. It enforces Google's Generative AI Prohibited Uses Policy, restricting content based on vague criteria beyond law, affecting web neutrality.

Cancel

My Data//Security & Privacy//Clear Local Data

© 2026 Ken ArmstrongSecurity Now™ is a trademark of TWiT LLC. All trademarks and copyrights of the Security Now podcast are respected and reserved to their respective holders.
This is a hobby project made with love and admiration for what Steve Gibson and Leo Laporte have built over 20 years.