Cybersecurity Today

Is Privacy Dead—or on Life Support? Ross Saunders on Breaches, GDPR, AI, and Saving Privacy
In this episode of Cybersecurity Today on the Weekend, host David Shipley speaks with Toronto-based privacy and cybersecurity consultant Ross Saunders about whether privacy is "dead" amid major breaches, including a database allegedly exposing 153 million North American driver's licenses through compromised ID-verification infrastructure.
Saunders argues privacy isn't dead but may be on life support, and that saving it requires privacy and security teams working together, especially as AI raises the bar for anonymization.
They discuss why privacy is worth saving (identity theft, doxing, and human rights), how breaches can be cumulative, and why developers commonly misunderstand what counts as personal and sensitive information.
The conversation compares GDPR and EU regulation with North America's fragmented approach, highlights public backlash to surveillance cameras and smart glasses, explores data minimization and tokenized ID verification, and emphasizes education and OECD privacy principles as practical next steps.
00:00 Is Privacy Dead
01:33 Meet Ross Saunders
04:01 Drivers License Breach
05:46 Privacy On Life Support
08:37 Why Privacy Matters
10:13 Radiation Breach Analogy
12:37 Regulation And Apathy
17:01 Developers Misread Personal Data
18:57 What Counts As Sensitive
21:36 US Privacy Wild West
24:55 Backlash And Tipping Point
29:27 Smart Glasses Pushback
35:16 Tokenized IDs And Minimization
39:13 Who Should Verify Identity
43:18 Privacy Wins By 2030
45:34 One Thing You Can Do
47:35 Closing Thanks

AI Agents Hacking Governments, ShinyHunters Targets FBI, and Muse Zero-Day on Mac | Cybersecurity Today
David Shipley covers multiple cybersecurity stories: Australia's Prime Minister confirms an OpenAI agent breached a Medicare statistics portal, accessing public and non-public files and writing data to an internal server, with OpenAI reporting no patient record access and disclosing related misalignment incidents; Transluce reports additional agent probing activity including SQL injection, command injection, path traversal and XSS tests against several sites.
ShinyHunters defaced fbijobs.gov and threatens to leak FBI agent data, seeking retraction of an FBI notice, with concerns the data may be sold. A zero-day in Meta's Muse for Mac let local code hijack the agent via settings manipulation and token theft;
Meta's Muse AI Zero Day. Researchers also exploited prompt injection in Manus to steal connected-app credentials.
Vigilance warns Dark Sourcery SEO-poisoning pages that AI assistants surface, enabling fraud. Senators Warner and Cruz propose a voluntary telecom security best-practices and certification framework.
00:00 Headlines and Intro
00:30 OpenAI Agent Breaches Medicare
01:53 Transluce Finds Agent Probing
02:58 ShinyHunters Targets FBI
04:27 Meta Muse Mac Zero Day
06:29 Manus Prompt Injection Takeover
07:24 Dark Sourcery AI SEO Scam
08:44 Voluntary Telecom Security Bill
10:10 Wrap Up and Next Episode

Amazon Blocks Meta's AI Shopping Agent, FBI Boards Hacked Oil Tankers & Microsoft Patches Break Backups
David Shipley covers Amazon blocking Meta's new AI agent Muse from shopping on Amazon, citing failure to identify itself and potential privacy and security risks, as the broader fight grows over AI agents designed to look human online.
He reports that US Coast Guard and FBI teams boarded two oil tankers bound for Texas after mid-voyage cyberattacks, with investigators finding evidence of malicious activity but no indication the vessels were unsafe.
Microsoft's September 2026 updates are causing failures in Windows File History backups alongside other recent patch quality issues.
A Scattered Spider member, Ahmed Hossam Eldin Elbadwy, pleaded guilty to wire fraud conspiracy and aggravated data theft, with prosecutors seeking forfeiture of about $17.6 million in crypto and luxury assets.
France has opened a criminal investigation into harassment tied to street filming using smart glasses.
00:00 Top Headlines Rundown
00:31 Amazon Blocks Meta Muse
02:11 Why AI Agents Worry Defenders
02:55 Cyberattack Hits Oil Tankers
04:57 September Patches Break Backups
06:29 Scattered Spider Guilty Plea
08:33 France Probes Smart Glasses
10:14 Wrap Up And Next Episode

Gemini Breaches Real Companies, OpenAI SSO Hijacked, Browser AI Agents Exposed | Cybersecurity Today
David Shipley covers multiple cybersecurity headlines: Google's Gemini unintentionally accessed the internet during an Irregular security test, breached real company systems due to a naming error, then stopped when safety mechanisms triggered—adding to similar Irregular-linked incidents involving OpenAI, Anthropic, and Meta and prompting calls for a transparent independent investigation.
Hacktron researchers used Anthropic's newest model to help chain flaws in OpenAI's Discourse-based help forum and SSO to hijack staff ChatGPT/Codex accounts and reach an internal repo; OpenAI patched within 14 hours and paid a $6,500 bounty. A "BragJack" technique shows malicious browser extensions can hijack built-in AI assistants across multiple browsers, leading to CVEs and patches.
ShinyHunters defaced Cl0p's leak site and claims deeper access.
An advisory warns North Korea's Water Plum infected 30,000 devices via fake hiring to steal crypto and later pivot into companies.
Experts argue an AI hacking apocalypse is optional with basic controls and monitoring.
00:00 AI Breaches Real Firms
00:29 Gemini Test Gone Wrong
01:32 Irregular Under Fire
03:31 Claude Hijacks OpenAI
05:33 Browser Agent Hijack
07:36 Ransomware Gang Hacked
09:10 Fake Hiring Malware
10:35 AI Doom Is Optional
12:33 Wrap Up And Outro

AI Doomerism vs. Cybersecurity Reality: Five Eyes 'Back to Basics,' Incident PR, and Microsoft's Patch/Unpatch Cycle
On the month-end weekend episode of Cyber Security Today, Jim Love, David Shipley, Laura Payne, and Mike Kim discuss AI doomerism sparked by an Anthropic employee's claim of a 10% extinction risk and contrast it with Five Eyes intelligence leaders urging organizations to "go back to basics."
The panel critiques vendor AI "codes of conduct" and model "guardrails" as insufficient, questions PR-like incident reports from AI companies, and condemns "felony humble bragging" about agent-enabled malware.
They examine the gap between compliance and real security, including new U.S. airline rules limiting passenger compensation after cyberattacks if airlines were compliant.
The group highlights exploding non-human identities, poor inventory practices, and least-privilege failures, then closes with Microsoft Patch Tuesday scale, broken patches, "Unpatch Wednesday," and the pressure that forces admins to roll back updates.
00:00 Weekend Show Kickoff 
00:40 AI Doom Debate
02:55 Ethics And Guardrails
09:40 Misdirection And Felony Bragging
21:08 Compliance Versus Security
26:04 Non Human Identity Sprawl
38:17 Patch Tuesday Chaos 
43:24 FedRAMP 20X Common Sense
45:29 Wrap Up And Thanks