Security Researcher Discusses AI Guardrails, EDR Killers and VPN Limitations

Summary

In an interview with David Bombal, researcher Marcus discusses AI restrictions on malware analysis, ransomware actors’ use of vulnerable drivers, and the limits of VPN protection against malicious captive portals.

Key points

Marcus says an Anthropic model refused to deobfuscate a password stealer that he attributes to an unnamed North Korean hacking group, even though he had reduced guardrails through a cybersecurity program.
He says he ultimately deobfuscated the sample manually and uses other AI models for some deobfuscation tasks, with separate infrastructure for sensitive material.
Marcus describes a ransomware actor exploiting legitimate, signed vulnerable drivers to gain kernel access and disable endpoint detection and response software.
Discussing Midnight Blizzard and Captive Trench, he says malicious captive portals can present ClickFix instructions before a user can connect a VPN. He advises treating portals as untrusted and not running commands they provide.
He argues that VPNs do not prevent tracking through advertising identifiers in apps and that their privacy benefits depend on the user's threat model.
Marcus questions broad public USB-charging warnings, citing phone trust prompts and data-mode controls, while acknowledging that an OMG cable can act as a keyboard under certain conditions.

Article Details

Topics: [18:16] Vulnerable signed drivers and EDR evasion
[19:43] VPN security and privacy limitations
[28:53] Captive Trench, malicious captive portals and ClickFix
[34:33] USB charging risks and OMG cables
[44:45] AI security testing and research containment
[48:13] AI-assisted vulnerability discovery and access to models
AI guardrails and malware deobfuscation