Security Panel Discusses Passkey Vishing, AI Prompt Injection and Copyright Takedowns
· 1:06:32 · Watch on YouTube ↗
Summary
A security panel discusses copyright takedowns exposing compromised government sites, vishing targeting passkey enrollment, prompt injection against a GitHub agent, and challenges monitoring AI systems.
Key points
- The panel says OnlyFans creators’ copyright takedown efforts have helped uncover compromised government websites hosting leaked content.
- The speakers describe vishing attacks that impersonate an organization and guide users through passkey enrollment to gain access.
- Suggested defenses include verifying callers through established channels and investigating unusual login locations or simultaneous logins.
- The panel discusses research in which a malicious public GitHub issue prompts an agent with private repository access to disclose data in a public comment.
- Speakers recommend least privilege and reviewing AI request and response logs, while noting that log access, coverage and sensitive content complicate monitoring.
- Citing SecurityWeek, the panel says a malicious Go module posed as a DNS subdomain scanning tool, with 700 malicious versions among more than 1,200 published versions.
Article Details
- Topics
- [06:24] Zero-day procurement and concerns about offensive security vendors
- [15:55] Copyright takedowns and compromised government websites
- [20:40] Vishing against passkey enrollment and verification practices
- [32:46] GitHub agent prompt injection and private data disclosure
- [38:20] SaaS and AI logging, least privilege and detection challenges
- [46:35] Malicious Go module distributed through GitHub repositories
- [48:20] Device identifiers, IP correlation and privacy
- [53:55] Age verification and privacy