Dan Goodin

And coming in and firing twenty-five to fifty percent of our talent in that area and then turning around and trying to take it to the private sector is completely the wrong move.

All right, next up here, a story from Ars Technica and, uh, Dan Goodin, and it's about a really massive data leak thanks to a very clever supply chain attack.

Terabytes worth of credentials, terabytes worth of credentials, many belonging to the world's biggest and most sensitive organizations, have been exposed in a supply chain attack on LiteLLM.

That's L-I-T-E L-L-M, as in large language model, an AI thing, uh, which it says here is an open source tool that streamlines AI-driven software development.

And then coming down the line, we've got interviews with, uh, folks from Epic about opt-out dark patterns.

We will of course be talking with Bruce Schneier in the 500th episode, which is coming up very soon.

Dan Goodin from Ars Technica, Tom Kemp, and some other fun surprises coming after that that came out of my trip to Defcon.

So that's gonna do it for this week.

It's meant to stop the amount of damage, right? It's like it's a proactive measure.

I think it's really interesting at the end of this article, um, uh, Dan Goodin wrote something, um, "Ultimately, attacks like Cosnitch and Microsoft's statement are reminders that LLM security is largely built on a list of reactive restrictions rather than building a road with banked turns that proactively prevent a car from veering off a cliff.

LLM developers-

[laughs]

I, I...

This is the kind of story that you see, um, um, you know, our friends, uh, Dan Goodin, Kim Zetter write.

This, this is one of those kind of stories.

It's a fantastic story, so shout outs to the authors, um, Duncan Campbell from the Sussex Center for Law and Technology, and, uh, Bill Goodwin, an investigations editor for Computer Weekly.

Okay, so we're gonna start by covering some important recent security events and then get into understanding this first of the two core issues of the way AI works.

Last Wednesday, uh, Ars Technica's great security topic, uh, writer Dan Goodin reported under the headline, "Terabytes of credentials leaked in massive supply chain attack," was, uh, Ars headline.

Uh, and of course, that was the kind of thing I would have chosen to share even a few years ago.

But the thing that raised my interest another several notches was the article's tagline, which read, "That data," that is the terabytes of credentials, "was scraped and exfiltrated from twenty-five hundred users of a compromised AI package." So I thought, "Whoa, uh, okay." Uh, it turns out what's, [chuckles] what's even more significant is we're not talking some random end users in Nebraska, you know, who no one knows.