How Varonis hacks AIs into snitching on themselves

How Varonis hacks AIs into snitching on themselves

Author: David Shipley August 29, 2026 Duration: 29:47

Varonis AI Threat Lead on Copilot Exploits, Prompt Injection, and the AI Hacking Trifecta

The host interviews Mark Vaitsman, AI threat research lead at Varonis, about Varonis Threat Labs' research into AI vulnerabilities, including a chain of single-click exploits in Microsoft Copilot (including "CoSnitch") and an Atlassian Confluence issue dubbed "RovoBlast" involving prompt injection, bypassing guardrails, and data exfiltration via a web-capable subagent.

Vaitsman explains why built-in model guardrails are insufficient, citing AI's lack of loyalty and "unlimited hunger for data," and argues for layered controls like least privilege, monitoring, and restricting data access.

He discusses psychological guardrail bypasses, introduces an "AI Hacking Trifecta" framework—enter, evade, escape—and comments on research showing AI-generated patches often fail, emphasizing human-led validation and guidance when using AI tools for security research.

00:00 Weekend Show Kickoff
00:44 Meet Mark Vaitsman
03:38 Teaching the Next Gen
04:19 Copilot Exploit Code Snitch
06:04 Atlassian RoboBlast Breakdown
08:52 Why Guardrails Fail
13:15 Manipulating Models to Comply
17:06 Securing Agents Without Handcuffs
20:11 AI Hacking Trifecta Framework
23:43 AI Patches and Human Research
27:43 Hope and Closing Thoughts


Every morning, Jim Love sifts through the noise of the digital world to bring you a clear, concise briefing on what actually matters. Cybersecurity Today isn't about fearmongering; it's about practical awareness. You'll hear straightforward analysis of the most recent attacks targeting companies, from sophisticated ransomware campaigns to stealthy data theft. Jim breaks down the implications of major breach disclosures, explaining not just what was stolen, but how it happened and who is affected. The focus remains on actionable intelligence-concrete steps and strategic thinking that can help protect your organization's data and infrastructure. This daily podcast serves as an essential filter for IT professionals, business leaders, and anyone responsible for digital assets, transforming complex threats into understandable insights. Tune in for a grounded perspective on navigating an online landscape where the risks are constantly evolving, and the need for clear, timely information has never been greater.
Author: Language: English Episodes: 50

Cybersecurity Today
Podcast Episodes
Cybersecurity Today Weekend Month in Review: August 2026 [not-audio_url] [/not-audio_url]

Duration: 56:27
AI Agents Hacking, Passkey Phishing, and Water Utility Attacks In this weekend month-in-review episode of Cyber Security Today, Jim is joined by David Shipley and Laura Paine to recap major July developments. David share…