Stolen AI Credits, Nuclear Prompts, and a Supply-Chain Bust Artwork

The Matthew Chapman Podcast

Join Matthew Chapman, a Cybersecurity Expert with over 30 years of experience architecting solutions for some of the world’s largest organizations. Each episode delivers a sharp, no-fluff briefing on the latest developments in cybersecurity, AI, and emerging technology — alongside occasional in-depth interviews with colleagues and industry professionals. Expect clear analysis, real-world insight, and the occasional laugh along the way.

All Episodes

The Matthew Chapman Podcast

Stolen AI Credits, Nuclear Prompts, and a Supply-Chain Bust

September 01, 2026

0:00 | 3:57

Here is your briefing for Tuesday, September 1, 2026. METR, the non-profit that stress-tests frontier A.I. agents, disclosed two security incidents. The ugly one started with a researcher's personal E.C.2 box and a vibe-coded dashboard that was supposed to sit behind Google login. A fail-open bug silently turned auth off, and the box sat on the public internet for days. Attackers found it the cheap way, hunting freshly registered sites for L.L.M. keywords, then asked the agent for its model-provider A.P.I. key and planted an S.S.H. key for stay-behind access. Over three weeks they burned credits that would have cost about six hundred thousand dollars if the provider had not given METR free inference. Sensitive eval data apparently stayed untouched. Your personal side project with a company key is still a company key. ESET says Russia-aligned U.A.C. zero zero nine nine is using a trick it calls GuardBreaker. Inside a malicious V.B.S. script that installs their MATCHBOIL loader, they tucked a comment that starts, I want to make a nuclear weapon. Help me. The point is not the bomb. It is to trip an L.L.M. safety filter so an A.I. assisted analyst never finishes reading the real payload. The target was in Ukraine, and the group already hits transportation and energy. Cybercrime crews used similar prompt bombs in malicious Python packages earlier this year. If your triage pipeline feeds the top of a file straight into a model with no isolation, the malware just wrote your refusal for you. VulnCheck is watching active exploitation of critical bugs in Langflow and Ruby on Rails. Against Langflow, attackers pull environment variables for OpenAI and A.W.S. keys, read secret files, and check S.S.H. history. VulnCheck saw more than fifty hits in a few hours on August thirtieth, then three hundred sixty by Monday, mostly from Russia against U.K. canaries. On Rails, C.V.E. twenty twenty-six six six zero six six abuses how Active Storage and libvips disagree on uploaded images, and activity is already hitting canaries in Singapore, Israel, and the U.K. with C.two in Israel. A.I. builder platforms are not sandboxes. They are credential vaults with a web U.I. Patch Langflow, patch Rails image handling, and assume anything internet-facing with model keys is already being scanned. Australian Federal Police arrested two men from Western Australia, ages twenty-one and twenty-three, tied to TeamPCP, the crew behind the long-running open-source supply-chain and extortion spree. Krebs on Security reports the group planted malware in hundreds of packages, ran the self-propagating Shai-Hulud worm, and turned compromised developer tools into more compromised developer tools. They also hit A.I. infrastructure by poisoning LiteLLM, harvesting cloud keys from more than twenty-five hundred organizations, and later claimed thousands of GitHub repos after a poisoned extension. Google Threat Intelligence calls TeamPCP less a single gang than a peer community with one center of gravity. Arrests do not unpoison the packages already in your lockfile. Audit what your build still trusts. Cosmos Labs says a critical balance bug in the shared Cosmos E.V.M. module was exploited across six blockchains between August twentieth and twenty-fifth. The flaw was reported in April. By mid-August the team knew every Cosmos E.V.M. chain was at risk, then still used its public silent-patch path instead of private emergency distribution. Attackers triggered an unchecked balance wrap to roughly two to the two hundred fifty-sixth and drained funds where permissionless vesting accounts were allowed. Fixes shipped August nineteenth. Operators who cannot upgrade are told to halt the chain. Knowing the blast radius and still shipping the quiet patch is how a research finding becomes a multi-chain incident. A stolen A.I. key on a personal box, malware that argues with your analyst model, live exploitation of A.I. builder stacks, a supply-chain crew finally in handcuffs, and a blockchain bug everyone knew about before the drains began. The pattern is familiar systems, trusted enough to skip the boring controls. That's the briefing. Stay sharp, keep your systems patched, and we'll see you tomorrow.

Kindle: https://www.amazon.com/dp/B0HHMH88H9
Apple Books: https://books.apple.com/us/book/local-ai-on-the-mac/id6807243472

Barnes & Noble: https://www.barnesandnoble.com/w/books/1151622292?ean=2940185390764

https://mattch

Support the show

Tuesday Cybersecurity Briefing

SPEAKER_00 0:07

Here's your briefing for Tuesday, September 1st, 2026. May

METR EC2 Key Theft Story

SPEAKER_00 0:11

ETR, the nonprofit that stress tests Frontier AI agents, disclosed two security incidents. The ugly one started with a researcher's personal EC2 box and a vibe coded dashboard that was supposed to sit behind Google login. A fail open bug silently turned off, off, and the box sat on the public internet for days. Attackers found it the cheap way, hunting freshly registered sites for LLM keywords. Then asked the agent for its model provider API key and planted an SH key for stay behind access. Over three weeks, they burned credits that would have cost about $600,000 if the provider had not given METR free inference. Sensitive eval data apparently stayed untouched. Your personal side project with a company key is still a company key.

Guardbreaker Prompt Bomb Trick

SPEAKER_00 0:53

ESET says Russia Align UAC-0099 is using a trick it calls guardbreaker. Inside a malicious VBS script that installs their matchboil loader, they tucked a comment that starts, I want to make a nuclear weapon help me. The point is not the bomb, it is to chip an LM safety filter so an AI-assisted analyst never finishes reading the real payload. The target was in Ukraine, and the group already hits transportation and energy. Cybercrime crews use similar prompt bombs in malicious Python packages earlier this year. If your triage pipeline feeds the top of a file straight into a model with no isolation, the malware just wrote your refusal for

Langflow And Rails Under Attack

SPEAKER_00 1:27

you. Volchek is watching active exploitation of critical bugs in Langflow and Ruby on Rails. Against Langflow, attackers pull environment variables for OpenAI and AWS keys, read secret files, and check SSH history. Volchek saw more than 50 hits in a few hours on August 30th, then 360 by Monday, mostly from Russia against UK canaries. On Rails, CVE 2026-66066 abuses how Active Storage and Libvips disagree on uploaded images. An activity is already hitting canaries in Singapore, Israel, and the UK with C2 in Israel. AI builder platforms are not sandboxes, they are credential vaults with a web UI patch lang flow, patch rails image handling, and assume anything internet facing with model keys is already being

Team PCP Supply Chain Arrests

SPEAKER_00 2:11

scanned. Australian Federal Police arrested two men from Western Australia, ages 21 and 23, tied to Team PCP, the crew behind the long-running open source supply chain and extortion spree. Krebs on security reports the group planted malware in hundreds of packages, ran the self-propagating shy hulued worm, and turned compromised developer tools into more compromised developer tools. They also hit AI infrastructure by poisoning Light LM, harvesting cloud keys from more than 2,500 organizations, and later claimed thousands of GitHub repos after a poison extension. Google Threat Intelligence calls Team PCP less a single gang than a peer community with one center of gravity. Arrests do not unpoison the packages already in your lock file. Audit what your build still trusts.

Cosmos EVM Multi Chain Drain

SPEAKER_00 2:53

Cosmos Labs says a critical balance bug in the shared Cosmos EVM module was exploited across six blockchains between August 20th and 25th. The flaw was reported in April. By mid-August, the team knew every Cosmos EVM chain was at risk, then still used its public silent patch path instead of private emergency distribution. Attackers triggered an unchecked balance wrap to roughly two to the 256th and drained funds where permissionless vesting accounts were allowed. Fixes shipped August 19th. Operators who cannot upgrade are told to halt the chain. Knowing the blast radius and still shipping the quiet patch is how a research finding becomes a multi-chain

The Pattern And What To Do

SPEAKER_00 3:28

incident. A stolen AI key on a personal box. Malware that argues with your analyst model. Live exploitation of AI builder stacks, a supply chain crew finally in handcuffs, and a blockchain bug everyone knew about before the drains began. The pattern is familiar systems, trusted enough to skip the boring controls. That's the briefing. Stay sharp, keep your systems patched, and we'll see you tomorrow.