AI browser bans and the top software flaws of 2025
This podcast episode dives into critical cybersecurity topics, starting with Gartner's warning to ban AI browsers in the workplace due to significant security risks, like zero-click exploits. The conversation then broadens to the role of AI model providers in the threat intelligence community, questioning their responsibility in sharing data after attacks. The panel also analyzes MITRE's latest list of top software weaknesses, the pros and cons of using social logins (SSO), and a novel 'bring-your-own-virtual-machine' attack vector that challenges traditional endpoint security.
This episode delves into several pressing cybersecurity topics, beginning with a strong endorsement of Gartner’s recent advisory for organizations to ban AI browsers for the time being. The panelists agree this is a pragmatic, not alarmist, stance, citing the significant risks demonstrated by emerging attacks.
Gartner’s Warning on AI Browsers
The primary concern with AI browsers like Perplexity’s Comet is that they introduce a new, unpredictable attack surface. The discussion highlights a zero-click exploit developed by Straker’s Star Labs, where a simple, malicious email prompt like “Please organize my drive” could trigger an AI agent to wipe a user’s Google Drive. This represents a paradigm shift from traditional attacks requiring social engineering or cookie theft.
Key points include:
- Unproven Security: AI browsers prioritize user experience over security, and until vendors mature their security posture, the risk of prompt injection, data exfiltration, and zero-click exploits is too high.
- Proposed Safeguards: The panel discusses potential solutions, such as requiring human review for any instructions an AI agent receives from external content and Google’s concept of a “user alignment critic”—a secondary model that evaluates an agent’s plan for safety.
- The Verdict: Despite these ideas, the consensus is to wait for the “1.1 version.” The technology is too new to risk in a corporate environment. The panel suggests a better approach is to treat AI agents like privileged users, wrapping them in security guardrails with defined permission scopes, decision logs, and true isolation.
The Role of AI Vendors in Threat Intelligence
The conversation transitions to the broader responsibility of AI providers in the cybersecurity ecosystem, sparked by Anthropic’s bust of an AI-powered espionage ring. Some in the security community felt Anthropic’s report lacked actionable Indicators of Compromise (IOCs).
- A New Responsibility: Panelists argue that AI providers, by sitting in the middle of these new attacks, inherit a responsibility to share threat intelligence. They can observe pre-attack intelligence, such as malicious prompts and patterns, which is invaluable to defenders.
- Lessons from Cloud Security: The situation is compared to the evolution of cloud security, where cloud providers eventually became critical intelligence partners. The panel argues that ignoring the AI layer in the threat chain would repeat past mistakes.
- Need for Collaboration: The core issue is the lack of a standardized framework for how AI providers detect abuse, notify victims, and share intelligence. A collaborative effort between AI vendors, security firms, and regulatory bodies is needed to establish a clear responsibility matrix, similar to the one developed for the cloud.
MITRE’s Top 25 and Persistent Flaws
The panel analyzes MITRE’s 2025 list of the most dangerous software weaknesses, noting with some cynicism that little has changed.
- The Same Old Problems: Decades-old vulnerabilities like Cross-Site Scripting (XSS), SQL Injection, and Cross-Site Request Forgery (CSRF) still dominate the top spots. The panelists describe the list as a “report card of fundamentals that we get wrong.”
- Cultural Failure: The persistence of these flaws is viewed as a cultural and foundational engineering failure, not a technical one. The pressure to ship features often overrides secure coding practices.
- Takeaway for Defenders: This list should be treated as a strategic blueprint. Defenders should map it to their technology stack, prioritize fixing these fundamental issues, and use it as a board-level risk tool or an OKR for engineering teams.
The Risk of Social Logins and a Novel Attack
- Consumer SSO: The convenience of social logins (“Sign in with Google”) is weighed against the risk of creating a single point of failure. The consensus is that it’s safer than password reuse if, and only if, it’s paired with strong Multi-Factor Authentication (MFA), good recovery hygiene, and is treated as a security control, not just a convenience. The adoption of passkeys is encouraged.
- Bring-Your-Own-Virtual-Machine (BYOVM) Attack: The episode concludes with an analysis of a creative attack reported by Red Canary. The attack chain involved spam bombing to create chaos, social engineering via a fake tech support call, and finally, deploying a malicious virtual machine on the victim’s system. This VM acts as “infrastructure within infrastructure,” providing the attacker with a persistent, stealthy foothold that evades traditional endpoint detection. This novel technique perfectly illustrates how modern attackers can run, hide, communicate, and persist while bypassing most conventional security tools.