Video summary

The Apex Agentic Adversary - Visual Prompt Injection Strikes

Main summary

Key takeaways

News and Commentary

Summary of “Security Now” (Episode 1086): Key arguments and reports

1) “Fable 5” performance changes: likely over-aggressive safety guardrails

Steve Gibson discusses coverage (via BleepingComputer) that, after a restored release, Anthropic’s Claude “Fable 5”-class model is being “nerfed” in practice. Users report it either:

  • falls back to an older model (Opus 4.8), or
  • triggers refusals more often than expected.

Reported symptoms include:

  • Difficulty with security- and code-adjacent tasks (e.g., C/C++/Rust references, Win32 API, memory/security/vulnerable/unsafe language)
  • Increased false positives—cases where “no safety risk” appears present, yet stricter filters activate anyway

Gibson’s analysis: the model likely isn’t inherently worse. Instead, the safety system is likely being tuned with a large safety margin, causing unnecessary blocks. He argues this is a downstream consequence of the inherent difficulty of controlling LLM behavior using simple guardrails/classifiers.

2) Visual prompt injection (“inkject”) bypasses text-based guardrails

The show highlights Deepkeep research on inkject, a form of visual prompt injection where malicious instructions are embedded in images.

Core claim: AI safety systems that block text prompts can fail when the malicious instructions never appear in the text layer. Instead, they’re interpreted by the model’s visual capabilities first.

The attack is described as:

  • Indirect: the user doesn’t need to knowingly provide the malicious image; it can be fetched from a public repository as a normal step in an “agentic” workflow.
  • Stealthy: the model completes the intended task while also performing unauthorized actions. Example: creating a privileged admin account during website deployment.

Reported testing: models named in the subtitles were all vulnerable, including OpenAI and Anthropic variants. OpenAI/Anthropic were reportedly notified ahead of publication.

Gibson takeaway: guardrails may vary in quality across providers, so users should assume non-top-tier systems could be exploitable in ways that indirectly harm end users.

3) Chrome 150 security: unusually massive patch volume

Gibson notes that Chrome 150 ships with 433 security fixes, including 20 critical vulnerabilities.

Key points he emphasizes:

  • The patch list is dominated by memory-corruption classes (e.g., use-after-free, out-of-bounds reads/writes, heap buffer overflows)
  • Improved vulnerability discovery tooling (including AI-assisted discovery) is uncovering many previously unknown issues quickly
  • Chrome 150 also includes post-quantum cryptography support (ML-DSA) and Android credential/passkey related updates in related platform changes

4) EU antitrust: Google’s record fine is upheld; escrow mechanics matter

The EU’s highest court rejects Google’s appeal against a record antitrust fine tied to its conduct in the Android ecosystem.

Gibson reports:

  • The fine is 4.125 billion euros
  • During appeals, fines are placed into escrow, meaning the money is effectively sequestered for years and becomes collectible if appeals fail

This suggests enforcement is not merely symbolic.

5) “Chat control” (CSAM detection) voting remains unresolved and contentious

Gibson discusses the EU’s ongoing “chat control” legislative process, including a “final” vote predicted soon but still unclear due to closed-door trilogues.

His argument:

  • The requirements conflict with privacy law, because enforcing “no illegal communications” necessarily implies broad monitoring.

Additional signals he notes:

  • High opposition from major vendors
  • Concerns about nontrivial false positives for AI-based detection
  • Indications that some member states may be more willing to pass it this time

6) Browser security feature: Opera introduces “Paste Protect” against clickfix clipboard attacks

Opera adds a built-in defense called Paste Protect to warn/block suspicious clipboard changes designed to trick users into running malicious commands.

Gibson frames it as:

  • Clickfix is a significant social-engineering vector
  • Opera’s market share is only about 2%, so he argues the “real fix” should be upstream at the OS level—specifically through Microsoft/Windows clipboard trust/origin controls

Even so, he views Opera’s solution as a step forward.

7) Windows “Blue Hammer” Defender escalation is being exploited in ransomware campaigns

Gibson covers CISA confirmation that the Blue Hammer local privilege escalation vulnerability in Microsoft Defender has moved from theoretical/zero-day usage into active ransomware exploitation.

He criticizes the timeline mismatch:

  • Microsoft patched it in mid-April
  • Yet CISA’s directive windows and still-late exploitation imply many systems remained unpatched for months

Message: patching remains the only real protection, even if the exploit complexity is non-trivial.

8) FAT filesystem (FATFS) supply-chain bug blast: “apex agentic adversary” framing

The episode’s closing major story ties to the title’s meaning:

  • RunZero (co-founded by HD Moore) published research on seven severe FATFS vulnerabilities with a “large blast radius”
  • FATFS is widely used in embedded systems because it’s portable and permissively licensed; many vendors vendor it into firmware

Gibson emphasizes:

  • Remediation is effectively hard at scale because there’s no strong patch distribution model
    • no reliable CVE history/patch-notification mechanism in the usual sense
    • patching depends on downstream vendors
  • Exploitation can be triggered by crafted FAT images inserted into systems (the “evil SD card” scenario)
  • Or exploitation can be delivered via update pipelines that mount untrusted FAT-formatted content

HD Moore’s quoted concept (as relayed): suppressing these issues “quietly” becomes increasingly difficult in the era of AI-assisted auditing—leading to an “apex agentic adversary,” where defenders and attackers can both scale vulnerability discovery.

9) Agentic offensive security and “agentic pen testing”

Sponsors and commentary reinforce a broader theme: security testing is moving toward continuous, autonomous testing.

The discussion frames Expo/agentic pen testing (autonomous offensive security) as a way to validate exploitability and attack paths faster than traditional, human-driven pentesting.

Presenters / contributors (as named in the subtitles)

  • Steve Gibson
  • Leo Laporte
  • Lisa (referred to repeatedly during sponsor/host segments)
  • Vinton (Vint) Cerf (discussed via TechCrunch coverage)
  • Robert Khan (credited with early internet work alongside Cerf)
  • Dave Patterson (UC Berkeley)
  • HD Moore (RunZero; quoted)
  • Todd Beardsley (RunZero VP security research)
  • Will Dorman (Thoros principal vulnerability analyst; quoted)
  • Elay Ferris (credited for human transcription: “written by an actual human”)
  • Kyle Spiran (Bitwarden co-founder; creator referenced)
  • Harold Dwight Moore (identified as HD Moore)

Original video