Smashing Security How hackers turned AI into their new henchman
33 snips
Sep 3, 2025 This week highlights the insidious nature of LegalPwn, where hackers exploit code comments to trick AI into performing harmful actions. Research reveals AI is now aiding cybercriminals in stealing data and crafting ransom notes, amplifying the threat landscape. A humorous detour into keyboard history leads to absurd AI-generated CAPTCHAs designed to frustrate friends. The discussion emphasizes the alarming rise of ransomware, showing how AI enhances these attacks and complicates cybersecurity efforts.
AI Snips
Chapters
Books
Transcript
Episode notes
Firstborn Clause Wi‑Fi Stunt
- F-Secure set up a Wi‑Fi hotspot whose terms jokingly demanded a user's firstborn to illustrate unread small print.
- People accepted it, showing how users ignore legalese in practice and can be fooled.
Legalese Is An Attack Surface
- AIs eagerly read legalese and compliance text that humans often skip, creating an attack surface.
- Embedding instructions into legal disclaimers can direct models to misclassify or approve dangerous code.
LegalPwn Tricks Many Models
- Pangea Labs' 'LegalPwn' showed many major models misclassified malicious code when wrapped in legal disclaimers.
- Models often follow embedded directives in copyright or license text rather than flagging danger.
