By playing, you agree to uListen's Terms and Privacy Policy and YouTube's Terms of Service.
On with Kara SwisherThe terrifying AI cyber threat no one is ready for
Summaries, chapters, transcripts, and FAQs on this page are made by uListen, not YouTube.
CHAPTERS
Chapter summaries
From “everything everywhere all at once” to an AI-accelerated threat landscape
Kara Swisher revisits Nicole Perlroth’s earlier warning about simultaneous cyberattacks on U.S. critical infrastructure and asks what has changed. Nicole says the underlying pre-positioning is still happening, but the pace and scale of capability is shifting due to AI.
- •Kara frames Nicole’s prior concern about simultaneous critical-infrastructure cyberattacks
- •Nicole says “everything’s changed” in the last year even though the core risk persists
- •Chinese hackers’ pre-positioning remains a central concern in her view
- •The conversation sets up AI as the major accelerant in what comes next
Chinese pre-positioning in critical infrastructure—and what detonation could look like
Nicole describes ongoing activity she attributes to Chinese hackers establishing access in key U.S. infrastructure sectors. She explains the feared scenario: multiple systems being hit at once, potentially as geopolitical leverage.
- •Nicole lists targeted areas: water, power, pipelines, high-speed rail, aviation, ports, and logistics
- •She describes the nightmare as coordinated “detonation” of existing access across the country
- •She says she previously thought widespread detonation would be unlikely except around a Taiwan scenario
- •She suggests even limited actions like “flicker the lights on and off” could be used as coercion
The “Mythos era”: AI models that write code—and can exploit it
Nicole explains what she calls the “Mythos era,” describing an Anthropic model built to write code that can also be used to find and chain vulnerabilities. She relays what she learned from interviewing Anthropic’s red teamer about how this changes who can conduct advanced exploitation.
- •Nicole describes Mythos as designed to write code but able to exploit code as a byproduct
- •She says it can find vulnerabilities across major operating systems and browsers and chain exploits
- •She recounts capabilities described to her: directing victims to a website to gather banking activity and extracting photos from a phone without unlocking it
- •She argues AI enables capabilities once limited to elite nation-state operators and their contractors
Who becomes dangerous when elite hacking tools become widely accessible
Kara and Nicole discuss how AI shifts risk from a small set of strategic actors to a broader pool. Nicole says the biggest concern is tier-two and tier-three states that previously relied more on social engineering and are now empowered by these models.
- •Kara suggests AI could put powerful tools in the hands of “chaos” actors
- •Nicole cites Nicholas Carlini’s view: tier-one states already had much of this capability
- •Nicole highlights concern about Iran and North Korea gaining new exploitation abilities
- •They frame AI as a productivity and access multiplier for less-capable adversaries
North Korea’s cyber evolution: from Sony destruction to bank theft and crypto heists
Nicole traces North Korea’s trajectory from the Sony Pictures attack to increasingly sophisticated financial operations. She argues North Korea learned it could use cyber operations for maximum impact and to generate revenue despite sanctions.
- •Nicole says the Sony attack severely disrupted Sony’s operations and damaged server capacity
- •She describes how North Korea learned to map networks, find “crown jewels,” and decide on maximal impact
- •She recounts the Bank of Bangladesh/SWIFT intrusion and the $81 million theft from the New York Fed attempt
- •She says crypto became a major opportunity North Korea exploited with sophisticated bridge and exchange heists
The remote IT worker fraud: North Koreans getting hired inside U.S. companies
Kara shifts to Nicole’s podcast investigation into North Korean IT workers infiltrating U.S. firms using false or borrowed identities. Nicole explains how she first heard about bizarre cases where the workers appeared to do little beyond collecting paychecks, then realized the scale was massive.
- •Nicole describes North Koreans applying under stolen or borrowed identities to get remote tech jobs
- •She notes initial incidents seemed “absurd” because some workers “didn’t do anything” beyond earning pay
- •She says the pattern expanded to major defense contractors and agricultural companies
- •Kara references Amazon disclosing a contractor hired a North Korean as an IT systems administrator
Laptop farms and AI-assisted interviews: how the scheme works in practice
Nicole details the operational mechanics: Americans host corporate laptops, enabling North Korean workers to remote in. She describes red flags in interviews—including AI-generated fluent answers—and how investigators test candidates with localized questions or prompts they may refuse to answer.
- •Nicole says some North Koreans steal identities while others pay Americans to loan identities and pass checks
- •Americans host shipped corporate laptops and install remote access tools for a monthly fee
- •Nicole describes interview tells: delayed responses, language barriers, then perfectly fluent answers consistent with chatbot use
- •She lists tactics to expose fraud: fake local references, university mascot questions, and “say something bad about Kim Jong Un”
Inside one cell: Discord coordination, China-based logins, and massive job application volume
Nicole recounts how a security firm deliberately hired a suspected North Korean with spyware on the laptop to observe operations. She says investigators accessed a Discord-based backend, linked activity to China, and discovered a high-volume job-application pipeline.
- •A security firm hired a suspected North Korean intentionally and sent a monitored laptop
- •Nicole says the worker logged into Discord used to manage the broader operation
- •Investigators inferred physical hosting in Florida while concluding logins originated from China
- •Nicole says one cell of 22 people applied to 160,000 U.S. jobs over three months
Motives, monetization, and why the problem spills beyond cybersecurity into HR
Nicole argues the initial motive was steady income rather than immediate theft, helping fund larger operations like crypto heists. She says as companies get better at detecting the scheme, some actors may shift toward extortion or data theft—and that screening remote workers is becoming the weak link.
- •Nicole says the original goal was paychecks—stable funding to support longer-term heists
- •Kara and Nicole discuss that access could be monetized later even if it wasn’t initially
- •Nicole says increased awareness is leading companies to find red flags and fire infiltrators
- •She characterizes it as largely an HR screening issue that may push companies to require in-person presence
Who runs laptop farms—and why the pool may grow with AI-driven job losses
Nicole describes the Americans who host laptop farms, including people with criminal records and others who believe they are running legitimate businesses. She connects the scheme’s appeal to broader economic pressures, suggesting job displacement could expand the pool of willing participants.
- •Nicole says many hosts have serious criminal records and seek quick cash on Reddit or LinkedIn
- •She cites a public case of an Arizona woman, Christina Chapman, hosting dozens of laptops
- •She describes meeting a host in Cincinnati and notes hosts may not know they’re aiding North Koreans
- •Nicole predicts the pool of participants could expand as AI contributes to job losses
China’s cyber upleveling: state funneling of vulnerabilities and stealth operations
Nicole contrasts earlier, loud Chinese phishing campaigns with today’s more sophisticated state-directed operations. She describes legal and structural mechanisms that funnel vulnerability discoveries to the state and points to operations that target telecom backbones and critical infrastructure.
- •Nicole recounts earlier Chinese operations as brazen phishing that became quieter over time
- •She says Chinese laws require vulnerability discovery to be offered to the state first
- •She describes talent from hacking competitions funneling into state capabilities
- •She points to Salt Typhoon and Volt Typhoon as harder-to-defend operations targeting security devices, zero-days, telecom, and critical systems
AI cooperation with China: red lines that didn’t hold and a “dangerous game of chicken”
Kara asks whether the U.S. and China can realistically cooperate on AI governance. Nicole expresses skepticism based on years of failed attempts to establish limits on hacking, and she discusses information operations that exploit U.S. cultural conflicts around data centers.
- •Nicole calls U.S.–China dynamics a “dangerous game of chicken” and wishes for new “technological diplomats”
- •She describes prior efforts to set red lines around hacking civilian water systems that were rejected
- •She argues China wants to be the backbone of AI infrastructure and references DeepSeek as strategic
- •She cites a report described as showing Russia and China amplifying data center issues as a wedge in U.S. culture wars
Naming and shaming hackers: impact, numbness, and the deterrence problem
An outside question asks whether public attribution still matters. Nicole says attribution had effects at times, including a period of reduced Chinese IP theft, but also may have pushed operations underground; she still argues critical infrastructure intrusions demand attention even as the public becomes numb.
- •Nicole says naming and shaming helped drive an Obama-era deal that reduced certain hacking for a time
- •She says activity resumed later in more sophisticated and stealthy forms
- •She argues critical infrastructure pre-positioning warrants near-daily coverage and attribution
- •She acknowledges growing numbness and a lack of meaningful deterrence
AI transforms offense and defense: deepfakes, scalable social engineering, and machine-speed attacks
Nicole describes early AI cyber use as social engineering and deepfakes, then pivots to AI-driven vulnerability discovery and exploitation at scale. She also outlines the hope that AI can strengthen defense by improving code, configuration, authentication, and vendor risk management.
- •Nicole lists AI-enabled attacks: targeted phishing in perfect English, audio and video deepfakes, and wire-transfer scams
- •She says AI allows these tactics to run at scale and grants skills previously limited to top-tier services
- •She predicts an “everything, everywhere” era where attackers operate at machine speed without fatigue
- •She highlights defensive opportunities: secure code, configuration, MFA at scale, and vendor interrogation
Anthropic vs. the U.S. government: model restrictions, “beefing,” and using frontier models to test ourselves
Kara and Nicole discuss tensions around Anthropic, government restrictions on model access, and disputes framed as Silicon Valley rivalries. Nicole argues that pulling models can hurt collective defense, because using these tools to find vulnerabilities in our own systems is a key near-term strategy.
- •Kara describes government limits on Mythos and Fable 5 and the back-and-forth over restored access
- •Nicole calls the situation a “giant” mess and contrasts it with what she sees as real supply-chain risks
- •She says Anthropic acted responsibly by withholding once it saw exploitation capabilities; she sought clarity by interviewing Nicholas Carlini
- •She argues the best defense is to aim frontier models at our own systems to find and eliminate vulnerabilities, and limiting allies’ access undermines that effort
Glasswing-style access and the reality check: critical infrastructure cyber posture is still “terrible”
Nicole reacts to a clip from Nicholas Carlini and discusses the idea of selectively providing powerful models to help defenders prepare. She says giving critical sectors advance, controlled access to red-team tools could help, but warns baseline cybersecurity in critical infrastructure remains weak.
- •Nicole describes Project Glasswing as a partial policy approach: limited access for testing and preparation
- •She acknowledges risks like jailbreaks but argues controlled testing offers a defensive head start
- •She mentions emerging agent-based tools that mimic adversaries for testing systems
- •She says critical infrastructure cybersecurity remains in poor condition despite the need to improve quickly
Election security and hollowed-out institutions: CISA, disinformation teams, and a voter-roll nightmare scenario
Nicole describes her experience advising CISA and praises its work during the lead-up to Russia’s invasion of Ukraine, then expresses dismay at cuts and firings that weaken U.S. cyber readiness. She also outlines a nightmare election scenario involving voter-roll manipulation or AI-enabled disinformation targeting key counties in key states.
- •Nicole says she joined CISA’s advisory board under Biden and saw effective public-private coordination
- •She describes being removed from the committee and says CISA has since been hollowed out
- •She credits the FBI cyber division as strong but says it is carrying a heavy load
- •She describes a nightmare election hack: changing voter registration status in key counties, and also a disinformation version that tricks voters into thinking they’re not registered
Is cybersecurity still bipartisan—and what it would take to change the trajectory
Kara asks whether cybersecurity remains bipartisan amid politicization and institutional erosion. Nicole says it’s politicized at the White House but still collaborative below that level, while noting intimidation and threats drive qualified people away; she suggests meaningful change may require a major shock.
- •Nicole says cybersecurity is no longer bipartisan at the White House but remains collaborative among staffers and industry CISOs
- •She links politicization to fights over misinformation/disinformation tracking and fallout such as threats against workers
- •She describes deterrents to public service: death threats, swatting, and personal risk for families
- •She says “someone has to go,” and Kara suggests it may take a devastating attack to force change
