By playing, you agree to uListen's Terms and Privacy Policy and YouTube's Terms of Service.

The terrifying AI cyber threat no one is ready for

AI is putting nation-state hacking tools in the hands of cybercriminals. Cybersecurity expert Nicole Perlroth joins to explain why she believes we're entering an "everything, everywhere, all at once" era of cyberattacks—and why the next…

Nicole PerlrothguestKara Swisherhost

Jul 16, 202654mWatch on YouTube

Summaries, chapters, transcripts, and FAQs on this page are made by uListen, not YouTube.

Transcript

50 min read · 9,795 words

0:00 – 0:19
Intro
1. NPNicole Perlroth
  If you had asked me, "Hey, what is the nightmare, you know, next, uh, chapter of this thing?" I would've written a book that didn't look that different [chuckles] from the era we are entering right now.
2. SPSpeaker
  [upbeat music] It is on.
0:19 – 1:16
From “everything everywhere all at once” to an AI-accelerated threat landscape
1. KSKara Swisher
  Hi, everybody. Today, I'm talking to cybersecurity expert Nicole Perlroth. We're talking about some of the m- terrifying digital threats facing America, including how North Korean operatives are infiltrating companies like Amazon. It's really important to talk to Nicole right now because the upcoming midterm elections are going to swing a little bit on cybersecurity, which the Trump administration seems to not care about. I wonder why. This is a surprising and critical conversation, so stick around. Nicole, thanks for coming on, "On."
2. NPNicole Perlroth
  Thanks so much for having me. It's so good to be back.
3. KSKara Swisher
  When you were on the show just over a year ago, you said you were most concerned about, quote, "Everything everywhere all at once cyber scenario, or multiple simultaneous cyberattacks on critical infrastructure." In a short period of time, we've experienced more geopolitical instability and rapid advances in AI. But so far, we've avoided this worst-case scenario. I- is that still your number one worry? Talk a little bit about what's changed in a year.
1:16 – 2:09
Chinese pre-positioning in critical infrastructure—and what detonation could look like
1. NPNicole Perlroth
  Uh, everything's changed. You know, last year I was saying we were worried about this quote, you know, "Everything everywhere all at once cyber scenario" based on what we were actually seeing Chinese hackers pre-positioning.
2. KSKara Swisher
  Mm-hmm.
3. NPNicole Perlroth
  Which, to jog everyone's memory, and it's still happening, is water, power, pipeline infrastructure-
4. KSKara Swisher
  Mm-hmm
5. NPNicole Perlroth
  ... high-speed rail, aviation, ports, logistics. That's all-
6. KSKara Swisher
  Right
7. NPNicole Perlroth
  ... still happening. So we had to contemplate this, you know, nightmare scenario of what would happen if all of these hackers sort of detonated on the access they have all at once. So it wouldn't just be one colonial pipeline, but, you know, hacks on critical infrastructure across the country. I always thought that it was unlikely that they would detonate on all these things at once unless they were making a move on Taiwan and they wanted us to think twice about whether we wanted to support this island 7,000 miles away, and that
2:09 – 3:32
The “Mythos era”: AI models that write code—and can exploit it
1. NPNicole Perlroth
  even in that case, they would maybe go for, you know, one water treatment facility and a power grid hack here or there, just flicker the lights on and off. Okay. The problem is [chuckles] now we're in the Mythos era, and-
2. KSKara Swisher
  Explain what that is for people who don't know, the Mythos
3. NPNicole Perlroth
  ... so Mythos is, you know, this new Anthropic model, new-ish at this point Anthropic model, that wasn't designed to exploit code. It was actually designed to write code.
4. KSKara Swisher
  Mm-hmm.
5. NPNicole Perlroth
  But as a byproduct, it can exploit code.
6. KSKara Swisher
  Mm-hmm.
7. NPNicole Perlroth
  Which means it can find vulnerabilities in every major operating system, every browser, and chain them together into an exploit so it can do things like... And by the way, I interviewed the head red teamer at Anthropic, so I'm a little bit close to the capability.
8. KSKara Swisher
  Okay.
9. NPNicole Perlroth
  And I said, "Describe the capabilities that this model has in plain English." He said, "It's the type of thing where I can direct you to a website and gather all your banking activity. I can pull the photos off your phone without you unlocking it. We have found exploits using this model in most major operating systems, most browsers, um, et cetera, et cetera, et cetera." And these are capabilities that I, you know, the expert, as a human, would
3:32 – 5:12
Who becomes dangerous when elite hacking tools become widely accessible
1. NPNicole Perlroth
  never have found otherwise. The model is finding these. And so the problem is now these models can do what only previously the tier one elite nation-state intelligence or their contractors could do.
2. KSKara Swisher
  Therefore-
3. NPNicole Perlroth
  Um-
4. KSKara Swisher
  ... and may not have done. Just, they're just using it as a strategic advantage versus-
5. NPNicole Perlroth
  Exactly
6. KSKara Swisher
  ... they would do it.
7. NPNicole Perlroth
  Exactly.
8. KSKara Swisher
  And the people that can now do it are kind of crazy people, possibly, or just-
9. NPNicole Perlroth
  Exactly
10. KSKara Swisher
  ... chaos monkeys or whatever.
11. NPNicole Perlroth
  Yeah, exactly. And when I asked this red teamer at Anthropic, Nicholas Carlini-
12. KSKara Swisher
  Mm-hmm
13. NPNicole Perlroth
  ... "Who do you worry about the most?" He said, "Well, on some level, the tier ones already have had this capability." You know-
14. KSKara Swisher
  Mm-hmm
15. NPNicole Perlroth
  ... obviously the models will increase their productivity. But you have to worry about these sort of tier two, tier three nation-states like Iran, like North Korea, that have never had this capability before, but have done pretty well with just social engineering, are now gonna have the ability to break in essentially anywhere they want.
16. KSKara Swisher
  So, um, let's talk about your new season of your investigative podcast, To Catch a Thief, which focuses, speaking of chaos monkeys, on how North Korean IT workers have successfully infiltrated m- major US companies. We're gonna talk m- about Mythos more later, but cybercrime is now a key part of the North Korean economy. People may remember the 2014 cyberattack on Sony Pictures carried out by a North Korean government-backed group. Talk about the advancements in North Korea's cybercriminal operations, uh, in th- those years, and in what way does the D, uh, PRK influence other adversaries? 'Cause they're sort of the out-front group here.
5:12 – 9:38
North Korea’s cyber evolution: from Sony destruction to bank theft and crypto heists
1. NPNicole Perlroth
  Yeah. So, you know, they came on the scene with Sony, and I think-
2. KSKara Swisher
  Mm-hmm
3. NPNicole Perlroth
  ... if I remember, I think it was All Things D-
4. KSKara Swisher
  Mm-hmm
5. NPNicole Perlroth
  ... that broke that it was a North Korean cyberattack.
6. KSKara Swisher
  Yes, that was me.
7. NPNicole Perlroth
  Uh-
8. KSKara Swisher
  That was me.
9. NPNicole Perlroth
  Yeah.
10. KSKara Swisher
  That was Kara Swisher. [chuckles]
11. NPNicole Perlroth
  Your, your old, uh-
12. KSKara Swisher
  Yeah
13. NPNicole Perlroth
  ... yeah, Kara Swisher, I broke that one.
14. KSKara Swisher
  When I was a reporter, back in the day-
15. NPNicole Perlroth
  Yeah
16. KSKara Swisher
  ... when I was a reporter.
17. NPNicole Perlroth
  Yeah.
18. KSKara Swisher
  Yeah.
19. NPNicole Perlroth
  You know, most people remember that attack, but as I s- kind of say in the podcast, few people remember it for what it actually was because most people remember the leaks and sort of the absurdity-
20. KSKara Swisher
  And the dumb-
21. NPNicole Perlroth
  ... of it all
22. KSKara Swisher
  ... arguments between the studio heads over stupid things, yes. Right, the emails.
23. NPNicole Perlroth
  Exactly. Yeah. But what they don't really remember is that these Ch-- uh, sorry, North Korean hackers decimated 70% of Sony's server capacity. You know, no one could get on email, no one could get on their devices. People were using fax machines, pen and paper. It was, it was hugely destructive. And what the North Koreans learned from that attack is, "Okay, we can do this." You know?
24. KSKara Swisher
  Mm-hmm.
25. NPNicole Perlroth
  "We can get into an organization with social engineering, we can basically map their network, find the crown jewels, and then we can decide what to do with those crown jewels for maximum impact." In this case, it was-
26. KSKara Swisher
  Right
27. NPNicole Perlroth
  ... to embarrass Sony and keep them-
28. KSKara Swisher
  It's about a movie
29. NPNicole Perlroth
  ... from releasing this ridiculous movie.
30. KSKara Swisher
  It was about a movie. Yeah.
9:38 – 10:49
The remote IT worker fraud: North Koreans getting hired inside U.S. companies
1. KSKara Swisher
  So how did your invest-- So they're getting better, and they're using crypto to do so. They're, they had their usual schemes, the phishing, the hacking, um, but th- this is a, a, a quantum l- level up. So talk about how, how did the investigation to the North Korean remote IT worker fraud begin? And, um, just for people who don't know, last year Amazon said one of its contractors hired a North Korean as its IT systems administrator. Talk about that.
2. NPNicole Perlroth
  Yeah. So this is super weird. Um, and I started hearing about this about two years ago. You know, some CISOs, some chief information security officers, started telling me, "You won't believe what happened. We actually accidentally hired a North Korean who had applied as a, you know, full stack developer under someone else's identity." I was like, "That's kinda weird, you know. What did they do?" The weird thing was, Nicole, they didn't do anything. They were actually just there for the paycheck. So it kinda was just the kind of this bizarre, absurd thing. And then I started hearing about major defense contractors having this issue, major ag companies.
3. KSKara Swisher
  So it was Kor- North, North Koreans pretending to be someone else in order to get a job?
4. NPNicole Perlroth
  Yes.
5. KSKara Swisher
  Okay.
10:49 – 13:06
Laptop farms and AI-assisted interviews: how the scheme works in practice
1. NPNicole Perlroth
  And in some cases, they are stealing identities to get these jobs.
2. KSKara Swisher
  Mm-hmm.
3. NPNicole Perlroth
  In other cases, they are paying Americans to loan out their identities.
4. KSKara Swisher
  Their identities, yeah.
5. NPNicole Perlroth
  Um-
6. KSKara Swisher
  Yeah
7. NPNicole Perlroth
  ... yeah, and pass background checks. And they are finding Americans to host their corporate laptop.
8. KSKara Swisher
  Mm-hmm.
9. NPNicole Perlroth
  So the employer will ship a laptop to this American, who gets, you know, $100 a month per laptop.
10. KSKara Swisher
  Mm-hmm.
11. NPNicole Perlroth
  And then that American will download some remote app that lets the North Korean remote in, and the North Korean pays them, you know, some nominal fee-
12. KSKara Swisher
  Yeah, this is, this-
13. NPNicole Perlroth
  ... and then is basically able to, to do what they need to do to do the job.
14. KSKara Swisher
  So th- this is Americans who operate what are known as laptop farms. Um, and so-
15. NPNicole Perlroth
  Yes
16. KSKara Swisher
  ... they're working for the, the DPRK, but not-- it's the DPRK that's working their laptops that they set up.
17. NPNicole Perlroth
  Exactly. And so I started digging into this, and at one point, I partnered with a security firm called Nisos that had been triaging some of these cases for Fortune 100 companies, and then posted a job for an AI developer and ended up, uh, getting a response from what they believed was a North Korean. So they-
18. KSKara Swisher
  Why did they believe that?
19. NPNicole Perlroth
  ... confirmed it was a North Korean. Oh, it was, you know, all the red flags. It was someone who comes on, and there's a slight delay in their answer, and there's clearly a language barrier, but then their answer is ... spoken in perfectly perfect English. Um, and it's clear they're using some kind of AI chatbot to answer these questions. And in this case, they actually, because they sort of suspected as much, they brought him back for a second interview, and they asked him questions like, "Oh, I see you're in Florida. You know, how'd you weather Hurricane George?" And there's this kind of delay, and then they say, "Oh, you know, we did, we, we did fine. A few branches came down here and there, but we were just fine." And there was no Hurricane George, that kind of thing. And so-
20. KSKara Swisher
  That's how you catch a thief on the spy
21. NPNicole Perlroth
  ... that's how you catch a thief.
22. KSKara Swisher
  Yeah.
23. NPNicole Perlroth
  So you, so they ended up sending him a laptop-
24. KSKara Swisher
  Do you like the Manhattan Dodgers? But go ahead, sorry.
25. NPNicole Perlroth
  [laughs] No, it's a lot of that. It's like-
26. KSKara Swisher
  Yeah
27. NPNicole Perlroth
  ... that's how you catch these guys.
28. KSKara Swisher
  Yeah.
29. NPNicole Perlroth
  It's like, "What was your university mascot?" was one-
30. KSKara Swisher
  Yeah, mm-hmm
13:06 – 14:45
Inside one cell: Discord coordination, China-based logins, and massive job application volume
1. NPNicole Perlroth
  Uh, but, you know, in this case, they hired him deliberately.
2. KSKara Swisher
  Yeah.
3. NPNicole Perlroth
  And they sent him a laptop that had spyware on it.
4. KSKara Swisher
  Mm-hmm.
5. NPNicole Perlroth
  And this guy that they hired basically logged into his Discord account, and so-
6. KSKara Swisher
  Mm-hmm
7. NPNicole Perlroth
  ... they were able to get into his Discord account, and it turns out that's where they were managing their whole backend operation, and it was this entire cell.
8. KSKara Swisher
  So the guy was a North Korean. This was a la- American laptop farm that did it, or this was a corporation that they were trying to get into?
9. NPNicole Perlroth
  So the security farm hired a North Korean that was using an American-
10. KSKara Swisher
  O- on purpose
11. NPNicole Perlroth
  ... to host his laptop.
12. KSKara Swisher
  Right, got it. Okay.
13. NPNicole Perlroth
  Yeah, in Florida.
14. KSKara Swisher
  Right.
15. NPNicole Perlroth
  So they could, they had, you know, they could see through the camera that they were sitting in a basically, like, container store type closet somewhere in-
16. KSKara Swisher
  Mm-hmm
17. NPNicole Perlroth
  ... Florida. And then they could, they sent him something that could cut through his VPN and show that actually he was logging in from China, which is where a lot of these North Korean IT workers are based. And then through this guy's own credentials that he stored in his Gmail account, they were able to get into this Discord channel where they organized their whole cell operations, and it was one cell of 22 people. But the pertinent thing is they were only able to keep this guy for three months 'cause they couldn't actually pay him, because that would be sanctions, um, uh, against sanctions. And just in those three months that they had access to this Discord channel, this one cell of 22 North Korean fake IT workers applied to 160,000 jobs just in the United States.
18. KSKara Swisher
  So they're trying to get an in filter.
19. NPNicole Perlroth
  And that's when I realized the scale of this. Yeah.
20. KSKara Swisher
  Yeah.
21. NPNicole Perlroth
  The scale of this-
22. KSKara Swisher
  And the, and the goal is to-
23. NPNicole Perlroth
  ... is insane
24. KSKara Swisher
  ... steal.
14:45 – 16:05
Motives, monetization, and why the problem spills beyond cybersecurity into HR
1. NPNicole Perlroth
  The goal is-
2. KSKara Swisher
  Fuck up or steal
3. NPNicole Perlroth
  ... to make a paycheck.
4. KSKara Swisher
  Right.
5. NPNicole Perlroth
  So the goal is an, initially-
6. KSKara Swisher
  Mm-hmm
7. NPNicole Perlroth
  ... when the Mandiants of the world would come in and triage-
8. KSKara Swisher
  Yeah
9. NPNicole Perlroth
  ... these cases, they would look. You know, did they plant malware? Did they steal IP?
10. KSKara Swisher
  Right.
11. NPNicole Perlroth
  Did they steal data? And for the most part, and it was really weird, they're just there for the paycheck.
12. KSKara Swisher
  Oh.
13. NPNicole Perlroth
  And my understanding was this is basically a way to get a steady form of funding, like almost like their-
14. KSKara Swisher
  Mm-hmm
15. NPNicole Perlroth
  ... ARR to fund-
16. KSKara Swisher
  Yeah
17. NPNicole Perlroth
  ... sort of these larger hacking crypto heists that can take-
18. KSKara Swisher
  Mm-hmm
19. NPNicole Perlroth
  ... a year in some cases of careful planning.
20. KSKara Swisher
  Right.
21. NPNicole Perlroth
  But-
22. KSKara Swisher
  So they may not be stealing. They want jobs, and they wanna hide themselves.
23. NPNicole Perlroth
  They want jobs.
24. KSKara Swisher
  But they could.
25. NPNicole Perlroth
  And they're taking, like, 12 jobs.
26. KSKara Swisher
  Yeah.
27. NPNicole Perlroth
  They could, and that's the thing, is now that companies like Amazon is talking about this-
28. KSKara Swisher
  Mm-hmm
29. NPNicole Perlroth
  ... Palo Alto Networks is talking about this, CISOs are talking to each other about this because it's really gotten to the point where, as one, you know, person at Mandiant told me, "I have yet to find a company in the Fortune 500 that hasn't-
30. KSKara Swisher
  They don't
16:05 – 20:27
Who runs laptop farms—and why the pool may grow with AI-driven job losses
1. KSKara Swisher
  So who are the Americans hosting the laptop farms?
2. NPNicole Perlroth
  Okay, so this was fascinating. I was like, who are these people that are just taking corporate-
3. KSKara Swisher
  Yeah
4. NPNicole Perlroth
  ... laptops, hosting them in their house? Okay, so I wanted to go meet with one of these people, and the only case that we've really heard about publicly is a woman in Arizona named Christina Chapman, who was hosting something like 60 laptops for the North Koreans. And so I was trying to find others, and it turns out a lot of these people have serious criminal records. They're Americans who, for whatever reason, can't get work. They're posting on a Reddit channel, "Hey, I'm looking for quick cash," and that's where the North Koreans are finding them. Sometimes they post that they're looking for work on LinkedIn, and that's how the North Koreans find them. But a lot of them have criminal backgrounds, which is why they can't get work, and maybe why they're willing to accept laptops from a total stranger.
5. KSKara Swisher
  Yeah, please just put this up and pretend it's you.
6. NPNicole Perlroth
  Yeah. And so for the podcast investigation, I wanted to go meet with one of these people, but their background checks were a little terrifying. But we found one woman in Cincinnati, and I did fly out to Cincinnati and knock on her door, and they let me in. And, you know, it's not like they ever tell these people, "Hey, we're North Koreans." You know, they make up an identity. In some ways, these people are being scammed themselves. But they come up with some reason why they can't be in the US, and they need this person to host their laptop. And some of these Americans that are hosting laptops are vets. Like, some of them are just people who think they're running a legitimate business. One of them had essentially the words laptop farm on their resumes. [laughs] Um, but they're just not asking questions about these people-
7. KSKara Swisher
  Right
8. NPNicole Perlroth
  ... who are willing to send them, you know, quick cash, quick, quick cr- crypto-
9. KSKara Swisher
  Just to sit there
10. NPNicole Perlroth
  ... to host these laptops. Yeah.
11. KSKara Swisher
  They're, they're not doing anything.
12. NPNicole Perlroth
  And what I think is really hard to think about is, like, the pool of those willing Americans-
13. KSKara Swisher
  Mm-hmm
14. NPNicole Perlroth
  ... is only going to get bigger and bigger-
15. KSKara Swisher
  That's right
16. NPNicole Perlroth
  ... as we start seeing more job losses from AI.
17. KSKara Swisher
  Job losses, yeah, 'cause it's easy money. It's easy money, so just be us. Just let, just let's buy your identity, essentially. Um, y- y- l- uh, we're gonna talk a little bit about China and the AI race and cyber threats in a second, but what, what was your conclusion from this, uh, this catching these essentially thieves, but really catching these employees, right? Because they're not thieves yet, they're employees.
18. NPNicole Perlroth
  I think it was a few things. I think one of them is we just take our eye off of North Korea. Um, you know, we caricature them, um, but we should use them as a case study right now because this is the actor that is an early adopter, as they were with crypto and the blockchain, um, that is quite persistent, uh, you know, really good at social engineering, and I have no doubt they're going to be one of the first nation-states that pop up in an AI-powered attack, and we can't take our eye off the ball. This is actually the kind of adversary that we should be paying very close attention to.
19. KSKara Swisher
  Right.
20. NPNicole Perlroth
  The other thing is this really isn't a cybersecurity problem in many ways.
21. KSKara Swisher
  Mm-hmm.
22. NPNicole Perlroth
  It's a, it's becoming one now that they're-
23. KSKara Swisher
  Mm-hmm
24. NPNicole Perlroth
  ... kind of moving towards extortion, et cetera.
25. KSKara Swisher
  Mm-hmm.
26. NPNicole Perlroth
  It's really an HR problem.
27. KSKara Swisher
  [laughs]
28. NPNicole Perlroth
  And it tells you how little we're actually screening some of these remote workers.
29. KSKara Swisher
  Mm-hmm.
30. NPNicole Perlroth
  Like, I want, I want remote work to stay. I love remote work. I think it's wonderful.
20:27 – 23:35
China’s cyber upleveling: state funneling of vulnerabilities and stealth operations
1. KSKara Swisher
  Let's talk about China, uh, uh, a shift to China and rise in cyber dominance. You mentioned them earlier. Um, for at least the last decade, China has targeted US telecom companies, notably the expansive Salt Typhoon attacks. China-backed hackers have also infiltrated critical infrastructure, including water, transport, and grid networks. You've talked about this being the era of, quote, "mutually assured digital destruction," but it sounds like China's gaining advantage in cyber dominance. Talk a little bit about that 'cause this is the argument, of course, all of Silicon Valley is making. So, and others say, "No, it's not as much." But give, give me your assessment of where we are, and if they have the upper hand, and if so, what are the consequences?
2. NPNicole Perlroth
  So they, when I first started covering Chinese cyberattacks against The New York Times, for instance, a decade ago, it was brazen, uh, but it was phishing. You know, it was loud, uh, but it was successful. Um, you know, some people called them the most polite hackers in cyber because they'd almost announce their presence. As we started outing some of these campaigns, they really went underground, and I think really the upleveling moment was when they started using their authoritarianism to their advantage.
3. KSKara Swisher
  [laughs]
4. NPNicole Perlroth
  They basically created a series of new laws that said, "Hey, if you find a vulnerability, you have to give the state right of first refusal."
5. KSKara Swisher
  Mm-hmm.
6. NPNicole Perlroth
  And all these Chinese hackers that I used to see at the big hacking competitions that would show, you know, how to hack into a Tesla or an iPhone or Android stopped showing up on state's orders pretty much.
7. KSKara Swisher
  Mm-hmm.
8. NPNicole Perlroth
  All that knowledge, all that skill started funneling directly to the state.
9. KSKara Swisher
  Mm-hmm.
10. NPNicole Perlroth
  And we started seeing some really significant upleveling and sophistication in some of these Chinese operations-
11. KSKara Swisher
  Mm-hmm
12. NPNicole Perlroth
  ... like Salt Typhoon, like Volt Typhoon.
13. KSKara Swisher
  Chinese state operations, not hackers.
14. NPNicole Perlroth
  Exactly.
15. KSKara Swisher
  Right.
16. NPNicole Perlroth
  And these are much harder to defend against. You know, we started seeing them come for security, uh, devices. We started seeing them find zero days, you know, vulnerabilities no one knew about, using those in the course of their operations, and we're catching them in not only our back-end telecom infrastructure, but in these critical entities like water and power.
17. KSKara Swisher
  Mm-hmm. Right, which is where the... So with their capabilities, this is the, you know, um, both, uh, US and China are locked in this global AI arms race-
18. NPNicole Perlroth
  Yes
19. KSKara Swisher
  ... that has experts on both sides concerned if the two nations fail to cooperate, right? Um, obviously Anthropic and OpenAI are accusing China of copying their AI systems through distillation, and the, uh, Trump, uh, Xi summit in May ended without any meaningful agreements on AI. So where are the... I mean, the biggest argument from Silicon Valley is we must do all these things without any, um, regulations in order to fight the Chinese. Most people that I think are intelligent say we've got to cooperate with them in some way. But w- is there a realistic chance of cooperation between the US and China on AI should it happen? And what do you make of the arguments of people, uh, you know, in Silicon Valley who are like, "It's, you know, it's the Xi or me argument" kind of thing-
20. NPNicole Perlroth
  Yeah
21. KSKara Swisher
  ... that they try to pull?
23:35 – 26:08
AI cooperation with China: red lines that didn’t hold and a “dangerous game of chicken”
1. NPNicole Perlroth
  You know, we are locked in this very dangerous game of chicken.
2. KSKara Swisher
  Mm-hmm.
3. NPNicole Perlroth
  And I wish that we had an entirely new generation of technological diplomats [laughs] that could sit down with Xi and say, "Hey, you know, none of us want the world that we're crashing towards." But I am close to people who've had similar conversations with China on hacking for years, on fentanyl, um, on, more recently on Volt Typhoon, these hacks of our critical infrastructure. Uh, at one point, you know, one of the people I interviewed last season on this, uh, when we were focused on China said they were tasked by the Biden administration to go to China and propose that we set up red lines just around hacking water treatment facilities, water systems, civilian water systems, and their c- their counterparts in China said no. So I don't know if it has changed now that we are slightly ahead on AI, but for how long are we ahead? Um, I think that, you know, the decision to release DeepSeek as an open weight model was intentional. They really want to be the backbone of AI and AI infrastructure. And there's a really interesting report that came out last week that The New York Times covered from a, from a startup called Alethea, where they looked at, um, some of the disinformation campaigns coming out of Russia and China right now, and they are latching onto data centers as an American culture war. I think in part in China's case, China wants to basically play up, you know, some of the fights around NIMBYism and environmental concerns, and all of the legitimate concerns we have around data centers in terms of water use, energy use, contamination. They wanna use that as, that as a wedge issue so that we don't have the data center infrastructure in the United States, that they own that.
4. KSKara Swisher
  Right. Well, it's going into space, Nic- Nicole.
5. NPNicole Perlroth
  That's right. That's right.
6. KSKara Swisher
  [laughs] It's ridiculous.
7. NPNicole Perlroth
  Uh, yeah. Can't wait for that one.
8. KSKara Swisher
  I gotta say, I'm with-
9. NPNicole Perlroth
  Um-
10. KSKara Swisher
  I'm with Sam Altman on this one, on Homeboy. But yeah, anyway, at this moment in time, um-
11. NPNicole Perlroth
  All I'm saying is-
12. KSKara Swisher
  Yeah
13. NPNicole Perlroth
  ... I wish, I wish we were living in a different world where we could actually sit down with them and have these conversations.
14. KSKara Swisher
  Right. Right.
15. NPNicole Perlroth
  And I think hopefully we will once the attacks start coming. Um, but right now I am sort of the, you know, ye of little faith on this issue.
26:08 – 28:34
Naming and shaming hackers: impact, numbness, and the deterrence problem
1. KSKara Swisher
  Every episode we get a question from an outside expert. Here is yours.
2. SPSpeaker
  [whooshing] Hi, Nicole. Your friend Dmitri Alperovitch here, co-founder of CrowdStrike and now chairman of Silverado Policy Accelerator. As you know, I spent a good chunk of my career putting names and faces on the hackers behind cyberattacks, because I believe that naming and shaming them would deter them and mobilize collective government actions against them. From where you sit, do you think that public attribution of cyber intrusions is still important, or have we become so accustomed and numb to it that it no longer serves any purpose? Thank you.
3. KSKara Swisher
  [whooshing] Thoughts?
4. NPNicole Perlroth
  Love Dmitri. Um, you know, the naming and shaming I thought had a big effect, and in some ways it did. We actually saw China go quiet. The Obama administration reached, um, an unprecedented deal with China for a while that we would cease... well, really, they would cease hacking for, uh, intellectual property and trade secrets, and we saw those drop off for about a period of 18 months. But that was during the Obama administration. In came Trump, kinda tossed the tables over, and we saw that resume. And when it resumed, it resumed in a much more sophisticated, well-organized, stealthy way. And so in retrospect, all of that naming and shaming that made them, you know, stop, actually I think just sent them further underground. So there is, you know, a legitimate question to say, what is the long-term benefit really of calling out these operations? I think we have to. You know, I think the fact that China is pre-positioning itself in some of our most critical infrastructure is worthy of almost daily national press coverage, and it hasn't gotten that, which is why I'm doing this podcast [chuckles] in the first place. I've just decided, okay, I'm gonna focus on these issues that I think are super important but are not getting that kind of mainstream coverage, China's hacking of critical infrastructure being one of them. I mean, I, I think it would be a bizarre world if we were catching these Chinese nation-state hackers inside our civilian water systems and for whatever reason saying, "Oh, it's just not worth at- you know, attributing it to China." But Dmitri has a great point, which is we are sort of becoming numb to this, and there's been so little action, and there is really no deterrence.
28:34 – 31:25
AI transforms offense and defense: deepfakes, scalable social engineering, and machine-speed attacks
1. KSKara Swisher
  Let's talk about Anthropic and its ongoing tensions with the U.S. government. We're gonna get into, as you, you mentioned Mythos at the beginning. But, um, talk about how AI has transformed cybersecurity. This is something you had written about w- for these, for Stut- uh, Stu- uh, Stuxnet and everything else. So talk about how it's transformed for both offensive and defensive purposes.
2. NPNicole Perlroth
  So AI in the beginning, you know, it's a really useful social engineering tool. You know, find me a useful target, craft a message in perfect English, um, in some cases create an audio deepfake of someone's voice that this person legitimately knows, like a CFO of a, a major enterprise, and ask them to basically, you know, ask someone in their accounting department to make a wire transfer. All of those things are things that we are seeing. And we are seeing video deepfakes too. We're seeing North Koreans use deepfakes in some of these interviews. Now we're entering a new phase, which is AI is giving hackers this tremendous advantage to pull off everything I just mentioned at scale. It's also giving them the skills to-- that, that they previously didn't have, that previously were just the purview of these tier one nation-states like NSA, you know, U.S.'s NSA and GCHQ, um, Israel, China perhaps, Russia perhaps. It's throwing those skills in the laps of cybercriminals, of these tier three nation-states like North Korea, like Iran, and I think we are about to enter what is truly the everything, everywhere, all at once cyber scenario, which is anyone- Who has any interest in hacking you will now have the tools to do so, whether that is, you know, me pissing off North Korea because of a podcast or Sony, you know, putting out a movie, or anyone that just has some dark interest in watching the world burn will now have these capabilities. And all of them will come at us at machine speed. So on offense, I think it's very clear that AI will give the bad guys the advantage, the offensive advantage. The hope is, though, that AI will also help us defensively to do the things that we, with our puny human minds, were never able to do before, like write secure code, uh, handle configuration, uh, ensure that we have multi-factor authentication turned on-
3. KSKara Swisher
  Right
4. NPNicole Perlroth
  ... at scale.
5. KSKara Swisher
  Right.
6. NPNicole Perlroth
  Uh, you know, make sure that our vendors, at least interrogate our vendors to make sure that they're not our biggest weak points.
7. KSKara Swisher
  Mm-hmm.
8. NPNicole Perlroth
  Um, you know, these are things where AI could create tremendous upleveling on defense.
9. KSKara Swisher
  Mm-hmm.
10. NPNicole Perlroth
  I think it's just a question of what is the delta [chuckles] between-
11. KSKara Swisher
  Between-
12. NPNicole Perlroth
  ... where we are now.
31:25 – 39:17
Anthropic vs. the U.S. government: model restrictions, “beefing,” and using frontier models to test ourselves
1. KSKara Swisher
  So, so, and, and of course, there's this infighting. To me, a lot of what has been happening with the Trump administration is an inside Silicon Valley beef. But Anthropic initially released its Mythos model in April to a limited group of companies for cybersecurity testing. Last month, the Trump administration abruptly banned the foreign use of Anthropic's two most powerful models, Mythos and Fable 5, due to national security concerns, and Anthropl-tropic disabled use for all customers, although Fable 5 is back. Just over two weeks ago, the Trump administration and Anthropic reached an agreement to restore access. Talk a little bit of what's happening here, what's happening internally, 'cause a little bit is, um, is, is again, this beefing among Silicon Valley rivals really. And th- an, an example of that is Anthropic suing the Trump administration after the Pentagon declared it a supply, uh, chain risk. I think that was Emil Michael's doing. Anthropic's CEO, Dario Amodei, before they went back and forth for months with Emil over safety guardrails and the Pentagon's use of AI. Emil famously was fired from Uber for nefarious, a bunch of nefarious actions that, uh, he has denied. Um, talk about what's happening here overall, and how does it end, uh, with the Pentagon, with the White House, and everybody else?
2. NPNicole Perlroth
  Uh, well, I think it's fair to call this a giant shit show. Um, [laughs] I think, I, you know, I don't dispute anything you just said, that I think it comes down to beefing and who's kissed the ring and who hasn't adequately kissed the ring. Um, but man, you know, we have real supply chain risks in the United States, many of which I've called out in my reporting. You know, TP-Link routers were one. DeepSeek is one. These are the real supply chain risks, so I think it says a lot that this administration went for Anthropic, I think, because of these conversations between Pete Hegseth, who I went to college with, and Dario-
3. KSKara Swisher
  Oh, wow.
4. NPNicole Perlroth
  Um-
5. KSKara Swisher
  How was that?
6. NPNicole Perlroth
  Over-
7. KSKara Swisher
  Sorry. Later
8. NPNicole Perlroth
  ... [chuckles] I think they both actually-
9. KSKara Swisher
  Mm
10. NPNicole Perlroth
  ... spent some time at my alma mater.
11. KSKara Swisher
  Mm.
12. NPNicole Perlroth
  Anyway, uh, no, Pete Hegseth, he was famous when we were in college for, um, being part of this right-wing organization that put out this magazine with an owl on the cover-
13. KSKara Swisher
  Mm-hmm
14. NPNicole Perlroth
  ... in, uh, crosshairs. And OWL stood for Organization of Women Leaders.
15. KSKara Swisher
  Oh.
16. NPNicole Perlroth
  So he's always sort of been, um-
17. KSKara Swisher
  That's great. What a charmer
18. NPNicole Perlroth
  ... like this. Yeah.
19. KSKara Swisher
  So he's been a charmer for a long time, yeah.
20. NPNicole Perlroth
  Yeah. Um, anywho, I think it, it, it, you know, this is why, and you've covered this brilliantly, this is why we saw Tim Cook show up with the golden statue. We saw everyone and their wives, uh, and mothers, uh, show up to the White House for the inauguration. This is what they're hoping to avoid. And in this case, you know, apparently Dario didn't play the game, and they are where they are. Now, [exhales] you know, it's, it's amazing to me to have watched, you know, Anthropic do what I think was the responsible action to withhold this model once it saw what its cyber exploitation capabilities were, and then to watch David Sacks sort of disparage it on Twitter, and I think either in an interview with Politico where he said this is all marketing, essentially. But I had the same questions. You know, how much of this is real? How much is, this is marketing? Which is why I went and interviewed Nicholas Carlini, the red teamer at Anthropic. If you listen to that interview, it's clear this guy doesn't have a marketing bone in his body. He's truly just a hacker's hacker who was testing the models to see what they're capable of and came away wide-eyed at what these models can do, and I think Anthropic did the right thing. Now, coming back to the previous question on offense and defense, the best thing we can do defensively in this moment is take Mythos, take Fable, take every model from every major frontier lab, test its exploitation capabilities-
21. KSKara Swisher
  Including the new ChatGPT, correct? And it, there's a new one.
22. NPNicole Perlroth
  Exactly. And Gemini. You know, all of these models now have these capabilities, and soon, again, the open weight models will too. And our best defense is to take them, aim them at ourselves, and see where we are vulnerable, and move very quickly to eliminate those inroads and kill paths. And so when you pull Mythos, or when you prevent our closest allies from having access to those models, from being able to essentially pen test themselves with these models, you know, test where they're weakest, it's a big deal, um, because this is our, sort of our greatest hope right now in terms of cyber defense, that we can use these models to test ourselves. And my understanding is that, you know, Mythos may still have the best cyber exploitation capabilities, but these other models are not far behind. And I don't know what the long-term play here is.
23. KSKara Swisher
  They're not far behind. They're not far behind, so that's why-
24. NPNicole Perlroth
  Yeah
25. KSKara Swisher
  ... to me... Now, just for people to know, David Sacks, uh, when he was, the, is, uh, uh, repeatedly warned that any sort of AI regulation could cost the U.S. in its lead race against China. He's accused Anthropic of, quote, "Running a sophisticated regulatory capture strategy based on fear-mongering." Um, a- and this is what's being infl- this is what's influencing the Trump administration, this frenzied, um, approach to a- lack of AI regulation in any way, or cooperation, which is more what you're saying here.
26. NPNicole Perlroth
  Yeah, that's right. And I think, you know, I think Anthropic has sort of done a good job doing some quiet education around some of these issues with the administration. Maybe that's why they backed off. But I think the big issue here is that, again, we're entering a new era. You know, I wrote a, a book, it took me seven years, about the humans and what it takes to find these zero-day exploit capabilities, these vulnerabilities that only they could find, and the market that existed from governments to buy these from these hackers and use them in their offensive operations. And these were the best of the best. And it was basically-
27. KSKara Swisher
  This, this book was "This Is How They Tell Me the World Ends," correct? That's right, yeah.
28. NPNicole Perlroth
  Yes, "This Is How They Tell Me the World Ends." And in retrospect, what that book was about was about scarcity. It was about the few people who could find these vulnerabilities and then create the code to exploit them in, you know, systems like our iOS iPhone operating system, so that they could, you know, basically turn these things into ankle bracelets. If you had asked me, "Hey, write a sequel, and you can make it fiction, make it science fiction. What is the nightmare, you know, next, uh, chapter of this thing?" I would've written a book that didn't look that different [chuckles] from the era we are entering right now, where AI can essentially find these vulnerabilities that, again, were just the purview of these advanced hackers and nation-states, and turn them on anyone they choose. And that's the era we're walking into, and we can't do this, like, game.
29. KSKara Swisher
  Yeah. China just said that its ZAI already matched Mythos in cybersecurity, and then of course, all the others will match what Mythos can do relatively quickly. Um-
30. NPNicole Perlroth
  Right
39:17 – 41:38
Glasswing-style access and the reality check: critical infrastructure cyber posture is still “terrible”
1. SPSpeaker
  I think the primary thing that determines how this plays out is how good the models get and whether or not they favor defenders or attackers more, and I feel like this is mostly a question of nature, and we can try and balance it one way or the other by making sure that, you know, when we put these models out for the first time, we bias them towards defensive capabilities. But I, I don't feel like there's any particular action that this week we can take that will determine what happens here.
2. KSKara Swisher
  Are we past the point of policy or an ability to handle these risks, uh, that AI poses to cybersecurity?
3. NPNicole Perlroth
  You know, I think that actually what Anthropic did with Mythos, essentially withholding it, they announced this project, Project Glasswing, where they were gonna give the model to a certain subset of companies, mostly cybersecurity companies and banks, uh, so that they could test their own systems and basically get ahead of the threat that was going to come. It's not perfect. Um, you know, there will be jailbreaks, et cetera. But it, I think it's actually a taste of somewhat good policy, that we essentially, before we kinda throw these capabilities into everyone's lap, we essentially test them against ourselves, and that way at least have a s- a, a chance of defending ourselves. You know, there are companies coming to market that deploy agents that mimic these adversaries that you can test, uh, against your systems, and, you know, not just the usual ways, but with social engineering and that kind of a thing. So there are, I think, ways to essentially up-level ourselves here, and I think-
4. KSKara Swisher
  Right
5. NPNicole Perlroth
  ... the best way is probably something that looks a lot like Glasswing. And I don't-
6. KSKara Swisher
  Sure
7. NPNicole Perlroth
  ... think that it's-
8. KSKara Swisher
  Right
9. NPNicole Perlroth
  ... a bad idea to essentially force the frontier labs to red team these systems and give, you know, companies-
10. KSKara Swisher
  Mm-hmm
11. NPNicole Perlroth
  ... particularly in critical infrastructure, advance, uh, access to these models so that they can up-level themselves as well. But I have now been in cybersecurity for almost 20 years, and the state of our cybersecurity, particularly at critical infrastructure entities, is terrible. Uh, you know-
41:38 – 50:20
Election security and hollowed-out institutions: CISA, disinformation teams, and a voter-roll nightmare scenario
1. KSKara Swisher
  Yeah, and it's not being helped by this administration. Let's go into it. Uh, the, the looking at cyber threats to the US ahead of the midterms. The Trump administration has weakened cybersecurity and infrastructure security agencies. CISA, which Trump established actually in 2018, is responsible for election cybersecurity, among other things. He also shut down an S- FBI task force intended to fight foreign influence in elections. The New York Times has reported these changes are part of a larger effort to affect the outcome of midterm elections. Talk about diminished cybersecurity agencies, um, will impact election officials, voters, and potentially the results, and that's, that's not with the other stuff that they're doing. They're also tr- getting these bipartisan commissions that help elections, uh, and give them good information. They're trying to break them down. Um, talk a little bit about that state when you're saying it's, it's a shit show, essentially.
2. NPNicole Perlroth
  So I should disclose here that when I left The New York Times, I left in part because I joined the, essentially the advisory board at CISA, uh, which is the Cybersecurity and Infrastructure Security Agency under Biden. Uh, they wanted a journalist on that committee. Uh, they asked me. I said yes, but of course, that meant stepping out of journalism because you can't be sort of inside the tent and reporting out- outside the tent at the same time. And it was incredible because I joined just before Russia invaded Ukraine, and a lot of CISA's efforts during that timeframe went towards getting American companies to get their shields up and also working with Ukraine cyber defense entities and other allies to help Ukraine. And it was an incredible effort, and one day that should be my next book because it really was a model for how public-private, uh-
3. KSKara Swisher
  Right
4. NPNicole Perlroth
  ... partnerships can come together in a meaningful way.
5. KSKara Swisher
  Mm-hmm.
6. NPNicole Perlroth
  And, you know, I walked into that, uh, advisory role with basically zero faith in the federal government-
7. KSKara Swisher
  Right
8. NPNicole Perlroth
  ... doing anything on cybersecurity, and I left truly impressed-
9. KSKara Swisher
  Yep
10. NPNicole Perlroth
  ... at what they were able to build in such a short time. So imagine my dismay when, you know, by the way, I got a letter saying, "Due to the misuse of resources-"
11. KSKara Swisher
  Oh.
12. NPNicole Perlroth
  "... you are no longer on this committee." Like, I don't think-
13. KSKara Swisher
  Oh
14. NPNicole Perlroth
  ... I ever got paid a single dollar. In fact-
15. KSKara Swisher
  Misuse
16. NPNicole Perlroth
  ... I, I think I, like, forgot to expense my-
17. KSKara Swisher
  Oh, Elon's-
18. NPNicole Perlroth
  ... you know, economy back of the plane
19. KSKara Swisher
  ... Elon's always trying to save us money. Elon's always trying to save us money.
20. NPNicole Perlroth
  Ah.
21. KSKara Swisher
  Mostly so he can take it for himself. But go ahead.
22. NPNicole Perlroth
  So, you know, they eliminated that committee, fine. Um, but then they started hollowing out the actual agency, I think in large part because of Chris Krebs coming out in the 2020 election and calling it the most secure election in history. Uh, but yeah, they took out some of the best. You know, those were people who were-
23. KSKara Swisher
  Mm-hmm
24. NPNicole Perlroth
  ... recruited during that time that I w- I served on that committee who were under, um, who were probationary, which is just-
25. KSKara Swisher
  Mm-hmm
26. NPNicole Perlroth
  ... like, that's what happens when you take these jobs.
27. KSKara Swisher
  Mm-hmm.
28. NPNicole Perlroth
  You're, no matter who you are or how good you are-
29. KSKara Swisher
  Yeah
30. NPNicole Perlroth
  ... you're just probationary until one day they just-
50:20 – 54:11
Is cybersecurity still bipartisan—and what it would take to change the trajectory
1. KSKara Swisher
  It's almost like they wanna change elections. It's interesting. Um, anyway, last, last question. Last year on this podcast, you said that cybersecurity remains a bipartisan issue, despite all this nonsense from Trump especially. Um, you said it remains a, a bar- bipartisan issue. Is that still true? Do you feel that or not at this point? Because the Trump administration is trying to put his finger on the scale. It's very obvious through these firings and, and, um, sort of demotions or, you know, just disintegration of these units that matter.
2. NPNicole Perlroth
  You know, clearly at the White House it's been politicized. It's no longer a bipartisan issue. Every level below that, though, you know, I've met with staffers for senators from both sides, same with Congress. Um, there's a lot of collaboration that happens in cybersecurity, thank God, not just among political parties, but among competitive companies. You know, this is one space where the chief information security officers are constantly talking to each other about the threats that they're seeing, and they're even organized by industry, where they get together and talk about the threats that they're seeing. And that level of threat intelligence is only increasing now with AI, and hopefully will continue to, to scale. Unfortunately, some of these things have become politicized, particularly around the misinformation/disinformation tracking. And, you know, Elon made it a huge issue. Um, you know, the Twitter Files were basically used to validate this conspiracy theory, um, and validate what happened next, which was sort of the destruction of the teams that tracked these issues.
3. KSKara Swisher
  Mm-hmm.
4. NPNicole Perlroth
  And even worse, we saw, you know, the people who worked on these issues at Twitter, et cetera-
5. KSKara Swisher
  God
6. NPNicole Perlroth
  ... become targets for death threats, et cetera.
7. KSKara Swisher
  Yep. Yeah, awful.
8. NPNicole Perlroth
  So it's like, who wants to raise their hand to take these jobs anymore?
9. KSKara Swisher
  So who does?
10. NPNicole Perlroth
  You know, we saw what happened-
11. KSKara Swisher
  So Mike-
12. NPNicole Perlroth
  ... with Chris Krebs.
13. KSKara Swisher
  So who does?
14. NPNicole Perlroth
  Well, you know, it's, it's depressing. Like, I-- it's not just cybersecurity. You know, I was calling my friend, who I think is infinitely qualified to run for Senate in Maine right now.
15. KSKara Swisher
  Mm-hmm.
16. NPNicole Perlroth
  And if he was to stand up and raise his hand and say, "I'm running," I, I think he could win.
17. KSKara Swisher
  Mm-hmm.
18. NPNicole Perlroth
  But he won't, because, you know, he's looking at past data that says there's a narrow path. But more than that, it's just like, if you have a nice life, why put yourself through that right now?
19. KSKara Swisher
  Mm-hmm.
20. NPNicole Perlroth
  Um, and it is happening on both sides of the, the aisle. You know, I also went to college with Mike Gallagher, and when he-
21. KSKara Swisher
  Mm-hmm
22. NPNicole Perlroth
  ... retired from Congress, he said, "I signed up for this, but my family didn't sign up for death-
23. KSKara Swisher
  Right
24. NPNicole Perlroth
  ... death threats and swatting and-"
25. KSKara Swisher
  Mm-hmm.
26. NPNicole Perlroth
  And it's really... You know, to me, that's almost like-
27. KSKara Swisher
  Very smart guy. Very-
28. NPNicole Perlroth
  Yeah.
29. KSKara Swisher
  Too bad he left, right?
30. NPNicole Perlroth
  Yeah.

Episode duration: 54:11

In the uListen app, the transcript lights up word by word as you listen. Get uListen

Transcript of episode aiAy_TWzlcg

Get more out of YouTube videos.

Read along on your phone, search it beside the video, or ask your favorite AI app what was said.

iOS

Intro

From “everything everywhere all at once” to an AI-accelerated threat landscape

Chinese pre-positioning in critical infrastructure—and what detonation could look like

The “Mythos era”: AI models that write code—and can exploit it

Who becomes dangerous when elite hacking tools become widely accessible

North Korea’s cyber evolution: from Sony destruction to bank theft and crypto heists

The remote IT worker fraud: North Koreans getting hired inside U.S. companies

Laptop farms and AI-assisted interviews: how the scheme works in practice

Inside one cell: Discord coordination, China-based logins, and massive job application volume

Motives, monetization, and why the problem spills beyond cybersecurity into HR

Who runs laptop farms—and why the pool may grow with AI-driven job losses

China’s cyber upleveling: state funneling of vulnerabilities and stealth operations

AI cooperation with China: red lines that didn’t hold and a “dangerous game of chicken”

Naming and shaming hackers: impact, numbness, and the deterrence problem

AI transforms offense and defense: deepfakes, scalable social engineering, and machine-speed attacks

Anthropic vs. the U.S. government: model restrictions, “beefing,” and using frontier models to test ourselves

Glasswing-style access and the reality check: critical infrastructure cyber posture is still “terrible”

Election security and hollowed-out institutions: CISA, disinformation teams, and a voter-roll nightmare scenario

Is cybersecurity still bipartisan—and what it would take to change the trajectory

Get more out of YouTube videos.