What should stop a compromised developer laptop from moving billions? And how much does least privilege buy you when an AI agent can find ways around the limits you set?

Jerry, Sounil, and Mario dig into the Nvidia board inquiry, the Binance theft, and France’s attribution of the supermarket fridge attacks. Then they get into recursive AI improvement, how to govern capable agents, and which security tools teams might rebuild in-house.

In this episode:

• Nvidia and chip export controls: The hosts discuss the reporting around Jensen Huang, what the board needs to know, and how companies should handle intelligence about possible foreign influence.

• The Binance hack: A fake job interview and a malicious coding assignment lead to a debate about developer access, transaction approvals, and testing under an assume-breach model.

• Fridge hacks and exposed OT: France’s attribution of the supermarket attacks brings the conversation back to what happens when attackers can reach refrigeration controllers and other operational technology.

• Recursive AI improvement and agent governance: Anthropic’s research prompts Sounil to ask whether any privilege can become effectively equivalent to root. The hosts discuss alignment, monitoring what agents do, and using law, norms, markets, and architecture to shape behavior.

• Build or buy? The hosts ask which security tools are ripe for in-house replacement, from niche GRC workflows to a custom syslog app. Then Sounil makes the case for rolling your own crypto, and Mario pushes back.

Stories and resources

Nvidia board inquiry — Associated Press

Binance incident update

French refrigeration attacks — CERT-FR

When AI builds itself — Anthropic

Sounil Yu’s C4 framework and Least Agency research

Chapters

00:00 Cold open

00:32 Welcome and episode rundown

02:49 Nvidia, chip exports, and board accountability

13:40 Binance and the fake job interview

17:26 Why one compromised laptop should never move funds

24:31 Fridge attacks and exposed operational technology

30:21 Anthropic and recursive AI improvement

35:05 Sounil’s law and root-like privilege

41:46 Governing agent actions

52:18 Law, norms, markets, and architecture

54:19 Which security tools are ripe for rebuilding?

1:06:37 The case for rolling your own crypto

1:10:40 Building a custom syslog app with AI

Hosts:

Jerry Perullo (Founder, https://adversarial.com/)

Sounil Yu (Founder, https://www.knostic.ai/)

Mario Duarte (CISO, https://www.whirlai.com/)

Producer: Tillson Galloway (Founder, http://githoundexplore.com/)