Cybersecurity Lessons from the Canvas Data Breach

More from Shared Security Podcast All episodes →

1. 

   E565 · 15 Jun 2026 · 11 min

   Guarding AI Agents: Boundaries and Safeguards

   AI agents are useful, but they become risky when they can take action in real systems. In this episode, Tom Eston discusses recent reporting about attackers tricking Meta’s AI support chatbot into helping hijack Instagram accounts, and why that story matters far beyond social media. Tom explains practical guardrails for AI agents: read-only access first, human approval for consequential actions, separated accounts and contexts, prompt-injection awareness, least privilege, logging, monitoring, and adversarial testing for support and account recovery workflows. Special thanks to Guardsquare…

2. 

   E564 · 10 Jun 2026 · 32 min

   Mobile Application Security: What Every Organization Needs to Know

   Mobile apps are now deeply connected platforms for identities, payments, sessions, APIs, healthcare, retail, gaming, and cloud services. In this special episode, Tom Eston talks with Joel Destefano, Senior Product Manager at Guardsquare, about the modern mobile app threat landscape and why organizations can’t treat mobile security as an afterthought. Topics include runtime manipulation, API abuse, account takeover, fake apps, overlays, malware-assisted fraud, reverse engineering, iOS vs Android risk, AI-assisted attacks, and why backend-only security is not enough. Special thanks to…

3. 

   E563 · 8 Jun 2026 · 17 min

   Microsoft Threatens Legal Action Over Exploit Disclosure

   Microsoft’s response to a researcher publicly disclosing proof-of-concept exploit code has reignited an old debate in security: where does responsible disclosure end and reckless disclosure begin? Tom and Scott discuss the Nightmare Eclipse controversy, the history of full disclosure, bug bounty incentives, and why legal threats against researchers may ultimately hurt customers. They also explain why researchers still need to follow responsible processes — and why vendors need to avoid punishing the people who help make their products safer. Special thanks to Guardsquare for sponsoring this…

4. 

   E562 · 1 Jun 2026 · 15 min

   Apple Finally Fixes One of Texting’s Biggest Security Problems

   Apple and Google are finally bringing end-to-end encrypted RCS messaging to iPhone and Android chats. In this episode, Tom Eston and Kevin Tackett explain why that matters, why insecure SMS is not going away anytime soon, and why Signal is still the better choice for truly sensitive conversations. They also revisit the green bubble versus blue bubble debate, platform trust issues, and what everyday users should understand before assuming every text message is private. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with…

5. 

   E561 · 25 May 2026 · 25 min

   Should AI Have Access to Your Financial Life?

   OpenAI is now allowing some ChatGPT users to connect their bank accounts and financial data directly to the platform. In this episode, we discuss the technology behind the feature, the convenience it promises, and the serious privacy and security questions it raises. From AI-generated budgeting advice to the risks of centralized financial profiling, we examine what happens when conversational AI gains visibility into your spending habits, debts, subscriptions, and financial goals. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application…

6. 

   E559 · 11 May 2026 · 22 min

   Passwords Are Still Failing Us (World Password Day 2026)

   World Password Day was on May 7th—but are we actually getting better at password security? In this episode, we discuss why compromised credentials are still behind the majority of breaches in 2026. From password reuse and phishing to infostealer malware and MFA bypass techniques, attackers are finding it easier than ever to log in instead of hack in. We also talk about whether passkeys can finally shift the landscape—and what organizations should be doing right now to reduce risk. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application…

7. 

   E558 · 4 May 2026 · 16 min

   Fake Party Invites and the Rise of Social Phishing Attacks

   Attackers are now impersonating invitation services to trick people into clicking malicious links and sharing sensitive information. These phishing attempts look like legitimate event invites, making them especially effective. In this episode, we discuss how these scams work and what steps you can take to stay protected. Special thanks to Guardsquare for sponsoring this episode! Guardsquare is the leader in mobile application security, with multi-layered protection for your Android and iOS apps. Learn more at Guardsquare.com. ** Links mentioned on the show ** New Phishing Scam: Fake…

8. 

   E557 · 27 Apr 2026 · 16 min

   New York’s 3D Printing Crackdown: Security or Surveillance?

   New York’s latest budget proposal could fundamentally change how 3D printers work—requiring built-in software that scans and blocks certain designs. Supporters say it’s about stopping ghost guns. Critics say it opens the door to surveillance and limits innovation. In this episode, we discuss what’s actually in the proposal, why it’s raising alarms across the tech community, and what it could mean for the future of user-controlled technology. ** Links mentioned on the show ** Stop New York’s Attack on 3D Printing! https://www.eff.org/deeplinks/2026/04/stop-new-yorks-attack-3d-printing **…

9. 

   E556 · 20 Apr 2026 · 28 min

   Project Glasswing: When AI Becomes the Ultimate Hacker—and Defender

   Anthropic has introduced Project Glasswing, a cybersecurity initiative powered by an unreleased AI model called Claude Mythos. This system can identify zero-day vulnerabilities, generate exploits, and even help fix them—often without human input. But there’s a catch: it’s considered too powerful for public release. In this episode, we discuss what Project Glasswing is, why it matters, and what it means for the future of cybersecurity, red teaming, and AI-driven threats. Is this the beginning of AI defending us—or the start of something much harder to control? ** Links mentioned on the show…

10. 

    E555 · 13 Apr 2026 · 23 min

    The Dark Web Explained with John Hammond

    The dark web is often misunderstood, but it plays an important role in both privacy technology and cybercrime activity. In this episode, Tom Eston speaks with cybersecurity researcher and educator John Hammond about what the dark web actually is and how it has evolved in recent years. The discussion covers underground marketplaces, ransomware leak sites, threat intelligence collection, and the operational risks involved in dark web investigations. John also shares details about his new training course Dark Web 2, which focuses on using a hacker mindset to gather cyber threat intelligence…