Episode Details

Today on Prime Cyber Insights, we explore the paradox of modern security: the launch of OpenAI's GPT-5.4-Cyber defensive model occurring simultaneously with the return of a critical 17-year-old Microsoft Excel vulnerability. Aaron Cole and Lauren Mitchell break down the implications of OpenAI's expanded Trusted Access for Cyber program and how it compares to Anthropic's Mythos model. The discussion shifts to practical risks facing enterprise security teams, including new prompt injection flaws in AI agents from Salesforce and Microsoft that could lead to database exfiltration. We also provide technical context on the April Patch Tuesday updates, specifically CISA's urgent deadline for a nearly two-decade-old RCE flaw and Microsoft's new RDP safety rails designed to block state-sponsored phishing techniques.

Topics Covered

• 🛡️ Defensive AI Frontier: OpenAI's launch of GPT-5.4-Cyber and the expansion of the TAC program for security teams.
• ⚠️ Legacy Risk Longevity: Analysis of CVE-2009-0238, the 17-year-old Excel bug now under active exploitation.
• 🔐 AI Agent Vulnerabilities: Understanding 'PipeLeak' and 'ShareLeak' prompt injections in Salesforce and Microsoft Copilot.
• 💻 System Integrity: Microsoft's decision to remove trust for cross-signed kernel drivers to stop EDR-killer tools.
• 🚨 Insider Threat Case Study: How Kraken is managing an extortion attempt following support-level insider compromises.

Prime Cyber Insights is for informational purposes only. Consult with your security and legal teams before making infrastructure or policy changes.

Neural Newscast is AI-assisted, human reviewed. View our AI Transparency Policy at NeuralNewscast.com.

• (00:01) - Introduction
• (00:22) - AI Defensive Models and TAC Expansion
• (00:22) - CISA KEV and 17-Year-Old Legacy Vulnerabilities
• (00:47) - Conclusion
• (00:47) - Prompt Injection and AI Agent Security