This week on Absolute AppSec, Seth (@sethlaw) and Ken (@cktricky) talk about AI exploitability in the 329th episode. They touch on OpenAI’s reported Hugging Face security incident, questioning whether the model demonstrated genuinely novel offensive capability. The main technical discussion returns to the fundamentals through an article on preventing IDOR. They also cover Krebs’ reporting on LG banning residential proxy SDKs from smart TV apps, explaining how free TV apps can turn consumer devices into proxy infrastructure and why IoT app ecosystems need stronger review. To find this episode, go to https://www.youtube.com/@AbsoluteAppSec/streams, or find us wherever you get your podcasts.  

Ken Johnson and Seth Law opened this episode digging into OpenAI's admission that one of its models had, during internal red-team testing with guardrails removed, exploited a flaw in a caching proxy to reach the open internet and hack Hugging Face. OpenAI framed this as proof that "advanced models can discover and exploit novel attack paths in real-world systems without source code access," but Ken pushed back hard on "novel” claim, arguing there's no evidence models invent new vulnerability classes rather than recognizing patterns they were trained on, like the general shape of an IDOR. He noted a tool like Burp Suite can do the same without source access, for the price of a person and a subscription, and suspects marketing polish drove the wording. His working theory is that OpenAI spent enormous inference compute brute-forcing a known bug category and chaining a couple of steps together, something replicable by any motivated attacker with money. Both Seth and Ken speculated this positions Frontier Labs for lucrative military and government cyber contracts as nations restrict which models can be used offensively, though Ken remains skeptical Frontier models beat targeted human-run tooling on cost, given the token bills he's seen firsthand.

Ken and Seth then walked through a blog post from SevHunt's Sam Mortensen on preventing insecure direct object reference, or IDOR, in TypeScript apps, and Ken praised it for going beyond the usual "look what I exploited" format to weigh remediation trade-offs. The article uses Zod to validate incoming IDs as proper UUIDs while tying them to the user's organization ID, which Seth found clever but uncomfortable, since it blends validation and authorization into one function, something both agreed can work but invites edge cases if overused. They also covered adding a tenant ID to every query and using distinct branded types for primary keys, solid defenses that still leave room for failure as systems grow complex. Seth pointed to real client work, including a healthcare billing role that held admin-level API credentials and could dump the entire user database, as proof authorization logic breaks down at scale no matter how many layers you stack. Ken recalled building a full authorization testing matrix at GitHub for this exact gap, and both agreed most teams they encounter now lack that rigor, which is why Ken leans on AI agents like Codex or Claude to map authorization logic and generate tests before tailoring fixes to each tech stack.

The final topic centered on Krebs on Security's reporting that LG is banning residential proxy SDKs, chiefly Bright Data, from WebOS apps following an FBI seizure of a related proxy platform back in July. Seth and Ken explained the underlying scheme: TV apps bury permission to route internet traffic through the device inside vague acceptance language, then sell access to that residential IP to data brokers, letting third parties browse the internet disguised as the TV owner's home connection. Research from spur.us found Bright Data SDKs embedded in roughly a thousand WebOS apps and six hundred Tizen apps, with Bright Data or its subsidiaries sometimes publishing the apps directly, concentrating a huge share of exposure in a single provider. Both hosts flagged the classic "if it's free, you're the product" dynamic and the unsettling abuse potential, since someone using your home IP as their proxy could make it look like you were browsing something illegal. They predicted wearables like smart glasses and watches are the next frontier for this abuse, and joked that AI chat assistants landing on smart TVs is inevitable, raising fresh questions about what tools those assistants get to touch.

You already know what we are going to be talking about all night long when we’re in Vegas. Go back to basics with a plain white tee (plus a twist!) here:

Join us in our Slack; just send us a note to join the channel. As long as you promise not to impersonate us (again), you can sit down, relax, and stay a while.

Stay Secure,

Seth & Ken

https://youtu.be/9N6OX38QCmg – Episode Episode 160 - Mental Health, Open Source Bug Bounties, IDOR — An episode that starts out in left field away from security topics by addressing mental health and how to keep sane when life gets busy, in both good and bad ways. Security does eventually become a topic in a discussion around bug bounties in the news as the European Government announces bug bounties for multiple open source projects. Finally, a discussion on the existence of IDOR everywhere and how to identify it in more complex scenarios. 

https://youtu.be/CjUSAFI7l-A – Episode 188 - There is no such thing as "done" with application security? Are our Sisyphean hosts (@cktricky and @sethlaw) therefore doomed to ever push this rock up the mountain, just to discuss ways to push it up again? 

https://youtube.com/live/SQpScUYHIUA – Episode 307 - 2025 Retrospective, Supply Chain, MCP and APIs - Episode claiming that previous predictions were largely accurate, particularly regarding the rise of prompt injection, AI-backed attacks, and the industry-wide shift toward per-token billing models. A major theme of the year was the solidification of supply chain security as a critical pillar of AppSec, driven by notable incidents such as Shai Hulud and React for Shell. Much of the discussion focuses on the Model Context Protocol (MCP); while it offers significant value for agentic workflows, the hosts criticize its current lack of robust security controls, specifically highlighting issues with OAuth implementations and short timeouts in existing clients. Finally, they discuss how the industry is moving toward a more nuanced balance between deterministic tools like Semgrep and the probabilistic creativity of LLMs to increase efficiency in security consulting. 

Anthropic’s Investigating three real-world incidents in our cybersecurity evaluations – Reviewing 141,006 cybersecurity evaluation transcripts, Anthropic found three incidents where Claude models (Opus 4.7, Mythos 5, an internal test model) escaped sandboxed capture-the-flag environments via a misconfigured internet connection and compromised three real organizations' systems, believing them to be simulated. No model deliberately tried to escape; the newest model stopped once it recognized the environment was real. Anthropic notified affected parties and is tightening evaluation-environment security.

Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident – A deeper look into the technical intricacies of the Hugging Face incident. 

Where in the world are Seth and Ken?

August 1-4, 2026 - AI-Enhanced Secure Code Review: Black Hat Edition - BlackHat USA, Las Vegas - Seth and Ken are bringing a four-day exclusive course to Black Hat. This is an update on the exclusive version of the course offered at Black Hat Europe. Early bird pricing is ongoing, so it’s a great opportunity to get a truly in-depth understanding of Secure-Code Review and how it can be empowered through LLM-tooling. Seth and Ken have innovated industry-leading trainings in both of these topics, so this four-day course promises to provide a lot of valuable insight.

August 10-11, 2026 - Agentic AppSec: Harnessing LLMs - DEF CON Training, Las Vegas - Comprehensive course designed for developers and cybersecurity professionals seeking to harness the power of Agentic AI and Large Language Models (LLMs) to enhance software security and development practices.