No—PSW #948 does not conclude that AI has taken over cybersecurity. The episode uses the question as a skeptical frame for discussing AI-agent control, an alleged AI worm, incident reporting and the danger of confusing impressive capability with reliable autonomy.
Recorded on 14 October 2026 and published on 15 October, the roughly two-hour episode is a broad security-news roundup hosted by Paul Asadoorian with Sam Bowne, Josh Marpet, Jeff Mann and Lee Neely. Danny Akacki, known as Rando, is the featured guest.
As an Amazon Associate I earn from qualifying purchases.
What PSW #948 is actually about
Paul’s Security Weekly episode 948 is a current-events security podcast, not a single-issue AI research paper or a forecast that machines are about to run the security industry. Its central question is practical: when an AI system can act, how much can operators control, observe and stop it?
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →| Episode detail | Information |
|---|---|
| Publication date | 15 October 2026 |
| Recording date | Wednesday, 14 October 2026 |
| Approximate length | Two hours |
| Host | Paul Asadoorian |
| Panel | Sam Bowne, Josh Marpet, Jeff Mann and Lee Neely |
| Special guest | Danny Akacki, also known as Rando |
Akacki introduces himself with, “Long time listener, first time crasher.” He is described as a DEF CON goon and client security strategy director at Coalfire’s Hex division. His appearance also connects the discussion to DEF CON 610 and its community events.
#1 Best Overall
Danny Akacki, DEF CON 610 and the community angle
Akacki discusses DEF CON 610’s Net Run CTF, scheduled for 21 November 2026 in Easton, Pennsylvania. The event replaces the former pub-crawl format with a capture-the-flag competition. That detail matters because it shows the episode’s interest in hands-on security culture, not only vendor announcements and breach headlines.
His comments also add a human, skeptical tone to the news roundup. One memorable line is, “I didn’t know that Huawei was a legitimate company. I thought they were a threat actor group.” It is presented as a joke about unfamiliarity, not as an assessment of the company’s status.
What the AI question means in this episode
Capability is not the same as controllability
The AI segment centers on reports that Anthropic found limits in controlling or monitoring AI agents. An agent that can browse, run tools or make changes may be useful, but usefulness does not prove that its actions can be constrained, audited or stopped at every stage.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
That distinction is the episode’s most durable lesson. Security teams should ask what permissions an agent has, what events are logged, how quickly a human can intervene and what happens when the model misunderstands a task. The panel treats control and consequences as operational questions rather than science-fiction speculation.
The alleged Anthropic AI worm
The panel also discusses claims and counterclaims about an Anthropic AI worm. The episode does not establish a universally accepted “AI worm” event; it treats the story as a dispute over what was demonstrated, how much autonomy was involved and whether the label overstated the capability.
That caution is important. A proof-of-concept that chains tools in a controlled setting is not automatically a self-propagating incident in the wild. Readers should separate a reported demonstration, the conditions required to reproduce it and evidence of real-world spread.
AI incident reporting and deepfake detection
AI incident reporting appears alongside discussion of Teams deepfake detection. Together, those items point to two different defensive needs: documenting when an AI system causes or contributes to harm, and identifying synthetic audio or video before it influences a business decision.
Lee Neely’s line, “I hope you’ve enjoyed the demo. Please stand by for full deployment,” captures the panel’s concern that demonstrations can move into production before organizations have built adequate controls.
The security stories covered in the roundup
The episode moves across software, cloud services, operational technology and physical infrastructure. The following grouping reflects the themes the panel draws out; it is not a claim that every item received the same amount of airtime.
| Story or topic | Episode emphasis |
|---|---|
| Router converted into an SDR | How ordinary network hardware can be repurposed for software-defined radio experiments. |
| Ivanti straight-to-root issue | A vulnerability path whose reported impact reaches root-level control. |
| Kernel exploit used to fix downloads | The unusual use of an exploit technique in a workaround for download problems. |
| Supermarket refrigeration | Internet exposure and missing patches reportedly allowed refrigeration units in French supermarkets to reach 122°F. |
| Java vulnerabilities and Lightwell Clearinghouse | A discussion of more than 400 Java vulnerabilities and IBM/Red Hat’s dependency-review service. |
| Sungrow solar infrastructure | An authentication bypass affecting solar infrastructure. |
| Russia’s data-center conflict | The security and geopolitical implications of conflict around data-center infrastructure. |
| Stop & Shop/Ahold Delhaize incident | A retail cyber incident and the business disruption that follows. |
| FortiBleed | A campaign discussion that attributes a figure of 86,000 firewalls to the episode summary. |
| Pre-compromised phones | The risk that a device can be compromised before its owner begins normal use. |
| FakeGit | Malicious or deceptive activity built around Git-related distribution and trust. |
| Shorter Let’s Encrypt certificates | What reduced certificate lifetimes mean for renewal automation and outage risk. |
| Critical GitLab patch | The need to apply a high-priority update to a widely used development platform. |
| Engineer locking thousands of devices | How one person’s access or actions can create a large-scale availability problem. |
| OpenAI employee hidden-recorder allegation | An allegation discussed by the panel, presented as an allegation rather than an established finding. |
Why the operational-technology stories matter
Several items show why cyber risk cannot be measured only by the number of stolen records or the technical severity score. Refrigeration systems, solar infrastructure, routers and retail systems connect digital access to physical conditions and revenue.
The 122°F refrigeration figure is an episode-summary claim attributed to the French supermarket story, and the 86,000-firewall figure is likewise attributed to the FortiBleed discussion. The episode material does not independently verify those numbers against the original incident advisories, so they should be read as reported context rather than universal measurements.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Josh Marpet summarizes this perspective with, “It’s the consequences that is the problem.” A moderate technical weakness can become urgent when equipment is internet-facing, unpatched and connected to a process that people depend on.
Best Value
How to use the episode’s lessons
- Evaluate control, not just capability: document an AI agent’s permissions, tool access, approval gates, logging and emergency stop path.
- Reduce unnecessary exposure: segment refrigeration, solar, router-management and other operational systems from the public internet whenever the design permits.
- Patch for the real environment: prioritize Ivanti, GitLab, Java dependencies and authentication flaws according to exposure and consequence, not headline value alone.
- Verify extraordinary claims: distinguish a demonstration, a vendor statement, an episode summary and an independently confirmed incident.
- Plan for physical disruption: include temperature, power, retail availability and device lockout scenarios in incident exercises.
Products, books and services named
The episode mentions several specific resources. Their appearance is not an independent product test, and current availability or commercial terms were not established in the episode material.
- JetKVM: a physical remote-management product discussed as the strongest hardware fit.
- Gemtek W1700K: another specific hardware query raised in the episode context.
- More Everything Forever by Adam Becker: a named book recommendation.
- ThreatLocker: appears in a sponsor read.
- Lightwell Clearinghouse: described as a paid IBM/Red Hat dependency-review service in the Java-vulnerability discussion.
Those mentions should not be mistaken for guarantees, rankings or endorsements. The episode is primarily a news and analysis program, and its recommendations sit alongside a much larger conversation about exposure, patching and accountability.
Bottom line
PSW #948’s answer to “Is AI taking over cybersecurity?” is essentially: not proven, and not the most useful question. The more immediate issue is whether people can constrain AI actions, detect failures and contain the consequences when software touches real infrastructure. By placing AI-agent claims next to refrigeration, solar, retail, certificate and patching stories, the episode argues for evidence and operational preparation over hype.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
