Inside the EncroChat law-enforcement implant, Irregular’s AI sandbox failure

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem – Episode 110: We dig into Computer Weekly’s scoop on the EncroChat hack and news that the French law enforcement implant was cobbled together from GitHub. Plus, Irregular, the $450M startup running sandboxes for OpenAI, Anthropic and Meta, drones over Romania’s gas platforms, OpenAI’s two-week training pause, and T-Mobile taking scissors to a cable during Salt Typhoon incident response.

Stick around for a UFO segment that somehow involves Dr. Phil.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Costin Raiu.

Timestamps:
0:00 Introductory banter; LabsCon speakers announced
9:06 A naval drone reaches the Neptun Deep gas platform
17:38 OpenAI pauses RL training: what “slowing the pace of scaling” costs
24:34 Guardrails vs refusals vs alignment.
33:54 Irregular, formerly Pattern Labs: $80M, $450M valuation, one job
46:11 JAGS on why security needs a new batch of startups right now
1:06:52 EncroChat revealed: a GitHub-sourced implant, IOCs
1:15:12 Law enforcement malware vs intelligence malware
1:21:07 T-Mobile, Salt Typhoon, and cutting the cable with a pair of scissors
1:32:06 Captive Crunch: hotel Wi-Fi, OAuth token theft, and the MSP supply chain
1:47:00 ICE RELIC, UNC6293, and the trouble with subcluster naming
2:00:39 UFO corner: David Grusch, Dr. Phil, and the Skywatcher Project
2:05:44 Shout outs, the Costin Challenge

Links:

• Transcript
  
• LABScon 2026 Speaker Roster Announced
  
• LABScon Speakers
  
• Romania destroys drone near Neptun Deep Black Sea gas project
  
• Naval drones in Romania
  
• OpenAI pacing model development in an era of cyber-critical capabilities
  
• Irregular on Recent Incidents: Ongoing Findings
  
• The End-State Fallacy: Where Is AI Security Headed?
  
• T-Mobile Cyber Staff Chopped Cable After Finding Chinese Hack
  
• Operation EMMA – An operation dedicated to disrupting EncroChat
  
• French cyber-spies used malware from GitHub to hack EncroChat
  
• CaptiveCrunch Supply Chains and Other Adventures in WIFI (Lumen)
  
• GTIG: Distinct Clusters Target Individuals of Interest to Russia
  
• ReliaQuest: DNS Poisoning Tactics Expand to Hospitality Wi-Fi
  
• TLPBLACK