Katie Moussouris on AI-as-malware, the monitoring gap, and an NTSB for AI

(Presented by TLPBLACK: A cybersecurity intelligence platform focused on sharing curated, high-sensitivity threat insights and research with trusted security professionals.)

Three Buddy Problem x Offensive AI Con: Luta Security chief Katie Moussouris makes the case for an NTSB-style board for AI incidents, with subpoena power and full-time investigators, after OpenAI’s DNS tunneling escape and the 52 days it took to notice a model had wandered into Australian government systems.

Along the way, we chat about her work on the Cyber Safety Review Board (CSRB), AI model refusals that leave defenders stuck, and why she still bets on hackers to bend this technology their way.

Cast: Juan Andres Guerrero-Saade, Ryan Naraine and Katie Moussouris.

Timestamps:
0:00 Intros at Offensive AI Con
1:00 OpenAI’s DNS tunneling incident and slow monitoring
4:36 Treating AI like malware in a sandbox
9:01 The business model is the misalignment
13:37 Log4j, SBOMs and an NTSB for AI
18:00 Trading liability protection for honest disclosure
22:13 Accountability and “once you become aware”
26:18 The Australia notification timeline
28:19 A blank-check administration and the Anthropic phaseout
34:35 Powerful models in the right hands
38:42 Kill switch bills and regulatory capture
42:36 EU fines as a tariff on American tech
48:03 Reasons for optimism
54:13 Bring back “information security”
1:01:57 Katie’s last word

Links:

• Transcript
  
• Katie Moussouris on Twitter
  
• Katie Moussouris | LinkedIn
  
• Luta Security | Bespoke Bug Bounty
  
• OpenAI Agent Breached Australian Data Portal in Newly Disclosed Hack
  
• CSRB Review: Log4j
  
• CSRB Report on Microsoft Online Exchange Incident
  
• EU Cyber Resilience Act: 24-Hour Reporting Duties
  
• Patching Faster Has Never Been the Answer
  
• The Real Story on AI Security Live From LABScon
  
• Katie Moussouris | LABScon
  
• DHS Disbands Cyber Safety Review Board
  
• The Chaos (and Cost) of the Lapsus$ Hacking Carnage
  
• Katie Moussouris on the Anthropic Export-Control Mess
  
• Fable 5 Export Controls Harm US Cyber Defense
  
• Offensive AI Conference
  
• TLPBLACK