How a brand new crypto wallet came with a spy inside

Lianne Potter (0:03)

One of those spyware companies is called Candiru. Now do you know what a Candiru is, Graham?

Graham Cluley (0:09)

Is that a kangaroo with a sweet tooth? Is that a Candiru?

Lianne Potter (0:13)

I can totally see that. It's a tiny parasitic catfish, known as the toothpick fish. And reputedly, if you take a wee in Amazon, the river, not Jeff Bezos' gaff.

Graham Cluley (0:24)

Although, I mean, frankly, if you've got the choice.

Lianne Potter (0:27)

Well, if you've got the choice.

SPEAKER_3 (0:37)

Smashing Security, episode 489 How a brand new crypto wallet came with a spy inside, with Graham Cluley and special guest Lianne Potter.

Graham Cluley (0:48)

Hello, hello, and welcome to Smashing Security episode 489 My name's Graham Cluley.

Lianne Potter (0:52)

And I'm Lianne Potter.

Graham Cluley (0:53)

Lianne, welcome back to the show.

Lianne Potter (0:55)

Hi.

Graham Cluley (0:56)

Super to see you and to hear your dulcet tones as well.

Lianne Potter (1:00)

Well, you know, the fans ask for it all the time, I'm sure.

Graham Cluley (1:03)

They do. They always say, we've had the King of the North, obviously, who's entered Downing Street now, but are you the cyber queen of the North? Have you branded yourself anyway? You're from Yorkshire, right?

Lianne Potter (1:15)

Correct. Correct.

A bit of a War of the Roses has been going on there with that reference of Mr. Burnham. But we will slide past that. If you want to call me the Queen of the North, I'll take it.

Graham Cluley (1:26)

For anyone who's not British, Yorkshire practically in the Arctic Circle.

Lianne Potter (1:31)

Practically, yes. That's why I'm wearing a cardigan. But the heating is not on yet, which is also very Yorkshire.

Graham Cluley (1:37)

Oh, yes. Well done to you. Before we kick off, let's thank this week's wonderful sponsors, 360 Privacy, Origin and Vanta. We'll be hearing more about them later on in the podcast.

SPEAKER_3 (1:48)

This week on Smashing Security.

Graham Cluley (1:50)

We're not going to be talking about how a cyber attack hit Romania's stock market agency. You'll hear no discussion of how a Ukrainian hacktivist defaced Russia's school testing system.

And we won't even mention how police are claiming scammers used AI to deep fake a sheriff's voice. So, Lianne, what are you going to be talking about this week?

Lianne Potter (2:14)

So, you buy one washing machine and then for months the internet thinks that's your entire personality. But that washing machine ad might not just want your money, it might also want access to your phone.

Graham Cluley (2:24)

And we're going to play click or treat and discover why your crypto wallet may not be as safe as you imagine. Plus, we've got a featured interview with Spencer Thompson of Origin who reveals what AI agents are really getting up to on your employees' laptops when nobody is watching. All this and much more, coming up in this episode of Smashing Security.

Earlier this year.

SPEAKER_4 (2:55)

Oh, here we go.

Graham Cluley (2:56)

Inside the walls of open AI.

Inside Hugging Face, something was happening. Agents talking to each other, dividing the work between themselves, leaving notes for one another in the dark where no human was watching.

SPEAKER_4 (3:10)

They're AI agents doing a code review, Graham. It's not the Manhattan Project.

Graham Cluley (3:14)

And when the sun came up on that incident, the finest engineering minds on the planet sat in a room and asked themselves one question.

SPEAKER_4 (3:23)

What did our AI do? The people who built the machine didn't know what the machine had done.

Graham Cluley (3:37)

And that brings us to you, dear listener. One question, and I want you to think about this. If an AI agent caused an incident at your company tomorrow, what evidence could you actually produce?

SPEAKER_4 (3:48)

Because the terrible truth is, most of us have the prompt. We have the result. But what goes on in the middle? No clue.

The commands it ran, the files it touched, the credentials it helped itself to, all of it gone.

Graham Cluley (4:11)

But not anymore.

SPEAKER_4 (4:13)

Because there is a sensor.

Graham Cluley (4:14)

On the machine. Watching. Always recording. Capturing everything the agent does as one unbroken trace. What was asked, what it reached, what it changed, lay down order, start to finish.

SPEAKER_4 (4:26)

This is Origin. Endpoint AI observability.

Graham Cluley (4:30)

Origin sees the agents that other tools walk straight past. Coding agents in the terminal. Local agents. Anything whispering to an MCP server on a laptop. No cloud gateway. No blind spot. Origin is already there.

SPEAKER_4 (4:46)

Somewhere, right now, an agent is doing something nobody asked it to do.