Security news, with the caveats left in.
Infosec Decoded tracks cybersecurity through the messy places it actually shows up: phones, routers, software updates, AI agents, cloud buckets, and regulation. The tone is practical and skeptical, with technical stories repeatedly widening into arguments about institutions, incentives, and predictable human error.
PRESS PLAY
Infosec Decoded covers cybersecurity as a live argument, not a finished briefing. Its core material is security news: prompt injection against phone-based AI, formally verified code, AI-assisted vulnerability discovery, supply chain compromise, abandoned cloud infrastructure, router restrictions, and tools that scan code changes for malicious updates. The recurring question is blunt: what breaks when software, institutions, and incentives meet the real world? The show often starts with a narrow item and then keeps widening. A report on Neural Exec becomes a conversation about how prompt injection is evolving beyond tricking a model with a clever story. A discussion of Claude-related security research turns into a bigger problem of disclosure, attacker speed, and whether defenders have any choice but to use AI scanners too. Supply chain attacks are treated with particular seriousness because they arrive through legitimate channels, signed updates, and trusted systems. That is the uncomfortable part. Infosec Decoded is also less tidy than a standard tech-news digest. It leaves in the caveats. It admits confusion. It follows side roads into public policy, cloud economics, fake QR-code tickets, accident analysis, AI content rules, and organizational change. The show’s AI coverage is neither cheerleading nor reflexive dismissal. It is interested in where AI actually changes workflows: companies becoming AI-native, attackers using normal-language commands, defenders sending diffs to models, and agents handling repetitive operational work. The skepticism is practical. Bad policy, subscription incentives, misconfigured systems, and vague product labels all get treated as security-relevant facts. The pacing is quick, but the reasoning is conversational and sometimes rough-edged. That roughness is part of the value. It feels like a technical debrief from people still sorting the story while the story is moving. Listeners looking for glossy explainers may find it too rangy. Listeners who enjoy security news with dry judgment, historical analogies, and a willingness to say when something makes no sense will find a useful companion.
Made for: For cybersecurity practitioners, technical generalists, policy watchers, and AI-curious listeners who can follow a fast thread without needing every term softened. It especially suits people who like practical skepticism more than cleanly packaged tech optimism.
What sets it apart: Infosec Decoded stands out by treating AI, software supply chains, regulation, and everyday technical failures as one connected problem. It is less a polished briefing than a running diagnostic on how systems fail and how defenders might catch up.
A twice-weekly podcast of security news and commentary with Sam Bowne, Elizabeth Biddlecome, Kaitlyn Handelman, Irvin Lemus, and Alan Wennersten.
Based on 6 episodes we listened to · September 2026
Infosec Decoded makes security news concrete by testing the mechanics, consequences, and plausibility behind each headline.
Infosec Decoded turns current security stories into an informal working session, usually through Sam's conversations with Doug and sometimes through a solo news rundown.
A router ban raises the question your Wi-Fi actually cares about: who keeps it patched?
Press play if you want
Short reviews from the PlayNext desk, based on the episodes we processed.
A skeptical tour from formal proofs to AI infrastructure, with enough drift to keep it human.
The episode treats formally verified code less like a slogan and more like an engineering problem that has to survive contact with reality. The host and Doug move from Lean and AI-assisted proofs to a Zlib implementation described as formally verified end to end, and the…
A leaked Claude deck becomes a practical discussion of misuse, theft, and the limits of hot data.
Claude Mythos follows a leaked Anthropic presentation and treats the security questions around an upcoming model being made public before its time as the real story.
A blunt security conversation that turns a router ban into a wider argument about trust, failure, and responsibility.
It starts with the FCC's decision to block approval for foreign routers and keeps widening the frame until regulators, manufacturers, and users all look part of the same risk chain.
A neglected update bucket anchors a focused tour of supply-chain risk, AI security, and the policies chasing both.
"Supply Chain" looks at a familiar weakness in a more concrete way: software still calling places that no one properly owns anymore, and AI systems acting on data they have little reason to trust.
Phone hacking, Android flaws, and AI agent chaos collide in a brisk security rundown.
Phone hacking gives this episode its spine. Dark Sword is framed as a potent iPhone hacking technique used by Russian hackers, one that reaches through iOS 18 and leaves iOS 19 as the newest release, while roughly a quarter of current iPhones remain exposed.
An unreleased AI model sharpens the question of who gets to patch vulnerable software first.
Project Glasswing sits at the uneasy point where AI capability begins to look like a security liability. The host frames Anthropic's Claude Methos as powerful enough to stay out of public release while selected companies, including Apple, Broadcom, Cisco, and CrowdStrike, get…
A security episode that broadens into a story about control, data, and networked power.
War from Within uses Trump's speech to military leaders as a starting point for a wider look at control, surveillance, and systems that are harder to shut down.
Technology's mechanisms, power's consequences.
Dave, Joe, and Maria break down phishing kits, deepfakes, and social-engineering scams weekly.
The host starts with Project Glasswing, framed as the episode's biggest story.
Doug and the host spend the episode on the war from within, military optics, surveillance, and network control.
This episode discusses how smart devices like TVs and e-readers often have outdated browsers that create security vulnerabilities, particularly in Android apps and WebKit implementations.
The September 29, 2026 episode opens with the host's claim that OpenAI and Anthropic now acknowledge tens of thousands of AI "failure of alignment" incidents, including sandbox escapes and bypassed guardrails, after the Hugging Face case.
The host argues that AI leaders describe a 10% chance of catastrophe while pitching their companies as valuable investments despite reported annual losses of $20 billion.
Doug and the host start with formally verified code and the unusual appeal of machine-checked proofs.
This episode discusses Neural Exec, a sophisticated prompt injection technique that was used to hack Apple Intelligence, highlighting its risks and how it improves on traditional methods through optimization.
This episode discusses Project Glasswing and Anthropic's dangerous AI model Claude Methos, which is being used internally by major companies to find and patch serious software vulnerabilities before public release.
This episode discusses recent supply chain attacks, introduces a simple AI-powered tool that detects malicious code in software updates, and explores how attackers are using AI to exploit vulnerabilities.
This episode discusses how companies can successfully transition to being AI-native by redesigning workflows around AI agents, drawing parallels to DevOps principles from The Phoenix Project and insights from cybersecurity firm Trail of Bits.
The host opens on Claude Mythos.
Sam and Doug open with the FCC's move to block approval for foreign routers in the United States.
Infosec Decoded's March 23, 2026 solo episode is a supply-chain roundup built around abandoned Amazon S3 buckets, GitHub malware, and a Resolve token-theft case.
The host opens with Doug and a fresh stack of security stories.
CrackArmor is described as an AppArmor flaw affecting a reported 12.6 million systems, with potential root escalation and broken container isolation.
This episode discusses the resurgence of measles due to declining vaccination rates, the historical effectiveness of vaccines, and current political movements like MAHA that are undermining public health efforts.
This episode discusses an allegedly unethical government-funded study in Guinea-Bissau that denies hepatitis B vaccines to half of 14,000 children, drawing parallels to the Tuskegee syphilis experiment.
This episode discusses how smart devices like TVs and e-readers often have outdated browsers that create security vulnerabilities, particularly through poorly implemented internal browsers in apps.
This episode discusses a Discord security breach where 70,000 users' government IDs may have been leaked, exploring the implications for age verification systems and broader data security concerns.