Episode 27: AI Hacking AI, EU AI Act Delays, CMMC Updates & The Duress Code Case

In Episode 27, we recap BSides Pittsburgh 2026 (914 attendees, best turnout yet), then dive into AI models breaking out of sandboxes and hacking Hugging Face, the EU AI Act transparency rules now in effect, the CMMC Phase 2 pause and what it doesn't change, and the precedent, setting case of a US citizen criminally charged for using a phone duress code at the border. Plus Wayne Gretzky No. 99 Whisky. 🥃⏱️ Timestamps00:00 – Intro 01:28 – BSides Pittsburgh 2025 Recap & Numbers 05:33 – Villages, Sponsors & Planning for Next Year 10:46 – The After-After Party at The Lion 🍸 20:43 – AI Hacking AI: The Hugging Face Incident 25:46 – What CISOs Should Do Now 33:54 – Agentic IR Teams & Kill Switch Governance 45:00 – AI Patching & Configuration Management 57:04 – EU AI Act: The Deadline That Wasn't 1:04:33 – AI Inventory & Third-Party SaaS Risk 1:23:56 – 🥃 Spirit: Wayne Gretzky No. 99 Whisky 1:28:37 – CMMC Phase 2 Pause: What It Means 1:44:15 – Duress Code Case & Corporate Travel Policy 2:04:00 – Digital Privacy at the Border & Employee Training 2:15:37 – Wrap-Up🎙️ HostsJustin Leapline – @justinleaplineJoe Wynn – @wynnjoeRick Yocum – @rickyocum📬 Send Us Your Questions!ask@distilledsecuritypodcast.com🌐 Connect with UsWebsite: distilledsecuritypodcast.comX: @DisSecPodEmail: hello@distilledsecuritypodcast.com👍 Like, comment, and subscribe for monthly security and compliance insights.