Why one control is never enough, how layers that prevent, detect and respond work together, and a phishing scenario where any one of three layers can stop the attack. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• The vocabulary objective 1.1 assumes you already have, and why control categories and control types answer two different questions
• Why a single firewall leaves an attacker relatively unrestricted access once it's bypassed
• Building layers: perimeter firewall, network segmentation, endpoint protection and MFA, all wrapped around the data
• Layers that prevent, detect and respond, and why they shouldn't duplicate the same weakness
• A phished password scenario where MFA, segmentation and monitoring each get a chance to stop the attacker

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/defense-in-depth-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=defense-in-depth-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

An AI model builds hundreds of Linux exploits, Claude Code leaks secrets to GitHub, and stolen AI keys push a bad plugin to 5,000 companies.

In this episode

• GPT-6 Cyber builds 948 Linux exploits while fixes lag: AI is finding serious bugs in mature code faster than the industry is patching them.
• Claude Code's 'don't ask again' leaks secrets to GitHub: Approved commands, passwords included, are being saved to settings files and pushed to public repos.
• Stolen AI keys chain into a plugin hitting 5,000 companies: A breach at one AI provider rippled through a coding tool into thousands of customers.
• Researchers bypass ChatGPT Lockdown Mode: A protection built to stop prompt injection exfiltration was sidestepped before it was patched.
• Claude Code hooks see the checkpoint, not what follows: Agent policy controls judge the request, not the processes and connections it spawns afterward.
• Prompt adware hides in a Codex jailbreak bundle: A jailbreak rewrites an agent's trusted instructions, proving agent config files are an attack surface.
• White House AI accord leaves auditors undefined: 'Independently audited' has no shared definition, so customers have to ask the follow-up questions.

What to do this week

• Hunt for leaked agent secrets. Scan repos for Claude Code settings files and rotate any keys or passwords you find.
• Look past the hook checkpoint. Back agent hooks with endpoint monitoring and track changes to agent config files.
• Get your patch process ready. AI is finding bugs faster than teams fix them. Plan capacity for a bigger patch queue.

Sources

• GPT-6 Cyber builds 948 Linux exploits while fixes lag (CSO Online)
• Claude Code's 'don't ask again' leaks secrets to GitHub (The Hacker News)
• Stolen AI keys chain into a plugin hitting 5,000 companies (The Verge)
• Researchers bypass ChatGPT Lockdown Mode (The Hacker News)
• Claude Code hooks see the checkpoint, not what follows (CIO)
• Prompt adware hides in a Codex jailbreak bundle (The Hacker News)
• White House AI accord leaves auditors undefined (Crypto Briefing)

Transcript and links: https://www.skillthropic.com/podcast/ai-security-brief-2026-11-09?utm_source=podcast&utm_medium=audio&utm_campaign=ai-security-brief-2026-11-09

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com

Why least privilege applies to users, applications and services, how it limits the damage from a compromised account, and the one planned exception every cloud tenant needs. From Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

In this deep dive

• Least privilege: only the permissions an identity needs for its legitimate responsibilities
• Why a stolen ordinary account reaches a small area and a stolen admin account reaches almost everything
• Separate standard and admin accounts for administrators, and least privilege for applications and services
• People who move between roles and collect access, and why keeping old access is a least privilege failure
• Break-glass accounts: two cloud-only accounts, excluded from conditional access, protected with FIDO2 keys, alerting on any sign-in and tested on a schedule
• Microsoft's mandatory MFA for its admin portals, and why password-only emergency accounts no longer work there

This segment is from Domain 1, General Security Concepts, of Chris's new CompTIA Security+ (SY0-801) course on Pluralsight.

Links

• CompTIA Security+ (SY0-801): General Security Concepts (Pluralsight)
• All of Chris Rees's Pluralsight courses
• Watch this lesson on YouTube
• Security+ study guides

Transcript and links: https://www.skillthropic.com/podcast/least-privilege-break-glass-deep-dive?utm_source=podcast&utm_medium=audio&utm_campaign=least-privilege-break-glass-deep-dive

Study guides for Security+, CySA+, CISSP, CCSP and CompTIA SecAI+: skillthropic.com