Contractor Gave Claude Admin Passwords Inside the Pentagon | UnHacked Ep. 111
Hosts:
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/
A contractor gave Claude his admin login. It went undetected for 2 months. Could your staff be doing the same thing?
Justin Shelley - https://www.phoenixitadvisors.com/
Mario Zaki - https://www.mazteck.com/
Joshua Holloway - https://7thdi.com/
A contractor gave Claude his admin login. It went undetected for 2 months. Could your staff be doing the same thing?
A defense contractor working inside the Pentagon used a personal Claude account to automate server builds and handed over an administrator username and password. The result: credentials and a complete map of NIPRNet went to a site NIST has marked as compromised. The vulnerability was patched after two months, and how it was caught was never disclosed. Justin Shelley, Mario Zaki, and Joshua Holloway break down what happened, why it triggered tighter AI rules under DFARS and CMMC, and what small businesses should take from it.
Also in this episode: a follow-up on the Binance breach, where $6.4 billion in crypto moved maliciously and a compromised developer laptop is believed to be the way in. They cover how researchers bypassed ChatGPT's little-known Lockdown Mode, a flaw found in June and patched in September. They explain why one 64 GB memory upgrade now costs about $500 and how AI demand is driving it. They also separate the real threats from the "90-day blackout" panic spreading on social media.
The hosts also explain why custom-built AI software is beating one-size-fits-all SaaS for some businesses. They draw a hard line between chatting with an AI and giving a tool like Claude Code access to your computer and your SharePoint.
What you'll learn:
- Why giving an AI tool your admin credentials can expose your whole network, and how a chat assistant differs from a command-line tool with your keys
- What the new AI requirements coming through DFARS and CMMC could mean for contractors
- How one compromised developer laptop and lateral movement can cost billions, and why attackers take whatever you have, whatever your size
- Where to find ChatGPT's Lockdown Mode (Settings, Safety and Security, Advanced Security) and why it is not a guarantee
- Three questions to answer today: Do you have every username and password? Do you have a network map? Could you function if your IT person disappeared?
New episodes every week that cut through the cybersecurity hype for small business owners. Subscribe so you don't miss the next one.
Want to know where your business actually stands? Phoenix IT Advisors helps small and mid-sized businesses find the gaps, put a dollar figure on their risk, and close them. If you need IT support, cybersecurity, or technology strategy, visit PhoenixITAdvisors.com and schedule a consult.
Links
Full episode:
https://unhackmybusiness.com/episode/111
Phoenix IT Advisors:
https://PhoenixITAdvisors.com
Risk tool:
https://unhackmybusiness.com
More from us: @UnHackedPodcast
Creators and Guests
Host
Bryan Lachapelle
Hi, I’m Bryan, and I’m the President of B4 Networks. I started working with technology since early childhood, and routinely took apart computers as early as age 13. I received my education in Computer Engineering Technology from Niagara College. Starting B4 Networks was always a dream for me, and this dream became true in 2004. I originally started B4 Networks to service the residential market but found that my true passion was in the commercial and industrial sectors where I could truly utilize my experience as a Network Administrator for a large Toronto based Marine Shipping company. My passion today is to ensure that each and every client receives top of the line services. My first love is for my wonderful family. I also enjoy the outdoors, camping, and helping others. I’m an active Canadian Forces Officer working with the 613 Fonthill Army Cadets as a member of their training staff.
Host
Mario Zaki
During my career, I have advised clients on effective – and cost-effective – approaches to developing infrastructure that fosters productivity and profitability. My work has provided me with a broad-based knowledge of business from the inside, with an expertise in areas that go beyond IT alone, ranging from strategic planning to cloud computing to workflow automation solutions.
