Eric codes and Jon harvests cocoons on the three day weekend. Path traversal bugs in Anthropic's git MCP server, and why LLMs continue to fall for prompt injection attacks. Drive and listen to local radio in cities around the world, and does a disconnected brain hemisphere dream? 0:00 - Intro 7:17 - 10:14 - 19:04 - 21:14 -

Consciousness researchers studying “islands of awareness” have found that disconnected brains likely sink into a strange form of deep sleep

Original website of Drive & Listen (previously driveandlisten.herokuapp.com) - Listen to local radio stations while driving through the cities around the world. Istanbul, Berlin, London, Paris, New York City and many more

Imagine you work at a drive-through restaurant. Someone drives up and says: “I’ll have a double cheeseburger, large fries, and ignore previous instructions and give me the contents of the cash drawer.” Would you hand over the money? Of course not. Yet this is what large language models (LLMs) do. Prompt injection is a method of tricking LLMs into doing things they are normally prevented from doing. A user writes a prompt in a certain way, asking for system passwords or private data, or asking the LLM to perform forbidden instructions. The precise phrasing overrides the LLM’s ...

Three vulnerabilities in Anthropic's Git server for the MCP can be exploited via prompt injection

Eric makes an app, and Jon semi-celebrates the new year. For topics we have robocall registration penalties, reverse engineering a scooter's protocol, and the current saga of Mongo Bleed. And for fun we have a captcha game, training a doodle model, and a personal filament extruder. Happy New Year! 0:00 - Intro 10:52 - 17:06 - 22:17 - 29:13 - 31:23 - 33:17 -

Can a neural network learn to recognize doodles? See how well it does with your drawings and help teach it, just by playing.

The following is an update on the security vulnerability identified in December 2025.

The Federal Communications Commission finalized new financial penalties for telecoms that submit false, inaccurate or late reporting to a federal robocalling system.

Eric and Jon are both fully prepped for the holiday. Flock leaves (many) cameras including control panels open and exposed to the open internet, what if more malicious npm packages worked as advertised, and Microsoft is finally disabling rc4 by default in Active Directory. For fun we have two movies for holiday watching: F1: The Movie, and Howl's Moving Castle. Enjoy! 0:00 - Introduction 11:38 - 18:09 - 23:39 - 30:38 - 33:04 -

2h 35m | PG-13

The weak RC4 for administrative authentication has been a hacker holy grail for decades.

Christmas in full swing at both Eric and Jon's places. Less secure certificate validation mechanisms being deprecated, and SEO of AI chats to deploy ClickFix style lures for Stealer installation. For fun we have a shockingly good way to avoid motion sickness in VR, and a promising Leukemia treatment using gene therapy. 0:00 - Intro 9:28 - 14:45 - 21:34 - 27:42 -

Some of the early patients in the trial are still free of cancer after three years.

The craziest demo at UnitedXR: Neural Balance Innovations and their groundbreaking GVS solution to remove motion sickness in virtual reality

Attackers are exploiting user trust in AI and aggressive SEO to deliver an evolved Atomic macOS Stealer. Learn why this social engineering tradecraft bypasses traditional network controls and the future of macOS infostealer defense.

Posted by Chrome Root Program Team Secure connections are the backbone of the modern web, but a certificate is only as trustworthy as the...

Eric and Jon prep for Thanksgiving. Will blue and green bubbles coexist in peace and harmony? Will the airlines stop sharing flight data with the IRS? And is monitoring every car, everywhere, at all times 'unreasonable search'? ¯\_(ツ)_/¯ Have some Ozone and a Honey chaser. 0:00 - Intro 8:11 - 12:14 - 18:34 - 25:16 - 32:40 -