Ep 57 - Your ChatGPT & Anthropic Chats Aren't Private, Your Bounties Are Theater, Review Is Dead

🎙️ Coffee, Chaos and ProdSec, Ep 57

Your AI chat window has a human reader now. Your bug bounty program can't triage its own findings. And somewhere out there, 18 AI agents are shipping code that nobody's going to review.

This week Cameron and Kurt trace one thread through four different stories: the gap between what we assume is private and what actually is. From an encrypted AI chat pitch built on the same logic that created Signal, to a leaked contractor pipeline reading real ChatGPT conversations, to a vulnerability management rant about why finding bugs faster doesn't make you more secure, to a solo developer running a fleet of AI agents that write more code in a day than any human could review in a week.

They cover zero retention agreements that nobody can actually audit, bug bounty programs that exist for legal cover more than for catching bugs, and what it means for Product Security and DevSecOps when code review quietly stops being a human job.

If you work in ProdSec, Application Security, or Security Architecture and you've ever clicked "accept" without reading it, this one's for you.

☕ New episodes every Wednesday.

Coffee, Chaos and ProdSec -> strong coffee, stronger opinions.