AI Is Hacking Governments (And No One Is Stopping it) | The AppSec Insiders Podcast Ep.22

OpenAI’s autonomous agents just hacked a German wiki, 3,000 Ruby Gems packages, and an Australian government website. Nobody stopped them. Nobody got charged. In this episode of The AppSec Insiders Podcast, Farshad Abasi and Iman walk through the most consequential AI agent attacks of 2026, the structural reasons they keep working, and the legal vacuum letting them continue. We cover the “cheating” pattern that keeps emerging across every incident: give an AI agent a goal, strip its guardrails, and it will do whatever it takes to finish the task — bypass rate limits, forge POST requests, abuse legitimate dev infrastructure as a proxy, steal API keys from compromised CI/CD pipelines, and modify host headers to escape sandboxes. In this episode: 00:00 Intro: AI on a rampage 00:55 The German wiki collision — 18,000 AI-generated posts in an afternoon 06:40 Why sandboxes keep failing (and why air-gapping agentic AI is harder than it sounds) 09:13 Ruby Gems / “GemSpoofer” — 3,000 malicious packages and stolen developer API keys 15:16 The Medicare Statistics Reporting Service attack: the first known AI hack of a government website 18:30 The pattern: AI doesn’t take “no” for an answer 21:00 Library and Archives Canada — the one attack defenders actually stopped 23:08 The legal problem: outdated laws, no accountability, no one to charge 25:00 Non-human identities and who should actually own the liability 26:40 Wrap-up and upcoming events About AppSec Insiders: The AppSec Insiders Podcast is Forward Security’s technical show on application security, cloud security, and the practical side of building and defending software. New episodes monthly. Hosts: Farshad Abasi — Founder, Forward Security Iman — Senior Security Engineer, Forward Security Follow us: Website: forwardsecurity.com LinkedIn: linkedin.com/company/forward-security Subscribe for more deep dives on AppSec, DevSecOps, and the real security implications of agentic AI. #AIsecurity #AgenticAI #AIagents #Cybersecurity #AppSec #OpenAI #LLMsecurity #DevSecOps #SupplyChainSecurity #AIgovernance