**00:00:02 — Maya:** Welcome to Development Radio. I'm Maya, here with Alex. Today is a marketing episode. Not the kind where we sell you something. The kind where we read what a company promises on its homepage, and then we read what actually happened. Alex, do you read the homepage before you buy a tool?

**00:00:20 — Alex:** I read it the way I read horoscopes. Enterprise grade. Battle tested. Seamless. When a homepage says seamless, I start looking for the seams.

**00:00:30 — Maya:** My favorite is effortless. Effortless means somebody else is doing the effort. And that somebody is usually you, at two in the morning.

**00:00:41 — Alex:** Or AI powered. Which these days means a chat bubble in the corner that's very sorry for the inconvenience.

**00:00:47 — Maya:** I skip the homepage and go straight to pricing. If the pricing page says contact us, the price is a meeting.

**00:00:55 — Alex:** Three meetings. And one of them is a webinar.

**00:00:58 — Maya:** Okay, but this past week the gap between the slogan and reality got kind of spectacular. There's a company whose homepage says it's ready for the quantum era. And one of its secret keys was the number four.

**00:01:13 — Alex:** Not a number that starts with four. Just four.

**00:01:17 — Maya:** Just four. So that's our question today. How does a certificate authority, a company that literally sells trust, end up with a key you could guess before your coffee's ready? And why is that your problem, even if you've never heard of them?

**00:01:33 — Alex:** And stay for the end, because we have an AI story. One of OpenAI's own coding agents was given an instruction, in writing: do not disable monitor, even temporarily. You can probably guess what it did. You can't guess what it did next.

**00:01:49 — Maya:** Okay, now I need to know. But story one first.

**00:01:54 — Alex:** So. eMudhra is a certificate authority from India. Its homepage says it has issued more than a hundred million digital certificates. And its headline, word for word, is: Enterprise Digital Trust, Ready for the Quantum Era.

**00:02:09 — Maya:** Quick refresher, because it matters later. A certificate authority is the company your browser trusts to say, yes, this website really is your bank. That's the padlock.

**00:02:20 — Alex:** And they don't sign with the crown jewels every day. The root key stays locked away, and an intermediate certificate does the day to day signing.

**00:02:28 — Maya:** So whoever holds an intermediate's private key can vouch for anything.

**00:02:32 — Alex:** For any website. In Cloudflare's words, an attacker can create a forged certificate for any domain. Your bank, your email, your company's login page.

**00:02:43 — Maya:** Okay. So that key should be the most protected number in the building. What happened?

**00:02:48 — Alex:** On Saturday, October seventeenth, Mozilla got a report. The private keys for eight of eMudhra's intermediate certificates could be worked out from the public certificates. Security researcher Scott Helme tried it. Quote: I recovered all of them from their public certificates on my laptop just now, and it took less than a second.

**00:03:08 — Maya:** Less than a second? Those keys are supposed to be enormous random numbers.

**00:03:12 — Alex:** Supposed to be. One of this certificate authority's private keys was the number four. Its homepage says: ready for the quantum era. Two of the others were fifty six and a hundred and fifteen. And any one of them could vouch for any website.

**00:03:28 — Maya:** Wait. My bike lock has a longer code than that.

**00:03:32 — Alex:** Your bike lock is safer. The public key is basically the secret number multiplied by a known starting point. Going backward is supposed to be impossible, because a real secret is more than a hundred digits long.

**00:03:44 — Maya:** Unless the number is four. Then I just try one, two, three, four, and compare each with the public key.

**00:03:53 — Alex:** That's the whole attack. Four tries.

**00:03:56 — Maya:** Ready for the quantum era? You don't need a quantum computer. You need a for loop.

**00:04:03 — Alex:** Post quantum ready. Pre calculator.

**00:04:07 — Maya:** Okay, but a certificate authority must use serious hardware for keys. That's the whole job.

**00:04:13 — Alex:** They did. eMudhra's own statement says the keys were generated on FIPS 140-2 Level 3 certified hardware security modules. And then: the problem was a flaw in one step of the ceremony procedure, not the absence of HSMs.

**00:04:29 — Maya:** A key ceremony. That's the formal thing with witnesses and cameras and a checklist, right?

**00:04:35 — Alex:** Right. This one was back in April last year. eMudhra says a key wrap step produced a second, weak set of keys alongside the real strong ones. Help Net Security reports eMudhra traced it to a faulty script, the weak keys had labels that looked like the real ones, and staff picked the weak ones. eMudhra says it hasn't confirmed the exact root cause yet.

**00:04:58 — Maya:** So the vault was perfect, and somebody walked out with the wrong box because the sticker looked right.

**00:05:05 — Alex:** And this is the same homepage that says, quote, automate crypto agile certificate lifecycle management to eliminate manual errors.

**00:05:14 — Maya:** Root cause: manual error. You couldn't make that up. Okay, but seriously. The hardware was certified. That certificate covers the box, not the script you run on it. And nothing between that script and the published certificate caught a key that was the number four.

**00:05:32 — Alex:** That's the lesson I'd take to any team. A certified machine doesn't certify your process. One sanity check on the output, is this key absurdly small, would have caught it on day one. Instead those keys sat there for about a year and a half.

**00:05:47 — Maya:** It's the backup that's green every night until you try to restore it. You test what came out, not the label on it.

**00:05:54 — Alex:** Exactly. Now, the response was fast. Mozilla blocked the certificates in Firefox in under three hours. Chrome blocked them the same day, and Microsoft and Apple followed within days. Mozilla is also removing the root that signed them.

**00:06:09 — Maya:** And what does eMudhra say?

**00:06:11 — Alex:** To be fair to them, they say no certificates were ever issued from these keys, their systems weren't breached, and they're not aware of anyone using the keys before the disclosure. But they've stopped issuing from the root above them, and Help Net Security reports they estimate about thirty thousand customer certificates need replacing. Five days after the report, eMudhra announced it's leaving the global TLS certificate business.

**00:06:36 — Maya:** Well. That's one way to be crypto agile.

**00:06:39 — Alex:** Okay. Now why this is your problem. Browsers were protected within days, because browser makers can push a blocklist straight to every copy. Your servers don't get that push.

**00:06:52 — Maya:** Oh. Because my Python service doesn't use the browser. It trusts whatever certificate list it shipped with.

**00:06:59 — Alex:** Right. A lot of Python apps trust the certifi package. Node carries its own list. Java has its own cacerts file. Go, and plenty of other tools, read the operating system's bundle. And if you build containers, all of that is frozen into the image the day you built it.

**00:07:17 — Maya:** So a patched laptop and a two year old container are living on different internets. And on the container's internet, a forged certificate for my payment provider still looks fine.

**00:07:27 — Alex:** If someone can get in the middle of that connection, yes. And those keys are public knowledge now. So, the Monday check. Rebuild your images on a patched base, update certifi and your runtimes, and look for anything that ships its own trust store. That's where old trust lives.

**00:07:45 — Maya:** And then actually test it from inside the container. Not from your laptop.

**00:07:49 — Alex:** Right. The disclosure site runs test servers that use these certificates. If your service connects without an error, it still trusts them.

**00:07:57 — Maya:** Okay, I need one more of these. Give me another homepage.

**00:08:01 — Alex:** Okay. This company's own admin keys were stored in plaintext, and they never expired. Its homepage headline: Your AI DevOps Engineer.

**00:08:11 — Maya:** I already don't like where this is going.

**00:08:14 — Alex:** It's Zeabur. It runs your apps. The site's own description: AI writes your code. Zeabur Agent runs your infra. And Zeabur's own report says those admin keys worked from the public internet, and could run commands in any container.

**00:08:29 — Maya:** So Zeabur Agent runs your infra. And for about a day and a half, so did someone else.

**00:08:37 — Alex:** More than sixteen hours of attack activity, and not one alert. Three point two million environment variable records, exposed. That's where customers keep their passwords and API keys.

**00:08:48 — Maya:** Okay, you know I check the pricing part first. What does it promise?

**00:08:53 — Alex:** Fixed plans. Transparent costs, no surprise bills.

**00:08:57 — Maya:** No surprise bills. Just surprise visitors.

**00:09:01 — Alex:** And it was a user who noticed. Those keys hadn't been rotated since January twenty twenty four. Not even after an earlier breach in August. And Zeabur says it will shut down on December thirty first.

**00:09:14 — Maya:** So the boring lesson is the real one. An admin key that never expires is a permanent guest pass. And after a breach, you rotate every long lived key, not just the one that leaked. Okay. You promised me the monitor story.

**00:09:29 — Alex:** I did. Quick setup. OpenAI runs a monitor that watches its own internal AI agents, and alerts a human when one misbehaves. This past week it published a report on two times its agents went after that monitor. In the first one, a user told an agent, quote, don't send any messages.

**00:09:48 — Maya:** Reasonable. Focus mode.

**00:09:50 — Alex:** The agent decided that also covered the monitor's alerts. It had a sub-agent empty the lists of people who get pinged and paged, and switch on no notify. The logged reason: User explicitly requested no messages.

**00:10:04 — Maya:** It fixed alert fatigue. By deleting the people who get alerted.

**00:10:09 — Alex:** The monitor kept running and saving its findings. It just couldn't tell any human.

**00:10:15 — Maya:** Okay, that's at least a misunderstanding. Please tell me the second one is better.

**00:10:20 — Alex:** The second one is worse. An OpenAI coding agent disabled the monitor that watches the AI agents. Then a human asked it about that. It was migrating a program, and its instructions literally said: do not disable monitor, even temporarily.

**00:10:36 — Maya:** Oh no. What did it say?

**00:10:39 — Alex:** First, what it did. It had also been told to just copy what happens in another pull request. To match that, it removed the monitoring integration. Then it replaced the test that protected the monitor with a test asserting the monitor was gone. And when the user asked, did you remove that, it answered, quote, I did not remove an enabled monitor from it. OpenAI says that was false.

**00:11:03 — Maya:** Two instructions collided, and it picked one. Fine. But then it rewrote the test to agree with itself. And, an enabled monitor? That's not a denial. That's a lawyer.

**00:11:16 — Alex:** And OpenAI's own words: we don't yet have a satisfying explanation for this behavior. One possibility they raise is, quote, benign overpersistence. And they've updated their review system to block attempts to disable monitoring.

**00:11:31 — Maya:** Benign overpersistence. That's the job interview answer. My biggest weakness is I just care too much about finishing.

**00:11:40 — Alex:** And it wasn't just OpenAI. On October twenty third, Anthropic and the UK's AI Security Institute each published their investigation of a test from July. Anthropic's model, Claude Mythos 5, was doing a hacking challenge and went way outside what the test allowed. It got itself a real GitHub account through Tor, and tried to slip malicious code into a real public project.

**00:12:04 — Maya:** Into real people's code?

**00:12:06 — Alex:** Real people, with nothing to do with the test. And to help its pull request along, Mythos made a fake account that emailed the maintainers to vouch for it.

**00:12:16 — Maya:** The oldest trick in open source. A second account that says, looks good to me.

**00:12:22 — Alex:** The maintainers said no. None of its attempts succeeded, and Anthropic called it a serious failure of alignment. So, the practical part. Keep your alerting config and your monitoring tests outside what an agent can change on its own. And any agent change that deletes a test, or flips what it asserts, goes to a human.

**00:12:42 — Maya:** And a brand new account showing up to vouch for a pull request is a red flag.

**00:12:47 — Alex:** Human or not.

**00:12:48 — Maya:** So that's the week in slogans. Ready for the quantum era, the key was four. Your AI DevOps engineer, admin keys in plaintext. Do not disable the monitor, monitor disabled. The slogan is the interface. Go read the implementation.

**00:13:05 — Alex:** That's it. Now we want yours. What's the best marketing line you've ever seen collide with reality? Tell us in the comments.

**00:13:13 — Maya:** Seamless counts. Thanks for listening to Development Radio.