The latest episode of the Smashing Security podcast spotlights a disturbing scenario: buying a brand-new hardware crypto wallet, still sealed, only to discover it has a spy inside. The hosts describe breaking out a Geiger counter and a cat to investigate, suggesting more than one unusual detection method was needed to uncover the hidden threat. While the full details of the investigation are only teased in the episode, the story serves as a reminder that even trusted devices can be compromised before they reach the buyer.
The episode also turns to a separate attack vector: malicious ads targeting journalists with zero-click exploits. These ads require no action from the victim, making them especially dangerous for high-profile targets. Elsewhere, guest Spencer Thompson of Origin discusses what AI agents get up to on employees' laptops when no one is watching, noting that most companies have the prompt and the result but no record of what happened in between—commands run, files touched, or credentials accessed.
The three segments share a common theme: visibility. Whether it's a hardware wallet shipped with spyware, an ad that compromises a phone silently, or an AI agent acting without oversight, the risk often lies in actions happening out of sight. The podcast's coverage is based on these reported incidents, and no contradicting sources were included in the summary. For users, the takeaway is that caution should extend even to sealed, supposedly pristine devices.