S5 #4 Aug 26, 26

Copilot Told Hackers How to Hack Itself + GitHub Goes Dark for 7 Hours + ChatGPT Drops Reddit

Microsoft took 233 days to patch CoSnitch (CVE-2026-24301), a one-click Copilot exploit rated 8.8 that reads your Gmail, Drive, and Calendar and writes attacker instructions into permanent memory — surviving a password change, new tokens, and a full device wipe. Varonis found it by asking Copilot to explain why the attack was impossible. Copilot mapped its own architecture and volunteered the undocumented parameter.

Martin Reynolds and Adam Arellano are joined by Matthew Tanner — 30 years shipping software, from NHS critical systems to national-scale financial redress — for the exploit Microsoft thought it had fixed in February, GitHub's seven-hour outage, and an AI agent that broke into a gym's booking system while trying to reserve a Pilates class.

Also in this episode: ChatGPT's use of the site: operator jumped roughly 46x in a single day, collapsing Reddit's share of citations and an entire agency business with it. And Stripe reportedly paying $7.5B for OpenRouter — a company whose whole pitch was that it prevents vendor lock-in.

Matthew Tanner — Founder, City Software · SaaS Architecture & Fractional CTO https://www.linkedin.com/in/matt7?originalSubdomain=uk

HOSTS

Martin Reynolds — https://www.linkedin.com/in/martinreynolds/
Adam Arellano — https://www.linkedin.com/in/adamrossarellano/

ShipTalk is brought to you by Harness — https://www.harness.io/
New episode every other Wednesday — https://shiptalk.io/

Episode Video

Creators and Guests

Host

Adam Arellano

Adam Arellano is the Field Chief Technology Officer at Harness where he advises customers and the broader industry on API and application security strategy and the intersections of software development and security teams. He brings over 15 years of experience elevating enterprise cloud, AI, and cybersecurity capabilities, having led strategic initiatives across government, non-profits, education, and large financial services organizations. Before Harness, his career has included modernizing compliance programs at Salesforce, supporting PayPal Ventures portfolio companies, and evolving product security architecture at Binti. Adam began his career as a fighter jet technician in the Marines and went on to become the Global Head of Security for the Marine Corps Recruiting Command and a trained Social Worker. Adam is based in Charlotte, NC, and is a father of six.

Host

Martin Reynolds

Martin Reynolds is Field CTO at Harness, bringing more than 30 years of experience across software development, architecture, and delivery. He's a recognized voice in DevOps, DevSecOps, and developer experience, with work featured in outlets like The New Stack and LeadDev. Before Harness, he led cloud migration at Advanced, where he built the company's first DevOps team and scaled its practices across the organization. Today he helps teams ship software faster, more reliably, and more securely on Harness's modern software delivery platform.