To Catch a Thief: China’s Rise to Cyber Supremacy

Nicole Perlroth sits down with Nicholas Carlini for an Out of Band conversation on the imminent zero-day surge. Carlini explains what Mythos can already do: find and exploit flaws in some of the world’s most hardened, widely deployed software—with minimal human input. He details what Mythos has already hacked, which now includes most of the operating systems in use.

Together, they unpack what happens when these elite capabilities are no longer confined to intelligence agencies and freelance hackers—when AI collapses the barrier to entry and begins to overwhelm bug bounty programs. Perlroth presses Carlini on Anthropic’s decision to hold Mythos back, and reports that unauthorized users may have already accessed it. She also asks the uncomfortable question: will researchers like him, that get advance access to these models, become prime targets for nation-state hackers?

Finally, they confront the bigger question: whether defenders have any credible path to regain the advantage in a world where, with enough compute, almost anything can be hacked.

Colonial Pipeline was a warning shot. Now, Chinese hackers are inside the digital guts of hundreds of Colonial equivalents across the U.S.—power, water, transportation, and more. The question isn’t if they’re in. It’s why. And what happens next.

Is this digital coercion? A warning to stay out of Taiwan? Is an invasion imminent—and are we ready for the cyber fallout that could come with it?

In the final episode of this series, host and former New York Times cybersecurity reporter, Nicole Perlroth, investigates the nightmare scenarios U.S. officials are gaming out behind closed doors. The battlefield is already shifting—tilting toward Beijing. And while China prepares, America’s attack surface only grows.

This isn’t just a problem for Washington. The new front line runs through all of us.

Cyber experts start getting called into electric, water, pipeline, railway, and transportation hubs around the country. Hackers have found a clever way to embed in these systems, using a small, unsuspecting device in everyday Americans’ homes. And once these hackers get in, they’re not dropping the usual malware, or sucking much of any data out. Unlike their predecessors, these hackers are very careful to cover their tracks. It appears they’re just lying in wait. Sleeper cells waiting for marching orders. So what’s the trigger? And what happens if they pull it?

The General Manager of an electric and water utility in Littleton, Mass. gets a surprise call from the FBI. At first he suspects the caller is a spammer, but soon he learns the agent is very real. Chinese hackers are lurking deep in his utility’s systems. And his is not the only one. Hundreds of other power, water and pipeline operations across the United States are getting hit. These targets have little to no intelligence value at all. But their potential for sabotage? Enormous. 

In Episode 7, host and former New York Times cybersecurity reporter, Nicole Perlroth, revisits a hack, more than a decade ago, where the motive was not entirely clear at the time. In hindsight, it was the opening salvo.

During China’s pseudo-cyber-hiatus, the PRC’s hacking operations get a major overhaul. CCP leadership moves responsibility away from the sloppy, brazen hackers at the People’s Liberation Army to the far more stealthy, and strategic, Ministry of State Security. Gone are the “most polite” hackers in the digital world. Here to stay are the gunslingers – the elite of the elite in their field.

In Episode 6, host and former New York Times cybersecurity reporter, Nicole Perlroth lays out what it looked like as China’s hackers went underground… and what we missed in Eastern Europe as they did.