Skip to main content
Eye on AI

#319 Subho Halder: Why Traditional App Security Fails in the Age of AI

57 min episode · 2 min read
·
Subho Halder

Episode

57 min

Read time

2 min

Topics

Health & Wellness, Sales & Revenue, Artificial Intelligence

AI-Generated Summary

Key Takeaways

  • Fake Application Categories: Three types of malicious apps infiltrate app stores: ad-revenue wrappers that monetize popular AI brands, data farming apps that harvest contacts and location for sale to brokers and competitors, and malware that directly attacks users. Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.
  • AI Democratizes Hacking: Script kiddies evolved into prompt engineers who instruct AI models like Claude to compile Android apps and identify vulnerabilities without understanding code. This lowers the barrier to entry for attackers while defenders must cover all bases since attackers need only one failure point. The reasoning capability of AI models transforms offensive security from algorithmic pattern matching to adaptive threat generation.
  • Developer Burnout Shifts: AI generates code in minutes but creates review bottlenecks lasting days. Developers spend hours understanding AI-generated pull requests without human authors to consult, reviewers use additional AI tools causing confusion, and QA teams test code with unknown intent. The fatigue moved from writing code to validating and deploying it, not eliminating the problem but relocating it downstream in development cycles.
  • Trust Requires Transparency: Companies build trust through three mechanisms: transparent data processing explanations, certifications like SOC 2 Type 2 that enforce access controls, and government accountability where regulators can summon companies. Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach, making trust psychological rather than purely technical.
  • Mobile Holds Concentrated Risk: Mobile devices store credit cards, SSNs, healthcare records, and behavioral data while security treats them as thin clients assuming server-side risk. Apps request one-time permission grants during installation that users ignore, unlike desktop browsers that prompt per-session. Release cycles compressed from months to days, APIs multiplied exponentially, and third-party SDKs exploded, transforming apps from static products into living systems requiring behavioral security models.

What It Covers

Subho Halder explains how mobile app security fails to keep pace with AI-driven development cycles, where fake applications harvest user data from app stores, traditional penetration testing becomes obsolete, and trust erosion forces companies to prove transparency in data handling as AI agents create new attack vectors requiring automated defense systems.

Key Questions Answered

  • Fake Application Categories: Three types of malicious apps infiltrate app stores: ad-revenue wrappers that monetize popular AI brands, data farming apps that harvest contacts and location for sale to brokers and competitors, and malware that directly attacks users. Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.
  • AI Democratizes Hacking: Script kiddies evolved into prompt engineers who instruct AI models like Claude to compile Android apps and identify vulnerabilities without understanding code. This lowers the barrier to entry for attackers while defenders must cover all bases since attackers need only one failure point. The reasoning capability of AI models transforms offensive security from algorithmic pattern matching to adaptive threat generation.
  • Developer Burnout Shifts: AI generates code in minutes but creates review bottlenecks lasting days. Developers spend hours understanding AI-generated pull requests without human authors to consult, reviewers use additional AI tools causing confusion, and QA teams test code with unknown intent. The fatigue moved from writing code to validating and deploying it, not eliminating the problem but relocating it downstream in development cycles.
  • Trust Requires Transparency: Companies build trust through three mechanisms: transparent data processing explanations, certifications like SOC 2 Type 2 that enforce access controls, and government accountability where regulators can summon companies. Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach, making trust psychological rather than purely technical.
  • Mobile Holds Concentrated Risk: Mobile devices store credit cards, SSNs, healthcare records, and behavioral data while security treats them as thin clients assuming server-side risk. Apps request one-time permission grants during installation that users ignore, unlike desktop browsers that prompt per-session. Release cycles compressed from months to days, APIs multiplied exponentially, and third-party SDKs exploded, transforming apps from static products into living systems requiring behavioral security models.

Notable Moment

Halder reveals AppKnox deployed an AI agent that automatically detects API errors, identifies code locations in GitHub, and submits pull requests for fixes. The system generates code in one minute, but developers require a full day to understand the root cause, reviewers struggle without human authors to consult, and senior engineers must intervene before production deployment, demonstrating how automation relocates rather than eliminates workload.

Know someone who'd find this useful?

Episode Transcript

If an app worked, looks good, that was considered a success. But what stood out is how much trust we placed in this mobile application. I mean, today, if you look at it, all your credit card information, all your personal identifiable information are there in your phone. And you are carrying these credentials, payment data, personal identity, and behavioral information everywhere. The offer started developing much more faster, and it didn't stay still anymore. Release cycles started compressing. It's no more months. It's gone down to weeks and now even days. APIs have multiplied. Too many APIs are in in the world. This episode is brought to you by Tastytrade. On ION AI, we talk a lot about how artificial intelligence is changing how people analyze information, spot patterns, and make more informed decisions. Markets are no different. The edge increasingly comes from having the right tools, the right data, and the ability to understand risk clearly. That's one of the reasons I like what Tastytrade is building. With Tastytrade, you can trade stocks, options, futures, and crypto all in one platform with low commissions, including zero commissions on stocks and crypto so you keep more of what you earn. The platform is packed with advanced charting tools, back testing, strategy selection, and risk analysis tools that help you think in probabilities rather than guesses. They've also introduced an AI powered search feature that can help you discover symbols aligned with your interests, which is a smart way to explore markets more intentionally. For active traders, there are tools like active trader mode, one click trading, and smart order tracking. And if you're still learning, Tastytrade offers dozens of free educational courses plus live support from their trade desk reps during trading hours. If you're serious about trading in a world increasingly shaped by technology, check out Tastytrade. Visit tastytrade.com to start your trading journey today. I'm going to myself. Tastytrade Inc is a registered broker dealer and member of FINRA, NFA, and SIPC. So, Subho, can you introduce yourself to listeners? Sure. Thanks, Greg. It's great to be here. My name is Shubhoo Halder, and I'm the cofounder and CEO at AppKnox. So I started my career as a security researcher long before AI was a part of everyday conversations. But back then, I spent most of my time reverse engineering mobile applications for banks, telecoms, and other big consumer companies out there. Mobile security at that point was largely ignored. If an app worked, looks good, that was considered a success. But what stood out is how much trust we placed in this mobile application. I mean, today, if you look at it, all your credit card information, all your personal identifiable information are there in your phone. And you are carrying these credentials, payment data, personal identity, and behavioral information everywhere. But still, security kind of treats these application like a thin client, assuming the real risk actually stays on the server. Right? And that disconnect …

Get the full transcript (9,459 words) + summary by email — free

One-time email with the complete transcript and AI summary of this episode. No account needed.

One email, no spam. We’ll also show you what SignalCast does.

Browse all Eye on AI transcripts →

You just read a 3-minute summary of a 54-minute episode.

Get Eye on AI summarized like this every Monday — plus up to 2 more podcasts, free.

Pick Your Podcasts — Free

Keep Reading

Books, tools, and gear mentioned in this episode

SignalCast may earn commission on purchases via these links.

Tools

  • by Microsoft

    Halder reveals AppKnox deployed an AI agent that automatically detects API errors, identifies code locations in GitHub, and submits pull requests for fixes.
  • by Anthropic

    Script kiddies evolved into prompt engineers who instruct AI models like Claude to compile Android apps and identify vulnerabilities without understanding code.

company

  • Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach.
  • by Apple

    Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.
  • Halder reveals AppKnox deployed an AI agent that automatically detects API errors, identifies code locations in GitHub, and submits pull requests for fixes.
  • Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach.
  • by Google

    Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.

More from Eye on AI

We summarize every new episode. Want them in your inbox?

Similar Episodes

Related episodes from other podcasts

Explore Related Topics

This podcast is featured in Best AI Podcasts (2026) — ranked and reviewed with AI summaries.

Read this week's Health & Longevity Podcast Insights — cross-podcast analysis updated weekly.

You're clearly into Eye on AI.

Every Monday, we deliver AI summaries of the latest episodes from Eye on AI and 192+ other podcasts. Free for one show.

Start My Monday Digest

No credit card · Unsubscribe anytime