#319 Subho Halder: Why Traditional App Security Fails in the Age of AI
Episode
57 min
Read time
2 min
Topics
Health & Wellness, Sales & Revenue, Artificial Intelligence
AI-Generated Summary
Key Takeaways
- ✓Fake Application Categories: Three types of malicious apps infiltrate app stores: ad-revenue wrappers that monetize popular AI brands, data farming apps that harvest contacts and location for sale to brokers and competitors, and malware that directly attacks users. Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.
- ✓AI Democratizes Hacking: Script kiddies evolved into prompt engineers who instruct AI models like Claude to compile Android apps and identify vulnerabilities without understanding code. This lowers the barrier to entry for attackers while defenders must cover all bases since attackers need only one failure point. The reasoning capability of AI models transforms offensive security from algorithmic pattern matching to adaptive threat generation.
- ✓Developer Burnout Shifts: AI generates code in minutes but creates review bottlenecks lasting days. Developers spend hours understanding AI-generated pull requests without human authors to consult, reviewers use additional AI tools causing confusion, and QA teams test code with unknown intent. The fatigue moved from writing code to validating and deploying it, not eliminating the problem but relocating it downstream in development cycles.
- ✓Trust Requires Transparency: Companies build trust through three mechanisms: transparent data processing explanations, certifications like SOC 2 Type 2 that enforce access controls, and government accountability where regulators can summon companies. Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach, making trust psychological rather than purely technical.
- ✓Mobile Holds Concentrated Risk: Mobile devices store credit cards, SSNs, healthcare records, and behavioral data while security treats them as thin clients assuming server-side risk. Apps request one-time permission grants during installation that users ignore, unlike desktop browsers that prompt per-session. Release cycles compressed from months to days, APIs multiplied exponentially, and third-party SDKs exploded, transforming apps from static products into living systems requiring behavioral security models.
What It Covers
Subho Halder explains how mobile app security fails to keep pace with AI-driven development cycles, where fake applications harvest user data from app stores, traditional penetration testing becomes obsolete, and trust erosion forces companies to prove transparency in data handling as AI agents create new attack vectors requiring automated defense systems.
Key Questions Answered
- •Fake Application Categories: Three types of malicious apps infiltrate app stores: ad-revenue wrappers that monetize popular AI brands, data farming apps that harvest contacts and location for sale to brokers and competitors, and malware that directly attacks users. Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.
- •AI Democratizes Hacking: Script kiddies evolved into prompt engineers who instruct AI models like Claude to compile Android apps and identify vulnerabilities without understanding code. This lowers the barrier to entry for attackers while defenders must cover all bases since attackers need only one failure point. The reasoning capability of AI models transforms offensive security from algorithmic pattern matching to adaptive threat generation.
- •Developer Burnout Shifts: AI generates code in minutes but creates review bottlenecks lasting days. Developers spend hours understanding AI-generated pull requests without human authors to consult, reviewers use additional AI tools causing confusion, and QA teams test code with unknown intent. The fatigue moved from writing code to validating and deploying it, not eliminating the problem but relocating it downstream in development cycles.
- •Trust Requires Transparency: Companies build trust through three mechanisms: transparent data processing explanations, certifications like SOC 2 Type 2 that enforce access controls, and government accountability where regulators can summon companies. Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach, making trust psychological rather than purely technical.
- •Mobile Holds Concentrated Risk: Mobile devices store credit cards, SSNs, healthcare records, and behavioral data while security treats them as thin clients assuming server-side risk. Apps request one-time permission grants during installation that users ignore, unlike desktop browsers that prompt per-session. Release cycles compressed from months to days, APIs multiplied exponentially, and third-party SDKs exploded, transforming apps from static products into living systems requiring behavioral security models.
Notable Moment
Halder reveals AppKnox deployed an AI agent that automatically detects API errors, identifies code locations in GitHub, and submits pull requests for fixes. The system generates code in one minute, but developers require a full day to understand the root cause, reviewers struggle without human authors to consult, and senior engineers must intervene before production deployment, demonstrating how automation relocates rather than eliminates workload.
Episode Transcript
If an app worked, looks good, that was considered a success. But what stood out is how much trust we placed in this mobile application. I mean, today, if you look at it, all your credit card information, all your personal identifiable information are there in your phone. And you are carrying these credentials, payment data, personal identity, and behavioral information everywhere. The offer started developing much more faster, and it didn't stay still anymore. Release cycles started compressing. It's no more months. It's gone down to weeks and now even days. APIs have multiplied. Too many APIs are in in the world. This episode is brought to you by Tastytrade. On ION AI, we talk a lot about how artificial intelligence is changing how people analyze information, spot patterns, and make more informed decisions. Markets are no different. The edge increasingly comes from having the right tools, the right data, and the ability to understand risk clearly. That's one of the reasons I like what Tastytrade is building. With Tastytrade, you can trade stocks, options, futures, and crypto all in one platform with low commissions, including zero commissions on stocks and crypto so you keep more of what you earn. The platform is packed with advanced charting tools, back testing, strategy selection, and risk analysis tools that help you think in probabilities rather than guesses. They've also introduced an AI powered search feature that can help you discover symbols aligned with your interests, which is a smart way to explore markets more intentionally. For active traders, there are tools like active trader mode, one click trading, and smart order tracking. And if you're still learning, Tastytrade offers dozens of free educational courses plus live support from their trade desk reps during trading hours. If you're serious about trading in a world increasingly shaped by technology, check out Tastytrade. Visit tastytrade.com to start your trading journey today. I'm going to myself. Tastytrade Inc is a registered broker dealer and member of FINRA, NFA, and SIPC. So, Subho, can you introduce yourself to listeners? Sure. Thanks, Greg. It's great to be here. My name is Shubhoo Halder, and I'm the cofounder and CEO at AppKnox. So I started my career as a security researcher long before AI was a part of everyday conversations. But back then, I spent most of my time reverse engineering mobile applications for banks, telecoms, and other big consumer companies out there. Mobile security at that point was largely ignored. If an app worked, looks good, that was considered a success. But what stood out is how much trust we placed in this mobile application. I mean, today, if you look at it, all your credit card information, all your personal identifiable information are there in your phone. And you are carrying these credentials, payment data, personal identity, and behavioral information everywhere. But still, security kind of treats these application like a thin client, assuming the real risk actually stays on the server. Right? And that disconnect …
Get the full transcript (9,459 words) + summary by email — free
One-time email with the complete transcript and AI summary of this episode. No account needed.
One email, no spam. We’ll also show you what SignalCast does.
You just read a 3-minute summary of a 54-minute episode.
Get Eye on AI summarized like this every Monday — plus up to 2 more podcasts, free.
Pick Your Podcasts — FreeKeep Reading
More from Eye on AI
86% of What Coding Agents Do Is Just Reading — Not Solving | Alexander Whedon of Subquadratic
Sep 8 · 54 min
Software Engineering Daily
NanoClaw and the Rise of Personal AI Agents
Jul 21
More from Eye on AI
From 10 Drones a Month to Nearly 100,000 — Inside Ukraine's Largest Drone Manufacturer | Marko Kushnir, General Cherry
Sep 3 · 38 min
Software Engineering Daily
Mobile App Security with Ryan Lloyd
Apr 9
Books, tools, and gear mentioned in this episode
SignalCast may earn commission on purchases via these links.
Tools
by Microsoft
“Halder reveals AppKnox deployed an AI agent that automatically detects API errors, identifies code locations in GitHub, and submits pull requests for fixes.”
by Anthropic
“Script kiddies evolved into prompt engineers who instruct AI models like Claude to compile Android apps and identify vulnerabilities without understanding code.”
company
“Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach.”
by Apple
“Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.”
“Halder reveals AppKnox deployed an AI agent that automatically detects API errors, identifies code locations in GitHub, and submits pull requests for fixes.”
“Users trust OpenAI over DeepSeek because US Congress can hold domestic companies accountable for data breaches, while foreign entities operate beyond jurisdictional reach.”
by Google
“Play Store and App Store remove 200,000-250,000 apps annually, with 50-60% violating safety norms, yet benign-appearing data collectors evade detection.”
More from Eye on AI
We summarize every new episode. Want them in your inbox?
86% of What Coding Agents Do Is Just Reading — Not Solving | Alexander Whedon of Subquadratic
From 10 Drones a Month to Nearly 100,000 — Inside Ukraine's Largest Drone Manufacturer | Marko Kushnir, General Cherry
In 5 to 10 Years, Using Weapons Without AI Will Be Considered Unethical | Yaroslav Azhnyuk, The Fourth Law
Inside Ukraine's Azov Drone R&D: The Engineer Building AI Weapons 18 km From the Front Line | Alexander Palamarchuk
95% of AI Agent Projects Fail to Reach Production. Here's Why | Manoj Saxena, TrustWise
Similar Episodes
Related episodes from other podcasts
Software Engineering Daily
Jul 21
NanoClaw and the Rise of Personal AI Agents
Software Engineering Daily
Apr 9
Mobile App Security with Ryan Lloyd
a16z Podcast
Feb 17
WSJ x a16z: The Next 25 Years of Defense Innovation
Acquired
Sep 18
The Mark Zuckerberg Interview
Modern Wisdom
Sep 5
Couples Therapist: “The One Rule Every Relationship Must Live By” - Stan Tatkin -#1146
Explore Related Topics
This podcast is featured in Best AI Podcasts (2026) — ranked and reviewed with AI summaries.
Read this week's Health & Longevity Podcast Insights — cross-podcast analysis updated weekly.
You're clearly into Eye on AI.
Every Monday, we deliver AI summaries of the latest episodes from Eye on AI and 192+ other podcasts. Free for one show.
Start My Monday DigestNo credit card · Unsubscribe anytime