We introduce the Kibitzer game: a repeated Attacker-Defender security game augmented with a third, strategic, non-participant informant-the Kibitzer-modeled on unsolicited security signals such as intrusion-detection alerts or threat-intelligence feeds. Unlike a mediator in the classical sense, the Kibitzer has no commitment power, is not chosen by either player, and has its own incentive: a reputational payoff for being trusted, coupled with a cost of vigilance. The Attacker can additionally corrupt the Kibitzer's signal at a cost. The Defender does not know the Kibitzer's reliability a priori and must learn how much to trust it. We study this game both analytically, deriving a partial-equilibrium threshold at which the Attacker's optimal corruption effort saturates, and computationally, via smoothed fictitious play (multiplicativeweights no-regret learning). Simulation shows a sharp equilibrium collapse: when corruption is cheap enough to always be worthwhile, the Kibitzer's own accuracy investment rationally falls to zero, and the analytical threshold consistently under-predicts the simulated transition point by roughly 3-4×, indicating that the trust-corruption feedback loop across all three players amplifies the collapse beyond what single-agent best-response reasoning would suggest. We further show that Bayesian trust-discounting reliably dominates both blind trust and ignoring the signal entirely, though a much simpler moving-average heuristic captures nearly all of this benefit in our tested regime-a result we report honestly as evidence against overclaiming the value of Bayesian machinery in this setting. We discuss implications for the economics of threat-intelligence procurement and directions for a full equilibrium characterization.