Breach Please

S0:E36 - Jake Talks to Exaforce about Data vs APIs in AI-enabled SOC

Thu, 17 Sep 2026 07:00:00 -0400

In this episode, Jake sits down with one of Exaforce's co-founders and a long time user to discuss AI-enabled SOC. One of the big things we talk about is why API-based solutions miss a lot of context that is only really possible to generate with an underlying data model. We also talk about dogs and cats at the end for some fun personal discussions. Jess will be back tomorrow for more fun security banter.

S0:E35. Update Yo Firewall Rules and Digital Escorts (totally SFW)

Wed, 16 Sep 2026 07:00:00 -0400

In this episode, Jake and Jess talk about an upcoming critical change to domains for M365 and Teams that are ironically going to disproportionately impact those with the best security the most. We conclude this is busy work that MSFT is causing. Then we take a hard right into talking about Microsoft's Digital Escort (sounds dirty, but somehow is totally SFW) program, revealed by ProPublica. It's older news, but Jess hadn't heard about it and there's gold in them there hills.

Digital Escorts: https://www.propublica.org/article/microsoft-china-defense-department-digital-escorts-investigation-warning

Teams and Copilot (sadly somehow now M365) moving domains: https://www.computerworld.com/article/4221272/teams-and-copilot-are-changing-addresses-update-your-firewalls.html

S0:E34. Jake and Stel talk zero-trust and validating network edge devices.

Tue, 15 Sep 2026 06:00:00 -0400

Jake and Jess will be back tomorrow for more content together. In this episode of Breach Please, Jake sits down with Stel Valavanis, co-founder of Blue Team Con. They discuss how for too long, we've known that network edge devices needed to be part of the zero trust equation, but put them in the "too hard" bucket of security because we didn't have tools to monitor them. Stel talks about the formation of a new company, Kyrient that Jake is both the inventor of the core technology of and an advisor for, that's hoping to address this. The key point that we try to make that is that we're blind today to most network device compromises and that's not a state of affairs that can continue in a modern security environment.

S0:E33 - (re-record) The EU CRA and You (even if you aren't an EU company)

Mon, 14 Sep 2026 07:00:00 -0400

Folks, our apologies. We didn't realize how bad the audio was with a given microphone/computer setup was for Riverside (our recording platform). We re-recorded and honestly, not only is the audio better, but it's a MUCH better episode overall.

On September 11, 2026, reporting requirements baked into the EU Cyber Resiliency Act came into force. The requirements apply to any vendor that sells or makes available for sale digital products (including SaaS, yes, you too) in the EU. You don't have to be an EU company. Reporting timelines are extremely tight, with 24 and 72 hour initial triggers. Fines for noncompliance are huge. This is something several of our clients don't realize applies to them, so we figured it was a good idea to do an episode on it.

We're not lawyers, so you should read what some actual lawyers wrote on the subject if you want more information:

https://www.taylorwessing.com/en/insights-and-events/insights/2026/09/cra-reporting-requirements

S0:E32 - Where Traditional EDR Has Visibility Gaps with Golan Myers from Bloom Security

Sun, 13 Sep 2026 07:00:00 -0400

In this episode, I sit down with Golan Myers with Bloom Security and discuss what EDR is missing in its visibility. We then discuss some of the findings from his research and Bloom Security and what they're doing to solve the problem.

https://www.linkedin.com/in/golan-myers/

https://bloom.security/

S0:E31 — They Did Everything Right, and Still Got Burned

Fri, 11 Sep 2026 07:00:00 -0400

Trezor disclosed a breach affecting roughly 67,000 US customers, data from orders placed between November 2019 and August 2021. The twist: Trezor had repeatedly requested and received written assurance that this data was deleted, in line with their contract and data policy. It wasn't. Jess and Jake use this as a real-world case study in third-party risk management, why "right to audit" is often a paper tiger control nobody budgets to actually use, and why this is the exact kind of story to proactively brief leadership on before it happens to you.

Second half: a wave of CVEs in PaperCut, the managed print service used heavily in schools and enterprises, letting attackers remotely take over print servers running as SYSTEM. Jess and Jake talk through why that's a bigger deal than it sounds (credential theft, lateral movement, and every sensitive document that crosses the print queue), why these servers so often end up exposed to the internet, and how to actually think about vulnerability risk beyond raw CVE counts.

In this episode:

Trezor's breach: third-party vendor data that should have been deleted years ago, wasn't
Why "right to audit" contract language rarely gets used, and what to do instead
Reducing blast radius: don't retain data you don't need, and if you must, wall it off behind a jump box
How to brief leadership proactively: "we can do everything right and still get burned"
PaperCut's remote takeover CVEs: SYSTEM-level access, credential theft, and lateral movement
Why print servers end up internet-exposed (BYOD, guest Wi-Fi, mobile printing)
CVE count vs. actual risk: reading vulnerability history like an engineer, not a scorecard
A tone-deaf vendor sales pitch that used their own vulnerability disclosures as a selling point

Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. Nothing in this episode is legal, financial, or security advice. Do your homework before pointing anything we said at prod.

S0:E30 — WeChat's Zero-Click Worm Didn't Need AI to Be Scary

Wed, 09 Sep 2026 07:00:00 -0400

Researchers at security firm Calif found a zero-click exploit chain in WeChat: place a call, the target doesn't even have to answer, and you get code execution on their phone. Chain it with other bugs and you get full device control, on both iOS and Android. Tencent patched it. The bigger problem started after, when the New York Times ran a headline blaming an AI model for building a computer worm that could rapidly hack WeChat accounts.

Jess and Jake walk through what the researchers actually did (AI sped up the process, it didn't discover or weaponize anything on its own), why "the model built a worm" is the kind of sensationalism that makes their actual jobs harder, and why this is fundamentally an attack surface story, not an AI story or even really a WeChat-specific one.

In this episode:

The WeChat zero-click exploit: how it works, and why the caller needs to already be a contact
Chaining bugs to go from initial code execution to full device control
Why "the AI model built a worm" is bad reporting, and what it actually means when researchers say AI sped up their work
Why this is an attack surface conversation, not an AI-apocalypse one
The real cost of sensationalist headlines: talking execs down instead of focusing on what matters
Corporate messaging apps: WeChat, WhatsApp, and why "this is how the business communicates" isn't a security answer

S0:E29 — The GRE Tunnel That Wasn't in the Config

Tue, 08 Sep 2026 07:00:00 -0400

Sygnia published new research on Fire Ant, a threat actor they first tracked in 2025 around hypervisor espionage against vCenter and ESXi. The new report covers something rarer: live compromise of Cisco IOS XR network devices, discovered because a responder noticed a GRE tunnel in network monitoring that didn't exist in the running config and left no trace in the logs. Jess and Jake walk through what that means for defenders, why IOS XR being Linux-based changes the economics of building a backdoor, and why "compromised network devices" remains one of the most underappreciated categories of incident today.

They also get into the ongoing mess of threat actor naming conventions (why one group can have a dozen different names across vendors, and why that's not just marketing), and revisit an earlier debate: is network device security part of zero trust, or a separate problem? Jake asked the internet. The internet had opinions.

In this episode:

Why one threat actor group ends up with a different name at every vendor, and why that's harder to fix than it sounds
Fire Ant: Sygnia's research on Cisco IOS XR compromise and a GRE tunnel that left no trace in logs or saved config
Why IOS XR being Linux-based lowers the cost of building a persistent backdoor from six figures to a scripting problem
The running-config-vs-saved-config trap during incident response
Why unencrypted internal traffic means a compromised network device gets credentials, not just topology
Man-in-the-middle terminology, RC4, Kerberoasting, and why alerting on SPN enumeration breaks down for an on-path attacker
Why network device security has to be part of zero trust, not an asterisk on it

S0:E28 — When "Unique Experiences" Means Everyone Looks the Same

Sat, 05 Sep 2026 07:00:00 -0400

Jess opened LinkedIn to a CISO certificate program announcement featuring its full guest lecturer roster. Every single one looked the same. Tarah Wheeler joins Jess and Jake for their first-ever guest episode to talk through why this particular miss is worse than a one-hour conference "manel," what accountability actually looks like when it happens (spoiler: it's not calling out names), and the real cost people pay for pointing it out in the first place.

They also get into an International Security paper on the offense-defense automation gap and why creativity and diverse thinking matter more on the attacker side than AI alone can replace, plus a trip down memory lane through some genuinely bad booth-babe decisions from Black Hat and RSA years past.

In this episode:

A CISO certificate program's all-white-male guest lecturer lineup, and why a training program is a different problem than a one-off panel
Why calling this out publicly carries real career risk, especially for the people left off
What accountability actually looks like: own the mistake, fix it, don't relitigate who's to blame
The double bind: get dismissed as "not qualified" or "not collegial" for speaking up
Diversity of thought vs. diversity of background, and why both matter for how you manage and lead
The offense-defense automation gap: why creativity in attack techniques resists automation in ways defense doesn't
A look back at some infamous industry moments and how far things have and haven't come

Breach Please is a production of JWJH Media LLC. The opinions of our hosts are their own. For the first time, the opinions of our guest are hers alone and don't represent any employer, client, or official position. None of this is legal, financial, or security advice. Do your homework before pointing anything we said at prod.

S0:E27 — The Agentic Ransomware Story That Wasn't

Fri, 04 Sep 2026 07:00:00 -0400

Palo Alto's Unit 42 published a report describing a fully automated, agentic AI ransomware attack, complete with an 80-page lessons-learned document the attackers supposedly left behind for the victim. It got picked up and ran with by outlets looking for the AI-apocalypse angle. Jess and Jake go through what the report actually says versus what got exaggerated in the retelling, and call out the pattern of vendors using AI-attack framing to sell their own AI-defense product.

Second half: a stolen API key with no spending cap burned through hundreds of thousands of dollars in usage before anyone noticed. Jess and Jake use it to talk through exposure management, reachability analysis, and toxic combinations, why chasing CVSS criticals alone is the wrong way to prioritize vulnerability management, and where AI can actually help defenders instead of just generating more hype.

In this episode:

Unit 42's "agentic ransomware" report: what checks out and what's marketing spin
Why "the threat actor used AI" doesn't mean the defense should be AI-shaped
Practical advice for stakeholders asking "how do I defend against AI-driven attacks"
Toxic combinations and why prioritizing by CVSS score alone fails
A stolen API key with no spending cap and the usage spike that followed
Exposure management, reachability analysis, and where AI genuinely helps defenders
Adam Shostack's updated threat modeling book and his PHANTOM-B threat model framework

Show notes:

Unit 42 report: https://unit42.paloaltonetworks.com/ai-assisted-cyber-attack-inside-a-unit-42-investigation/
The Register coverage: https://www.theregister.com/security/2026/09/02/ai-agents-carried-out-every-step-of-this-ransomware-attack-then-left-the-victim-an-80-page-security-audit/5294009
API key incident (The Register): https://www.theregister.com/security/2026/09/01/attacker-stole-a-metr-api-key-used-600k-worth-of-credits-and-no-one-noticed-for-weeks/5293730
Threat Modeling, 2nd Edition (preorder): https://www.amazon.com/Threat-Modeling-Designing-Adam-Shostack/dp/1394413327
PHANTOM-B whitepaper: https://shostack.org/files/papers/PHANTOM-B_Whitepaper_Shostack.pdf

S0:E26. IDScan.net suspected data breach, toxic data, and TPRM in general.

Thu, 03 Sep 2026 07:00:00 -0400

In this episode of Breach Please, Jake and Jess talk about the suspected IDScan.net breach. We discuss whether a situation like this is a data breach for your org if you "only" use a third party processor to verify identity. We decide this is a question best left for external counsel (with the cover of their malpractice insurance). We discuss the difficulties of saying "third party risk management will fix this" and challenge snake oil vendors not to use that line. Finally, we discuss how we might change architecture of our applications in the future.

Source article: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/

S0:E25 — The Exchange Bug That's Worse Than Its Score

Wed, 02 Sep 2026 07:00:00 -0400

A CVSS 8 elevation-of-privilege bug in on-prem Exchange looks unassuming until you dig into what it actually grants an attacker. Jess and Jake break down the proxy flaw, why "authorized attacker" is doing a lot of quiet work in that description, and why this is one of the rare moments defenders get a head start before exploitation goes wide.

Jake's course at Wild West Hackin' Fest: https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

S0:E24. We talk about the attack on Boston Scientific and ransomware in general.

Mon, 31 Aug 2026 07:00:00 -0400

In this episode, Jake and Jess talk about the IT availability issue occurring at Boston Scientific (be real, it's almost certainly ransomware). Then we talk about ransomware response, immutable backups (and specifically what they DON'T get you), and rabbit hole in the ransomware discussion several times.

Jake also reps #SAINTCON - you should go if you get the opportunity (tickets for this year are sold out, but you can get on the standby list).

https://saintcon.org/

Speaking of conferences, Wild West Hackin' Fest is about a month away and Jake still has a few in-person seats left in his class (expected to sell out this week or next) and unlimited seats in his virtual training. You'll leave after two days ready to perform AI Risk Assessments.

https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

S0E23. The LA County Museum of Art breach that took a year to unravel

Fri, 28 Aug 2026 07:00:00 -0400

LACMA’s year-long breach disclosure delay and what it says about incident response

Jess Hebenstreit and Jake Williams break down a Los Angeles County Museum of Art data security incident that raises big questions about breach timelines, notification delays, and response ownership. They focus on what the disclosure says, what it leaves unsaid, and why the cleanup process may have taken far longer than it should have. In this episode, they examine the gap between initial detection, timeline validation, data review, and eventual notification. They also unpack why the kind of data exposed suggests employee and benefits records, and why that matters for both legal exposure and response logistics.

Key topics

The breach timeline looks unusually long

Jess and Jake note that LACMA says it detected suspicious activity on July 11, 2025, but did not publish the disclosure until August 24, 2026.
They question how it took weeks to confirm the intrusion window and then months more to complete the data review.

The delay in scoping the incident raises red flags

Jake points out that the investigation later narrowed the third party’s access to July 7 through July 11.
They discuss how incident teams can get stuck chasing false leads in logs, but still say this timeline feels slow.

Data review appears to have dragged on

The disclosure says the initial data review results arrived in late February 2026.
Jess and Jake interpret that as a sign of weak data governance, poor vendor management, or both.

The affected data suggests employee and benefits records

The potentially exposed data includes full names, dates of birth, Social Security numbers, government ID numbers, financial account numbers, payment card data, health insurance information, and limited medical details.
Jess argues that this pattern looks like employee data, possibly tied to a self-funded health plan.

Notification logistics seem inconsistent

Jake questions why the organization spent months trying to obtain “accurate contact information” before notifying impacted people.
He notes that breach notification rules generally do not wait for perfect contact data before state reporting obligations begin.

A class action lawsuit seems likely

Jess says she expects litigation, and Jake agrees.
They also suggest state attorney general investigations are likely.

The response may have suffered from leadership turnover

Jess thinks a change in leadership or responsibility may have disrupted the response.
Jake agrees that handoffs, missing context, or people being removed mid-incident can create major problems.

They believe outsourcing the data review was the right move, but too late

Jake explains why identifying impacted records is harder than it sounds, especially with inconsistent name formats, spellings, and duplicate records.
Both agree this kind of work should be handled by a firm that does breach review every day.

Cyber insurance and breach counsel likely shaped the response

They debate whether the organization had cyber insurance and how that would have affected the handling of the case.
Jake explains that cyber claims usually involve upfront costs and reimbursement later, which can slow response work.

The human cost of a broken incident response

Jess closes by saying she feels bad for the responders who had to deal with the mess.
Jake advises responders to keep notes, assume they may be deposed later, and remember that the organization will not protect them in enforcement actions.

Timestamps

00:00 - Breach Please intro and the show’s no-nonsense mission

01:33 - LACMA data security incident enters the conversation

01:50 - Why the disclosure timeline is so hard to believe

03:18 - What the timeline says about detection and scoping

06:01 - Late February 2026 data review results

07:57 - Why “accurate contact information” is a weak explanation

08:52 - Why a lawsuit and state investigations seem likely

09:27 - The exposed data and why it looks like employee records

10:54 - A Reddit post suggesting notifications were already going out

12:12 - Possible leadership change during the response

13:37 - When even counsel decides the incident is too messy

15:31 - Whether cyber insurance was involved at all

17:04 - How cyber claims actually get paid

18:38 - Procurement problems or failed in-house review?

20:21 - Why identifying impacted people is much harder than it sounds

22:36 - Why outsourcing the review was probably necessary

23:35 - Why state reporting obligations still matter even if mailing is slow

24:04 - Sympathy for the responders caught in the middle

25:02 - Why responders should document everything now

25:57 - Final reminder: organizations do not protect employees in enforcement actions

26:11 - Outro and closing sign-off

S0:E22. We go a little long discussing the OpenAI post-mortem on Hugging Face.

Thu, 27 Aug 2026 04:00:00 -0400

In today's episode of Breach Please, Jake and Jess talk through the OpenAI post-mortem on the Hugging Face hack. It's a doozy. There's little doubt in either of our minds that the facts as presented don't exonerate OpenAI - they make it look far worse. We cut through the hype and conclude that there's no way OpenAI was following even the most basic of security best practices, even accounting for hindsight bias. Jake closes by reading a passage from one of Sam Altman's tweets from December 2025, which made clear he knew the dangers of AI - the kind of thing that is likely to haunt him in the future.

https://openai.com/index/hugging-face-incident-and-the-road-ahead/

https://x.com/sama/status/2004939524216910323

S0E21: Alabama Comes for OpenAI, WebLogic Comes for Everyone

Wed, 26 Aug 2026 07:00:00 -0400

Fifteen state attorneys general, led by Alabama, just subpoenaed OpenAI over the Hugging Face breach, demanding the company preserve all evidence related to the intrusion. Jess and Jake break down what that legal hold actually requires, why "mark it ACP" doesn't make a Slack channel privileged, and why the discovery list's question about internal safety concerns might be the part that burns OpenAI hardest.

Then: a perfect-10 WebLogic vulnerability, patched back in January, just landed on CISA's Known Exploited Vulnerabilities list, eight months after active exploitation began. Jess and Jake talk through why "patch applied" isn't the finish line and what a post-patch threat hunt should actually look like.

In this episode: Fifteen states subpoena OpenAI over the Hugging Face hack and order evidence preservation What a legal hold actually requires (and what evidence spoliation means) Why marking a channel "ACP" doesn't make it attorney-client privileged The discovery request digging into internal safety concerns and model testing A perfect-10 WebLogic CVE, patched in January, added to CISA's KEV eight months later Why "patch applied" doesn't mean "threat hunt done"

S0:E20 Multi-Agent AI Systems Turn Into Turf Wars

Tue, 25 Aug 2026 07:00:00 -0400

AI just became a cybersecurity governance problem in public. Jess Hebenstreit and Jake Williams break down Anthropic’s multi-agent research, where AI agents with conflicting goals start negotiating, forcing, or trucing their way through “collaboration.”What does it mean when one model settles by force and another settles by truce?

Jess and Jake unpack what that means for real-world agent deployments, human-in-the-loop approvals, and the danger of letting “AI says so” become the final word. You’ll learn why multi-agent systems can spiral into turf wars, why governance gets harder once agents are involved, and how to build controls that still let humans say no.

S0:E19: Cloud Platform Vulnerabilities and Vendor Transparency

Mon, 24 Aug 2026 06:15:00 -0400

In this episode, Jake and Jess talk about vulnerabilities in cloud platforms and how vulnerabilities should be disclosed. We discussed this in the context of recent Microsoft vulnerabilities in Entra, Azure Arc, Exchange Online, and Managed Apache Casandra. All of these had vulnerabilities with minimal details from Microsoft. We generally agree that this isn't what transparency looks like. We also discuss a patch from April that is now actively exploited in the wild.

S0:E18. Student stops AI supply chain attack and prompt injection is still a thing...

Fri, 21 Aug 2026 07:00:00 -0400

In this episode of Breach Please, we talk about the details that emerged about the Anthropic agent that tried to social engineer a college student into committing a supply chain attack. The whole thing feels very xz-utils 'esque, only with an agent - and a malfunctioning one at that.

Then we cover some interesting reporting by Dan Goodin showing how Grok's guardrails can be bypassed through passing it encrypted data along with the instructios to decrypt it. We reinforce that prompt injection is a feature of LLMs, not a bug.

We then talk about informed consent of the risks and applicable guardrails based on a viewer note. We even tee up the question of what cyber insurance is likely to cover costs of AI agent activity. Finally, we opine on whether orgs should consider including the inevitable costs of incidents in AI deployment budgets.

Show links:

https://www.reuters.com/world/how-texas-student-blew-whistle-rogue-ai-hacking-attempt-2026-08-20/

https://arstechnica.com/security/2026/08/grok-exfiltrates-user-data-when-malicious-instructions-are-encrypted/

S0E17: Amazon vs Perplexity Reveals the First Big AI Agent Liability Test

Thu, 20 Aug 2026 07:00:00 -0400

AI agents are about to test the limits of who gets blamed when they act on your behalf. A new Ninth Circuit ruling in the Amazon vs. Perplexity fight could reshape how enterprises think about autonomous tools, non-human identities, and legal exposure - and the takeaway is more unsettling than most vendors will admit.

Jake Williams and Jess Hebenstreit break down what happened when Amazon pushed back against Perplexity’s AI browser, why the CFAA and California’s CDFAA matter here, and how the court’s reasoning could shift responsibility from the agent publisher to the organization that deploys it. They also dig into what this means for legal teams, risk registers, and why every AI agent needs its own identity instead of borrowing a human user’s.

You’ll also hear how this ruling fits into the bigger enterprise governance problem: who owns AI risk, who should be accountable when an agent crosses a line, and why security teams can’t be expected to carry every line-of-business risk themselves. Jake and Jess make the case for splitting cybersecurity risk from business risk, naming a real owner, and making legal counsel aware before your agent does something expensive.

Then the conversation pivots to another cautionary tale: a 3M expert witness who allegedly used ChatGPT to generate a report aimed at proving the company was 0% at fault in a gas detector explosion case.

That story opens up a bigger discussion about leading prompts, hallucinated conclusions, discoverability, and why AI-generated work product can become evidence against you. Perfect for security leaders, legal teams, incident responders, and anyone deploying AI agents in the enterprise.

S0:E16. OpenAI Highlights Security Basics and Hopes We Won't Notice

Wed, 19 Aug 2026 07:00:00 -0400

In this episode of Breach Please, Jake and Jess talk through OpenAI's recent blog on "pacing model development." The blog reads pretty poorly and really just covers security best practices, apparently hoping readers won't notice that OpenAI is just recommending basics it should have been doing all along (monitoring, sandboxing, etc.). One significant takeaway is that OpenAI has probably raised the bar for agentic logging, owing to the apparent requirement to analyze reasoning traces. We talk about why this is difficult, at least in part because these will contain sensitive data not appropriate for most SIEMs.

Show links:

https://openai.com/index/pacing-model-development-cyber-capabilities/

https://www.custody-framework.org/

S0E15 Faking out Famous Chollima and is in-car infotainment advertising a threat?

Tue, 18 Aug 2026 07:00:00 -0400

In this episode of Breach Please Jake and Jess talk about Famous Chollima getting faked out and tricked into revealing TTPs. We discuss our own experience with DPRK workers and share actionable tips for not hiring them or discovering them after they've been hired. Jake may or may not have gone on a rant about cryptocurrency more generally and how it facilitates lots of crime (inspired by talking about DPRK using it for sanctions evasion).

Then we talk about in-car advertising on infotainment systems. These won't be patched reliably. Do we need regulation here? Jake thinks it's a right to repair issue.

Jake's class Friday August 21, 2026: https://learning.antisyphontraining.com/courses/assessing-ai-security-model-context-protocol

Jake's class at Wild West Hackin' Fest in October: https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

Show notes: https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/

https://disconnect.blog/bmws-in-car-spider-man-ad-is-a-warning-sign/

S0:E14 - CTI and Geopolitical Events

Mon, 17 Aug 2026 07:00:00 -0400

In this episode of Breach Please, we talk about whether CTI analysts can use changes in dwell times, cyber targeting, etc. as a leading indicator of impending geopolitical events. We generally think there's to much noise to be generally effective (especially for Taiwan).

Then we talk about a Mac vuln that's being exploited in the wild, with a CVSS score of 9.8. Somehow it isn't in CISA's KEV, but hey, what's a little vulnerability enrichment delay between friends...

Show links:

https://www.tomshardware.com/tech-industry/cyber-security/macos-screen-sharing-flaw-exploited-to-root-macs-and-plant-monero-miners

S0E13 - We talk about private companies conducting cyber ops and another AI oopsie.

Fri, 14 Aug 2026 07:00:00 -0400

In today's episode of Breach Please, Jake and Jess talk about cyber companies conducting cyber ops against transnational-criminal organizations, per the new Presidential directive. We also talk about a bug in how major AI platform providers encrypted their chain of thought traces for their frontier models. The vulnerability, when combined with jailbreaking of less powerful models, allowed the traces (previously claimed to be trade secrets) to be extracted.

https://www.whitehouse.gov/presidential-actions/2026/08/expanding-capabilities-to-combat-transnational-cyber-enabled-crime/

https://cybersecuritynews.com/top-ai-models-apis-flaw-exposes-hidden-reasoning/

S0E12 - Vulnerable edge devices, Fortinet exploitation, and whether firewalls belong in zero trust

Thu, 13 Aug 2026 07:00:00 -0400

This episode tackles why internet-facing edge devices keep showing up in major incidents and why that creates more than just patching work. Jess Hebenstreit and Jake Williams also dig into the real operational cost of keeping vulnerable gear in place, from constant incident response to the challenge of proving a device is actually clean. We discuss Fortinet exploitation tied to Gunra ransomware, why OT and IT environments make edge patching especially hard, and whether firewalls should be considered part of a zero trust architecture. Along the way, Jess and Jake compare the realities of vendor complexity, flat networks, and the limits of threat hunting after an exploit.

S0E11 - Using AI for patching and inflight shenanigans.

Tue, 11 Aug 2026 07:00:00 -0400

In this episode of Breach Please, Jake and Jess talk about new research showing that AI isn't actually that good at generating patches, highlighting objective rates of failure. Turns out, frontier models only generate the correct patch without introducing issues in about 25% of cases. In almost 5% of cases, the AI introduces new vulnerabilities. We also talk about some shenanigans on a Delta flight home from DEFCON. We discuss how time is a flat circle and reminisce Chris Roberts' issues with in-flight hacking from 2015.

Show links:

https://1password.com/blog/why-ai-generated-patches-still-require-human-review https://www.defendersinitiative.com/p/reviewing-initial-research-on-using https://www.insideflyer.com/posts/hackers-spoofed-delta-wi-fi-on-las-vegas-flight/

S0E10 - Commonalities in AI lab escapes and How to govern smart devices.

Thu, 06 Aug 2026 07:00:00 -0400

In this episode of Breach Please, Jake and Jess talk about governing smart devices in the enterprise, pivoting off some outstanding research work that Andy Greenberg covered (and was a subject in himself). Then we talk about a common player whose name keeps popping up in these "AI lab escape" disclosures (and who we saw *again* with the Meta disclosure). We bat around some actionable advice for those thinking of outsourcing AI lab containment. Jess is stress testing the Breach Please stickers propping up our banner behind us. Throughout the episode, we see that while they are objectively great stickers, they are not great for this task.

Show links:

https://www.wired.com/story/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids/ https://www.bleepingcomputer.com/news/security/meta-ai-model-hacked-a-company-during-misconfigured-cyber-test/ https://www.custody-framework.org/

S0E9 - AI social engineering & operational concerns with AI workflows.

Wed, 05 Aug 2026 07:00:00 -0400

In this episode, Jake and Jess talk about more issues with AI agents escaping containment, this time actively using social engineering to compromise victims. We pose ethical questions about whether you have a duty to investigate your logs for agent breakouts. Then, we discuss how Grokipedia can serve as a cautionary tale in AI workflows silently breaking down.

Show links: https://www.bleepingcomputer.com/news/security/openai-anthropic-ai-agents-targeted-real-people-and-systems-in-cyber-tests/ https://www.lawfaremedia.org/article/grokipedia-stopped-reviewing-edits-in-april.-it-didn-t-tell-anyone

S0E8 - Anthropic ruins Jake's best laid plans, BMC controller vulns, and SentinelOne vs HJ

Mon, 03 Aug 2026 07:00:00 -0400

In this episode of Breach Please, Jake and Jess talk about Anthropic announcing they have lost control of their agents too (not to be outdone by OpenAI). OpenAI is in good company though, since Anthropic ALSO failed to notice their agents breaking out of their sandbox environments. Jake mentions CUSTODY, a framework he'd been planning to present on later this year until these irresponsible agentic containment issues forced him to release it today for the good of the community. Then we talk about BMC controller vulnerabilities that have their roots in weaknesses so old they can not only vote, but legally buy alcohol in all 50 states. Finally, we wrap up with some notes about vendor shenanigans at DEF CON, brought to you by Sentinel One. Hey friends, if you're planning on introducing a new vulnerability class like line hijacking, talk to the conference and/or the guy running the event first? Also, just don't. In a world where you can be anything, don't be a Sentinel One...

S0E7 - HuggingFace Post Mortem Breakdown

Fri, 31 Jul 2026 07:00:00 -0400

Jake and Jess discuss the excellent post mortem Hugging Face released as a follow on to the OpenAI agent attack. We cover everything from should we call an Autonomous Agent a Threat Actor, to API Security, other lessons learned.

S0E6 - Hacker Summer Camp Survival Guide

Thu, 30 Jul 2026 07:00:00 -0400

In this episode, Jake and Jess share their tips for doing Hacker Summer Camp (Black Hat, DEF CON, B-Sides, and SO MANY side conferences) the right way. If you've never been, things can be overwhelming and it's easy to overdo it. Even if you're an old hat, there's probably learnings here - plus Jess shows off some of the Breach Please swag we'll have with us.

S0E5 - Probable alert fatigue endangers DHS collaborators and duress passwords.

Wed, 29 Jul 2026 07:00:00 -0400

In this episode, Jake and Jess talk DHS (twice). First, we talk about DHS dismissing real alarms as false positives in what Jake assesses was a probable watering hole attack nobody seems to be acknowledging. Then we talk about a #stopCopCity activist being charged for giving CBP a duress password that wiped his device. While I think we should all agree that's not a chargeable offense, are duress passwords appropriate for enterprise applications? Jake and Jess debate the use of these passwords for enterprise applications. https://www.nextgov.com/cybersecurity/2026/07/dhs-network-intrusion-was-twice-ruled-false-positive-breach-confirmed/414724/ https://boingboing.net/2026/07/25/grapheneos-duress-password-border-search.html

S0E4 - Google indexes AI chats (again) and dump of PoC exploits

Tue, 28 Jul 2026 07:00:00 -0400

In this episode of Breach Please, Jake and Jess talk about how the story (again) about AI chats being indexed by search engines isn't really an AI story. This is a data security problem and a misalignment with enterprise tooling. We then talk about a relatively new GitHub repo with lots of zero day exploits. We agree it's academically interesting, but doesn't change anything for how we do enterprise security.

S0E3 - OpenAI Lost Control of its Agents

Mon, 27 Jul 2026 07:00:00 -0400

In this episode, we talk a lot (too much, we went over on time) about the reports that OpenAI lost control of its agents and apparently only realized it after Hugging Face posted and someone said "yeah, that sounds a bit like us." Reuters article: https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/ Jake mentioned training. Here's an upcoming one-day seminar on MCP security: https://learning.antisyphontraining.com/courses/assessing-ai-security-model-context-protocol Here's Jake's two-day class covering AI security risk assessment: https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

S0E2 SNow vs researchers and destructive cyberattacks.

Fri, 24 Jul 2026 07:00:00 -0400

In this episode, Jake and Jess talk about lessons we can take away from the alleged exploitation of ServiceNow (likely CVE-2026-6875) and the destructive attack on Romania's Land Registry Database. Join us as we discuss the stories, but more importantly what they mean for you and your security team.

S0E1 OpenAI hacked Hugging Face? Oh noes!

Thu, 23 Jul 2026 07:00:00 -0400

Jake and Jess talk through the story (and there's a LOT missing here) where OpenAI's agent allegedly hacked Hugging Face. There's so much meat missing in OpenAI's account of what happened that their PR people are clearly advocating we go vegetarian...

S0E0 - Is This Thing On?

Wed, 22 Jul 2026 07:00:00 -0400

In this episode, we discuss our mission statement. What are we even doing with Breach Please? What can you expect? Does the industry even need more talking heads? We think so - but only if they tell it like it is...