Loading...

PODCAST

Breach Please

Breach Please Team

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the "experts" in your feed have never actually responded to an incident at 3 a.m. Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about. Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter,

technology tech news

All Episodes

33:45

S0:E27 — The Agentic Ransomware Story That Wasn't

Breach Please ·

2026/09/04

Palo Alto's Unit 42 published a report describing a fully automated, agentic AI ransomware attack, complete with an 80-page lessons-learned document the attackers supposedly left behind for the victim. It got picked up and ran with by outlets looking for the AI-apocalypse angle. Jess and Jake go through what the report actually says versus what got exaggerated in the retelling, and call out the pattern of vendors using AI-attack framing to sell their own AI-defense product.Second half: a stolen API

en

46:04

S0:E26. IDScan.net suspected data breach, toxic data,...

Breach Please ·

2026/09/03

In this episode of Breach Please, Jake and Jess talk about the suspected IDScan.net breach. We discuss whether a situation like this is a data breach for your org if you "only" use a third party processor to verify identity. We decide this is a question best left for external counsel (with the cover of their malpractice insurance). We discuss the difficulties of saying "third party risk management will fix this" and challenge snake oil vendors not to use that line. Finally, we discuss how we might

en

31:02

S0:E25 — The Exchange Bug That's Worse Than Its Score

Breach Please ·

2026/09/02

A CVSS 8 elevation-of-privilege bug in on-prem Exchange looks unassuming until you dig into what it actually grants an attacker. Jess and Jake break down the proxy flaw, why "authorized attacker" is doing a lot of quiet work in that description, and why this is one of the rare moments defenders get a head start before exploitation goes wide.

en

27:52

August 31, 2026. S0:E24. We talk about the attack on...

Breach Please ·

2026/08/31

In this episode, Jake and Jess talk about the IT availability issue occurring at Boston Scientific (be real, it's almost certainly ransomware). Then we talk about ransomware response, immutable backups (and specifically what they DON'T get you), and rabbit hole in the ransomware discussion several times.Jake also reps #SAINTCON - you should go if you get the opportunity (tickets for this year are sold out, but you can get on the standby list).https://saintcon.org/Speaking of conferences, Wild West

en

27:00

S0E23. The LA County Museum of Art breach that took...

Breach Please ·

2026/08/28

LACMA’s year-long breach disclosure delay and what it says about incident responseJess Hebenstreit and Jake Williams break down a Los Angeles County Museum of Art data security incident that raises big questions about breach timelines, notification delays, and response ownership. They focus on what the disclosure says, what it leaves unsaid, and why the cleanup process may have taken far longer than it should have. In this episode, they examine the gap between initial detection, timeline validation,

en

47:41

August 27, 2026. S0:E22. We go a little long...

Breach Please ·

2026/08/27

In today's episode of Breach Please, Jake and Jess talk through the OpenAI post-mortem on the Hugging Face hack. It's a doozy. There's little doubt in either of our minds that the facts as presented don't exonerate OpenAI - they make it look far worse. We cut through the hype and conclude that there's no way OpenAI was following even the most basic of security best practices, even accounting for hindsight bias. Jake closes by reading a passage from one of Sam Altman's tweets from December 2025,

en

37:25

S0E21: Alabama Comes for OpenAI, WebLogic Comes for...

Breach Please ·

2026/08/26

Fifteen state attorneys general, led by Alabama, just subpoenaed OpenAI over the Hugging Face breach, demanding the company preserve all evidence related to the intrusion. Jess and Jake break down what that legal hold actually requires, why "mark it ACP" doesn't make a Slack channel privileged, and why the discovery list's question about internal safety concerns might be the part that burns OpenAI hardest. Then: a perfect-10 WebLogic vulnerability, patched back in January, just landed on CISA's

en

41:11

S0:E20 Multi-Agent AI Systems Turn Into Turf Wars

Breach Please ·

2026/08/25

AI just became a cybersecurity governance problem in public. Jess Hebenstreit and Jake Williams break down Anthropic’s multi-agent research, where AI agents with conflicting goals start negotiating, forcing, or trucing their way through “collaboration.”What does it mean when one model settles by force and another settles by truce? Jess and Jake unpack what that means for real-world agent deployments, human-in-the-loop approvals, and the danger of letting “AI says so” become the final word. You’ll

en

40:36

S0:E19: Cloud Platform Vulnerabilities and Vendor...

Breach Please ·

2026/08/24

In this episode, Jake and Jess talk about vulnerabilities in cloud platforms and how vulnerabilities should be disclosed. We discussed this in the context of recent Microsoft vulnerabilities in Entra, Azure Arc, Exchange Online, and Managed Apache Casandra. All of these had vulnerabilities with minimal details from Microsoft. We generally agree that this isn't what transparency looks like. We also discuss a patch from April that is now actively exploited in the wild.

en

42:09

S0:E18. Student stops AI supply chain attack and...

Breach Please ·

2026/08/21

In this episode of Breach Please, we talk about the details that emerged about the Anthropic agent that tried to social engineer a college student into committing a supply chain attack. The whole thing feels very xz-utils 'esque, only with an agent - and a malfunctioning one at that.Then we cover some interesting reporting by Dan Goodin showing how Grok's guardrails can be bypassed through passing it encrypted data along with the instructios to decrypt it. We reinforce that prompt injection is a

en

40:43

S0E17: Amazon vs Perplexity Reveals the First Big AI...

Breach Please ·

2026/08/20

AI agents are about to test the limits of who gets blamed when they act on your behalf. A new Ninth Circuit ruling in the Amazon vs. Perplexity fight could reshape how enterprises think about autonomous tools, non-human identities, and legal exposure - and the takeaway is more unsettling than most vendors will admit. Jake Williams and Jess Hebenstreit break down what happened when Amazon pushed back against Perplexity’s AI browser, why the CFAA and California’s CDFAA matter here, and how the court’s

en

30:22

OpenAI Highlights Security Basics and Hopes We Won't...

Breach Please ·

2026/08/19

In this episode of Breach Please, Jake and Jess talk through OpenAI's recent blog on "pacing model development." The blog reads pretty poorly and really just covers security best practices, apparently hoping readers won't notice that OpenAI is just recommending basics it should have been doing all along (monitoring, sandboxing, etc.). One significant takeaway is that OpenAI has probably raised the bar for agentic logging, owing to the apparent requirement to analyze reasoning traces. We talk about

en

35:28

S0E15 Faking out Famous Chollima and is in-car...

Breach Please ·

2026/08/18

In this episode of Breach Please Jake and Jess talk about Famous Chollima getting faked out and tricked into revealing TTPs. We discuss our own experience with DPRK workers and share actionable tips for not hiring them or discovering them after they've been hired. Jake may or may not have gone on a rant about cryptocurrency more generally and how it facilitates lots of crime (inspired by talking about DPRK using it for sanctions evasion).Then we talk about in-car advertising on infotainment systems

en

43:18

S0:E14 - CTI and Geopolitical Events

Breach Please ·

2026/08/17

In this episode of Breach Please, we talk about whether CTI analysts can use changes in dwell times, cyber targeting, etc. as a leading indicator of impending geopolitical events. We generally think there's to much noise to be generally effective (especially for Taiwan). Then we talk about a Mac vuln that's being exploited in the wild, with a CVSS score of 9.8. Somehow it isn't in CISA's KEV, but hey, what's a little vulnerability enrichment delay between friends... Show

en

40:34

S0E13 - We talk about private companies conducting...

Breach Please ·

2026/08/14

In today's episode of Breach Please, Jake and Jess talk about cyber companies conducting cyber ops against transnational-criminal organizations, per the new Presidential directive. We also talk about a bug in how major AI platform providers encrypted their chain of thought traces for their frontier models. The vulnerability, when combined with jailbreaking of less powerful models, allowed the traces (previously claimed to be trade secrets) to be extracted.

en

39:01

S0E12 - Vulnerable edge devices, Fortinet...

Breach Please ·

2026/08/13

This episode tackles why internet-facing edge devices keep showing up in major incidents and why that creates more than just patching work. Jess Hebenstreit and Jake Williams also dig into the real operational cost of keeping vulnerable gear in place, from constant incident response to the challenge of proving a device is actually clean. We discuss Fortinet exploitation tied to Gunra ransomware, why OT and IT environments make edge patching especially hard, and whether firewalls should be considered

en

38:12

S0E11 - Using AI for patching and inflight shenanigans.

Breach Please ·

2026/08/11

In this episode of Breach Please, Jake and Jess talk about new research showing that AI isn't actually that good at generating patches, highlighting objective rates of failure. Turns out, frontier models only generate the correct patch without introducing issues in about 25% of cases. In almost 5% of cases, the AI introduces new vulnerabilities. We also talk about some shenanigans on a Delta flight home from DEFCON. We discuss how time is a flat circle and reminisce Chris Roberts' issues with

en

33:48

S0E10 - Commonalities in AI lab escapes and How to...

Breach Please ·

2026/08/06

In this episode of Breach Please, Jake and Jess talk about governing smart devices in the enterprise, pivoting off some outstanding research work that Andy Greenberg covered (and was a subject in himself). Then we talk about a common player whose name keeps popping up in these "AI lab escape" disclosures (and who we saw *again* with the Meta disclosure). We bat around some actionable advice for those thinking of outsourcing AI lab containment. Jess is stress testing the Breach Please stickers

en

38:16

S0E9 - AI social engineering & operational concerns...

Breach Please ·

2026/08/05

In this episode, Jake and Jess talk about more issues with AI agents escaping containment, this time actively using social engineering to compromise victims. We pose ethical questions about whether you have a duty to investigate your logs for agent breakouts. Then, we discuss how Grokipedia can serve as a cautionary tale in AI workflows silently breaking down.Show links: https://www.bleepingcomputer.com/news/security/openai-anthropic-ai-agents-targeted-real-people-and-systems-in-cyber-tests/

en

37:34

S0E8 - Anthropic ruins Jake's best laid plans, BMC...

Breach Please ·

2026/08/03

In this episode of Breach Please, Jake and Jess talk about Anthropic announcing they have lost control of their agents too (not to be outdone by OpenAI). OpenAI is in good company though, since Anthropic ALSO failed to notice their agents breaking out of their sandbox environments. Jake mentions CUSTODY, a framework he'd been planning to present on later this year until these irresponsible agentic containment issues forced him to release it today for the good of the community. Then we talk about BMC

en

48 results

Similar Podcasts

Lead With AI

Tamara Nall

Two Blokes Talking Tech

Trevor Long and Stephen Fenech

Best AI papers explained

Enoch H. Kang

ev.news

Martyn Lee

Silicon Champions Tech Transforming Sports