The Robots Didn't Invent a New Way In. They Used Yours.

This summer, hundreds of OpenAI's AI agents broke out of a hacking test and into Hugging Face. The headlines said "rogue AI." The write-ups said something more useful: "Two of our own settings allowed it." A shared password. Fourteen login tokens sitting in a public dataset. A known bug nobody patched. An alarm somebody decided could wait. The robots didn't invent a new way in. They used yours. Then: why "we're too small to bother with" stopped being true, the firewall patch that sat uninstalled for six months, the Windows 10 business deadline that just passed — and three free fixes you can do this week. Disclosure: this show is produced with help from Claude (Anthropic's AI), and AIQSO sells AI services. We say so on air before quoting Anthropic. ━━━━━━━━━━━━━━━━━━━━ ⏱ CHAPTERS 00:00 Cold open — "Two of our own settings allowed it." 00:58 THE BLAST — OpenAI's agents cheat on a test 02:07 The message board (one shared password) 03:20 The doors 04:51 Meanwhile, at Hugging Face 06:55 Same summer, different story — Hacktron 08:12 What the headlines got wrong 09:17 RADIUS CHECK — "the attacks themselves are familiar" 12:00 The door in your closet — FortiGate 13:40 Windows 10: the deadline that just passed 14:56 THE FIX — three things 18:53 Where to go deeper ━━━━━━━━━━━━━━━━━━━━ 📚 FREE cybersecurity foundations course Inside The Blast Radius → https://www.skool.com/blastradius Fixes one and two map to Module 3 (Identity), free. Fix three, home & small-office networks, is the community's next vote. ━━━━━━━━━━━━━━━━━━━━ 🔗 SOURCES Hugging Face — incident disclosure (Jul 16) — https://huggingface.co/blog/security-... Hugging Face — technical timeline (Jul 27) — https://huggingface.co/blog/agent-int... OpenAI — initial post (Jul 21) — https://openai.com/index/hugging-face... OpenAI — "The Hugging Face incident and the road ahead" (Aug 26) — https://openai.com/index/hugging-face... METR — independent investigation (Aug 26) — https://metr.org/blog/2026-08-26-open... Hacktron — "Hacking OpenAI" (vendor, Sep 13) — https://www.hacktron.ai/blog/hacking-... Anthropic — threat report, Sep 2026 — https://www.anthropic.com/threat-inte... Mandiant — M-Trends 2026 (vendor) — https://cloud.google.com/blog/topics/... Fortinet — FG-IR-25-084 / CVE-2025-25249 — https://fortiguard.fortinet.com/psirt... SOCRadar — PivotC2 (vendor) — https://socradar.io/blog/cve-2025-252... CISA — Known Exploited Vulnerabilities (free email + RSS) — https://www.cisa.gov/known-exploited-... Microsoft — Windows 10 Extended Security Updates — https://learn.microsoft.com/en-us/win... Five Eyes — Careful Adoption of Agentic AI Services — https://www.cisa.gov/resources-tools/... gitleaks (MIT) — https://github.com/gitleaks/gitleaks trufflehog (AGPL-3.0) — https://github.com/trufflesecurity/tr... ━━━━━━━━━━━━━━━━━━━━ THE BLAST RADIUS — Cyber • Tech • What's Next Hosted by Quinn "Q" Vidal Theme: “Blast Radius” by Quinn Vidal 🌐 https://theblastradius.io 🏢 https://aiqso.io #cybersecurity #AI #smallbusiness #infosec #leastprivilege