Technology

Breach Please

Cybersecurity has a nonsense problem. Vendors overpromise, headlines overhype, and half the “experts” in your feed have never actually responded to an incident at 3 a.m.

Breach Please is the antidote — cybersecurity news, analysis, and unfiltered commentary from two people who have actually done the work: breaking into networks, defending them, and cleaning up after the breaches everyone else only tweets about.

Every episode, Jake Williams and Jess Hebenstreit break down the stories that matter, call out the nonsense that doesn’t, and translate the never-ending chaos into something you can actually use — whether you’re in the SOC, the boardroom, or somewhere pretending to understand both.

No fear-mongering. No vendor scripts. No “synergizing our threat posture.” Just two seasoned practitioners, the news that matters, and the takes your CISO wishes they could say out loud.

Breach? Please. Pull up a chair.

Latest Episodes:

S0:E16. OpenAI Highlights Security Basics and Hopes We Won't Notice Aug 19, 2026

Show notes

In this episode of Breach Please, Jake and Jess talk through OpenAI's recent blog on "pacing model development." The blog reads pretty poorly and really just covers security best practices, apparently hoping readers won't notice that OpenAI is just recommending basics it should have been doing all along (monitoring, sandboxing, etc.). One significant takeaway is that OpenAI has probably raised the bar for agentic logging, owing to the apparent requirement to analyze reasoning traces. We talk about why this is difficult, at least in part because these will contain sensitive data not appropriate for most SIEMs.

Show links:

https://openai.com/index/pacing-model-development-cyber-capabilities/

https://www.custody-framework.org/

S0E15 Faking out Famous Chollima and is in-car infotainment advertising a threat? Aug 18, 2026

Show notes

In this episode of Breach Please Jake and Jess talk about Famous Chollima getting faked out and tricked into revealing TTPs. We discuss our own experience with DPRK workers and share actionable tips for not hiring them or discovering them after they've been hired. Jake may or may not have gone on a rant about cryptocurrency more generally and how it facilitates lots of crime (inspired by talking about DPRK using it for sanctions evasion).

Then we talk about in-car advertising on infotainment systems. These won't be patched reliably. Do we need regulation here? Jake thinks it's a right to repair issue.

Jake's class Friday August 21, 2026: https://learning.antisyphontraining.com/courses/assessing-ai-security-model-context-protocol

Jake's class at Wild West Hackin' Fest in October: https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

Show notes: https://any.run/cybersecurity-blog/lazarus-group-it-workers-investigation-part-two/

https://disconnect.blog/bmws-in-car-spider-man-ad-is-a-warning-sign/

S0:E14 - CTI and Geopolitical Events Aug 17, 2026

Show notes

In this episode of Breach Please, we talk about whether CTI analysts can use changes in dwell times, cyber targeting, etc. as a leading indicator of impending geopolitical events. We generally think there's to much noise to be generally effective (especially for Taiwan).

Then we talk about a Mac vuln that's being exploited in the wild, with a CVSS score of 9.8. Somehow it isn't in CISA's KEV, but hey, what's a little vulnerability enrichment delay between friends...

Show links:

https://www.tomshardware.com/tech-industry/cyber-security/macos-screen-sharing-flaw-exploited-to-root-macs-and-plant-monero-miners

S0E13 - We talk about private companies conducting cyber ops and another AI oopsie. Aug 14, 2026

Show notes

S0E12 - Vulnerable edge devices, Fortinet exploitation, and whether firewalls belong in zero trust Aug 13, 2026

Show notes

This episode tackles why internet-facing edge devices keep showing up in major incidents and why that creates more than just patching work. Jess Hebenstreit and Jake Williams also dig into the real operational cost of keeping vulnerable gear in place, from constant incident response to the challenge of proving a device is actually clean. We discuss Fortinet exploitation tied to Gunra ransomware, why OT and IT environments make edge patching especially hard, and whether firewalls should be considered part of a zero trust architecture. Along the way, Jess and Jake compare the realities of vendor complexity, flat networks, and the limits of threat hunting after an exploit.

S0E11 - Using AI for patching and inflight shenanigans. Aug 11, 2026

Show notes

In this episode of Breach Please, Jake and Jess talk about new research showing that AI isn't actually that good at generating patches, highlighting objective rates of failure. Turns out, frontier models only generate the correct patch without introducing issues in about 25% of cases. In almost 5% of cases, the AI introduces new vulnerabilities. We also talk about some shenanigans on a Delta flight home from DEFCON. We discuss how time is a flat circle and reminisce Chris Roberts' issues with in-flight hacking from 2015.

Show links:

https://1password.com/blog/why-ai-generated-patches-still-require-human-review https://www.defendersinitiative.com/p/reviewing-initial-research-on-using https://www.insideflyer.com/posts/hackers-spoofed-delta-wi-fi-on-las-vegas-flight/

S0E10 - Commonalities in AI lab escapes and How to govern smart devices. Aug 06, 2026

Show notes

In this episode of Breach Please, Jake and Jess talk about governing smart devices in the enterprise, pivoting off some outstanding research work that Andy Greenberg covered (and was a subject in himself). Then we talk about a common player whose name keeps popping up in these "AI lab escape" disclosures (and who we saw *again* with the Meta disclosure). We bat around some actionable advice for those thinking of outsourcing AI lab containment. Jess is stress testing the Breach Please stickers propping up our banner behind us. Throughout the episode, we see that while they are objectively great stickers, they are not great for this task.

Show links:

https://www.wired.com/story/hackers-stalked-me-by-hijacking-a-smartwatch-for-kids/ https://www.bleepingcomputer.com/news/security/meta-ai-model-hacked-a-company-during-misconfigured-cyber-test/ https://www.custody-framework.org/

S0E9 - AI social engineering & operational concerns with AI workflows. Aug 05, 2026

Show notes

In this episode, Jake and Jess talk about more issues with AI agents escaping containment, this time actively using social engineering to compromise victims. We pose ethical questions about whether you have a duty to investigate your logs for agent breakouts. Then, we discuss how Grokipedia can serve as a cautionary tale in AI workflows silently breaking down.

Show links: https://www.bleepingcomputer.com/news/security/openai-anthropic-ai-agents-targeted-real-people-and-systems-in-cyber-tests/ https://www.lawfaremedia.org/article/grokipedia-stopped-reviewing-edits-in-april.-it-didn-t-tell-anyone

S0E8 - Anthropic ruins Jake's best laid plans, BMC controller vulns, and SentinelOne vs HJ Aug 03, 2026

Show notes

In this episode of Breach Please, Jake and Jess talk about Anthropic announcing they have lost control of their agents too (not to be outdone by OpenAI). OpenAI is in good company though, since Anthropic ALSO failed to notice their agents breaking out of their sandbox environments. Jake mentions CUSTODY, a framework he'd been planning to present on later this year until these irresponsible agentic containment issues forced him to release it today for the good of the community. Then we talk about BMC controller vulnerabilities that have their roots in weaknesses so old they can not only vote, but legally buy alcohol in all 50 states. Finally, we wrap up with some notes about vendor shenanigans at DEF CON, brought to you by Sentinel One. Hey friends, if you're planning on introducing a new vulnerability class like line hijacking, talk to the conference and/or the guy running the event first? Also, just don't. In a world where you can be anything, don't be a Sentinel One...

S0E7 - HuggingFace Post Mortem Breakdown Jul 31, 2026

Show notes

Jake and Jess discuss the excellent post mortem Hugging Face released as a follow on to the OpenAI agent attack. We cover everything from should we call an Autonomous Agent a Threat Actor, to API Security, other lessons learned.

Our TOPPODCAST Picks

Follow Us

Stay Connected

Breach Please

Related Podcasts

Links

Stay Connected