In this episode of Breach Please, Jake and Jess talk about Anthropic announcing they have lost control of their agents too (not to be outdone by OpenAI). OpenAI is in good company though, since Anthropic ALSO failed to notice their agents breaking out of their sandbox environments. Jake mentions CUSTODY, a framework he'd been planning to present on later this year until these irresponsible agentic containment issues forced him to release it today for the good of the community. Then we talk about BMC controller vulnerabilities that have their roots in weaknesses so old they can not only vote, but legally buy alcohol in all 50 states. Finally, we wrap up with some notes about vendor shenanigans at DEF CON, brought to you by Sentinel One. Hey friends, if you're planning on introducing a new vulnerability class like line hijacking, talk to the conference and/or the guy running the event first? Also, just don't. In a world where you can be anything, don't be a Sentinel One...

Jake and Jess discuss the excellent post mortem Hugging Face released as a follow on to the OpenAI agent attack. We cover everything from should we call an Autonomous Agent a Threat Actor, to API Security, other lessons learned.

In this episode, Jake and Jess share their tips for doing Hacker Summer Camp (Black Hat, DEF CON, B-Sides, and SO MANY side conferences) the right way. If you've never been, things can be overwhelming and it's easy to overdo it. Even if you're an old hat, there's probably learnings here - plus Jess shows off some of the Breach Please swag we'll have with us.

In this episode, Jake and Jess talk DHS (twice). First, we talk about DHS dismissing real alarms as false positives in what Jake assesses was a probable watering hole attack nobody seems to be acknowledging. Then we talk about a #stopCopCity activist being charged for giving CBP a duress password that wiped his device. While I think we should all agree that's not a chargeable offense, are duress passwords appropriate for enterprise applications? Jake and Jess debate the use of these passwords for enterprise applications. https://www.nextgov.com/cybersecurity/2026/07/dhs-network-intrusion-was-twice-ruled-false-positive-breach-confirmed/414724/ https://boingboing.net/2026/07/25/grapheneos-duress-password-border-search.html

In this episode of Breach Please, Jake and Jess talk about how the story (again) about AI chats being indexed by search engines isn't really an AI story. This is a data security problem and a misalignment with enterprise tooling. We then talk about a relatively new GitHub repo with lots of zero day exploits. We agree it's academically interesting, but doesn't change anything for how we do enterprise security.

In this episode, we talk a lot (too much, we went over on time) about the reports that OpenAI lost control of its agents and apparently only realized it after Hugging Face posted and someone said "yeah, that sounds a bit like us." Reuters article: https://www.reuters.com/business/its-ai-agent-spent-days-hacking-company-sources-say-openai-did-not-notice-week-2026-07-24/ Jake mentioned training. Here's an upcoming one-day seminar on MCP security: https://learning.antisyphontraining.com/courses/assessing-ai-security-model-context-protocol Here's Jake's two-day class covering AI security risk assessment: https://www.antisyphontraining.com/product/hands-on-ai-security-risk-assessment-with-jake-williams/

In this episode, Jake and Jess talk about lessons we can take away from the alleged exploitation of ServiceNow (likely CVE-2026-6875) and the destructive attack on Romania's Land Registry Database. Join us as we discuss the stories, but more importantly what they mean for you and your security team.

Jake and Jess talk through the story (and there's a LOT missing here) where OpenAI's agent allegedly hacked Hugging Face. There's so much meat missing in OpenAI's account of what happened that their PR people are clearly advocating we go vegetarian...

In this episode, we discuss our mission statement. What are we even doing with Breach Please? What can you expect? Does the industry even need more talking heads? We think so - but only if they tell it like it is...