20:42

Ep. 04 Oct 15, 2026

The Robots Didn't Invent a New Way In. They Used Yours.

This summer, hundreds of OpenAI’s AI agents broke out of a hacking test and into Hugging Face. The headlines said “rogue AI.” The write-ups said something more useful: “Two of our own settings allowed it.” A shared password. Fourteen login tokens sitting in a public dataset. A known bug nobody patched. An alarm somebody decided could wait. The robots didn’t invent a new way in. They used yours. Then: why “we’re too small to bother with” stopped being true, the firewall patch that sat uninstalled for six months, the Windows 10 business deadline that just passed — and three free fixes you can do this week. Disclosure: this show is produced with help from Claude (Anthropic’s AI), and AIQSO sells AI services. We say so on air before quoting Anthropic. ⏱ CHAPTERS 00:00 Cold open — “Two of our own settings allowed it.” 00:58 THE BLAST — OpenAI’s agents cheat on a test 02:07 The message board (one shared password) 03:20 The doors 04:51 Meanwhile, at Hugging Face 06:55 Same summer, different story — Hacktron 08:12 What the headlines got wrong 09:17 RADIUS CHECK — “the attacks themselves are familiar” 12:00 The door in your closet — FortiGate 13:40 Windows 10: the deadline that just passed 14:56 THE FIX — three things 18:53 Where to go deeper 📚 FREE cybersecurity foundations course Inside The Blast Radius → https://www.skool.com/blastradius Fixes one and two map to Module 3 (Identity), free. Fix three, home & small-office networks, is the community’s next vote. 🎬 Watch the video edition: https://youtu.be/lpBHjwiuFeM 🔗 SOURCES Hugging Face — incident disclosure (Jul 16) — https://huggingface.co/blog/security-incident-july-2026 Hugging Face — technical timeline (Jul 27) — https://huggingface.co/blog/agent-intrusion-technical-timeline OpenAI — initial post (Jul 21) — https://openai.com/index/hugging-face-model-evaluation-security-incident/ OpenAI — “The Hugging Face incident and the road ahead” (Aug 26) — https://openai.com/index/hugging-face-incident-and-the-road-ahead/ METR — independent investigation (Aug 26) — https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/ Hacktron — “Hacking OpenAI” (vendor, Sep 13) — https://www.hacktron.ai/blog/hacking-openai Anthropic — threat report, Sep 2026 — https://www.anthropic.com/threat-intelligence-report-september-2026 Mandiant — M-Trends 2026 (vendor) — https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026 Fortinet — FG-IR-25-084 / CVE-2025-25249 — https://fortiguard.fortinet.com/psirt/FG-IR-25-084 SOCRadar — PivotC2 (vendor) — https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/ CISA — Known Exploited Vulnerabilities (free email + RSS) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog Microsoft — Windows 10 Extended Security Updates — https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates Five Eyes — Careful Adoption of Agentic AI Services — https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services gitleaks (MIT) — https://github.com/gitleaks/gitleaks trufflehog (AGPL-3.0) — https://github.com/trufflesecurity/trufflehog THE BLAST RADIUS — Cyber • Tech • What’s Next Hosted by Quinn “Q” Vidal Theme: “Blast Radius” by Quinn Vidal 🌐 https://theblastradius.io 🏢 https://aiqso.io #cybersecurity #AI #smallbusiness #infosec #leastprivilege

21:27

Ep. 03 Oct 13, 2026

The Voice Was Real Enough.

A couple in Michigan got one phone call from a voice they trusted — and $66,000 of their closing money was gone. Was it an AI voice clone? Maybe. It doesn’t matter. There was no step in the process where it would have mattered. The same summer, four of the biggest hedge funds on Wall Street got calls from people who weren’t who they said they were. Nobody lost a dollar. The difference wasn’t a deepfake detector. It was a rule. In this episode: what actually happened, what the headlines got wrong, why you can’t train people to spot a deepfake, the payment rule that quietly became mandatory in June — and three things you can do this week for $0. ⏱ CHAPTERS 00:00 Cold open — four hedge funds, one couple 00:55 THE BLAST — Michigan, $66,000, and a phone call 02:00 Was it a deepfake? (it doesn’t matter) 03:34 A busy summer — Wall Street, Spain, Hong Kong, North Korea 06:42 What the headlines got wrong 09:20 RADIUS CHECK — you can’t train it out of people 11:20 Every catch was a human with a rule 12:22 The rule that landed in June (Nacha) 16:55 THE FIX — three things 20:53 Where to go deeper 📚 FREE cybersecurity foundations course Inside The Blast Radius → https://www.skool.com/blastradius The Fix in this episode maps to Module 3 (Identity), free. The social-engineering module is the community’s next vote. 🎬 Watch the video edition: https://youtu.be/0Ps5llxqjlE 🔗 SOURCES CNN — the Michigan homebuyers (Sep 15 2026) — https://www.cnn.com/2026/09/15/us/homebuyers-voice-cloning-scam FBI IC3 2025 Internet Crime Report — https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf FBI PSA: create a secret word with your family (Dec 3 2024) — https://www.ic3.gov/PSA/2024/PSA241203 Wall Street vishing wave (Aug 2026) — https://www.investmentnews.com/fintech/point72-citadel-among-hedge-funds-hit-by-ai-vishing-attacks/267708 Spain: face-swap vs video ID (Aug 2026) — https://www.theregister.com/security/2026/08/11/deepfake-hiccup-unmasks-suspected-digital-certificate-fraudster/5285934 Hong Kong: AI voice notes after a WhatsApp hijack — https://www.scmp.com/news/hong-kong/law-and-crime/article/3362297/hong-kong-raises-alert-ai-voices-150-whatsapp-hijackings-lead-hk26m-losses North Korean IT workers — US State Dept alert (Jul 2026) — https://www.state.gov/releases/office-of-the-spokesperson/2026/07/alert-to-countries-companies-and-other-entities-regarding-north-korean-it-workers Arup, Hong Kong (2024) — https://hongkongfp.com/2024/02/05/multinational-loses-hk200-million-to-deepfake-video-conference-scam-hong-kong-police-say/ Humans vs deepfakes meta-analysis (2024) — https://www.sciencedirect.com/science/article/pii/S2451958824001714 Nacha Fraud Monitoring Phase 2 — https://www.nacha.org/rules/risk-management-topics-fraud-monitoring-phase-2 CISA ScubaGear (Microsoft 365) — https://github.com/cisagov/ScubaGear CISA ScubaGoggles (Google Workspace) — https://github.com/cisagov/ScubaGoggles THE BLAST RADIUS — Cyber • Tech • What’s Next Hosted by Quinn “Q” Vidal Theme: “Blast Radius” by Quinn Vidal 🌐 https://theblastradius.io 🏢 https://aiqso.io #cybersecurity #deepfakes #scams #smallbusiness #wirefraud

23:02

Ep. 02 Sep 22, 2026

You Didn't Get Hacked. Your Shipper Did.

A company whose entire product is “don’t trust anybody” had about 80,000 customers’ names, phone numbers and home addresses stolen last month — twice, through two different vendors, without ever being hacked themselves. Their shipping provider got breached through a dashboard tool. Their email provider got breached and used to phish their customers. And the data that leaked was data a contract said had been deleted five years ago. This is what a blast radius actually looks like — and what a small business is supposed to do about it on Monday morning. CHAPTERS 00:00 The company that sells “trust nobody” 00:40 The Blast — Trezor, ShipMonk, and a dashboard 05:59 The part that made me do this episode 08:32 Radius Check — where does your company actually end? 10:45 The control nobody audits 16:46 The Fix — three things you can do this week 22:24 Where to go deeper FREE cybersecurity foundations course: Inside The Blast Radius — https://www.skool.com/blastradius (The Fix maps to Module 1 “The Map” and Module 3 “Identity”. Both free.) Watch the video edition: https://youtu.be/nn8Nr9FGZbI SOURCES Trezor / ShipMonk disclosure: https://trezor.io/blog/news/recent-customer-data-exposed-in-shipping-provider-incident Expanded disclosure (67,000 more): https://thehackernews.com/2026/09/trezor-says-shipmonk-breach-exposed.html Initial 13,689 disclosure: https://www.bleepingcomputer.com/news/security/trezor-discloses-data-breach-affecting-nearly-14-000-customers/ Weekly breach roundup (Brevo, Mathspace): https://www.privacyguides.org/news/2026/09/11/data-breach-roundup-sep-4-10-2026/ THE BLAST RADIUS — Cyber • Tech • What’s Next. Hosted by Quinn “Q” Vidal. https://theblastradius.io · https://aiqso.io

11:06

Ep. 01 Sep 16, 2026

AI Ain't New, Y'all Just Late

The technology everyone discovered last year has been running your spam filter, your fraud alerts, and your autocomplete for decades. A short history of how we got here — and why “new” is the most expensive word in tech. This is episode one. Meet your host, and let’s cut through some noise. THE BLAST RADIUS — Cyber • Tech • What’s Next Hosted by Quinn “Q” Vidal Know your radius. Shrink the blast. Cybersecurity, changing tech, and industry recommendations for the people who have to run the network on Monday — not the ones writing the press release.