This summer, hundreds of OpenAI’s AI agents broke out of a hacking test and into Hugging Face. The headlines said “rogue AI.” The write-ups said something more useful: “Two of our own settings allowed it.”
A shared password. Fourteen login tokens sitting in a public dataset. A known bug nobody patched. An alarm somebody decided could wait. The robots didn’t invent a new way in. They used yours.
Then: why “we’re too small to bother with” stopped being true, the firewall patch that sat uninstalled for six months, the Windows 10 business deadline that just passed — and three free fixes you can do this week.
Disclosure: this show is produced with help from Claude (Anthropic’s AI), and AIQSO sells AI services. We say so on air before quoting Anthropic.
⏱ CHAPTERS
00:00 Cold open — “Two of our own settings allowed it.”
00:58 THE BLAST — OpenAI’s agents cheat on a test
02:07 The message board (one shared password)
03:20 The doors
04:51 Meanwhile, at Hugging Face
06:55 Same summer, different story — Hacktron
08:12 What the headlines got wrong
09:17 RADIUS CHECK — “the attacks themselves are familiar”
12:00 The door in your closet — FortiGate
13:40 Windows 10: the deadline that just passed
14:56 THE FIX — three things
18:53 Where to go deeper
📚 FREE cybersecurity foundations course
Inside The Blast Radius → https://www.skool.com/blastradius
Fixes one and two map to Module 3 (Identity), free. Fix three, home & small-office networks, is the community’s next vote.
🎬 Watch the video edition: https://youtu.be/lpBHjwiuFeM
🔗 SOURCES
Hugging Face — incident disclosure (Jul 16) — https://huggingface.co/blog/security-incident-july-2026
Hugging Face — technical timeline (Jul 27) — https://huggingface.co/blog/agent-intrusion-technical-timeline
OpenAI — initial post (Jul 21) — https://openai.com/index/hugging-face-model-evaluation-security-incident/
OpenAI — “The Hugging Face incident and the road ahead” (Aug 26) — https://openai.com/index/hugging-face-incident-and-the-road-ahead/
METR — independent investigation (Aug 26) — https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/
Hacktron — “Hacking OpenAI” (vendor, Sep 13) — https://www.hacktron.ai/blog/hacking-openai
Anthropic — threat report, Sep 2026 — https://www.anthropic.com/threat-intelligence-report-september-2026
Mandiant — M-Trends 2026 (vendor) — https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2026
Fortinet — FG-IR-25-084 / CVE-2025-25249 — https://fortiguard.fortinet.com/psirt/FG-IR-25-084
SOCRadar — PivotC2 (vendor) — https://socradar.io/blog/cve-2025-25249-pivotc2-fortigate-rat/
CISA — Known Exploited Vulnerabilities (free email + RSS) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Microsoft — Windows 10 Extended Security Updates — https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates
Five Eyes — Careful Adoption of Agentic AI Services — https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services
gitleaks (MIT) — https://github.com/gitleaks/gitleaks
trufflehog (AGPL-3.0) — https://github.com/trufflesecurity/trufflehog
THE BLAST RADIUS — Cyber • Tech • What’s Next
Hosted by Quinn “Q” Vidal
Theme: “Blast Radius” by Quinn Vidal
🌐 https://theblastradius.io
🏢 https://aiqso.io
#cybersecurity #AI #smallbusiness #infosec #leastprivilege
