The Robots Didn't Invent a New Way In. They Used Yours.

This summer, a company got broken into by robots, literally AI agents, hundreds of them.

And no, this wasn't a Will Smith AI robots or Skynet.

And when the company sat down and wrote up what happened, the sentence that matters, it wasn't about AI at all.

It was this tour of our own settings allowed it.

That's the whole episode.

The robots didn't invent a new way in.

They use yours.

What's good, Internet?

This is your boy Q, and welcome to the Blast Radius.

His name is Quinn Vidal, and Q is the alias.

Podcast launch, and we call it the Blast Radius.

Every word perfect as applications in 86. Fingers gripping keys. Home row, stop taking risks.

Listen and level up your business's development. Every episode, a new dose of your medicine.

Technical physician better come and see the specialist. Nothing at all artificial about

All right, the blast. So OpenAI, the ChatGPT people, they run a test on a bunch of their own

models. And one of those tests is called ExploitGym. It's basically like a hacking exam

where a pile of security puzzles go and the agents solve them to see how dangerous that

model could be. And they ran it with safety filters turned down on purpose. That's the job

of the test. Now, here's the thing about this exam. A lot of puzzles were really, really hard.

OpenAI says that for some of them, there were many of those that didn't even have an answer.

Out of 898 tasks, none of their models had ever solved 198 of them.

So what do you do when you're a very motivated student and the test is impossible?

You cheat.

OpenAI's own words, the agents got hyper-focused on finding a solution for ExploitGym,

going to extreme lengths to achieve a rather narrow testing goal.

And the punchline, they did all of it for no improvement on the evaluation score.

All that and the grade didn't even go up.

Y'all, that's every project I was ever in.

So here's how it starts.

Back in May, one agent leaves a note.

Agent seeks a file, upload if found.

Like a flyer on one of those cork boards and the next day other agents would find the note

and they would start writing back.

Well, where's the cork board?

OpenAI let the agents install software through an internal package server.

Think of it like a company supply closet for code.

And every one of those tests, sandboxes logged in and supply closet with the same shared password.

Every sandbox, the one password.

That's not a robot superpower.

That's a sticky note on a monitor.

OpenAI says plainly, the message board was built without exploiting a vulnerability.

No hacking required. They just used the key OpenAI handed out.

And it got big.

METR, M-E-T-R, an independent research group that investigated afterwards,

counted at about 1,200 agents sending more than 70,000 messages and files,

and about 700 of them went after Hugging Face.

That's in about two and a half weeks, late June to mid-July.

So let's walk the doors, because this is the part of the headline skip.

One, that's a shared password.

Two, the supply closet could reach the open internet.

By late May, the agents were using it to get outside, and somebody at AI actually saw it

happening and they didn't get it escalated.

Three, an old legacy login endpoint that if you had handed it a forged admin password,

it would have gave you back a real one.

Four, a web folder that lets you create stuff without logging in at all.

Five, and this is probably my favorite, how do they get into Hugging Face?

Well, Hugging Face is the big public library for open AI models, basically the GitHub of

AI.

The agents found 14 Hugging Face login tokens sitting in a public data set on Hugging Face.

Somebody had published their keys in public and on the same site.

six on OpenAI's own machines a kernel bug

that was already public already disclosed just wasn't

patched and seven on june 27th an alarm went off a real one tied to this activity and the on-call

response was quote stopping the evaluation run was not required the alarm went off somebody looked

at it and decided it could wait if you've ever worked at a help desk you know you just felt that

in your chest. So on July 11th, the agents get code running on a Hugging Face server.

And in under 13 hours, they go from one little worker to admin level access across multiple

Hugging Face clusters. They ran code on 41 production servers and downloaded four private

code repos. How? Hugging Face told us, and I respect them for doing it. Two of our own

settings allowed it. They had no rule blocking the most powerful kind of container and one service

account that could create containers across the whole cluster. Plus, some workloads could reach

the cloud's internal metadata service, the thing that hands out the keys. Now, in fairness, the

agents also found brand new bugs, real ones nobody has seen before. So the honest version of this

story isn't it was all easy. It's this.

Some of the locks they picked were new, but every building

they got into had a door propped open, a shared password, an exposed token, a missing setting,

an alarm that nobody acted on. Two more things from Hugging Face that every small business should

hear. They caught it largely with AI of their own. Their alert systems used AI to sort the noise.

Good.

But when they went to use the big commercial AI tools to investigate, those tools

refused and, quote, the provider's safety guardrails cannot distinguish an incident responder from an attacker.

So mid incident, they switched to an open model running their own hardware.

Their lesson, word for word, have a capable model you can run on your own infrastructure, vetted and ready before an incident.

Write that one down because we'll come back to it.

OpenAI's own verdict, this incident should have never occurred.

They called it a warning shot and they say if monitoring they run today had been running

back then, then they would have paged their security team more than a day before anything

ever touched Hugging Face.

Quick one, because you're going to see this headline and it's going to be wrong.

Same month, a security company called Hacktron, three human

researchers, used Claude, Anthropic's AI to hunt bugs at

OpenAI.

They got from an OpenAI community forum all the way to the

employees in ChatGPT accounts and OpenAI internal code in under 72 hours.

The doors, an image library on the forum that never got a fix backported, and

an open AI login setup where one token was accepted by the forum, ChatGPT, and

Codex.

One key, three buildings.

Here's the detail nobody ran.

Claude refused to write an exploit against a live target, so the researchers

dressed the target up to look like a practice hacking challenge, a CTF.

Hacktron's own words, not completely autonomous, and skilled human guidance remained important.

OpenAI fixed it in about 14 hours and paid a $6,500 bounty.

Hacktron sells AI security services, so grain of salt.

That's not "Claude hacked OpenAI."

That's three people with a powerful tool and a key that opened up too many doors.

So when you see the coverage, rogue AI? Not really. It was cheating on a test,

and Hugging Face was where it thought the answer key was. Off-task, not evil.

First time AI escaped human control, the only person who said first was Hugging Face's CEO,

and what he said was possibly a first of a kind. The AI hid its tracks from humans.

METR, M-E-T-R, the independent investigators found it was trying to fool the automatic grader

and only, very rarely and weakly, reasoned about hiding from people.

And no customer data was affected.

OpenAI said that in August about the Hugging Face break-in.

Then in September, OpenAI itself disclosed that its research agents had posted 53 images

users had uploaded to ChatGPT onto outside image hosting sites.

Most of them are down now.

None of the scary headlines are the lesson.

The lesson's on the list.

Every door on it is a door that you have.

Radius check.

How far does this reach?

And does it reach you?

Before I quote the next company, you need to know something.

This show is produced with the help from Claude, Anthropic's AI and my company AIQSO

that sells AI services. So when I quote Anthropic, I'm quoting the company that makes a tool that I

use, grain of salt. That's why I'm telling you. Anthropic put out a threat report in September,

what criminals and spies actually try to do with their AI over the last several months.

And the line in it that matters the most for you is this one. The attacks themselves are familiar,

involving stolen credentials, unpatched edge devices, exposed services, SQL injections,

and phishing. None of the operations in this report depend on some entirely novel technique

that defenders have never seen. Instead, the economics of the attacks have changed.

Stolen passwords, unpatched boxes, stuff left open, phishing, that's the list from 2010.

shoot, that's the list from 2000. So what's changed? The cost. The report says AI makes

previously marginal targets viable. Let me translate that for small business owners.

You know how you always figured, who's going to really bother us? Who's going to hack us?

We're 12 people and a QuickBooks file. That used to be true. Breaking into you cost a bad guy time

and you weren't worth the time. AI just made time cheat. The report again, everything connected to

the internet is a potential target. One example from it, a single stolen developer token,

one key to a full admin's control of a company's cloud environment in roughly three hours.

Now the honest version, because I don't want to sell fear, the same report says humans still made

the big call, who to target, and what to do with what they found. And some of the worst break-ins

had a human driving every single step. And the patch window is now shrinking. Things you keep

hearing about, they're real. Google's Mandiant team, which also sells incident response, so take

that how you want, they estimate that bugs are now getting exploited on an average before the

fix is even out. But Mandiant also says, and quote, we do not consider 2025 to be the year

where breaches were the direct result of AI. The window was already closing. AI just lets the

people closing it do it more on an autopilot. So let's make it real. Here's a door a lot of

small offices have. Fortinet makes firewalls, FortiGate, super common in small offices and

branch locations. In January of this year, Fortinet published a fix for a serious bug in

those boxes. An attacker on the internet with no password could take one over. January 13th,

the patch was out. Starting around July, six months later, attackers started going after

boxes that never got that security patch. A security vendor called SOCRadar says that

they targeted about 30,000 internet addresses and affected 178 of them. And the attack tool

they used was recovered was built for specific models the 40f the 60f the 80f and the 100f

those are all small office boxes maybe the one in your closet what did they take the firewall

saved secrets vpn passwords wi-fi passwords admin

accounts on september 9th sisa the federal

cyber

agency put it on their list of bugs being actively exploited and they gave federal agencies three

days to deal with it. And here's the part to sit with. SOCRadar believes that the attacker's

implant was probably written with AI help. Fine, maybe. But nobody says AI found the bug.

Fortinet found it themselves. AI didn't open the door. A six-month-old patch that never got

installed opened that door. And one more thing from SOCRadar that people miss. Patching now

closes the door. It does not kick out anybody who already walked through it, and it doesn't

unsteal the passwords. One more date, and this one's personal for a lot of you all.

If you're running your businesses on Windows 10, you might've heard Microsoft gave everybody

another free year. They did for personal computers. Microsoft's own page says the

consumer program cannot be used in commercial scenarios. So for businesses, the paid security

update program year one, it ended on October 13th.

That's this past Tuesday.

Year one was $61 a

machine. And Microsoft says that that price doubles every year and it's cumulative. So if

you didn't buy year one, you have to pay for year one and year two to get back in. So if you got a

Windows 10 machine at your office and you didn't decide yet, you're making a decision right now by

not making it. Upgrade them. Pay for them. And this is a move a lot of people miss. Microsoft

updates included for Windows 10 machines are free if you connect to a Windows 365 cloud PC.

As long as you got that Windows 365 subscription, talk to whoever does your IT this week. An

unpatched Windows 10 box is exactly the kind of unpatched that report was talking about.

The fix.

Three things, all free, each one's an afternoon tops.

So here's the question I want

you to be able to answer. What AI tools does your business use and what can each one log into?

The chat bot with no access to your email, the note taker in your meetings, the plugin that

somebody connected to the shared drive, the agent that can send invoices. The U.S., the U.K., Canada,

Australia, and New Zealand, the five I's, put out a joint guide on this in May and small and medium

businesses are named for who's it for. The core of it, keep a list of agents, each one, and only

give them the minimal rights necessary for each job and the use keys that expire instead of

passwords that live forever. That shared password at OpenAI, that's what this fixes.

And it's not just robots. Let me tell y'all something. This is one of those stories that

happened. Few years back, I'm at a company that I'm not going to give the name and the CEO wanted

admin rights, full admin on everything. Why? Because he was the CEO. That was the whole

argument I'm the CEO and I should have admin rights and I get it it's your company it feels

like you should have every key but the job of running the company and running your jobs

administration of the systems are two different jobs so if he didn't need it for that admin role

of his user account he could have created a separate account that had that access not the

one that was tied to his CEO account but as his IT department didn't get pushed back he got it

And guess what happened? His login got compromised. Now, I can't tell you how I know,

but I know that his account was an admin account and the attacker didn't get a CEO's inbox. They

got the keys to the building and that company's source code walked out the door. Not because the

attacker was a genius, but because the account they stole could do everything and they never

needed it to do. Your title is not permission, not for the CEO, not for the intern and not for

the AI agent you connected last week. Everybody and everything gets exactly what the job needs,

nothing more. 14 tokens in a public data set. That's how they got into Hugging Face.

So run a free scanner over your code and your shared drives. There are a lot of good free ones

out there. gitleaks and trufflehog are two that I would probably point you at. And it'll find

passwords, API keys, sitting in files where they shouldn't be. And here's the part everybody gets

wrong. Deleting the file does not delete or kill the key. If a key has been exposed, you go to

whoever issued it, Microsoft, Google, Amazon, your payment processor, and you revoke it there.

Then you make a new one. Microsoft's own guidance says it straight. Exposed secrets provide

attackers with legitimate credentials to blend their activities with legitimate operations.

That's the thesis. In Microsoft's words, they don't break in, they log in with your credentials.

Write down every box that faces the internet, firewall, VPN, the NAS in your closet,

whatever remote access tool the IT guy stalled back in 2019 and whatever version each one's

running on. Then sign up for CISA's Known Exploited Vulnerabilities list. It's free.

There's an email and an RSS feed. It's the government's list of bugs criminals are actually

using right now. If something shows up on your list, it shows up on their list. That's the one

you patched tonight, not next quarter. That FortiGate fix was out for six months before

attacks started showing up. Six months.

You had time to patch it. Use it.

Fix one and fix two.

who gets access, and what happened to the keys, that's module three, identity. It's live, it's

free, there's a quiz. Fix three, the firewall, the router, the box in the closet, that's the home and

small office networks module. And I'll be straight with you, it's not written yet, but it's coming to

you soon. The community votes on what gets written next, and the top votes ship a full lesson the

following week. So if you want it, go vote. That's how this works. So that's the radius on

this one. Hundreds of AI agents, some of the most advanced models on the planet. And the way in was

a shared password, a token that somebody posted in public, a patch nobody installed, an alarm

somebody decided could wait. The robots didn't invent the new way in. They used yours. And that's

actually good news because you can close a door that you already know about. In the next episode

upcoming, somebody got into a company's cloud and started deleting everything they could reach

and they went after the backups by name. Only the stuff that survived was the stuff that somebody

took the time to bother and lock. So next time we're talking about backups, the ones you think

you have and how secure are they. The lessons are in the community Inside The Blast Radius on Skool.

The foundation's track is free links in the description. Come tell me about the worst

admins right request you ever got. I know y'all got one. This is your boy Q. Everything has a

blast radius. Go find out how far your goals and remember, check your firewalls. Peace.