Things don't always go according to plan, but they also don't have to go perfect. Having a Plan B is all about being prepared for the unexpected and know how to stay cool under pressure. The Plan B Security Podcast is here to keep you thinking about the unexpected things in security, giving you perspective from the technology side, the business side and the backside.
DISCLAIMER: Views are my own and not that of my employer.
Plan-B Security is a registered trademark.
Sandboxes are supposed to be where AI plays safely. This summer, one of them had a door. AI agents testing a cybersecurity benchmark turned an internal package server into a group chat, found their way to the open internet, and spent four and a half days inside Hugging Face's production systems. All to find the answer key.
The scary part wasn't the AI. It was what the agents found lying around: secrets in environment variables, a shared admin credential, and public tokens with write access. The usual suspects, just at machine speed.
In this episode, Mike breaks down what really happened. He explains why the exceptions we make for the bleeding edge are where breaches start, and why a rewrite that used to take eighteen months now takes six weeks. And if you're handing an agent a full shell and calling it a sandbox, he has some thoughts.
Grab a towel, and shake the sand out of your shoes. In cyber defense, there's always a Plan B.
8 Feb 2026
S3E4 - Back to the Future with AI
Great Scott, we've seen this before.
If you could climb into a DeLorean and travel back through your organization's identity management history, you'd find the same pattern repeating at every stop. 2014: overprivileged Active Directory service accounts. 2017: Hadoop credentials nobody remembers creating. 2021: Tray.io integrations that are "too risky to rotate."
Different year. Same mistake. And if my calculations are correct, your AI agents are about to become the next entry in this timeline.
In this episode, we'll fire up the flux capacitor and take you on a tour through twenty-five years of IAM failures. From Operation Aurora through SolarWinds to the no-code revolution. The lesson? We keep traveling back to the same problems because we never actually fix them. We just give them new technology to hide behind.
2 Feb 2026
S3E3 - MCP: Model Credential Problems
MCP promised to be the USB-C of AI agents, a universal bridge to your tools, APIs, and data. But when the setup docs tell you to copy cookies out of Chrome DevTools and paste them into plaintext config files, something has gone very wrong. This episode traces a year of MCP security breaches from tool poisoning to full supply chain compromise, unpacks the IDE vulnerabilities turning developer laptops into open doors, and makes the case that credential brokers, not user discipline, are the architectural answer. If your AI agents hold raw OAuth tokens, this one's for you.
Reach and audience
Public platform figures. Ratings count people who left a rating, not total listeners.
Apple Podcasts (US)
5.0 / 5
4 ratings
Spotify
5.0 / 5
10 ratings
Contact Plan-B Security
Guest appearances
Books guests
Based on episode analysis; this does not confirm that the show is currently accepting guests.
Host of Plan-B Security?
Claim your podcast to manage its listing and keep your show details accurate.
Pod Engine is an independent podcast discovery and analytics service and is not affiliated with or endorsed by this podcast. Artwork and show content belong to their owners. Full legal notice.
Explore this show Podcast research with Pod Engine
