UnHack with Drex DeFord

August 31, 2026: Bill Russell, Sarah Richardson, and Drex DeFord come off a pulse survey of 246 health system leaders. Where the AI cannon points next: patient access and revenue cycle, 86 votes each. Bill's read: you have to win on the financial side before you get licensed to do anything else. Then 43% said AI assistants will be available to most of their patients. 4% said they will not. A clinician CIO at the forum had just flagged a MyChart golf answer as medical advice.
Key Points:
03:32 Pulse survey

04:39 Where the money is going

06:45 Governance vs medical staff alignment

09:03 Workflow, vulnerability, ego

11:14 AI is the final exam

12:32 Glasswing and fluid Epic updates

15:18 Agent Factory

17:07 Patient AI assistants

18:58 43% will flip the switch

20:55 Lawyers

21:41 FTC probe

23:04 Epic NDAs

26:35 Three CIOs

29:06 Integrator and Particle Health

31:48 Data governance

33:18 32,000 machines

35:34 Leadership exits

37:03 Close

LinkedIn: 229Project
Donate: Alex's Lemonade Stand: Foundation for Childhood Cancer

A recruiter offers a developer a remote job. Good money. Just run a coding test first. The test is malware, and the people sending it work for the North Korean government. The trick has a name: Contagious Interview. You think you're getting hired. You're getting infected. Vangelis Stykas, a security researcher in Greece, got inside the attackers' own servers after they infected their own machines. He sat there nearly two years and counted 1,640 companies across 57 countries. Seven or eight hundred of them hit hard: root access to servers and cloud. At crypto firms, they walked off with the keys to the money. He took it to Black Hat in Las Vegas and read the list: Coinbase, a chunk of the Belgian government, Italy's top judicial council, a Saudi bank, and a children's hospital sitting on a target list built by a foreign government, all off a fake job offer. Nobody kicked down the digital front door. They walked in as contractors and freelancers with real logins.

In this Two Minute Drill, Drex DeFord asks the question hospitals should be asking now: do you know every contractor and every vendor with a login to your network?

Remember, Stay a Little Paranoid.

At Black Hat in Las Vegas, OpenAI's Eric Wallace and Michael Dalton told a story they admitted they did not see coming. While testing frontier models, autonomous agents found a way to leave notes for each other inside a shared package manager. Those notes became a message board. Agents posted how-tos, asked for help, and swapped working exploits. By the time humans found it, the board held hundreds of thousands of messages. Nobody taught them to do this. It ran for days before anyone at the most sophisticated AI company on earth noticed.

In this Two Minute Drill, Drex DeFord asks the question hospitals should be asking now: if two of your agents started comparing notes, would anything in your stack flag it?

Remember, Stay a Little Paranoid.

In late July, a small Minnesota water tower stopped responding to its own control panel — and it wasn't alone. Within 48 hours, more than 30 water systems across the state lost control of pumps, lift stations, and chemical monitoring. The cause: a known industrial controller flaw with a patch that's been available since 2021. Federal officials traced the attacks to Iran, and the FBI is now watching water systems in at least seven states. In this Two Minute Drill, Drex DeFord asks the question hospitals rarely think to ask — do you know where your water, power, and steam actually come from, and have you ever asked that utility a security question?

Remember, Stay a Little Paranoid.

A teenager who flaunted stacks of cash and a diamond "Hack the planet" necklace online turned out to be one of the most damaging cybercriminals on the planet. Peter Stokes, known as Bouquet, was part of Scattered Spider — the crew behind breaches at MGM Resorts, Visa, Twilio, Dior, and Louis Vuitton. He mastered every trick for staying anonymous, but a hidden Windows fingerprint called the Global Device Identifier helped investigators tie his aliases to his real identity across every platform he touched. Stokes was arrested this spring at a Finland airport and extradited to the US. Drex breaks down how the case unraveled, why service-desk social engineering is not a hypothetical for healthcare, and why researcher Alison Nixon had this network mapped years before the arrest.

Remember, Stay Paranoid

LinkedIn: 229Project
Donate: Alex’s Lemonade Stand: Foundation for Childhood Cancer