网络安全恐慌、AI国有化、模型挤压与“什么都不能拥有”

Nothing said on Empire is a recommendation to buy or sell any investment or product. So, hello everyone. Welcome back to Empire. We have 2 updates this week. We don’t have Santi. He didn’t make it, and I don’t know where he is. But we replaced Rob with Dragonfly’s better half. The best third, I would probably say, is Haseeb. Haseeb, welcome to the show.

Hello, everyone. I definitely have better hair than Rob.

So I think you’re right, Zaki. We invited Zaki to help us explain all these crazy cyber events. Santi might join later, but we have Haseeb. We actually did a little castling: Haseeb moved on to Empire, and we sent Rob to the lair to be torn apart.

So, Haseeb, how about you give nicknames at the beginning? What will Rob’s nickname be?

I don’t know. I’m so glad I don’t have to write anything and that you’re driving. I’m only here as a secondary character. This feels great.

So, what’s it like to get a promotion, to go from a category B show to a category A show? You know, an A show.

I’m just glad people are finally starting to listen.

No, I’m glad we fooled you. Nobody’s listening here, Haseeb, but—

Okay, great. Perfect.

Well, all the links will be in the show notes.

1. Is AI Breaking Cybersecurity?

That’s right. That’s right. Okay, I’m happy to talk about it.

I assume people have seen what’s going on, but maybe I’ll give a very brief overview. I opened my feed and saw the NSA tweeting that all organizations using PHP in their systems should prepare for an update. I saw other people tweeting about the huge hack that was happening. The craziest thing was that the Prime Minister of Japan tweeted about it.

I think it’s clear to everyone that there was some kind of huge cyberattack this week. Only a small number of people really understand what happened. A lot of people were just Googling “What is PHP?” and “What is Node.js?” and asking, “What actually happened to those two things?” Zaki, maybe you can give Empire listeners who are less familiar with cybersecurity a quick overview.

PHP is a programming language for creating web applications. Perhaps the most famous application built on PHP is Facebook, followed by WordPress. If you’ve been blogging in the last 20 years, you’ve likely used WordPress at one time or another. A huge percentage of websites on the internet—around 70%—use PHP.

AI discovered how to exploit a flaw that people had known about since 2004, but there had never been any attacks or exploits related to it. The GPT-56 model, the ChatGPT model, found a way to exploit this vulnerability. A process of coordinated disclosure and patching took place a few months ago. Then information somehow leaked about what the bug and the exploit were, so there was a real panic yesterday to make an announcement, release a patch, and disclose the information, because many of these sites weren’t actively maintained.

A kind of war began on the internet between people exploiting vulnerabilities and those fixing them. There were also a bunch of other exploits affecting startups. Railway, a very popular service, was also compromised. So, if you’ve been doing anything related to online security in the last day or two, you’ve had a pretty busy time.

I understand. What else would you add to what you said?

Two things. Matthew Prince, the CEO of Cloudflare, wrote that even before the disclosure—I think the NSA was the first to proactively report it, or at least to do so in a public forum—they were seeing several hundred attempts to exploit this vulnerability every hour. People already knew about it through the leak, just as Zaki said.

Forty-five minutes after the announcement, the number had increased to tens of thousands, and now it’s in the millions of attempts per hour. It’s become part of the background radiation of the internet. If you have any web service, they’ll check to see if you’re using PHP. Are you using an old version of PHP? If so, they’ll try to get control and see what they can do with your server.

It’s worth explaining what this vulnerability does. If you send certain data to a web server hosting a PHP site, it gives you what’s called a shell. You get access to a command line on the server of whoever is running it, with the same access rights as the website. From there, you can usually get to the database and everything else, gain access to the information, and start stealing data. That’s what this vulnerability does.

There’s speculation that this vulnerability somehow caused the crazy series of cascading failures we saw on the internet yesterday. It’s possible that this was true for Railway if they were using PHP, given that it’s a fairly new startup. There are hints that maybe that’s what happened, and that’s why all their secrets could have been exposed. Anyone who had an application on Railway—a platform as a service similar to Heroku—was told that every secret they had deployed there could be compromised. The site also went down for all resources hosted on Railway.

Then we had a whole series of other events that were clearly unrelated. One involved eMudhra, one of the largest certification authorities in India. It turned out they had deployed keys or certificates where the private key was the number 4, as well as numbers like 283. It looks like they didn’t know how to generate keys at all. For some reason, no one knows if the Indians will ever be allowed to generate them again. They actually just announced that they’re getting out of the certification industry. They said they had thoroughly uncovered everything that went wrong, that there had been no compromises to their infrastructure, and that this was less than 1% of their income. So they’re exiting that line of business.

I think they probably said that after everyone kicked them off the internet. Can you hear me?

We can hear you.

I saw on Bloomberg how Matthew Prince from Cloudflare was talking to Greg Brockman from OpenAI. I think you guys might have mentioned this, but it’s a little crazy that they were using 6-month-old or 3-month-old models that everyone was so excited about. If you can break the internet with models that aren’t as capable as today’s, that’s something.

I’d be interested to hear your perspective, Zaki. There’s no end in sight to this. Do you think that’s the case, or are we going to strengthen the internet during these 3 to 6 months of chaos? And after this, would we expect things to settle down a little?

I’d step back a little bit, because a lot of things happened yesterday, and I think it’s important to differentiate them. They’re not all the same story, even though it feels like they are.

First of all, PHP is a notoriously dangerous language. Facebook nominally uses PHP, but they actually rewrote PHP from scratch because of how terrible it is as a programming language. It’s just a disgusting language. Most frameworks like WordPress and Drupal, and anything built on PHP, are very old. So the idea that 70% of websites on the internet use PHP is probably about the number of websites, not the number of visits. Judging by visits, almost no one uses PHP these days because it’s such a bad language.

It doesn’t surprise me that PHP has a bunch of bugs, or that AI managed to find some of them. This particular bug wasn’t related to anything PHP is generally terrible at, but it’s just not the best language to start with. What’s remarkable is that, since this bug was discovered, it seems to have been independently found by a bunch of people at the same time. It was independently discovered by OpenAI’s Patch the World project, a security researcher, and the company Wiz. It seems all 3 found the vulnerability at the same time, and they all worked to fix it and responsibly report it so that people with big PHP implementations could patch everything. All of this has been happening in the background for the past few months.

At the same time, the eMudhra situation—the certification authority with a supposedly secure key—is clearly unrelated to AI. It’s just complete incompetence, and I don’t know how long people didn’t notice it. Railway was also hacked, but we don’t really know the details. It’ll probably be some time before we know exactly why. There was a vulnerability in Node.js and something else, it seems, in Bun. There was a vulnerability there, too. And then there was an independent supply chain attack on an LLM-based library. An attacker interfered with a Python LLM library and uploaded a new version of one of its dependencies.

2. Where Are The AI-Powered Cyberattacks?

All these things happened at the same time, but they clearly don’t have the same cause. There isn’t one explanation for all of them. I think we’re seeing an acceleration in regular cybersecurity. Just a month ago, I think it was Theo Jaffe, who’s been following the situation, who wrote, “Everyone is talking about these superhuman AI hackers, and yet it doesn’t look like there’s some kind of digital Pearl Harbor happening. It doesn’t seem like the number of service failures has increased.”

I think we’ve hyped it a bit into reality. Yes, it’s true to some extent that we were expecting something like, “What does GLM-5.3 do?”

What does Kimi K3 do that is actually changing the cyber landscape around us? We’ve already seen this in the crypto sphere: this year saw an absolute record for the number of network breaches—not in terms of the amount of money, but simply the sheer number of incidents. We haven’t seen this in regular software. It seemed as if the number of CVEs had increased dramatically. That’s certainly true, but it doesn’t seem to have had much of an impact on the regular internet. Now we’re starting to see it become really destructive, and I suspect that’s what the next 6 months will look like.

From my own experience working with the models, I don’t have access to Mythos or Daybake Red, the top cyber models, but I have used most of the others. In defensive work, the idea you put into the model really matters. The model will take your idea and start developing it, but the idea comes from me. When I get an idea, I put it in, and a few hours later, either a whole bunch of vulnerabilities appear or nothing.

Mm-hmm.

I think that also explains the time lag, because the attacking side has to sit around, test different ideas, and do experiments. Then suddenly a whole bunch of vulnerabilities appear. Greg from OpenAI said the same thing when asked what percentage was due to skill and what percentage was due to the model. He said they were working with a researcher. It was hard to say for sure, but he seemed to think 80% of the success was down to the researcher working with the model. Then he said something interesting: “We used our more sophisticated models, and once we understood what the researcher was looking for, we directed our own model, and it found significantly more vulnerabilities.” So this makes me incredibly anxious.

I mean, you said you didn’t understand how they didn’t notice. I think we underestimate how much legacy code there is, where these bugs or holes, whatever you want to call them, have been sitting for years.

The thing about the PHP vulnerability is that it was found in 2004. People have known about it since 2004, but no one fixed it because there were no known ways to exploit it.

And I think that’s also the attitude change the industry needs: “No, no exploits.”

But that means it was impractical for humans.

When I hear that, it seems like it was impractical for people to turn it into an exploit, right?

How can this be described better? AI seems to be mainly lowering the economic barrier to carrying out these attacks. We knew this bug was there. It existed for 20 years, but the economic barrier was extremely high. Now that economic barrier has simply decreased.

It looks like we’re going to start seeing this everywhere, or after some time.

Yes. We will most likely see it. And again, in the crypto sphere, we’ve gone through all of this at an accelerated pace, because if you’re an attacker, the first place you’re going to point your lasers is crypto. That’s the easiest place to monetize these kinds of attacks, right?

3. Ads (Fidelity, DAS London)

I think Tay [?] was trying to figure this out from the Railway credentials leak, because whoever attacked Railway was clearly going in and stealing all the sensitive data. You can see some of the cryptocurrency stolen using these Railway secrets. That’s a natural way to monetize the Railway hack, right? You can use OpenAI keys or Anthropic keys, or try to sell tokens on the black market. You can hack into people’s emails, or, most obviously, look for crypto keys and take the cryptocurrency.

The total amount of crypto they got from Railway is estimated to be around $1 million. A million dollars is nothing on-chain, right? Is it even worth spending time stealing a million online? This suggests that all the energy of people using GLM-5.3 and these new models with cyber capabilities to attack for profit was initially directed at networks. We saw all this first in blockchain. Only now has it become economically profitable to take these same models and try to carry out conventional software attacks.

There was a story recently about a hacker, apparently Chinese, who massively attacked websites for $50 apiece and was able to compromise hospitals and a bunch of other random infrastructure companies. This is exactly what’s happening now. It’s like pirates on the high seas, and you have to act.

4. Can AI Defend Against Itself?

Another thing that might interest people, if they don’t know about it—and this is getting into the details—is that there are so-called “abliterated” models. These are modified models from which all the refusal mechanisms have been removed. I’ve had to start using them for protection, because DeepSeek, GLM, Opus, and Astra will refuse to do protective things, too. They’ll say it’s too dual-use and they won’t do it.

Now I have a catalog of modified GLM and DeepSeek models. If Opus and Astra won’t look for a bug and work on the problem, I move on and try to get it to hack the data. If that doesn’t work, I move on to the abliterated models.

To reduce the chance of a disaster, we know where the exploits are and people are patching the holes. Obviously, governments in Europe have shut down most of their sites, or at least a lot of them—it’s always Europe. What’s the worst-case scenario here? Is it just more data leaks, more sensitive information like your blog posts or support tickets? Give us an idea of the real level of damage we can expect from exploiting this particular vulnerability.

I’m actually pretty relaxed about this cyber story. I think we’re in for a tough 6–12 months, but I don’t think it will lead to mass social collapse. I think these are mostly small attacks on infrastructure, old companies, and people who don’t invest enough in their own defense. There are a lot of very old sites, and it wasn’t economically viable or scalable for anyone to attack them, because there were simply more valuable targets.

Thanks to AI, this automation becomes very simple: you can scan the entire internet, find any PHP website, try to penetrate it, and see if there’s anything valuable there. For the most part, I think we’re in for a tough 6–12 months. Eventually, many websites will go out of business, and those that remain will become much more reliable and have some kind of standardized security program.

I think we’ll see significant changes in governments’ norms of behavior around the world. They’ll realize this is part of their job as guarantors of national defense. Just as we have police protecting parks and office buildings, this is part of the government’s responsibilities. I think we’ll start to see a norm that this should happen in cyberspace, and that it’s the government’s responsibility to provide protective services, maybe subsidize code analysis, do active monitoring, and even enforce takedowns when they say, “Hey, this service is just sitting there, and it’s insecure.” We’ll go in, hack your software, and update it so that you can’t be attacked by someone doing it maliciously. I think that’s what it’s all about: governments will actually take it upon themselves.

The entire internet has long relied on volunteer firefighters. I’m one of those volunteer firefighters in most cases. Nobody pays me for this. I just show up and do my thing. I try to help with a vulnerability or find an exploit and report it. I get the feeling: why is this my job at all? Why am I sitting here, writing prompts for these AIs and struggling with these vulnerabilities? Why am I spending my own tokens on this? It seems like it should now be the government’s responsibility to have a GPU and spend resources on fixing all public infrastructure. It’s strange. It’s always been strange, but it remains strange that people like me find themselves on the front lines of protecting so much public infrastructure.

Would you go so far as to say that ultimately it will come down to the government nationalizing, for example, OpenAI, because it’s a matter of national security? If an attacker were to take down the power grid, nuclear reactors, or, let’s say, the stock market, that would have huge economic consequences. If there are only a select few companies with the most sophisticated models and computing power, and they don’t disclose it, then the government should have exclusive access to it. How do you ensure that?

5. Ads (Fidelity, DAS London)

This episode was produced with the support of Fidelity Crypto—a platform created in-house with the same discipline. Fidelity applies it to everything so you can invest in cryptocurrency with confidence. Trade cryptocurrency protected by advanced security features. Get started at fidelity.com/crypto. Cryptocurrency services are provided by Fidelity Digital Assets. NA is not FDIC or SIPC insured and involves the risk of significant losses. Fidelity Brokerage Services LLC, member NYSE, SIPC.

On November 10-11, the main institutional crypto event returns to London. Blockworks Digital Asset Summit at the Hilton Park Lane Hotel. 1,500 attendees, over 700 institutions and speakers from BlackRock, JP Morgan, Coinbase, Robinhood, Figure and others. Meet the developers and investors who are bringing topics like tokenization and DeFi to the mainstream. 2 days of panel discussions, networking, and side events building the financial future on blockchain. Book your ticket at blockworks.com/events. See you in London.

6. Should The Government Control AI Labs?

By the way, we need to discuss what happened this week. There were 2 very interesting pieces of news. First, Anthropic announced its public benefit fund, which essentially involves transferring a portion of the company’s shares to this fund—an entirely new structure. The idea is that the US public will become richer or benefit from Anthropic’s success.

That same week, Elon said, “I’m giving one of my SpaceX shares to every child in America.” This will be the first of many promotions. So I think, Santi, that’s exactly what you’re leaning toward.

I mean, there’s a trade-off where maybe what Zaki is saying is, you know… I’ll go even further and say, if cybersecurity is the most important thing right now, then you have to have access to the computing power and the most sophisticated models. Forget about the F-16; this is a matter of national security.

Ministry of War and Ministry of Defense. Education.

Well, no—the Department of White Hat Hackers. That’s what you are.

Yes. Yes.

Okay. I think this is a strange reason for nationalizing laboratories. I actually believe that laboratories will be nationalized someday, but not because of this. I think that’s quite understandable.

First of all, you don’t need Mythos or Astra for cyber protection. Sure, it’s useful, but even just getting GLM-5.3 or GM 5.3 could fix a bunch of this stuff. A lot of it is pretty simple and banal. You don’t come up with crazy, never-before-seen attack methods.

For example, in the attack on Hugging Face, they literally used what was an unreleased OpenAI model at the time, and Hugging Face successfully defended itself once it realized there was a breach. So the answer is that protection is not a trivial task, but you don’t need super geniuses to provide it. You just need to identify the hack, block it, and update your software. We have ordinary people who can do it.

So someone has to constantly work on the software. That’s another point, isn’t it? It costs money. This costs money. And it costs GPU hours. Someone has to…

Yes. But the government doesn’t need to requisition GPUs to do this. They can just pay the market price for the GPUs, and we’ll maintain a market economy because we’re not China. To me, that sounds perfectly acceptable. We have a huge defense budget. Let’s spend some of the government’s money on GPUs. That will probably mean GPU prices go up, but so be it. This is a great use for those GPUs.

So I think it’s completely unrelated to the whole concept of a public benefit corporation—OpenAI and Elon Musk.

Wait, wait, but I want to hear your theory. If they’re still going to nationalize them, what’s the reason? If not this, then what?

I think it’s simply because they’ll view these as national security assets, and I suspect they’ll most likely be nationalized when the bubble bursts.

Yes, I think so. I think when they become the primary means of warfare—which they’re not now, and we’re not even close to that—but when that happens, or they become something like a civilizational competition, the question will arise: “Hey, why not nationalize anything at all?”

First, it’s extremely secret, and it’s very important to maintain that level of secrecy at the national security level. I think we’re probably already there, given what happened with that Saudi who tried to introduce some kind of spy device into OpenAI. So that’s one reason for nationalization.

The second reason is that the private market may no longer finance this research program at the scale the state needs. We’re clearly not there yet. Private markets are very willing to fund this now, but we could get to that point if the bubble bursts.

I think if the bubble bursts, that’s the most likely time to nationalize the labs. It’ll be like, “Listen, now it’s like NASA and the space race. Private markets don’t want to fund this, but we want to because we think it’s important at the national level, even if there’s no obvious economic return.”

I take the opposite view. If the AI bubble bursts and the valuations of these companies fall by 70%, people will say, “I told you so,” and move on to something else.

I don’t think so. I think it’s—

No. No way. No way. Absolutely impossible.

Yes. They’re 100% saved from bankruptcy.

Do you really think they won’t be saved?

I think the market—

What do you mean by bailout?

I mean, like in 2008, when the government stepped in and…

They would default on huge debts, which would cause a chain reaction in the economy and lead to a serious recession.

Well, I mean, again, it’s not systemic. When you think about OpenAI and Anthropic, to be aggressive, they might be 30% of all capital spending. So it’s not systemic yet, because there are still other labs that can fill the gap.

I mean, it’s mostly about demand, right? Prices would drop significantly, and everything would cascade down to demand. So I agree with that, but those are 2 different questions.

Does the government own the labs? That’s what this is. That’s the idea. Is the government—

Well, that would be a bailout if you took on the data center commitment.

No, that’s not true. In 2008, for example, look at how the automakers were bailed out under TARP. They were bailed out, and the US government didn’t own General Motors, right?

But they actually own the banks, right?

Yes. And because of that, and because of the growing cascade of regulations around banks, they don’t actually own the banks, but their control over them has accelerated massively.

We were thinking about this wrong, man, right? What is it? The CIA or someone else has a venture capital fund. The NSA or CIA has In-Q-Tel, right?

There have been cases where they did that in Israel, too. They fund a startup, and then it becomes so important that they just knock on the door and say, “Public service is over. We buy you or you go to jail,” essentially.

Yes. And they’ll set a price, and that will be the end of it.

I think that’s what’s going to happen eventually. Maybe, to your argument, if the stock market is in free fall, they’re in a vulnerable position, and the government will use that to its advantage and say, “We’re not going to pay a trillion for this. We’ll pay perhaps half a billion or half a trillion.”

I checked the facts myself. I’m actually wrong here. After the TARP bailout, the government owned 61% of General Motors. They sold all their shares over the next 5 years.

I didn’t know they owned that much. I thought they owned maybe a small share.

But automakers don’t have national security considerations, and they don’t have civilizational considerations like laboratories.

7. Will AI Labs Become Nationalized?

Yes. Hey, I don’t know if there’s a prediction market for this, but what do you think the chances are of this happening, and when do you think it’ll happen? You’ve seen something similar with Sam or Dario trying to wash their hands of it, saying they’re releasing a model like Prometheus and taking responsibility for the chaos and consequences of the product. Do you think this will happen in a year or 2?

Look, I think if there’s a Democratic president in the next administration, the chances of nationalizing the labs will increase significantly. I think there’s a general feeling that these companies are so important that they should be owned by the state.

I suspect this will happen during a financial crisis, which is quite likely given the scale of data center construction and the irrational optimism that prevails now. However, the collapse would have to be truly large to require real government assistance. There could be minor drops, and a lot of private credit could depreciate without causing a catastrophic cascading effect.

But if it does happen, I think it will most likely be the moment when the government says, “Okay, we’re buying this and taking control of it.” I also believe that, for the government, Anthropic and OpenAI should look well ahead of everyone else. They have to seem really special.

Yes. And I think that’s also a question: what do you think is happening? Everything is changing literally every week. How far ahead are they?

If you think Google and xAI are already at that level, then you can say, “Well, let them go bankrupt.” But, of course, the prevailing view now is that Anthropic and OpenAI are the leaders and are the most important research institutes in America today. The market treats them that way, and I suspect the government does, too.

Do you think this should happen?

Do I think this should happen? Yes, I think so. Look, I really think that at some point it will become quite clear that the interests of government and society and those of private companies will diverge.

If computing power really becomes the most important resource of civilization—which I don’t think is the case yet, but almost certainly will be in the future—then I don’t think it’s unwise to say, “Hey, there’s a better way for us to figure out how to invest capital and how to make a profit from it.”

If profits are highly dispersed and difficult for an individual company to obtain, then a market economy will almost certainly underinvest in computing, research, acceleration, and so on. We see that Anthropic somehow manages to capture a significant portion of the profits it generates, while almost no one else does. Almost everyone else is losing money, despite creating these incredible, world-changing models.

Almost everyone else is losing money, and that seems very strange. It might actually be an equilibrium: because of so much hype, we’re overcompeting. When you’re in a state of excessive competition, there’s usually a crash, and eventually the amount of investment society provides is significantly reduced.

I suspect what’s happening in AI is much closer to basic science, since it’s very difficult for private entities to fully internalize the value of what they create. This should mean that, without a mania like the one we’re seeing now, underinvestment in research is to be expected. Governments usually exist to address this. I don’t know, Zaki, what do you think?

I think everything you say is true and completely normal. I have a little bit of a “this is the singularity” feeling. I’m in San Francisco. I’m here for the singularity, and there’s a part of me that’s always thinking: What if the returns are so great that even if you only get a crumb, it justifies the level of investment we’re seeing?

I mean, yes, but the question is, why don’t we invest even more? Why isn’t half of society working to make AI faster, cheaper, and so on? If you nationalize it, maybe that’s what’s needed.

8. Is The AI Boom Overvalued?

Well, the market doesn’t like it. Meta reported earnings yesterday, and Zuckerberg said, “Hey, we want to keep going.” They didn’t take off. They didn’t provide projections for capital expenditures for 2027, but they raised the lower bound of the figure. They beat expectations on earnings and revenue, but the market hated it. The stock fell by about 9%.

I’d like to go back to what you said earlier about irrational optimism. You and I have usually discussed this in the context of the crypto industry. Where do you see the most irrational optimism in the AI sector? Where do you see it most, or just in general?

I’m a venture capitalist, so I focus mostly on seed rounds. When I see these new labs being valued at $3–4 billion with 5 interns from OpenAI and some kind of draft white paper, I think, “Okay, that seems like irrational optimism.” A lot of the valuations for labs and companies that don’t have a business model seem irrational. If you’re the seventh-best open-source lab in the U.S., you’re just wasting money. There’s no universe where that adds value to the world, but you’re spending huge amounts of money.

It’s also pretty obvious that right now everyone is hoping GPU prices will only go up, because if they go down, a lot of people will be wiped out by the investments they’re making. And because of the limitations on building data centers, you have to think in multiyear time horizons. It’s very difficult to think about the payback on projects like these in 1 or 2 years. That essentially forces people to take huge risks they wouldn’t take in a more rational, liquid market.

Where’s the greatest euphoria right now? I don’t know. I almost want to say China, where some of these Chinese companies and labs are. I look at them and see that they simply have no path to profit. I like what they do, and it’s very—DeepSeek is probably the best of them all. But if you look at, say, StepFun or Kimi, they’re great, incredible labs, but I can’t imagine how they’re going to make money, and their cash flow is incredibly negative.

But that’s your theory, dude: Chinese frontier models are actually state property.

No, no, absolutely not. They’re all listed in Hong Kong. None of these labs can go public in Shanghai because they need to be profitable in mainland China to do so. None of these companies are profitable, so they can’t enter the market in China. They all go public in Hong Kong.

The Hong Kong stock market is much less regulated than the Chinese one. In addition, there’s much less money in Hong Kong than in China. On some level, the CCP is paying attention to this. If you work in one of these laboratories, you’re not allowed to leave the country, your passport is taken away, and so on. But these are not state-owned companies at all. The difference between Alibaba or Tencent and DeepSeek is enormous. They’re not the same at all.

No, continue.

I mean, this is madness for anyone competing in the inference market. It’s almost impossible to compete with Chinese companies on their models because they sell tokens at prices significantly below the cost of maintaining these models.

Well, apparently DeepSeek has a positive margin on its inference.

I believe them when they say that. But what about net profit after deducting training costs? They probably lose money on every model generation, even if their inference has a positive gross margin. Everyone’s theory is, “Look, we’ll catch up when we get to general-purpose AI.” This is everyone’s logic: “It doesn’t matter what we earn or lose now. All that matters is that when we reach the promised land, boundless blessings await us.” When the numbers and the stories get big enough, you can justify almost anything.

Yes. American companies are subsidizing costs because when new GPUs appear, their cost will drop significantly.

Well, except for Anthropic. Anthropic is definitely making money.

9. Who Is Actually Winning In AI?

Yes, and Anthropic’s profits are simply insane. Anthropic has crazy margins, especially on the API. It seems like the market is trying to figure all this out. What do you think is the biggest mistake investors make, both public and private? Is it related to the graphs that are currently spreading—for example, lower token costs, rental prices, or memory? The market is clearly nervous, and volatility is at an all-time high. I’m wondering what the most important metric is for you and what the most confusing aspect of this revolution is.

One of the graphs that’s constantly being waved around is the share of tokens going to Chinese labs, but that’s a completely irrelevant figure. That’s not what matters. The dollar amount is important, and if you look at the money, just look at OpenRouter. On OpenRouter, the most popular model by a huge margin is DeepSeek, especially its new Flash model. It’s really very good. But Anthropic still dominates in cost, even on OpenRouter, where most people try to use non-core labs.

The question is, why use Anthropic over OpenRouter if you’re simply overpaying? The answer is that people are willing to pay a huge premium for advanced intelligence. That will probably remain true for some time, which means you either need to work for the mass market, like DeepSeek, or target the highest level. In the middle is a kind of “no man’s land,” and I simply don’t understand how to build a business there.

Another thing I find very interesting, and don’t fully understand yet, is that OpenAI has increasingly started to realize—or maybe they’re changing their minds—that their position doesn’t really depend on having models. With OpenAI, you can now spend your OpenAI credits using Kimi K3 and, it seems, GLM 5.3. You can use this in your OpenAI program. What does that mean? It means they understand that a lot of money is being spent on these Chinese models.

They used to try to criticize Chinese models, saying, “Oh, you never know what they’re doing there. Maybe there are sleeper agents that will wake up and steal all your money or something.” Now they’re like, “Okay, to hell with this. People still use them. Obviously, we won’t be able to convince them not to, so at least let their expenses go through our systems.”

At this point, you’re kind of like Salesforce, right? Your task is simply to own your clients’ spending on AI. Maybe you’ll use OpenAI models, but someday they’ll start adding Anthropic models and say, “Listen, just run your models through us. We’re like OpenRouter for you. We take on ZDR. We have corporate agreements. We have all these other things you might want to use, too. Just stay with us. We’ll be your control panel for AI.”

If you want to use other models, that’s fine. We understand. We’d prefer that you use ours and will try to direct you to ours, but ultimately what we really want is to be an interface to AI.

I think OpenAI is probably heading in that direction, especially considering they’ve lost a significant portion of their lead to Anthropic. If they can’t regain that leadership, they may realize in the long run that this is a better strategy. Once you accept this model, there’s almost no turning back.

Just like when they focused on the consumer segment, they had a really hard time catching up with Anthropic in the enterprise sector and in programming because they’d bet on chat. That’s how 4o came about, and this kind of flattering, “yes-man” model, instead of trying to get ahead of everyone on the path to AGI.

On the other hand, if you think of your role as an interface to AI and a kind of open router for business, that probably means OpenAI will increasingly fall behind those who are truly competing on the principle of, “My only business is to have the smartest models, and if I don’t have them, I’m a loser.” What do you think? I haven’t heard Haseeb’s opinion on this before.

I really like it. I found it compelling and interesting. I don’t sit here and think about investments like the rest of you. I’m thinking about development. I think the concept of a router is very interesting. One of the things I’m building right now is something like an AI router or an open router. I’m constantly working on this and thinking about it a lot: the routing layer is very valuable.

10. Does The World Need More AI Labs?

It continues to be a strange question: Who creates the advanced model? Who benefits the most from it? Why, for example, did it make sense for Meta to spend a hundred billion dollars to create a “wonder”? Where is the monetization? Wouldn’t it be better to just license Opus and run it on your own computing power? It’s still very unclear. It’s really unclear why you’d build your own lab, unless you know why—other than the fact that you can raise a lot of money and pay yourself to do it.

It’s unclear how to compete in this race. I don’t want to be in it at all. Simple.

Zaki, let’s go down a level. We spend all our time here at the model level, so maybe this is for you, since you spend more time on development. The Railway hack was interesting because anyone who does vibe coding probably stores their keys on Railway. Anyone in the Twitter space using Claude to build something will be told to use Railway. Like a lot of my vibe-coding projects, I just stored my API keys on Railway, as did many of my friends.

Did that make you look at it differently? Did what happened this week affect the idea that “SaaS died” because of vibe coding? Did it have any influence?

I think it was a skills issue. I’m not a Railway user, although many of my colleagues are, and I helped them with incident response when Railway was down because there were a lot of chaotic clicks. My main takeaway is that this doesn’t mean the consequence should be “work slower.” The question is how to work faster, but safer at the same time.

The problem was that it was too difficult to just take all my API keys and delete them. That was the main thing people faced after the Railway situation. They were saying, “I want Railway to keep all my API keys.” But if I want to destroy all of them, I have to call all my friends to get the keys, or have them call and turn them off themselves.

Yes, yes. What you’re asking about is pure positivity. I think we’re close to the time when the agent will proactively fix this for you.

Yes, as long as the agent isn’t compromised or something. There are new attack vectors, like agent versus agent, and we have to be careful. But I think defenses will improve quickly, and the world will be a better place if more people do vibe coding.

I just came across a business that hasn’t updated its website in 15 years. They’re still using the old Twitter logo, not the blue X. I’m like, “How are you doing?” And they feel completely normal. I think this business would be better off coding and creating a new website.

11. Is Crypto Custody Consolidating?

Guaranteed. Hey, let’s talk about crypto for a bit. I know, I have to do this. Maybe I shouldn’t. Maybe not. Mom, do we really have to?

There are rumors that Visa is buying Fireblocks for $2.5 billion. Visa said they wouldn’t comment, and Fireblocks said, “This is news to us.” Be skeptical about this, but honestly, it wouldn’t surprise me. Their last round was at an $8 billion valuation, and now they’re selling for $2.5 billion, according to the rumors. I’m really interested to hear your thoughts on something like this. Maybe you can tell me a little more about it?

There are a bunch of companies that will never hit their 2021–2022 estimates, and Fireblocks is definitely one of them, even though we’re their customers. It’s a good product. Their valuation was based on the idea that it would keep growing, that the graph would never bend, and that the whole world would eventually end up on Fireblocks. Obviously, that didn’t happen.

If you look at all these custodial businesses, they seem to be full. I’m sure they grow at a moderate rate, but once you move into a world of linear rather than exponential growth, you’re judged very differently. I don’t know Fireblocks’ financials. Go on, Zaki.

I’ll take it upon myself: their product is terrible. It’s truly terrible. They were optimized only for crypto funds as their clients, and they’ve squeezed themselves into this niche. The number of crypto funds isn’t growing exponentially. They were denying whales and stuff like that. I’m like, “Why are you doing this? It’s the same workflow.” They’re really only suited to Dragonfly. That’s the only type of client they serve. I’ve been a Fireblocks client multiple times, in different places and in different capacities. It’s a disappointing product.

If you think it’s so bad, why become their customer in multiple places? What do you use instead? What do you prefer?

When it comes to security, you don’t optimize your system for who has the best control panels. It’s a question of who has the strongest defense. Israelis know their stuff. That’s all I want to say.

I don’t think it’s that simple—that they’re Israelis, so they should be trusted.

Well, obviously Michael Shaulov is a great developer. I’m just saying they’ve always done a really good job with the combination of Indians and Israelis. Those are different things.

Zaki, go ahead.

The reason I was a Fireblocks customer in the past was that they supported assets that other custodians essentially didn’t have. They were the most reputable and safest option for those assets.

So you wouldn’t use a custodian from India? What do you think about this, Zaki?

I didn’t say that. I didn’t say that. I wouldn’t use a custodian—I didn’t say that.

Okay, good. I’m just saying, I think this eMudhra thing is probably really bad for India from a sovereignty perspective, too, because it was the only Indian CA. There’s nothing else really like that.

But putting your irrational exuberance aside, let’s look at this in context. Fireblocks last raised money in 2022–2023 at an $8 billion valuation. If they sell for $2.5 billion, the only ones who’ll make money from it are the last investors, who’ll get their preferred shares back. It’s a situation like Airtable or Bending Spoons.

No, no, no. It’s not so bad. They definitely didn’t raise anything close to $2 billion. They probably didn’t even raise a billion. They raised $550 million; their big round was $550 million.

Okay. So the total amount of preferred shares is somewhere around a billion, right?

How much? There’s no way they didn’t have $450 million in this. I’d guess it’s somewhere around $750 million or $800 million. They’ve raised—I’m looking at our funding data. It looks like they raised about a billion.

Oh, they raised a billion. Okay. They raised a billion. Not a bad result. The last group of investors gets their money back. Everyone who invested at a valuation below $2.5 billion makes a small profit. The initial investors get quite good returns, and ordinary shareholders get something, too. That’s usually how it works: after you cover the billion in preferred shares, the surplus of $1.5 billion is distributed further.

We need to get rid of it. No, no, no. You can’t get double the benefit. If you get your billion back, you’re out, right? If you get paid $1 back because you invested at an $8 billion valuation, you get 1x and you’re out. Everyone else who makes a profit shares the rest, converting it into common shares.

Well, it depends on the conditions, but yes, new investors don’t get a double payout. They get a maximum of 1x.

Of course. So imagine the last round never happened. Essentially, they’re going out for $1.7 billion or whatever, giving people back the money from that last round. What if you just rewound time to what the cap table looked like before the last round? It’s not the best result since the previous round, but definitely not bad.

It’s more like Bending Spoons. In the case of Airtable, I invested in a billion-dollar round, and I just got my money back because they bought it literally at face value.

Oh, so they’re closing the preferred stack.

Yes. They closed it. I closed mine.

Got it. So the common stock was completely wiped out in that deal. Obviously, common shares aren’t wiped out here.

Owners of common stock get something. If you’re an early worker, this is still a good result for you. So tell me: is this good or bad if we assume this is a real deal that’s actually happening? If you were an investor in Fireblocks, would you say, “Great, go for it,” or, “Wait, we still have a couple more years”?

Look, I don’t know the financial figures or Fireblocks’ finances, so it’s hard for me to say. If the buyer is Visa, then it’s completely liquid. Although, perhaps there are earnout payments. That’s another point to consider with these deals: will it be cash plus shares paid at closing, or is it an earnout? That’s a big headline number, but they still need to achieve 3 other metrics. If they don’t meet them, the value of the deal will be significantly lower.

These things are never easy unless it’s an extremely hot deal, and this deal isn’t hot. Presumably, there’s some structure or deferred payment here, so the nominal value is less. That being said, knowing these details, I’d probably say it’s a good deal. It looks like we probably won’t be able to take this business to an IPO. The IPO market is very weak right now. You’ve seen how many IPOs have been canceled. If we have no other prospects for liquidity, let’s accept reality and take Visa shares.

12. Crypto's Next Wave Of M&A

Well, yes, because BitGo isn’t trading very well, right? Let me suggest that this deal is actually hotter than you think. Fireblocks is right at the point where many companies are looking to go public in 2026 or 2027. They have somewhere between $100 million and $400 million in revenue, let’s say, but that’s not enough. Five years ago, that was enough to go public. Now it’s definitely not enough for an IPO, so they need to make several acquisitions to enter the market. Buying a company with $10 million in revenue won’t change anything fundamentally. I assume Fireblocks has somewhere between $150 million and $200 million in regular revenue. $150 million in total revenue is already significant for an IPO.

So I guess if they can, but it’s not private companies betting on them. The other one is—

Yes. It sounds like you know something. There are a large number of companies that want to go public. They already exist somewhere, so are you saying there’s at least one private company betting on them to merge and go public?

No. Think about all those late-stage companies that raised capital in 2021. I’m just naming names, of course, but I don’t think you’re a serious contender for Fireblocks. If you’re an investor in Fireblocks and you’re thinking, “Hey, I want to get out of this. I want to get some liquidity,” it’s a frivolous proposition to say, “Okay, this other private company wants to merge with you, so maybe we can go public.” This is a frivolous request. No one is going to accept—

Is there any argument? Cyber stocks have gone absolutely parabolic, like CrowdStrike and some others. Is there a repositioning here where, for example, you have really smart security cryptographers at StarkWare, companies working on formal verification, and Fireblocks? Is there some kind of turnaround that’s valuable simply because you position yourself as a cyber company? In a world where you could get at least something, that’s the only thing I can imagine. I don’t know if this has any prospects or if the market will buy it. To me, that sounds pretty implausible.

You pay so much for talent if you think about it literally. We’re going to hire smart people in cybersecurity. I think they’re more likely to think, “Okay, I keep hearing that the world is going to be tokenized, that every asset is going to be on the blockchain. I need to have an answer for how I’m going to internalize this business. Fireblocks is a good answer to how I’m going to do this.” On the other hand, we saw a story that Trail of Bits could potentially be acquired by OpenAI. That makes a lot more sense in the story you’re telling, not just through the people, but also through the data.

Very good. I see very good cryptographers there, security experts. I’m actually willing to bet that a lot of it is data in addition to talent. But security isn’t sticky, and security talent isn’t sticky for organizations in general. It’s very hard to retain, so people don’t pay a lot of money for it. You’re very interchangeable.

What was the predicted price for Trail of Bits? Was there one?

I don’t think there was any price in circulation.

Interesting. I’d guess maybe $100 million to $200 million or something like that. For an audit firm, as a rule, such companies don’t go for high prices. StarkWare last raised somewhere between $150 million and $200 million. I didn’t participate in that round, but it was a couple of years ago.

Yeah, if it was in 2022, it probably wasn’t what they’d get today. Most security businesses, at least in the crypto space, don’t have recurring revenue. They’re mostly service businesses, and their software revenue is very low. There really hasn’t been much of a large, scalable security business in the crypto space, like SaaS or other software. I think Hypernative is probably the only company with decent revenue, but no one is big there.

What is Hypernative’s revenue?

I don’t really know. Definitely less than $100 million, but I don’t know exactly how much.

13. What Is The Market Telling Us?

Hey, Santi, let’s end this. I’m really curious. Santi, have you seen that you can supposedly create gold from mercury?

Yes, I saw it. I saw it. Well, that’s a bit of an exaggeration, but—

No, of course, it’s hyperbole that gets 10,000 likes on Twitter and stuff, but I want to hear your thoughts on this meme.

I think that’s how people feel right now. For those of you who don’t watch us on YouTube, it basically means: you can’t own stocks because capital spending is slowing down. You can’t hold crypto because of quantum and AI risks, right? Bitcoin is dead because quantum computing will break it. You can’t use the internet because everything is broken. You can’t have software because SaaS is dead, right? You can’t own gold because they learned how to create it in a lab. You can’t hold bonds because inflation and crowding out investments harm them. So you can’t own anything.

I’ll just say this: I just got a note from an investment bank. I’ll read it. In the last 30 years, there have only been 3 instances where the 10-year Treasury yield fell more than 15 basis points in a day and gold lost more than 2% on the same day. This is an extremely rare coincidence: only 3 days in the last 30 years. Both of those 2008 incidents happened during the global financial crisis, when the world was essentially falling apart. When I see a large correlation, when everything is trading in sync and moving in the same direction, that means a significant reduction in leverage. There’s panic selling and forced selling.

I’ll say this: Ken Griffin was on Bloomberg this week, and I think he made a good point that blaming hedge funds or deleveraging always seems like a lazy answer. I do believe there are legitimate concerns about capital expenditures, rising financing costs, and so on, but let’s not forget that the market is at a historic peak. There’s a lot of variance in this, but the last 2 weeks have been pretty bad for people using high leverage. If you work with spot and just hold quality assets, I’m not worried at all. I’m calm, and I do my thing.

There’s so much news right now. Just think about what we’ve discussed in this podcast. For example, 70% of the internet—if you just read the headline and think about how the algorithms are going to trade it. The first headline is, “70% of websites on the internet are vulnerable.” The second is, “Facebook is running short of cash for the first time.” All big companies like Google and Facebook have negative cash flow. Those 2 facts alone create a new paradigm, and you hear from Stanley Druckenmiller and others that this is a very challenging time to trade the markets.

I don’t think it’s that difficult to invest in the market if you have a planning horizon of more than 1 or 2 years. You might have to update your plans because, as Steve said, if losses come in, the likelihood of a recession could increase. But you don’t have to react to all of that. I think a huge amount of value will be created. Every time I see a very draconian, very negative headline like the “SaaS apocalypse” that happened this summer, maybe it’s a good time to start buying. These businesses aren’t going anywhere. It seems to me that the market pendulum is simply swinging from week to week.

14. Content Of The Week

I’m not going to go into that. Okay, content of the week: listen to Tesla’s earnings call. I think Elon explains his point of view very well. He’s a great communicator. I’m not saying that everything he says is correct or that I agree with it, but it’s good content to listen to as you start forming your own independent opinions about it all.

This is a good moment to conclude. Content of the week. Hi, Zaki, we do content of the week every week. Bring a podcast. Bring a book. Bring an article. Rob, bring the movie. Steve, you probably know this.

Rob, I didn’t think about that.

Yes. You know what Rob always says? “Scare me.” Was this marked when you were trying to get him into the firm?

I didn’t know that.

It should have been on a list of pluses, and then this is a red flag about the guy: he likes horror movies.

I didn’t know that. I didn’t know that.

Okay. Interesting. It’s funny because I can’t—I find horror movies completely uninteresting.

They don’t scare me.

Yes, I’m of the same opinion. I just think they’re kind of stupid.

Oh, you’re not scared?

No, I’m not afraid. I think, why should I be afraid? Why should I agree to be scared?

I feel both, but I also often laugh in the middle of a horror movie because I find them so stupid.

Okay, Santi, you have Tesla’s earnings call. This is the extremely boring content of the week.

Do you see how they treat me here? I don’t even know why I’m still sitting in this chair, man.

It’s late at night. I don’t even know why I’m coming. I need some entertainment.

It’s too late to sleep anyway. We’re being attacked by cyberattacks. Some ASMR earnings calls.

Okay. Hey, Zaki, what do you have?

As far as movies go, I recently watched John Wilson’s “The History of Concrete.” It’s pretty good. I think it’s already streaming, so I recommend watching it there rather than in theaters, if it’s still out there. If you haven’t seen John Wilson, he’s a very eccentric director.

Mm-hmm. Quality.

He’s not for everyone, but I liked it. It’s like a movie to me, something you can get into.

Okay. He deserves to speak.

Well, you can come back next week. I wasn’t warned about this either. One of my friends, who was one of the original engineers at Mina, has a podcast called “Superlinear.” He’ll love it if I promote his extremely niche podcast on this. It’s at Superlinear.fm. It’s about agent programming, kind of an influencer theme, where he just talks about programming, but he’s a very good programmer. This has had a huge impact on my developer workflow.

What’s it called? Superlinear.fm?

Superlinear.fm.

Class. I like this combination of practices for developing with AI. Deeply interesting.

I started reading Ari Emanuel’s book. Ari Emanuel founded Endeavor, is behind the UFC, and represents a lot of people in Hollywood, for those who don’t know him. He just released a book.

The guy who played Ari in “Entourage”?

Johnno, of course.

You have a wonderful book. Ari from “Entourage” wrote a book.

Yes. Yes. It’s beautiful. It’s beautiful.

Listen, he’s dyslexic, so he doesn’t write emails or send messages to anyone. The book is called “Roll the Calls” because, in the agency business, you call your assistant and say, “Call everyone.” So he just sits there and makes 200 calls a day. At my first job out of college, I was making 150 calls a day, and let me tell you, that’s a lot of calls in a day. So, yeah, Ari Emanuel, “Roll the Calls.” Good book.

Somewhere in the middle.

Hi, Zaki. Thanks for joining.

Santi, glad to be here. Listen to “The Chopping Block.” See how Rob copes. Let’s see how he moderates.

I don’t know how he moderates. Interesting. I didn’t see Rob moderating their chat, and I’m nervous about how poorly they coordinate it. So tell us: we have very little coordination here. What can we do? How can we improve coordination in Empire?

You actually have to run the business. You have everything well organized.

Okay. No, no, you guys are doing well. What consensus mechanism should we use here to make sure that—maybe you should have—

I think benevolent dictatorship is the best way for any show.

This is true. This is true. Okay, friends. Thank you for listening. See you next week.

See you all. Have a nice weekend. See you, friends.