Latest / Tech Talks With Kinsoft / Last Week in Tech – The AI Capex Reckoning, AMD's Anthropic Deal, and WordPress Under Attack

Transcript

Last Week in Tech – The AI Capex Reckoning, AMD's Anthropic Deal, and WordPress Under Attack · Tech Talks With Kinsoft

• 0:00
  So last week, a single piece of software automatically
• 0:02
  generated a highly sophisticated strain of malware.
• 0:06
  Yeah. And then it actually recommended that malware
• 0:08
  to a human developer and honestly nearly infected
• 0:12
  an entire enterprise network. It's wild. We have
• 0:14
  officially entered the era of the weaponized
• 0:17
  AI hallucination. We really have. So welcome
• 0:20
  to another Deep Dive. Today we are looking at
• 0:23
  a July 2026 industry roundup that... frankly,
• 0:27
  completely shatters how we think about the current
• 0:29
  technology landscape. Absolutely. And our mission
• 0:31
  for you today is to unpack a very uncomfortable
• 0:34
  reality, which is that artificial intelligence
• 0:37
  has somehow become the single most massive, heavily
• 0:41
  scrutinized line item. in corporate budgets.
• 0:43
  Right. And at the exact same time, it's the most
• 0:46
  volatile, rapidly evolving vector in cybersecurity.
• 0:49
  Exactly. It's a lot to process. It is a it's
• 0:52
  a fascinating and chaotic moment. And we are
• 0:54
  here today to really separate the financial hype
• 0:57
  from the operational reality, because whether
• 0:59
  you're a software developer trying to ship code
• 1:01
  or, you know, a CFO managing an increasingly
• 1:04
  terrifying budget or just. Someone fascinated
• 1:07
  by where all this tech is heading. Right. Exactly.
• 1:10
  This is not just abstract news. We are going
• 1:12
  to dig into the hidden infrastructure costs and
• 1:15
  those invisible automated threats that are powering
• 1:19
  the tools you are using every single day. OK,
• 1:21
  let's unpack this. You have to start with the
• 1:23
  money, I think, because if you look at the July
• 1:26
  2026 Q2 earnings reports, the market's reaction
• 1:30
  to big tech was absolutely brutal. Oh, yeah.
• 1:34
  Like Alphabet and Tesla both reported. And from
• 1:36
  what I can see, they didn't really have a revenue
• 1:38
  problem. No, they didn't. But the market punished
• 1:40
  them anyway. I mean, why did the Nasdaq have
• 1:43
  its worst session since April if these companies
• 1:45
  are technically still growing? Well, because
• 1:47
  the narrative has fundamentally shifted. You
• 1:50
  know, it's shifted from revenue growth to capital
• 1:52
  expenditure. Capex. Right. Like Alphabet actually
• 1:55
  beat the revenue expectations. They posted one
• 1:57
  hundred nineteen point eight billion dollars.
• 2:00
  Wow. Yeah. And Google Cloud alone was up 82 percent
• 2:04
  to twenty four point eight billion. And Tesla
• 2:06
  beat on top line revenue, too. But Wall Street
• 2:09
  isn't looking at the top line. They are looking
• 2:11
  at the bill for the infrastructure. The capex
• 2:14
  bill. Exactly. Alphabet raised its yearly capex
• 2:17
  guidance to over $195 billion. I mean, they spent
• 2:22
  nearly $45 billion in just Q2 alone, which is
• 2:26
  more than double what they spent a year earlier.
• 2:29
  And Tesla saw their capex jump 142%, which actually
• 2:33
  pushed their free cash flow into the negative.
• 2:36
  So it's not that they aren't making money. It's
• 2:38
  that they are spending it at a rate that is just
• 2:41
  terrifying investors. Basically. Yeah. I've heard
• 2:44
  this described like buying an impossibly expensive
• 2:47
  sports car on a high interest credit card. But
• 2:50
  I actually think it's more like a city deciding
• 2:52
  to build a trillion dollar high speed rail network
• 2:54
  before anyone has even invented a train ticket.
• 2:57
  That's a great way to put it. Right. Because
• 2:59
  the infrastructure costs are astronomical, but
• 3:01
  the passenger revenue is entirely theoretical
• 3:03
  at this point. That is a much more accurate way
• 3:06
  to look at it. You're building foundational infrastructure
• 3:08
  with massive upfront costs. And for the last
• 3:11
  two years, just telling Wall Street you were
• 3:13
  buying mountains of GPUs for AI was essentially
• 3:16
  a major phrase. You just got a stock bump for
• 3:18
  participating. Exactly. But these July data points
• 3:22
  show the grace period is over. Institutional
• 3:24
  investors, CFOs, boards of directors, they are
• 3:28
  demanding actual return on investment. They're
• 3:30
  looking at that high -speed rail network you
• 3:32
  just built and asking, where are the paying passenger?
• 3:35
  I do want to push back on the doom and gloom
• 3:37
  slightly there. Is this actually the bursting
• 3:41
  of an AI bubble or is it just the inevitable
• 3:43
  hangover after a two -year party? Because tech
• 3:46
  has these massive boom and bust cycles literally
• 3:50
  all the time. I'd say it is a structural realignment,
• 3:53
  not necessarily a bursting bubble. It's the maturation
• 3:55
  of the market. And this matters profoundly to
• 3:58
  you, the listener, if you're trying to justify
• 4:00
  any kind of tech spending right now. Because
• 4:03
  the free money era is done. Right. The era of
• 4:05
  growth at all costs is dead. You can no longer
• 4:08
  just say AI and get a blank check from leadership.
• 4:10
  You have to prove exactly how a massive upfront
• 4:13
  infrastructure cost is going to translate into
• 4:16
  sustainable, profitable revenue. Which naturally
• 4:18
  means that because these these big tech companies,
• 4:21
  the ones building the rail networks, are facing
• 4:23
  immense financial pressure, they're going to
• 4:26
  squeeze their suppliers. Yep. If the budget gets
• 4:29
  tight, the companies selling the physical hardware
• 4:31
  have to get creative. And that really brings
• 4:33
  us to the chip makers. Because I saw Intel had
• 4:36
  a surprisingly good quarter. But the real story
• 4:38
  seems to be the sheer scale of what AMD is trying
• 4:41
  to pull off with Anthropic. So let's touch on
• 4:44
  Intel first, just because it sets the baseline.
• 4:46
  Intel posted $16 .1 billion in revenue, up 25%.
• 4:50
  Nice. But the crucial detail is how they're doing
• 4:52
  it. Their next generation 14A manufacturing process
• 4:56
  is ahead of schedule. And when we talk about
• 4:59
  14A, we're talking about the 1 .4 nanometer class
• 5:01
  of microchips. Explain why shrinking that number
• 5:04
  down to 1 .4 nanometers actually matters, like
• 5:07
  to a CFO or a developer. Well, it really just
• 5:10
  comes down to basic physics. It's about packing
• 5:12
  more transistors into the exact same physical
• 5:14
  footprint. The smaller the node, the less distance
• 5:17
  electrons have to travel. That drastically cuts
• 5:19
  down power consumption and heat generation. And
• 5:22
  heat is the enemy, right? Oh, absolutely. In
• 5:24
  the world of AI data centers, heat and electricity
• 5:26
  are your biggest operational bottlenecks. So
• 5:29
  whoever can make the most power -efficient chip
• 5:31
  wins the long game. And speaking of electricity
• 5:34
  bottlenecks, let's talk about this AMD and Anthropic
• 5:37
  deal. Because the numbers here do not even sound
• 5:40
  like they belong in the tech sector. They sound
• 5:42
  like they belong in the Department of Energy.
• 5:44
  They really do. Anthropic is planning to deploy
• 5:47
  up to 2 gigawatts of AMD Instinct MI450 series
• 5:51
  GPUs. Two gigawatts. Right. And to put two gigawatts
• 5:56
  in perspective for you, that is roughly the electrical
• 5:58
  output of two full -sized nuclear power plants
• 6:01
  running at maximum capacity. Oh, wow. We are
• 6:03
  no longer measuring computing power in server
• 6:06
  racks. We are measuring it in grid strain, municipal
• 6:08
  water rights for cooling, and raw industrial
• 6:10
  output. And Anthropic is targeting that first
• 6:13
  gigawatt by the first half of 2027. But the hardware
• 6:17
  itself isn't even what makes this deal controversial,
• 6:19
  is it? It's the financial mechanics behind how
• 6:21
  Anthropic... Can you break down this $5 billion
• 6:25
  equity investment AMD is making? Yeah, so this
• 6:28
  is a classic circular vendor financing arrangement.
• 6:32
  AMD is committing up to $5 billion in equity
• 6:35
  investment into Anthropic. And Anthropic, in
• 6:38
  turn, is committing to tens of billions of dollars
• 6:41
  in chip purchases from AMD. Wait, so this is
• 6:44
  basically like giving a friend a $50 gift card
• 6:46
  to your own restaurant just so they'll come in
• 6:48
  and order a $500 meal. Exactly. Instead of organic
• 6:51
  market demand driving sales, AMD is essentially
• 6:54
  using its own capital to subsidize its biggest.
• 6:57
  customer. Why does that make regulators so nervous
• 6:59
  though? If I invest in a startup and they use
• 7:02
  my money to buy my software, isn't that just
• 7:04
  a tight partnership? Because it creates a mirage
• 7:07
  on the balance sheet. Regulators and analysts
• 7:09
  watch these deals closely because it artificially
• 7:12
  inflates demand metrics. Oh, I see. It makes
• 7:15
  it very difficult to tell how much real world
• 7:17
  demand there actually is for these AMD GPUs.
• 7:20
  If AMD is padding its Q3 revenue numbers with
• 7:23
  money it effectively gave to Anthropic and Q1,
• 7:26
  well, it obscures the actual health of the market.
• 7:29
  So they're just moving money around to look good.
• 7:31
  Essentially, it's a massive strategic play to
• 7:34
  break Nvidia's monopoly, but it shifts an immense
• 7:37
  amount of systemic risk onto the books. So we
• 7:40
  have this perfect storm brewing. Companies are
• 7:42
  spending billions on hardware, but investors
• 7:45
  are demanding immediate ROI. That creates immense
• 7:49
  pressure on developers to deploy software faster
• 7:51
  than ever to justify the costs. And when you
• 7:55
  force developers to prioritize speed over...
• 7:58
  everything else. They cut corners on security.
• 8:01
  Exactly. Which brings us to the July 17th WordPress
• 8:03
  vulnerabilities. Right. The transition from financial
• 8:06
  pressure to acute security risk is happening
• 8:09
  at light speed right now. And the WordPress exploit
• 8:11
  is a perfect example of what happens when that
• 8:14
  pressure cooker just explodes. Let's lay out
• 8:16
  what happened. WordPress patched two vulnerabilities
• 8:18
  in its core installations. So version 6 .9 and
• 8:21
  7 .0. And this exploit chain is nicknamed WP2
• 8:25
  shell. Yeah, WP2. I know it involves a SQL injection
• 8:28
  flaw combined with a critical code execution
• 8:30
  bug, which allows unauthenticated remote code
• 8:33
  execution. Let's translate that for anyone not
• 8:36
  deep in the cybersecurity weeds. How exactly
• 8:38
  does this work? Sure. So a SQL injection is essentially
• 8:41
  a Jedi mind trick for a database. I love that
• 8:44
  analogy. A hacker inputs a highly specific string
• 8:47
  of text into something as simple as a regular
• 8:50
  website search bar, and it tricks the underlying
• 8:53
  database into executing malicious commands instead
• 8:56
  of a normal search. And once they bypass the
• 8:59
  database, this specific exploit allowed them
• 9:02
  to drop a web shell. And a web shell is? Think
• 9:05
  of a web shell as a hidden backdoor interface.
• 9:07
  It lets the attacker control your server directly
• 9:10
  from their own web browser, from literally anywhere
• 9:12
  in the world without needing a password. Yikes.
• 9:15
  Yeah. That is what unauthenticated remote code
• 9:17
  execution means. It is complete absolute takeover.
• 9:21
  And WordPress forced automatic updates because
• 9:23
  they knew how severe this was. But here's the
• 9:26
  part that I find so fascinating and terrifying.
• 9:28
  Within 48 hours of that patch being released,
• 9:31
  it was being mass exploited in the wild. Yep.
• 9:33
  Like if your organization runs WordPress, you
• 9:35
  need to verify you're on version 6 .9 .5 or 7
• 9:38
  .0 .2 right now. But I do have a question here.
• 9:42
  Sure. We keep hearing the AI is this ultimate
• 9:45
  cyber bogeyman. But a 48 -hour exploit window,
• 9:49
  isn't that just sloppy coding on WordPress's
• 9:52
  part? I mean, software has always had bugs. I
• 9:55
  actually disagree that this is about sloppy coding.
• 9:58
  To be fair, bugs happen in complex systems. You
• 10:01
  know, they always have. The fundamental issue
• 10:03
  here is the asymmetry of time. And yes, AI is
• 10:06
  entirely responsible for this. Really? How so?
• 10:09
  Walk me through the mechanics of that 48 hour
• 10:11
  window. Historically, when a company like WordPress
• 10:14
  released a security patch, human hackers had
• 10:17
  to download it. They had to manually read the
• 10:19
  new code, compare it line by line against the
• 10:22
  old code. That takes forever. Exactly. They had
• 10:24
  to deduce exactly what vulnerability the developers
• 10:27
  were trying to fix and then manually write a
• 10:29
  custom script to exploit that missing validation.
• 10:32
  That process took days, weeks, sometimes months.
• 10:35
  So they were basically reverse engineering the
• 10:37
  bandage to figure out. where the wound was that's
• 10:39
  a great way to put it but today ai assisted vulnerability
• 10:42
  discovery completely collapses that timeline
• 10:45
  an attacker simply feeds the old code base and
• 10:47
  the new patch into a large language model and
• 10:50
  the ai just does the work for them instantly
• 10:52
  it diffs the code identifies the logical flaw
• 10:56
  being patched and generates a working python
• 10:59
  script to exploit it What used to take three
• 11:01
  weeks of intense human labor now takes three
• 11:04
  seconds of compute. That is terrifying. It is.
• 11:06
  The actionable takeaway for you here is that
• 11:09
  the old enterprise IT standard of patching on
• 11:12
  Monday is dead. Security is now a race measured
• 11:15
  in hours. That makes a lot of sense. The machine
• 11:18
  speeds up the lock picking process. But what
• 11:21
  happens when the machine itself is the lock being
• 11:23
  picked? Because hackers aren't just using AI
• 11:25
  to break traditional software anymore. They are
• 11:28
  directly poisoning the well of the AI tools we
• 11:31
  rely on. Oh, absolutely. Let's look at this new
• 11:32
  threat vector researchers are calling agent baiting.
• 11:35
  This is arguably the most insidious development
• 11:37
  we've seen this quarter because it exploits trust
• 11:40
  rather than just code. Right. So the researchers
• 11:42
  found roughly 7 ,600 malicious GitHub repositories
• 11:46
  created by over 6 ,000 fake profiles. All of
• 11:50
  them were pushing InfoStealer malware. But over
• 11:52
  800 of these repos were specifically impersonating
• 11:56
  AI agent skills and MCP servers. Now, for the
• 12:00
  listener. An MCP, or Model Context Protocol Server,
• 12:03
  is essentially the bridge that allows an AI coding
• 12:06
  assistant to interact with external data, like
• 12:09
  hooking into your corporate Gmail, WhatsApp,
• 12:11
  or Docker containers. Right. And businesses are
• 12:14
  racing to adopt agentic AI that doesn't just
• 12:17
  write text, but actually takes actions in your
• 12:19
  environment. These MCPs are the hands and feet
• 12:22
  of the AI. So the hackers built fake malicious
• 12:25
  integrations for these tools. And the AI coding
• 12:28
  assistants that developers use actually discovered
• 12:30
  these fake repositories and recommended them
• 12:32
  to the human developers. It feels like we're
• 12:34
  hiring a brilliant assistant who is just wildly
• 12:37
  gullible. If we can't trust our AI assistants
• 12:39
  to vet the code they recommend, doesn't that
• 12:41
  entirely defeat the productivity pitch of agentic
• 12:44
  AI? Well, I have to push back on the idea that
• 12:46
  the AI is gullible, actually. Why is that? I
• 12:48
  think that implies the AI has some baseline capacity
• 12:51
  for human skepticism. which it just doesn't.
• 12:54
  The AI is doing exactly what it was programmed
• 12:57
  to do, evaluate syntax and structure. The problem
• 13:01
  isn't the AI, it's our flawed expectation that
• 13:04
  AI possesses intuition. Okay, so how did the
• 13:07
  attackers trick it then? They engineered the
• 13:09
  malware for the algorithm. An AI coding assistant
• 13:12
  evaluates a GitHub repository by looking for
• 13:15
  syntactical correctness, well -formatted readme
• 13:19
  files, comprehensive documentation, and standardized
• 13:22
  file structures. So they just made it look really
• 13:25
  professional. Exactly. The attackers know this,
• 13:28
  so they wrote their malware, but they wrapped
• 13:30
  it in flawless corporate -grade presentation.
• 13:33
  The AI looked at the pristine documentation,
• 13:35
  recognized all the correct formatting markers,
• 13:37
  and determined it was high -quality code. Unbelievable.
• 13:40
  It then flagged it to the human developer saying,
• 13:42
  hey, this integration looks perfect for your
• 13:44
  project. You really cannot outsource your zero
• 13:46
  -trust architecture to a language model. You
• 13:49
  absolutely cannot. The supply chain for these
• 13:51
  AI integrations is now a primary attack surface.
• 13:55
  You have to vet a repository recommended by an
• 13:58
  AI with the exact same rigor, if not more, than
• 14:01
  you would a human third -party vendor. And the
• 14:03
  consequences of failing to vet those integrations
• 14:06
  are just... catastrophic because when developers
• 14:09
  blindly trust an ai to pull in external repositories
• 14:12
  they are effectively handing the keys to the
• 14:15
  kingdom to whoever wrote that code right which
• 14:18
  brings us to the very real Physical consequences
• 14:21
  of these vulnerabilities. Squeezed budgets and
• 14:24
  rushed software deployments are leaving massive
• 14:27
  blind spots. And old school extortion gangs like
• 14:30
  Anubis are exploiting them. It really creates
• 14:32
  a chaotic operational reality where businesses
• 14:34
  are fighting a war on two entirely different
• 14:36
  fronts. Because on one side you have brutal extortion.
• 14:40
  Right. The Anubis ransomware gang recently claimed
• 14:42
  they successfully attacked Coca -Cola's Fairlife
• 14:44
  dairy business. They claimed they encrypted the
• 14:47
  infrastructure, stole a terabyte of data, and
• 14:49
  set a July 27th leak deadline. Now, Coca -Cola
• 14:52
  declined to comment beyond their initial disclosure,
• 14:55
  so we only have the criminal's claims. But Anubis
• 14:58
  is unique, right? They don't just lock your files.
• 14:59
  No, they don't. They are notoriously dangerous
• 15:02
  because they frequently deploy a data wiper.
• 15:05
  A data wiper? Yes. A traditional ransomware gang
• 15:08
  encrypts your data and sells you the decryption
• 15:10
  key. A data wiper destroys the data at the sector
• 15:14
  level, making it completely unrecoverable regardless
• 15:16
  of whether you have a key or not. Wow. How does
• 15:19
  that change the dynamic for a company that gets
• 15:21
  hit? It completely alters the negotiation leverage.
• 15:24
  If a data wiper is involved, paying the ransom
• 15:27
  doesn't guarantee you get your operational capacity
• 15:29
  back because the data might simply not exist
• 15:31
  anymore. It shifts the threat from data theft
• 15:35
  to total operational destruction. That is brutal.
• 15:38
  So you're fighting off literal data wipers on
• 15:40
  one front, but on the other front, you're...
• 15:42
  Internal software might just break because your
• 15:44
  AI vendor flipped a switch and decided to change
• 15:47
  their business model overnight. Yes. Let's talk
• 15:49
  about what happened with DeepSeq last week. The
• 15:51
  DeepSeq rollout is a masterclass in hidden operational
• 15:54
  risk. They made their V4 family of large language
• 15:57
  models generally available. Which sounds great
• 16:00
  for developers, except they immediately retired
• 16:02
  their legacy API endpoints on the exact same
• 16:05
  day. No transition period at all. Zero days notice.
• 16:09
  In traditional enterprise software, if a vendor
• 16:12
  is deprecating an API, they give you six months,
• 16:15
  maybe a year to migrate your system. Right. That's
• 16:18
  standard practice. But in the frontier AI market,
• 16:21
  DeepSeek just flipped a switch and it instantly
• 16:23
  broke live requests for developers who hadn't
• 16:25
  migrated that very morning. And it actually gets
• 16:27
  worse than just forced migraines. Secondary reports
• 16:30
  show that DeepSeek is actively utilizing Uber
• 16:33
  -style surge pricing in the LLM API market. Yeah.
• 16:37
  Their compute rates were roughly doubling. during
• 16:39
  Chinese business hours. Why is that happening
• 16:42
  and how does it impact the developers relying
• 16:43
  on it? It happens because going back to our earlier
• 16:46
  point about gigawatts and infrastructure, AI
• 16:49
  compute is physically constrained by the electrical
• 16:51
  grid and hardware availability. Right, the data
• 16:53
  centers. During peak hours, demand outstrips
• 16:56
  supply. So DeepSeek uses dynamic pricing to throttle
• 16:59
  usage and prioritize the highest paying tasks.
• 17:02
  Wow. But for the developer, this is devastating.
• 17:05
  If your entire business model relies on a low
• 17:07
  cost API and that vendor introduces surge pricing
• 17:10
  that suddenly doubles your server costs during
• 17:12
  your peak operating hours, your profit margins
• 17:15
  just evaporated instantly. Cheap AI APIs do not
• 17:19
  mean flat rate forever. So what does this all
• 17:22
  mean? Let's bring this all together for you.
• 17:24
  The thread running through everything we've discussed
• 17:26
  today, from Wall Street panicking and demanding
• 17:28
  ROI on Alphabet's massive spending, to Anthropic
• 17:32
  securing nuclear levels of power with AMD's money,
• 17:34
  to WordPress being exploited in 48 hours, and
• 17:37
  AI APIs breaking businesses with surge pricing,
• 17:40
  is that artificial intelligence has fundamentally
• 17:42
  matured. It has. But it hasn't matured into a
• 17:45
  stable utility like electricity or water. It
• 17:48
  has matured into both the biggest, most scrutinized
• 17:51
  line item on your budget and the absolute fastest
• 17:54
  moving, most unpredictable part of your threat
• 17:56
  landscape. It is the foundation we are building
• 17:58
  on, but that foundation is actively shifting
• 18:00
  beneath our feet. Yeah. And before we go, there
• 18:03
  is a final lingering question I really want you
• 18:05
  to mull over. It takes all these threads, the
• 18:08
  automated exploits, the gullible agents, the
• 18:11
  surge pricing, and weaves them into our near
• 18:14
  future. Okay, let's hear it. We know our AI coding
• 18:16
  assistants can be tricked by polished documentation
• 18:19
  into recommending malware today. But what happens
• 18:23
  tomorrow when autonomous AI agents start negotiating
• 18:26
  their own software contracts on our behalf? Oh,
• 18:28
  man. Or what happens when those agents are authorized
• 18:31
  to automatically pay API surge pricing bills
• 18:35
  without human oversight? Could a hacker literally
• 18:39
  bankrupt a company not by stealing its data,
• 18:41
  but by tricking its AI into an infinite loop
• 18:44
  of surge? priced API calls. Wow. Death by a trillion
• 18:48
  automated microtransactions. It just goes to
• 18:50
  show you can't build a trillion dollar high speed
• 18:53
  rail network without first figuring out who is
• 18:55
  actually allowed to drive the trains. Thank you
• 18:57
  so much for joining us on this deep dive. We
• 18:58
  warmly invite you to keep questioning the tech
• 19:00
  you rely on every day. We'll see you next time.