Latest / Tech Talks With Kinsoft / Last Week in Tech – Google Reshuffles Its AI Empire, Washington Writes a Rulebook It Won't Show You, and Memory Sold Out to 2030

Transcript

Last Week in Tech – Google Reshuffles Its AI Empire, Washington Writes a Rulebook It Won't Show You, and Memory Sold Out to 2030 · Tech Talks With Kinsoft

• 0:00
  I mean, imagine discovering that the richest
• 0:01
  company on earth has six billion dollars tied
• 0:05
  up in an IOU from just one single customer. Right.
• 0:08
  Just sitting there. Yeah. Just sitting in accounts
• 0:10
  receivable. Six billion dollars. And it's basically
• 0:13
  this massive single point of failure buried deep
• 0:16
  in a, you know, just a totally routine financial
• 0:19
  disclosure. It really is wild when you catch
• 0:21
  it. It is. And so today we're taking the crisp
• 0:24
  bow off the tech industry's shiny PR to actually
• 0:28
  look at the invisible wires and, well, the massive
• 0:31
  debts that are holding it all together. Because
• 0:33
  it changes your entire perspective, right? When
• 0:35
  you stop looking at the flashy product launches
• 0:37
  and start looking to hit independencies. Exactly.
• 0:40
  We all want to believe that the software and
• 0:42
  the hardware ecosystems that we rely on are these
• 0:44
  robust, independent pillars. But a closer read
• 0:48
  of the data shows a deeply intertwined system.
• 0:51
  One pulled thread can just unravel your entire
• 0:54
  strategic roadmap. And that is exactly our mission
• 0:57
  for this deep dive. We are unpacking a highly
• 0:59
  dense tech briefing from August 17th, 2026. The
• 1:03
  Tech Talks with Kinsoft Update. Right, the Kinsoft
• 1:06
  Update. We are going to decode a series of quiet
• 1:11
  but massive tectonic shifts happening in the
• 1:13
  background of the industry right now. So we're
• 1:16
  looking at a major changing in the guard at Google.
• 1:18
  classified government AI testing frameworks,
• 1:21
  those hidden billion dollar financial dependencies
• 1:24
  we mentioned, and a physical hardware squeeze
• 1:26
  that is literally going to dictate what you can
• 1:29
  actually buy next year. And if you're looking
• 1:31
  for the through line for all of these seemingly
• 1:34
  disconnected events. It's control. Control. It's
• 1:38
  all about who actually builds the foundational
• 1:41
  AI, who is legally allowed to evaluate it, who's
• 1:45
  financing all this compute power, and frankly,
• 1:47
  who holds the keys to the physical supply chain.
• 1:49
  Because if you don't understand those control
• 1:51
  mechanisms, you really can't protect your own
• 1:52
  operations. Exactly. So let's start at the absolute
• 1:55
  top of the AI food chain with who is actually
• 1:57
  building the tools you use every day. Because
• 2:00
  Google just went through an earthquake. Oh, Matt.
• 2:02
  Yeah. On August 5th, they dropped two announcements
• 2:04
  within like... minutes of each other, and it
• 2:07
  detailed the biggest AI leadership reshuffle
• 2:10
  in years. So, Demis Hassabis, the legend who
• 2:15
  co -founded DeepMind, is stepping back from day
• 2:18
  -to -day operations. Right. He's moving up. Yeah.
• 2:21
  He's becoming the chair of Google DeepMind and
• 2:23
  Alphabet's chief scientist. And taking his place
• 2:25
  operationally is Kare Kavukoglu. And to be clear,
• 2:29
  he is no outsider parachuting in to just, you
• 2:32
  know, manage spreadsheets. Definitely not. He
• 2:34
  is a 13 -year veteran of DeepMind. I mean, he
• 2:36
  worked on foundational projects like DQN. Oh,
• 2:39
  DQN. That was the reinforcement learning that
• 2:41
  famously taught AI to play the classic Atari
• 2:44
  games. That's the one. He also worked on WaveNet,
• 2:47
  which is... the architecture behind that incredibly
• 2:49
  realistic AI voice generation. And so now he
• 2:52
  steps up as senior vice president reporting directly
• 2:54
  to Google CEO Sundar Pichai. Which is huge. It
• 2:58
  is. He now controls Gemini model development,
• 3:01
  the frontier research teams, the developer teams,
• 3:03
  and the Gemini app itself. And we should note
• 3:05
  the briefing highlights the Gemini app just crossed
• 3:08
  950 million monthly users. It's a staggering
• 3:11
  number. I know, right? But before we get into
• 3:14
  the implications of Coray taking over. The second
• 3:17
  bombshell in that same announcement was about
• 3:19
  Jeff Dean. 27 years at Google. 27 years. He's
• 3:24
  the mind behind TensorFlow, Google Brain, MapReduce.
• 3:29
  These are technologies that literally shaped
• 3:31
  the modern Internet. Completely. And he is leaving.
• 3:34
  He's starting an independent public benefit corporation
• 3:36
  with his longtime collaborator, Sanjay Gemmawat,
• 3:39
  focusing on machine learning and science. Now,
• 3:43
  Google is a founding investor, but still. This
• 3:46
  is the end of a massive era. It is a profound
• 3:48
  changing of the guard. But, you know, for the
• 3:51
  listener who is actually relying on Google Workspace
• 3:53
  or Google Cloud for their business, the structural
• 3:56
  shift with Coray is what actually matters to
• 3:59
  your day to day. How so? Well, historically,
• 4:01
  Google suffered from this massive paper to product
• 4:04
  gap. Oh, right. The brilliant researchers publishing
• 4:07
  cutting edge AI papers sat in a completely different
• 4:09
  silo from the product teams trying to build features
• 4:12
  for everyday users. That separation created massive
• 4:15
  internal friction. So if Google was like a massive
• 4:17
  world -renowned restaurant, it sounds like the
• 4:20
  visionary executive chef who spent all day experimenting
• 4:23
  with molecular gastronomy just moved up to the
• 4:27
  corporate office. I like that. Yeah. And the
• 4:29
  veteran sous chef who actually knows how the
• 4:31
  kitchen line operates and how to get plates to
• 4:33
  tables quickly is now entirely in charge of the
• 4:36
  menu. That is exactly the dynamic at play. Consolidating
• 4:40
  the cutting edge research and the consumer product
• 4:42
  pipelines under one operational leader and having
• 4:45
  them report straight to the CEO signals a clear
• 4:47
  mandate for speed. They want to ship faster.
• 4:50
  Exactly. The pace of AI features rolling out
• 4:53
  to your workspace is going to accelerate. But,
• 4:56
  and this is a big but, this introduces a critical
• 4:59
  governance check for anyone managing enterprise
• 5:01
  tech. Right. When a hyperscaler, one of these
• 5:04
  massive cloud providers, changes the singular
• 5:06
  person deciding what gets built, your own internal
• 5:09
  roadmap assumptions suddenly have a new owner.
• 5:12
  So if your business heavily relies on Google's
• 5:14
  AI trajectory, you need to be asking questions
• 5:17
  in your next account review about how this specific
• 5:21
  leadership change alters their promised deliverables.
• 5:24
  You have to. You can't just assume the old roadmap
• 5:26
  is still valid. Okay, so Google is trying to
• 5:29
  speed up its product pipeline and push AI out
• 5:32
  faster. But here is where I get genuinely confused
• 5:35
  by the source material. Because while big tech
• 5:39
  is hitting the gas, the US government... is quietly
• 5:43
  like pulling the curtains closed on how these
• 5:46
  models are even evaluated. Yeah, this is a major
• 5:48
  shift. The briefing details Executive Order 14409.
• 5:53
  The government has directed an interagency group
• 5:55
  led by the National Security Agency to build
• 5:58
  a framework for reviewing what they call frontier
• 6:00
  AI models. And the mechanism of this framework
• 6:03
  is severe. It requires developers of state -of
• 6:05
  -the -art closed source models to give the government
• 6:07
  pre -release access for up to 30 days before
• 6:09
  they can even ship the product to the public.
• 6:11
  Wait, I need to stop you there. A 30 -day secret
• 6:13
  testing window. Yep. How does the government
• 6:15
  even define what a national security risk is
• 6:18
  in a text generating model? The briefing itself
• 6:20
  points out there is no clear definition of state
• 6:22
  of the art yet. And logistically, how do you
• 6:25
  comprehensively test a massive, unpredictable
• 6:28
  neural network in just a month? You are hitting
• 6:31
  on the exact logistical nightmare the industry
• 6:34
  is facing right now. They're essentially putting
• 6:37
  these models in a digital SCIF. A sensitive compartmented
• 6:42
  information facility. Right. Highly secure, physically
• 6:45
  isolated environments with incredibly detailed
• 6:48
  access logging. They will use automated red teaming,
• 6:51
  bombarding the AI with prompts designed to trick
• 6:54
  it into generating, say, biological weapon blueprints
• 6:57
  or discovering zero day software vulnerabilities.
• 7:00
  That sounds intense. What about the open models,
• 7:02
  though? Interestingly, open weight models like
• 7:05
  Google's Gemma, which just hit 900 million downloads,
• 7:08
  they are explicitly excluded from this pre -release
• 7:11
  framework, mostly because once an open model
• 7:14
  is out, the cat is out of the bag. But for the
• 7:16
  massive proprietary models from OpenAI, Anthropic,
• 7:19
  or Google, this testing is mandatory. And the
• 7:22
  most concerning detail in the briefing, at least
• 7:24
  to me, is that the government is reportedly not
• 7:26
  going to publish this framework or the results.
• 7:28
  No, it's entirely classified. They've actually
• 7:30
  directed the National Institute of Standards
• 7:32
  and Technology NIST to stop issuing public model
• 7:35
  assessment reports. So if they're testing these
• 7:38
  models in secret and shutting down the public
• 7:40
  scorecards, how on earth... Are businesses supposed
• 7:44
  to know if the AI they are integrating is actually
• 7:47
  safe? That's the problem. The public evidence
• 7:50
  base is effectively vanishing. For the last two
• 7:52
  years, if you wanted to know whether a new model
• 7:54
  was prone to leaking data or writing insecure
• 7:57
  code, you could just read an independent public
• 7:59
  evaluation from NIST. Right. With the cyber capability
• 8:02
  benchmarking process becoming classified, you
• 8:05
  are left with nothing but the vendor's own marketing
• 8:08
  press releases. And a vendor is never going to
• 8:10
  tell you their new upgrade is worse than the
• 8:12
  last one. So the burden completely shifts to
• 8:14
  the listener. If I'm running a company, I can't
• 8:16
  rely on generic public benchmarks anymore to
• 8:19
  decide if an AI tool is safe for my customer
• 8:22
  data. You must build your own evaluation sets
• 8:24
  immediately. How does that look in practice?
• 8:26
  You need to curate 30 or 40 real... documented
• 8:30
  cases from your own business where you know the
• 8:33
  absolute correct answer every single time your
• 8:36
  vendor pushes a mandatory model upgrade you run
• 8:39
  that specific set of questions through the new
• 8:41
  system that makes sense it takes maybe a half
• 8:43
  day of work to build that baseline but it is
• 8:46
  the only empirical way to know if an upgrade
• 8:49
  you didn't even ask for just quietly broke your
• 8:51
  internal processes Man. Well, if the government
• 8:54
  is no longer giving us the public safety metrics
• 8:56
  on AI, the next logical place to look is how
• 8:59
  the financial markets are evaluating AI's success.
• 9:02
  Oh, absolutely. And looking at the August earnings
• 9:04
  reports, the market is looking aggressively under
• 9:06
  the hood at capital intensity. The reaction to
• 9:09
  these earnings calls was wild. Look at AMD. Yeah,
• 9:11
  that was a fascinating one. They reported $11
• 9:13
  .5 billion in revenue, up 50 % year over year.
• 9:17
  Data center revenue was up 107 percent, now making
• 9:20
  up 58 percent of the entire company. Lisa Su
• 9:23
  confirmed a massive partnership to deploy GPUs
• 9:26
  and AMD Helios racks for Anthropic. I mean, it's
• 9:29
  an incredibly strong quarter, but their shares
• 9:32
  fell. Yeah, they dropped. And compare that to
• 9:35
  Palantir, who reported the day before. Palantir
• 9:37
  posted just under $2 billion in revenue, up 93
• 9:41
  percent. But the metric that mattered was their
• 9:43
  adjusted free cash flow, which came in at a massive
• 9:46
  $1 .22 billion. And following that report, Palantir's
• 9:51
  shares jumped sharply. They did. I have to challenge
• 9:53
  the market logic here. Why punish AMD for growing
• 9:56
  50 %? AMD is mining the iron and forging the
• 10:00
  steel that the entire AI industry requires to
• 10:02
  function. Palantir's just selling tickets to
• 10:04
  use the bridge. Why does the market reward the
• 10:07
  software layer but penalize the company laying
• 10:09
  the physical foundation? Because laying that
• 10:11
  physical foundation requires an eye -watering
• 10:14
  amount of upfront cash, and investors are getting
• 10:16
  nervous about the long -term math. The key metric
• 10:19
  to look at is capital expenditure versus gross
• 10:21
  margin. Okay, break that down. AMD's guidance
• 10:24
  showed their gross margin staying roughly flat
• 10:26
  around 56%, while the money they had to spend
• 10:28
  on capital expenditure, so building new fabrication
• 10:30
  capacity and research, that more than doubled.
• 10:33
  Palantir, being a software company, threw off
• 10:36
  $1 .2 billion in free cash flow on $1 .9 billion
• 10:39
  of revenue. Ah, I see. The market isn't just
• 10:42
  counting the revenue AI generates anymore. They're
• 10:45
  aggressively questioning what it physically costs
• 10:48
  to earn that revenue. Exactly. And this reveals
• 10:51
  a structural lesson about the economics of AI.
• 10:54
  You have to understand the difference between
• 10:55
  an AI product and an automated service. What's
• 10:58
  the difference? If you build a true software
• 11:01
  product, you spend the money once to develop
• 11:03
  it, and your margins expand as millions of people
• 11:06
  use it. But with many AI workloads, the computing
• 11:09
  cost scales one for one with every single user
• 11:13
  prompt. Because it takes GPU power every time
• 11:16
  someone asks a question. Right. That isn't a
• 11:18
  product. That is a service you happen to have
• 11:20
  automated. And if you don't price it carefully,
• 11:22
  scaling up your user base will literally bankrupt
• 11:25
  you in compute costs. Which brings us perfectly
• 11:27
  to the most jaw -dropping financial vulnerability
• 11:30
  in this entire briefing. Those massive compute
• 11:32
  costs have to be paid somehow. And it leads to
• 11:34
  some terrifying accounting. Let's look at Microsoft's
• 11:37
  fiscal 2026 Form 10 -K disclosure. This is where
• 11:41
  it gets scary. It really is. Microsoft disclosed
• 11:44
  $24 .1 billion of revenue from commercial arrangements
• 11:48
  with OpenAI for the year ending June 30. That
• 11:53
  number alone is staggering. But the real shocker
• 11:56
  is further down the page. Microsoft disclosed
• 11:58
  $6 billion in accounts receivable from OpenAI.
• 12:01
  Accounts receivable is money that you have billed
• 12:04
  for services rendered, but the client has not
• 12:06
  actually paid you yet. Six billion dollars owed
• 12:08
  by one single customer explicitly disclosed in
• 12:12
  a statutory filing. So if I'm running a midsize
• 12:14
  business and I see the richest tech company on
• 12:17
  earth holding a six billion dollar IOU from a
• 12:19
  single partner, I mean, that tells me I need
• 12:20
  to look at my own customer concentration risk
• 12:22
  immediately. That is the exact right takeaway.
• 12:24
  Customer concentration is a blind spot that companies
• 12:27
  systematically under report to themselves. Oh,
• 12:29
  yeah. Many businesses could not tell you exactly
• 12:32
  what percentage of their operating revenue is
• 12:34
  tied up in their top three clients. Ask yourself,
• 12:37
  what happens to your runway if your biggest client
• 12:40
  suddenly delays their invoices by 90 days? If
• 12:44
  customer concentration is a critical metric worth
• 12:46
  disclosing to the SEC at Microsoft scale, you
• 12:49
  absolutely must be tracking it at yours. Wow.
• 12:52
  Well, to cover those massive capital expenditures
• 12:54
  and unpaid IOUs, companies have to guarantee
• 12:56
  their future capacity to generate revenue. And
• 12:59
  that brings us to the physical hardware market.
• 13:02
  The squeeze. Yeah, the great hardware lockup,
• 13:04
  because to guarantee that capacity, the megacorporations
• 13:07
  are quietly buying the supply chain out from
• 13:10
  under everyone else. Let's look at memory components.
• 13:13
  Samsung, the world's largest memory manufacturer,
• 13:16
  is putting 60 to 70 percent of its entire memory
• 13:19
  production capacity under five year binding agreements.
• 13:21
  That's a massive chunk of global supply. And
• 13:24
  these contracts are going to just five major
• 13:26
  global data center customers and five massive
• 13:29
  AI clients. Deposits are already paid. And crucially,
• 13:33
  floor prices are set to protect Samsung if market
• 13:35
  prices fall. SK Hynix is executing the exact
• 13:39
  same playbook with around 10 of their own customers.
• 13:42
  The structural implications of this are massive.
• 13:44
  I mean, AI doesn't just require processing GPUs.
• 13:47
  It requires staggering amounts of high bandwidth
• 13:50
  memory to feed data to those processors. By signing
• 13:54
  these binding five -year agreements, the vast
• 13:56
  majority of the global memory supply for the
• 13:58
  rest of the decade is contractually locked behind
• 14:00
  closed doors. It feels like trying to buy a laptop
• 14:03
  or a server for your IT team is going to be like
• 14:06
  trying to buy front row concert tickets, only
• 14:08
  to find out the venue sold 70 % of the seats
• 14:11
  directly to a handful of VIPs before the box
• 14:14
  office even opened. Yeah, that's exactly it.
• 14:16
  The rest of us are left fighting over whatever
• 14:17
  scraps are left in the nosebleeds. That is painfully
• 14:20
  accurate. The standard enterprise buyer is not
• 14:23
  one of those VIPs. Neither is your primary IT
• 14:26
  reseller. The memory chips going into your next
• 14:28
  server cluster or the laptops you plan to issue
• 14:31
  to employees over the next three years are being
• 14:33
  pulled from a much smaller, highly constrained
• 14:36
  leftover pool. And what about pricing? Well,
• 14:39
  because of those floor price clauses, the historical
• 14:42
  boom and bust cycle of memory pricing is broken.
• 14:44
  Even if global consumer demand softens, the manufacturers
• 14:48
  have a contractual safety net, meaning prices
• 14:51
  are unlikely to drop for the everyday buyer.
• 14:53
  So how do we actually play defense against a
• 14:55
  global hardware squeeze? You remove ambiguity
• 14:58
  from your procurement pipeline immediately. Go
• 15:01
  to your suppliers today and get your fiscal year
• 15:03
  2027 hardware quotes in writing with a locked
• 15:07
  validity period. a verbal estimate is worthless
• 15:10
  when allocation gets tight right get it in writing
• 15:12
  second if you have a critical infrastructure
• 15:14
  refresh scheduled for the next 12 to 18 months
• 15:17
  you need to model the financial impact of bringing
• 15:19
  that purchase forward waiting will likely subject
• 15:22
  you to higher prices and massive delays ask your
• 15:25
  supplier explicitly Is this specific configuration
• 15:28
  currently allocation constrained? Okay, so we
• 15:32
  are seeing scarcity in hardware, but we are also
• 15:34
  seeing major turbulence in software, specifically
• 15:37
  the software as a service market. The briefing
• 15:40
  highlights Airtable being acquired by Bending
• 15:42
  Spoons for an enterprise value of $1 .285 billion.
• 15:47
  Quite a drop. Yeah. To put that in perspective,
• 15:49
  Airtable serves over 500 ,000 organizations,
• 15:52
  including 80 % of the Fortune 100, and was valued
• 15:55
  at over $11 billion back at its peak in 2021.
• 15:59
  This represents a brutal market recalibration
• 16:01
  for SaaS valuations. But what matters to the
• 16:03
  listener who relies on Airtable is understanding
• 16:05
  the acquirer's standard playbook. Right, bending
• 16:07
  spoons. Yeah, bending spoons is a private equity
• 16:10
  style firm that also owns Evernote, Vimeo, WeTransfer,
• 16:14
  and recently picked up AOL and Eventbrite. pattern
• 16:18
  after an acquisition is to radically reorganize
• 16:21
  the internal teams and aggressively overhaul
• 16:24
  pricing and monetization structures to extract
• 16:27
  value. Right. So if Airtable is a load -bearing
• 16:30
  pillar for your company's daily operations, this
• 16:33
  is the exact moment to pull your contract, read
• 16:36
  the renewal terms regarding price hikes, and
• 16:38
  make sure you know exactly how to export your
• 16:40
  data if the new pricing model doesn't work for
• 16:42
  you. You need an exit strategy before you are
• 16:45
  forced to need one. Exactly. And speaking of
• 16:48
  shifting software dependencies, we have to look
• 16:50
  at the tools developers use to actually write
• 16:52
  software. Meta just launched a beta for Muse
• 16:55
  Code, powered by their Muse Spark model. Which
• 16:58
  is their new coding agent. Right. This is a terminal
• 17:01
  -based AI coding agent designed to compete directly
• 17:04
  with Anthropic's Claude code and OpenAI's Codex.
• 17:07
  The technical differentiator Mark Zuckerberg
• 17:09
  highlighted is its use of isolated work trees.
• 17:12
  Okay. So how does an isolated work tree actually
• 17:14
  function in practice? Essentially, instead of
• 17:17
  the AI fumbling around in your live code base,
• 17:20
  it fans out and creates separate sandboxed clones
• 17:24
  of your repository. It assigns sub -agents to
• 17:28
  work on different problems in parallel within
• 17:30
  those isolated environments. So it's not touching
• 17:33
  the real code yet. Exactly. Only when the code
• 17:36
  is verified does it present the solution back
• 17:38
  to your main working copy. It is designed to
• 17:41
  prevent the AI from accidentally breaking production
• 17:43
  code while it hallucinates a solution. The source
• 17:46
  material did mention some industry reporting
• 17:48
  about pricing structures from used code, including
• 17:51
  a rumor regarding a cheaper tier that requires
• 17:53
  you to consent to your proprietary code being
• 17:56
  used to train their future models. But the source
• 17:58
  could not verify those details, so we want to
• 18:00
  be very clear that the pricing rumor remains
• 18:02
  unverified. Good to clarify. Still, the broader
• 18:04
  trend is undeniable. Massive tech companies are
• 18:07
  fiercely competing to provide agents that write
• 18:09
  your internal code. Which brings us to an urgent
• 18:12
  governance requirement. If you run a development
• 18:14
  team, you must establish a firm written policy
• 18:17
  today. Which of these AI agents are legally permitted
• 18:21
  to touch your company's code repositories? And
• 18:24
  under what specific conditions, if any, can your
• 18:26
  code be utilized for external training? Because
• 18:29
  if a developer on your team uses an unauthorized
• 18:32
  agent to fix a bug and that agent absorbs your
• 18:35
  proprietary algorithm, you have a massive intellectual
• 18:38
  property leak. You do. And it happens faster
• 18:40
  than you think. All right. We've covered long
• 18:42
  -term AI strategy, financial risks, and hardware
• 18:44
  scarcity. But we always need to close out with
• 18:47
  the immediate fires. The things you have to fix
• 18:49
  today. Yes, the things you literally have to
• 18:51
  fix today because the structural dependencies
• 18:53
  are already failing. The urgent patch list for
• 18:56
  August is severe. On August 3rd, a zero -day
• 19:00
  vulnerability was exploited in Metabase, an incredibly
• 19:02
  popular open -source business intelligence tool.
• 19:05
  And this is a bad one. This is an unauthenticated
• 19:07
  SQL injection via the password reset endpoint.
• 19:10
  Because Metabase is an analytics tool, it is
• 19:12
  by definition wired into the core databases of
• 19:15
  your entire company. For those who might not
• 19:17
  live in the cybersecurity trenches, how does
• 19:19
  an unauthenticated SQL injection actually work
• 19:22
  in this scenario? Imagine walking up to a bank
• 19:25
  teller. And instead of handing them your ID to
• 19:27
  access your account, you hand them a piece of
• 19:29
  paper with the bank's own internal override code
• 19:32
  that says, give this person all the cash in the
• 19:35
  vault. Oh, wow. Yeah. And SQL injection means
• 19:37
  the attacker types database commands directly
• 19:40
  into the password reset box. The system fails
• 19:42
  to recognize it as malicious input. reads the
• 19:45
  command and simply obeys, granting full administrator
• 19:48
  access. That is catastrophic. The attacker instantly
• 19:52
  gets the credentials for every single database
• 19:54
  that the Metabase instance is connected to. The
• 19:57
  briefing notes that Framework, the laptop maker,
• 19:59
  had to notify their entire customer base. A form
• 20:02
  builder called Tally reported email addresses
• 20:04
  and hash passwords were taken. LexisNexis saw
• 20:08
  unusual activity on third -party hosted servers
• 20:11
  affecting their Metabase API. It was widespread.
• 20:13
  But here is the part that makes no sense to me.
• 20:15
  The source says this vulnerability has no CVE
• 20:19
  score. The Common Vulnerabilities and Exposure
• 20:22
  System hasn't officially rated it, yet Metabase
• 20:25
  itself declared it a 10 out of 10 emergency.
• 20:27
  How does a 10 out of 10 not have an official
• 20:30
  CVE? It highlights a terrifying reality of modern
• 20:33
  cloud exportation. The speed of attackers actively
• 20:36
  exploiting a flaw often outpaces the bureaucracy
• 20:39
  of assigning a CVE number. You cannot wait for
• 20:43
  an official government severity score to act.
• 20:45
  A 10 out of 10 from the vendor means you drop
• 20:47
  everything. So what's the fix? The fix requires
• 20:50
  you to patch to the latest secure August release
• 20:52
  immediately. You must manually revoke all active
• 20:55
  user sessions, rotate every single connected
• 20:57
  database credential because they must be considered
• 21:00
  compromised, and if you cannot patch today, you
• 21:02
  must block the password reset endpoint at your
• 21:05
  network perimeter. Okay, drop everything and
• 21:07
  patch Metabase. What else is on the critical
• 21:09
  list? And Abel's nCentral platform. This is a
• 21:11
  remote monitoring and management tool used by
• 21:13
  countless outsourced IT providers. It has been
• 21:16
  under active exploitation since August 1st due
• 21:18
  to an authentication bypass. An authentication
• 21:20
  bypass. So they just skipped the log. Yep. Attackers
• 21:24
  can simply step around the login screen and gain
• 21:25
  full administrative control of the IT management
• 21:28
  systems. If you are running this on -premises,
• 21:31
  the hotfix build released on August 6th is absolutely
• 21:34
  mandatory, even if you already applied an earlier
• 21:36
  patch. So patch Metabase and nCentral today.
• 21:39
  Also, briefly, IBM Langflow and Apache Tomcat
• 21:42
  were just added to Cease's known exploited vulnerabilities
• 21:45
  catalog, so ensure your teams are patching those
• 21:48
  on their required timelines as well. You know,
• 21:51
  these vulnerabilities tie perfectly into our
• 21:53
  broader theme today. Metabase is your analytics
• 21:56
  plane. And central is your management plane.
• 21:59
  When attackers target these specific tools, they
• 22:02
  aren't just trying to break a single application.
• 22:05
  They're going after the foundation. Exactly.
• 22:07
  They are weaponizing your own structural dependencies
• 22:09
  against you. Having absolute visibility and rigid
• 22:12
  control over these central nervous systems is
• 22:14
  the only way to survive. It really all comes
• 22:17
  back to looking past the shiny box to see the
• 22:20
  invisible wires. From Google re -architecting
• 22:23
  its AI leadership to eliminate internal friction,
• 22:26
  to the US government quietly locking down model
• 22:29
  testing and killing public benchmarks. We've
• 22:31
  traced $6 billion IOUs buried in Microsoft's
• 22:35
  regulatory filings, watched memory chips get
• 22:38
  contractually hoarded by megacorporations years
• 22:40
  in advance, and seen critical zero -day flaws
• 22:43
  threaten the very tools we use to manage our
• 22:45
  data. It proves that being genuinely well informed
• 22:48
  in the tech sector right now requires ignoring
• 22:50
  the press releases. It means reading the boring
• 22:53
  statutory filings to find the hidden debt, understanding
• 22:56
  the capital expenditure required to keep AI running,
• 22:59
  and tracking the physical supply chains that
• 23:01
  determine if your software actually has a server
• 23:03
  to run on. Because if you only look at the final
• 23:05
  product, you are completely blind to the risks
• 23:07
  holding it up. It leaves me with a final, slightly
• 23:09
  provocative thought to consider. Let's hear it.
• 23:12
  We are seeing governments hide AI benchmark results
• 23:15
  from the public, and we are seeing big tech hide
• 23:18
  massive financial and hardware dependencies until
• 23:21
  statutory filings force their hand. Given how
• 23:24
  brittle this ecosystem is, how long until the
• 23:27
  market demands a mandatory nutritional label
• 23:29
  for enterprise AI tools? Oh, a nutritional label.
• 23:33
  Yeah. Not just a label for algorithmic safety,
• 23:35
  but a transparent breakdown proving the fundamental
• 23:37
  economic and structural stability of the tools
• 23:40
  we are building our entire future upon. An AI
• 23:43
  nutritional label for structural stability. Yeah.
• 23:46
  Imagine seeing a label that says, warning. This
• 23:50
  tool is heavily dependent on a single, uncollected
• 23:53
  $6 billion invoice. Exactly. It feels completely
• 23:56
  inevitable. Thank you for joining us on this
• 23:58
  deep dive. Keep questioning the information around
• 24:00
  you. Lock in your hardware quotes this week and
• 24:02
  start building those AI evaluation sets today.
• 24:05
  We'll catch you next time.