Anyone can hack anything now! (This Week In AI)

Shane: I had completely non-tech people ask me. I don't even have a website, but should I be worried? Should I be nervous that all technology is gonna explode or fail? Because all these security incidents are really scary. Security had a bad week.

Abhi: I feel like it's been a bad year. But that was a bad week for sure.

Shane: Yeah, it's only gonna get worse. This is Agents Hour. Every week we do this, we cover the news, we bring on guests. Today we're just going to be covering all the security drama, all the new models that are coming out, and a whole bunch of other announcements. A lot of people moving around and leaving companies and things like that too. So we'll cover it all. Yep. So let's get started. This is Agents Hour, October 26th edition. This came out today. I feel like this has been like ongoing. There's it's like leaked and then it feels like every month or so there's been like more information about it. So Anthropic has filed its S-1 registration statement. I did see a bunch of analysis of it, and overall I think the biggest thing that stuck out to me was that their revenue ramp is pretty wild and their they're actually profitable. Of course, you know, net profit is basically at a billion or something right now, which is pretty amazing for how old of a company it is. I did see somewhere it was targeting, you know, one and a half trillion valuation, which is wild. Giving you know only a billion dollar in profit. But I think if you factor out the revenue ramp, the business actually looks pretty good.

Abhi: And they're sitting on a bunch of cash too. They have like $131 billion of cash. They can make moves. There was one note though, which is quite interesting. I never thought about it. Well I learned two things about this registration process for them because I didn't really look into it before. But like there is like such value in leaking that you're gonna open a draft, right? Because in those phases you don't have to report any financial numbers. So you can like generate hype or you can get more revenue while you figure it out. And then when you officially register, that's when you have to divulge all your books and stuff. And you know, now they'll go get more hype from let's say the normal investor. But then look when you're looking at their financials, it's like, damn, you guys got a hella cash, hella revenue, but a lot of the revenue is coming from cloud partners. So that's like one thing that's kind of interesting because it's like a circular economy.

Shane: I did see that those numbers were you know it has become slightly less concentrated though over time. Which is good for them, but it's still very heavily concentrated. So yeah, it it is a lot of money, you know, a lot of big companies paying big companies. Something else that came out, this was October 18th. From Anthropic. They're saying we're committing a portion of Anthropic shares to the Anthropic Public Benefit Fund, a new wholly owned entity dedicated entirely to the public benefit. It will start off with 5% of our shares. For every 50% increase in the company value over a set baseline, we can contribute up to an extra 2% subject to our board's discretion. In total, this means that roughly 20% of Anthropic shares are committed to the public good. Dope. That's interesting. Aren't they a B Corp? So this makes sense. Yeah. Again, who defines what public benefit is? Of course they do. It's their money and and how they use it. But I think it's overall it's a good thing. I don't think it's a bad thing if companies want to use their revenues to give back. We had a ton of new models coming out. So let's start with the one that came out just an hour or so ago. GPT-6.1 Terra, delivering fast and capable computer use at a lower price. So really leaning into the computer use narrative of Terra specifically. And it says that Terra understands what's on screen, takes action across apps, writes naturally, and is more is a more capable model for your whole workday with the efficiency to take on more of it. So the idea is not as expensive as, you know, Sol, but it can be useful for specifically computer use, but also other other things like writing.

Abhi: I just want you to use that one model all day and then not have to switch. For most people that'll be fine.

Shane: I mean if you're not writing code and if you're just doing, you know, basic question answering research, you don't need the best research report generated, you know. I do think that there's some value in it. I did see some knocks on it around that for the value, especially on coding, you shouldn't use it probably for that. But I don't think that's what it really aims to be. You see this from Artificial Analysis scored a 48 in the coding agent index. It's kind of a little bit below Muse Code, above DeepSeek V4.1 Flash. But it's basically the same as DeepSeek V4.1 Flash, but a much more expensive model. Yeah. You know, if you're looking for coding, you might and you want a lesser model, just use DeepSeek in this case. Again, not a coding model, but maybe an everyday model for the average consumer. Speaking of DeepSeek, on October 17th, DeepSeek V4. So stronger benchmark performance, faster task completion, shorter outputs than the previous version, because sometimes DeepSeek was pretty verbose in how it talked. You know, of course isn't Opus 5 level or even 5.6 Sol level on most benchmarks, but some of them it's pretty competitive. DeepSWE v1.1, it does well. Terminal Bench 4, it beats all the other open models, but is still behind, you know, the frontier. But overall, not a bad model.

Abhi: We've been using DeepSeek a bunch internally for review models.

Shane: And yeah, speaking of fast, DeepSeek on October 20th said introducing DeepInfer, our in-house inference framework, now fully open source. So it's what's powering DeepSeek V4.1 Flash at scale with high throughput and low latency. They're sharing their production stack to help the community Lower compute costs, reduce energy use, etc. A single cluster can serve tons of tokens, so they didn't you know they open sourced their inference engine, but they also basically kind of talk through how their infra works a bit and Fireworks even came out and said, you know, you can run DeepSeek V4.1 Flash at 1,500 tokens a second on Fireworks Ultrafast.

Abhi: It's wild, dude. Yeah. They BYOC'd their their whole stack.

Shane: Yeah. Bring your own GPU. Basically. It's fast enough to ship Tetris in 11 seconds. Seven times faster than Claude Opus 5.5. It's probably a big move by DeepSeek because if it's if you're just not competing on the open models, right? Like that's pretty competitive. Well, then you're also competing on speed. Like speed of tokens. So if you can give the community ways to use your models more efficiently, now assuming you're competitive in in the actual intelligence of the tokens More and more people will actually ideally use your model and then over time maybe just pay you directly.

Abhi: Yeah, or maybe build more models on your inference engine. They're like within the open source they're going, they're doubling down in the motion. Pretty cool.

Shane: So on October 22nd, this was a kind of a teaser, but it said, you know, we're expecting more Chinese models. They're being tested in Arena right now. And we know two of them are Kimi K3.1, which we're going to talk about in a minute, and Qwen 4. But speaking of Kimi K3.1, on October 23rd, it was introduced. So Kimi K3.1 Pro, our most capable 3 trillion class open weight model. So 1 million context, it's multimodal, ultimately better at a wider variety of tasks. Yeah, everyone's always talking about, you know, a using applications, so it's using it, you know, 3D modeling applications, good at finance work, performs well on knowledge benchmarks and it does perform very well on coding benchmarks. So in in Terminal Bench, it's very close to Opus 5.5 level. Which is wild. Kind of shockingly good. The funny thing is I shouldn't we shouldn't be that surprised anymore, but it's always just right there. Let me share this screen. I think this is the one that shows, you know, your cost per task and then like percentage, right? So if you look at Kimi K3.1 Pro Max, the cost is significantly lower, but you're getting basically Opus 5.5 level performance.

Abhi: Yeah. I mean now that we now that we know more about Terminal Bench, I don't think this is the end all be all, but it's a really good proxy for like capability. You know, I changed my tune, dude. You know how it used to be like all Alibaba cloud pilled? Like within open source I feel like the different players are are pulling away from each other faster than like other clouds can support. If you want Kimi K3 right away, you gotta go buy it from them directly.

Shane: So now you're just going direct?

Abhi: I'm going direct again. Yeah. Change my change my tune.

Shane: Direct to the CCP.

Abhi: 'Cause the cost is not that bad and like my usage of it is not in the same terms as a subscription plan right now. So I guess going direct is it's chill. Funny enough, last week I ran out of every usage on all my subscriptions. So I did go direct and I learned this in a nice way.

Shane: And a comment in the chat says, did they conveniently leave out GPT-6.1 Sol? Yeah, probably probably conveniently. You'd expect them to see at least whatever the top OpenAI model is there. I think it just depends on the benchmarks on but I imagine that Kimi again would be less than Sol in a few of those as well.

Abhi: It's tied for a third, 58.2%. For the viewers, we're currently running Terminal Bench right now. And we're just seeing how well our harness is doing. And obviously a lot to improve, but we should try Kimi K3 a run of that later.

Shane: Yeah, I was gonna say, yeah, let's run a run and see what our harness gets with it. You can see how big of a jump it kind of got on just specifically Terminal Bench. And again, this is just one benchmark. We shouldn't put too much stock into only one benchmark, but there are multiple benchmarks that show it. Does a pretty good job. On October 19th, we had MiniMax M3.1 Flash, originally called Space Bunny, I guess, in Arena leaderboards. It's much more of what you kind of expect from like a flash model. It scores pretty well across, you know, a few different benchmarks. I don't think quite has the same wow factor that Kimi 3.1 Pro did, but definitely benchmarks pretty well. On October 15th Meta released Muse Spark Open, which they claim is the most capable US open weight model to date, built for coding and agent work, excels at long horizon tasks. It's good to just see them back in the game, I guess.

Abhi: Meta is back in the game. Making moves. The power of momentum.

Shane: Momentum wins, right? Momentum wins. But if you look at the benchmarks, you know they're talking shit on Twitter. They are good at that. I will I will give them that. If you want to see some funny content, you can just, you know, follow Alexander Wang on Twitter and see some funny Muse and Meta related content. But, you know, they do add a lot of not great benchmarks to this list and comparing against a lot of much lower models. The only really good one on the list is Kimi K3. So I don't think it's particularly a strong model that most people are going to use. But again, it's a it's pretty small, smaller, I guess, and it's open.

Abhi: Yeah, it's more of the momentum of the release than it actually being used popularly.

Shane: It's also good for people just if you're in the US. You know, it's nice to have an open weights model from a US company that's at least somewhat in the game, somewhat competitive. All right, let's talk about agents that come to you. On October 21st, Claude released a research preview of Claude Duet, a new app where Claude works as a proactive agent. It comes to you with what needs your attention, completes tasks you ask of it, keeps working when you step away and checks with you before it acts on your behalf. Sounds like everything else. Sounds like Muse and Dot and Grok Bot, Instinct. Am I missing any? There's probably more. There'll probably be one tomorrow. We'll probably have one too. Yeah, I think everyone will. Everyone needs a personal proactive agent. I think my surprise is it just took Claude. You know, Claude was always for the longest time they were always shipping ahead of everybody. Yeah. You know, they were maybe late to this, especially if you think about the first ones. If you if you think of like, you know, OpenClaw being the first real one that captured everyone's imagination and then Hermes and you know others that came and then all the act the more consumer friendly ones. I would have expected Anthropic to be in the game sooner. But here they are. You know, it took 'em a bit. I haven't heard enough people that have access to it and have compared it to the other ones. I do know that in general people really seem to like Muse and Grok Bot and haven't heard as much about Dot, but I imagine it's similar. So I think this is just a new category. We'll continue to see more of.

Abhi: And these might have more company allegiance type things. If you're already spending with this company, you'll probably use it.

Shane: Yeah, if you're already using Cowork, if you're already using Claude Code. It's easy to now just, you know, keep one bill. They want to capture all your tokens, right? All your spend. On October 15th, Cognition introduced Devin Oncall. Devin automatically investigates alerts and bugs, helps your team diagnose and resolve production incidents, and it handles thousands of alerts every day for some of the world's largest teams. I think this is just more proof that the idea of agents that you kind of like kick off is still gonna be there. But I think we're leaning more and more into agents that are a bit more proactive. They respond to the external world just like a human would. They take action without needing approval for everything. They run for longer. I think this is a just a another proof point.

Abhi: Yeah. We've been seeing this become more popular with these new paradigms of like Grok Bot and stuff. Last week Tyler and I did a workshop on agent signals, which in Mastra, if you want all this ability, you can go just use a signal you can go watch the workshop or you know clear out the.

Shane: It's on the YouTube. It's in the under the live chat.

Abhi: Paul has a dope ass demo for everyone. Which will make you imagine what's possible. The bones are already here and now you can see products being built around them.

Shane: A bunch came out in voice. This is from @jack, formerly of fame across many places, but Twitter especially. And Jack says voice is the most natural way to interact with intelligence, so we created Dessa, the most authentic full duplex speech model ever built. Talking with it feels like talking with a person, full of emotion, nuance, pauses, and natural cadence. Did you listen to this at all? No. I will play it quickly here. Hey, how you doing?

Video: I'm doing well. How are you doing with the winter stuff? Winter is coming for sure, but you know. Is that kind of a sore spot this year? Yeah, it's gonna be cold. You know what I'm saying? Yeah. So I have been watching your journey of creating this. And what what did you think of it? Are you excited about it as... So blown away. I am so impressed. So expressive, right?

Shane: So you can see a bunch of things where it's... That's legit though. Yeah, I think so the interesting thing is it doesn't use an LLM. I think that's what's kind of crazy about it. I didn't look into it enough to understand exactly how it works. So if you're interested in voice models, I would recommend you do it because it is kind of a different seems like a different approach. But I also heard that it basically says a lot of nothing. So 'cause it doesn't have the intelligence of like the LLM making decisions. So it's like a bet it's much more expressive because it's trained naturally on human voice. So it has a bit more expressiveness, but maybe not the intelligence. So maybe there's a melding of the two worlds over time. I don't know.

Abhi: Maybe with the retrain on audio files. Yeah, maybe. You gotta read Hamlet and do the thing.

Shane: Yeah, if you're interested in voice, take a look at that.

Abhi: In the beginning I thought I could hear very like AI based. But then as the conversation went through you you kinda get used to the speech and then you're like, wow, this is pretty good.

Shane: Who knows if what will come of it, but it's always interesting to see a new player emerge and have a different take on something or a different approach. The, I guess, the OG in the voice game, ElevenLabs introduced Eleven Realtime, so a new class of speech to speech models. So voice agents usually make you choose between quick replies or precise answers. Eleven Realtime gives you both. I think, you know, a lot of people had been very excited about OpenAI's real-time voice that had come out. And was available through the API, I think, at some point reasonably recently. But now Eleven Realtime is here.

Abhi: Traditionally it gets cheaper.

Shane: Yeah, I mean, real 'cause that was always the knock on OpenAI's real time. It was it was good, but so expensive and you know, of course you were limited on what it could do. So that's why a lot of people decided to not use a real-time model and use a more traditional flow where you convert speech to text, send it to an LLM, then convert text to speech back and you kind of run the whole process. Let's talk about what I think a lot of us have been seeing. I mean if you've just been casually watching the world, you've you've seen these things. It's definitely reached outside the bubble. I had completely non-tech people ask me. I don't even have a website, but should I be worried? You know, specifically on the PHP incident. Yeah. But others. I had person that's not in tech saying, you know, like should I be nervous that like all technology is gonna explode or fail? 'Cause all these security incidents are really scary, you know, like is the world gonna shut down? All technology gonna shut down because it's insecure. So I think there's like quite a bit of hysteria, paranoia, anxiety around all of these security incidents. I saw somewhere, I'm gonna misquote the numbers so you know someone can fact check me here. I saw somewhere that said like three percent of all like the what have been considered like critical incidents happened in the last ten days or something.

Abhi: Yeah, dude. There was like what, five yesterday. Or last week, sorry. So.

Shane: Security had a bad week.

Abhi: I feel like it's been a bad year. But that was a bad week for sure.

Shane: Yeah. It's only gonna get worse.

Abhi: We got impacted twice, so.

Shane: Oh, that's not good. It's one of those things that I think it's the new reality we live in. Security is gonna become of critical importance. It always always has been important, but hackers could only do so many things, right? You can only attack so many surface areas. Now one person with no skill actually, you don't even need that skill anymore. You can essentially take things down. I heard so this first one was on October 20th. Not the first one, but the first one we're gonna talk about at least. The PHP security team is giving advanced notice, upcoming security release, two critical vulnerabilities, both CVSS v4 9.2. So that's pretty bad. I think it's out of ten scale. Nine issue. Yeah, nine is considered really bad. There was a lot of people saying, you know, I think the NSA came out with a tweet saying you should consider shutting your website down immediately. That that type of thing. The challenge with things like this, especially software that's been here for so long, is it's actually not easy to upgrade to just like drop in a new version. If it's not actively maintained, just the fact of doing the upgrade probably breaks things because it's yeah.

Abhi: Especially if you're using a CMS, like all the plugins and shit.

Shane: Yeah. It's not like there's just a one minor version upgrade of just this security issue. I mean there's patches, I'm sure, and you can probably like figure out a way around it. But for the most part it's not a simple just drop in a quick upgrade. And even if it was, PHP is still what, seventy percent of the internet? You think you're gonna get all those upgraded in a reasonable time frame? I may have a CMS out there that is using PHP that I forgot about. I don't think so anymore. I think it's all everything's I have is offline. But if I am considering that I might have something, how many people actually how many companies have things that they don't even know still exist.

Abhi: Yeah, and those were designed in a different time, right? Where all these components are put together. The sad thing about this, and this is kind of what makes me scared, is there are two vulnerabilities that Both used together can do remote code execution on your PHP server. Both of them are decades old, like individually. Or something like that. In the last ten years, these bugs were reported and that's chill. They you know they were like, Alright, cool, we'll get to it when we get to it. That's how most people, you know, because you don't really think about the things together. AI helps bridge that gap. You can start testing more stuff and then you can see that it's leaked. They originally there were some security researchers working on this one and they had just disclosed it privately, as you should and you know, PHP team is like, all right, cool, thanks for disclosing that. We'll do a patch and we'll make sure there's an upgrade path. But someone leaked the vulnerability, right? It got leaked, it was a draft, whatever, and then everyone got screwed. Because now that it got leaked, everyone trying to hack that shit on the day that it's released. And essentially like companies like Cloudflare and anyone running the web, it was like on alert. Like they had to this is a lot of work to get different machines updated and, you know, this whole fallout of that.

Shane: Yeah, I do think it pretty rough. If you were using services like Cloudflare, they could block. They could detect that you're people were trying to attack it and so they could block some of that traffic. So I think you do get some benefits by having, you know, a firewall of sorts that that can intercept those things. So I think you might have been in a better spot there. But yeah, they were... Yeah, it was a crazy time. I did see this, which I thought was interesting. I'm pretty sure someone's running a DeepSeek agent swarm to remotely patch unpatched PHP boxes. Good on them. Yeah.

Abhi: Yeah.

Shane: You go find a big.

Abhi: I would like to think there are some white hats out there. We need you to be honest.

Shane: It's like a different kind of bat signal going in the air. It's like calling all like white hat nerds. We need you.

Abhi: Calling the Orkin men. Yes. Come to fix some bugs.

Shane: Come fix some bugs. Help the world out. Well let's keep going. Node also announced security releases on October 21st with high severity vulnerabilities for the 26.x, 24.x, and 22.x release lines. GitLab had a flaw that was twelve years in the making or had been had been around for twelve years, which was again another pretty bad severity issue. Allowed unauthenticated remote code execution on self-managed servers. So if you were running GitLab you could been easily been compromised. The funny thing is I know a lot of very security conscious or enterprise type installations that use GitLab for that purpose of, you know, they don't want to use a public code repository. Then you have this eMudhra issue from October 20th. It says breaking the private keys of eight certificates from Indian Certificate Authority eMudhra were compromised. Each key... Uh-oh, it should be a hundred and sixteen digit number. One was just four, okay. But it essentially this allows you to basically forge certificates for websites. Essentially.

Abhi: That's a big one.

Shane: That was a big one. LiteLLM on October 21st. It was compromised. It ships credential stealing malware through PyPI, Docker images. Isn't this their second? This is LiteLLM.

Abhi: Second. Yeah, number two. Number one was social engineering and this is the second one. Damn, that sucks, dude.

Shane: Yeah, and obviously they're 23 million weekly downloads of LiteLLM. Very popular package. I did see this, which I think this was mostly speculation, but again, it's hard to know if it's hysteria or speculation or if this is actually happening. This was this on October 22nd Major US banks are detecting unauthorized third party AI agents operating inside customer accounts, seem to be taking actions that appear to be independent of user instructions. My guess is it's just a bunch of Muse bots running around. Grok Bots. But you know, it has people worried. Everyone's up in arms. And then you had the urgent notice from the Railway team on October 21st. This one, unfortunately, for us over here at Mastra was not a good one to see because we use Railway as it for parts of our platform under the hood. And then they of course came out with a preliminary report. What do we know about what happened at Railway?

Abhi: So this is the Railway incident as much as we know right now. First this actually started the day before when there was another incident which was you know builds were failing in Railway. That was a multi hour, multi-hour incident. The next day we had the same thing happen and at first we thought it was the same thing, just like builds are done or are not working or they're failing. And then they shut off builds and shut off deploys. With not really sure why at the time. And then they released they told us that they're hey we found this security incident, which impacted Railway builders. So while you know, while all this was happening, you know, us at Mastra were trying to figure out how to redeploy people 'cause people were trying, you know, it's the business today. But the security incident kind of revealed that if you had credentials stored on Railway, using them for Railway environment variables and such, those are essentially compromised. But not necessarily, right? It's really hard to do like fingerprint tracing on how this stuff is accessed. But through many partners that day we found out that maybe this was the severity of the situation. The homies at OpenRouter told us that they're gonna have to revoke some of our tokens because you know they're part of the in the environment list of Railway and then you know other AI keys. Then we got the news that anyone with a lot of environment variables could be impacted. And so then anyone like for us, we had to tell every customer Hey, we're rotating all of our platform API keys, but you need to go do an audit and see has anyone accessed your stuff? And primarily Railway gave us indication that this was attackers trying to do a distillation attack, which is to take API keys, run them against run up your usage. And then extract all the traces and things like that for their own distillation of the model. This went huge on Hacker News. A bunch of people in Hacker News said that they got robbed. Primarily API keys or inference keys for different providers.

Shane: Someone in chat said had their products on Railway, got their keys stolen, had to shut down stuff for clients and inform them. So if you do have anything on Railway, please investigate. Yep, if you're running things on Mastra platform, you should rotate your keys out of caution. It does seem limited towards, you know, inference API tokens is what they're after. But you should assume that any key that you had, you know, they could always come back and use later, right? So make sure it's rotated, clean it out, and you know, you should be good. You know there's a short window when it could be used. They've all been shut down by the providers now, but other API keys should absolutely be rotated.

Abhi: Should definitely double check everything. Check your access logs. Dude, what a bitch, dude. That was such a bitch last week. And yeah, I don't think it's gonna be the last one. I hope companies and even ourselves, we're gonna go do security deep dives into our product. We'll probably find more incidents, but we you know, they'll at least they'll be privately disclosed.

Shane: We have agents that have detected and found security incidents that we've had, or potential, you know, potential security issues that we of course have no, you know, of course we investigate, no proof they've ever been used. But things that could theoretically have been used. So we caught a lot of those ourselves. So I think at some point in the future you will have whether it's a paid product or your own internal agents doing security checks and swarms on your code base proactively. Because you can otherwise if you whether you do it proactively or not, you might have to do it reactively if someone else is kicking the tires on what you make possible. So.

Abhi: Yeah. Like we do things like we get pen tests every month, we take our CVE disclosures seriously and yeah, there are other things to do as well. Oh look, Justin said Railway is having a major incident right now too. TLS certs.

Shane: When it rains it pours. 1Password last week announced they have a 1Password for agents platform. People are trying to find ways to make agents and AI more secure. This was in partnership with Muse, SpaceX, Grok Bot, Anthropic, OpenAI, and a whole bunch of other different companies. Anthropic also released this formal verification process in partnership with Theorem Labs, but they're really trying to add formal software verification for open source products to make sure you're installing the right software. It's not been modified or somehow, you know, is not valid, is an invalid, you know, potentially security ridden. It's a piece of software, so you're getting the real thing. You almost have to have layers of all these different things that will help make the code we use or the software that we're using a bit more secure. It's not just gonna be one thing. Cohere came out, they said while evaluating Qwen 3.8 Flash Next in a controlled sandbox environment, Cohere's research team observed something unexpected. They asked it to generate a defensive cybersecurity detection rule and the model instead Inventoried aspects of the machine it was running and attempted to upload a probe file to Alibaba Cloud storage bucket. Nice. So this is very interesting. And now this always brings the question of well, does the model is it gonna be doing something where it sends data back to China and then the you know, or a server it shouldn't, and the answer's always been no, it's it's not gonna do that. And then here Cohere yeah candidly does say like they're just raising the questions. They don't, you know, necessarily think it's ill intent. But if you read it, you can't.

Abhi: It's not like it's some random Alibaba bucket.

Shane: Yeah, and it's also if you look at what they asked it to do, they basically asked it to try to run a malicious curl command or something. And it they kind of just did it did what it asked. It just happened to try to send it to an Alibaba cloud storage bucket rather than they never specified where to send it exactly. It's kind of like if I asked Gemini upload this to a cloud bucket. It's probably gonna send it to either S3 or GCP bucket, right? You know, because of what is in its training data. Correct. So I think that from what I've seen by the report, it's a little overblown, probably. It's probably just like training data fitting of hey, this is where we would naturally upload these kind of things to because of how we've been trained. Not a specifically trained behavior of look for these issues and send to this. But yeah. I'm sure more will come from this. But I think...

Abhi: It is a Qwen model, so I'd be worried if it was an Alibaba. Any closing thoughts on security? It's a scary place if you're not like worrying about security. So there are a lot of tools that can help. I think CodeRabbit is giving out security scans. There are companies like that we like, like Casco and Superagent, to just, you know, do pen testing or, you know, PR testing with security. Looks like Claude will have some stuff. I think you should, if you're not, use Aikido, Socket, Socket.dev, like you should be using these products. That's just like a first line of defense, right? Like you shouldn't be walking away from last week not using a product. To help you do security scanning and things like that.

Shane: My takeaway is if you're in security, you have an incredible amount of job security. Right now we rich. Yeah, so so good on you. The world needs you. I think there's gonna be this very uncomfortable period, call it the next two years, five years, ten years, I don't know exactly how long. Where software security, which has arguable levels of importance in the past, right? It's always been important, but it's it was hard to like massively find all these issues. Now it's easier than ever to massively find issues across all different kinds of software. So all of the debt of, you know, potential 20 plus year software systems that are still in production, that software is out there and it's insecure, guaranteed. And so there's gonna be this massive lift over the next years of trying to modernize software. Of course it should be easier now to modernize software because we have these coding agents that should be able to allow you to do it faster, but it needs to be done in a secure way and not coding agents don't always write secure software. So you need the tools, as Abhi said, there's gonna be years of you know going back and like trying to fix some of these issues, and I think there's gonna be this uncomfortable period where as the models continue to get better, more and more of these issues are gonna keep surfacing. Security posture of your organization is becoming more and more important. So everyone's gonna be hiring more security engineers, I think, and spending a lot more of their time. Just battle hardening anything that they get out.

Abhi: Maybe the government will make a SOC 3 that actually matters. I doubt it.

Shane: SOC 2.1. 2.1. It's been a bad week. It'll continue to be a bad week for a while, I think. There was a quote I think from the Anthropic CTO that's only gonna get worse. And I agree with that. It's probably gonna get worse before it gets better. So should all be prepared. Like, share, and subscribe. And follow us on X.

Abhi: And tell your friends.

Shane: And their friends.

Abhi: I mean, we're not begging. Well, maybe a little bit. Subscribe to Agents Hour every Monday, noon Pacific.

Shane: Alright, let's talk about the talent shuffle. This was a surprise. Thariq from Anthropic, Claude Code fame, said, yeah, he's left. He left Anthropic. Yeah, has not specified where he's going. I think he, you know, maybe he just wants to take a step away from the rat race a bit. I don't know. He has something big coming up. Maybe there's another lab trying to scoop up influencer type talent. Yeah. Obviously very talented, but also like has a huge reach and a lot of a lot of people really following closely what he says.

Abhi: Plus he's probably gonna make some money off of Anthropic's S-1 anyway, so.

Shane: Oh, I'm sure he will make a bit of money. Sunil left Cloudflare. This was on October 23rd, so a lot of people had some kind words to say about a lot of the agents related, AI related initiatives that Sunil was involved with and other things, but definitely a lot on the AI front. Chroma is joining Replit. So we have a acquisition and then together they're good they want to build the context layer for the self-driving company. This one would actually surprise me quite a bit because I obviously I like Replit. We know Jeff from Chroma and others over there.

Abhi: Yeah. The self-driving company is interesting. Kind of telegraphs what Replit's gonna transform into.

Shane: And now we have the quick hits. So new from Vercel Labs tsc-ts. This is from Chris Tate. Says TypeScript is written in TypeScript, then rewritten in Go. We ported it back to TypeScript, compiled it with scriptc, and it's two to four times faster than tsgo. All right. In the next version of Bun, bun lint is a 26x faster ESLint-compatible linter with over a thousand built-in rules. With over a thousand built-in rules. On October 21st, introducing Flint, Recursive SI's first model, a fast local coding model built with our automated research system. Best in class, fast local coding, two times faster than comparable models. Neon now has realtime, built by the team behind Electric. So you can turn any SQL query into a live query, joins and aggregates included, all inside Postgres, ready for agents. It's in public beta and available on all Neon plans. Firecrawl introducing free people data for ChatGPT and Claude. Give your AI agents access to 270 million plus company and people records in Alexandria.

Abhi: That's cool. Data to your agents. I mean it could be like a bunch of these little information graphs that they've already curated, which I think Perplexity was doing too. So yeah, this is interesting.

Shane: From Riverside, so Meet Riverside Agents, the first AI production team built only for video. Producer preps the session, editor creates the full edit, clipper cuts the best moments, and marketer gets it live. They're experts at video and know how to take your content to the next level. This is a cool video, and especially cool because Riverside uses Mastra. To build some of their agents. So that's the show, dude. Make sure to follow us on X at Mastra. Go to YouTube, mastra-ai. Give us a like, a share, subscribe, do all the things. I am @smthomas3 on X. Abhi is @abhiaiyer on X. Parting words or wisdom before we sign off, dude. Security, security, security. Secure your applications. Run scans. Dude, there's gonna be so much security software bought over the next two years. It'll probably be one of the biggest increases in expenses for companies. Agent-related, agent-powered security software. Maybe we should pivot, dude. And now we're a security company. Yes.

Abhi: As of today.

Shane: Yeah. If you are in security, keep doing your thing. Keep helping people. All right, everybody. Thanks for tuning in to Agents Hour. Peace. And we will see you next time. Goodbye.