The Most Terrifying Week in AI History...
Riley Brown and developer Ansh Nanda break down a chaotic week of major bugs in PHP, Node.js and GitLab, cheap AI-powered hacking and API key theft, plus practical steps for people and businesses to stay safe.
The gist
-
Nanda says a PHP bug gave attackers root access to servers, so the FBI and NSA urged patching or going offline, putting old WordPress blogs at risk.
-
Nanda says DeepSeek V4.1 Flash, at about 15 cents per million tokens, made mass hacking cheap, fueling stolen API keys, resold tokens and distillation.
-
For businesses, Nanda suggests 1Password service accounts for API keys and an always-on agent checking billing every 30 minutes, which he says saved at least $30,000.
-
For individuals, Nanda recommends checking haveibeenpwned.com, a password manager, signing in with Google or Apple, and passkeys, while Brown suggests reviewing authorized apps.
-
Nanda suggests having an agent like ChatGPT delete unused accounts, and argues US labs should teach Chinese labs to build model guardrails.
"I think another big tip for businesses is to use the 1Password service accounts, which basically have pointers towards API keys. So then you wouldn't store an API key openly in your server. You would just store a pointer to it... it doesn't prevent the hacks, but it makes it e..."
▶ Play at 16:286 creators recommend it, including Claire Vo, Jake Glacer, and John Coogan.
See all on the 1Password page"Another thing I recommend is having an always-on agent, whatever you like, even Claude Code, that's just running in a loop. And it just checks all your billing infrastructure cuz that's the main exploit."
▶ Play at 22:23108 creators recommend it, including Liam Ottley, Peter Yang, and Claire Vo.
See all on the Claude Code page"Number one, go to haveibeenpwned.com. You can go and put your email in there and your password and you can see if it's in any of these dark web public data sets... It's been around for like 20 years. I think it's created by some pretty great security engineers. So I do recomme..."
▶ Play at 17:15"If you use iPhones and Apple devices, you can also use Apple Passwords. I think that's also awesome."
▶ Play at 19:17"Other than two-factor authentication, use passkeys. Passkeys are even more secure than two-factor authentication cuz you need a physical device to authenticate yourself, like Touch ID or Face ID, which is even better than just an authentication code."
▶ Play at 20:35"You should ideally sign in to any services using your Google and Apple account as well, cuz they have the best security... if you just log in with Google, now you're trusting Google for that authentication for the password, and Google's probably not going to get hacked. So, I ..."
▶ Play at 19:22"You can actually use agents to go scour the internet. So, if you have ChatGPT, you just say, 'Hey, these are my emails. Go see if I've been pwned, and go to websites that I haven't used in 6 months, and delete all of them.' And it'll just log into all these websites and delete..."
▶ Play at 20:52159 creators recommend it, including John Coogan, Peter Yang, and Claire Vo.
See all on the ChatGPT pageWhat they recommend · 8 picks
Software & apps
6 picks · Ansh Nanda and Riley Brown
"I think another big tip for businesses is to use the 1Password service accounts, which basically have pointers towards API keys. So then you wouldn't store an API key openly in ..."
"Number one, go to haveibeenpwned.com. You can go and put your email in there and your password and you can see if it's in any of these dark web public data sets... It's been aro..."
"I got my Twitter hacked 6 months ago... that was because I had authorized apps that should not have been authorized. So this is another thing on Twitter, highly recommend lookin..."
Riley, Greg, Peter and Claire agree on 45 things
See what they all use, in their own words. Paid ads are left out.
See what they all swear by Or pick your own peopleAI tools
2 picks · Ansh Nanda ·Ansh's AI tools →
"You can actually use agents to go scour the internet. So, if you have ChatGPT, you just say, 'Hey, these are my emails. Go see if I've been pwned, and go to websites that I have..."
"Another thing I recommend is having an always-on agent, whatever you like, even Claude Code, that's just running in a loop. And it just checks all your billing infrastructure cu..."
Ansh Nanda
7 picks · guest
"I think another big tip for businesses is to use the 1Password service accounts, which basically have pointers towards API keys. So then you wouldn't store an API key openly in ..."
"Number one, go to haveibeenpwned.com. You can go and put your email in there and your password and you can see if it's in any of these dark web public data sets... It's been aro..."
"You should ideally sign in to any services using your Google and Apple account as well, cuz they have the best security... if you just log in with Google, now you're trusting Go..."
Riley Brown
1 pick · host
"I got my Twitter hacked 6 months ago... that was because I had authorized apps that should not have been authorized. So this is another thing on Twitter, highly recommend lookin..."
Also mentioned
Related episodes
Episodes covering similar topics
More from Riley Brown