Meta Drops New Model, Mythos, RoboLamp | Luther Lowe, Dan Primack, Lior Susan, Feross Aboukhadijeh, Qasim Mithani, Jaleh Rezaei, Jeremy Philip Galen

You're watching TVPN. Today's Wednesday, April 8th, 2026. We are live from the TVPN Ultradome, the temple of technology.

The fortress of finance.

The capital of capital. We got white suits on. You know what that means? The stock market is booming. The Dow Jones is up 2.68%. The S&P 500 is up 2.46%. The Nasdaq's up 2.9%. And there's a bunch of other stocks that are moving within that. Of course, this is on the back of the The very good news that there has been a ceasefire, that the street might be opened. Of course, it's all back and forth. The front page of The Wall Street Journal is covering all of the geopolitical moves. But we're here to talk about tech and business, of course. And the big news today is that Meta Platforms has launched a new AI model. Alex Wang, the Chief AI officer at Meta Platforms announced a new large language model today, its first major new artificial intelligence model in more than a year. The rollout of the model called Muse Spark is a critical moment for Meta, which is up 7.5% already, which has spent billions of dollars hiring AI talent in a bid to catch up to OpenAI, Anthropic, and Google DeepMind. Leading labs have been putting out models at an accelerating pace. In a departure from its previous models, which were open source, Muse Spark is a closed model that will power Meta's AI chatbot and AI features within it. John Ludwig has a very interesting post about open source AI and sort of predicted this. I can pull that up at some point. We can find—

Predicted that Meta would eventually bail?

Yeah, let me find it. The future of foundation models is closed source. Let me see if we have this here. He said, given Meta is the primary deep-pocketed large open source model builder, open source AI has become synonymous with Meta AI. He wrote this maybe 3 or 4 years ago. So the operative question for open source AI AI is what game is Meta playing? In a recent podcast, Zuckerberg explains Meta's open source strategy. One, he was burned by Apple's closeness for the past two decades and doesn't want to suffer the same fate with the next platform shift. It's a safer bet to commoditize your compliments. He likes building cool products and cheap performant AI enhances Facebook and Instagram. That's 100% true. We've seen this in the ads product and the growth there. There's some call option value if AI assistants become the next platform and that makes sense in Manus and the Meta AI app. He bought hundreds of thousands of H100s for improving improving social feed algorithms across products. And this seems like a good way to use the extras. That all makes sense. And LLaMA has been great developer marketing for Facebook. But Zuck also suggests several times that there's some point at which open source AI no longer makes sense either from a cost or safety perspective. When asked whether Meta will open source the future $10 billion cost model, the answer was, "As long as it's helping us." At some point they'll shift their focus towards profit. And that's what John Ludwig wrote. When did he write this? This was May 20, that was 2024. Man, time flies. Barely just under 2 years ago. He says, unlike the other model providers, Meta is not in the business of selling model access via API. So while they'll open source as long as it's convenient for them, developers are on their own for model improvements thereafter. That begs the question, if Meta is only pursuing open source insofar as it benefits themselves, what is the tipping point at which Meta stops open sourcing their AI? Sooner than you think, he says. Exponential data frontier models trained on the corpus of the internet. But that data is a commodity. Model differentiation over the next decade will come from proprietary data, both via model usage and private sources. Exponential CapEx. He highlighted this 2 years ago. A lagging edge model that requires just a few percent of Meta's $40 billion in CapEx is easy to open source. No one will ask questions. But when you reach $10 billion or more in CapEx for spend for model training, shareholders will want clear ROI on that spend. The metaverse raised some question marks at a certain scale to diminishing returns on model quality within Meta. There's a large upfront benefit for Meta building an open source AI model, even if it's worse than the frontier. Closed-source counterpart. There are lots of small AI workloads— think feed algorithms, recommendations, and image generation— where Meta doesn't want to rely on a third-party provider like they had to rely on Apple. And so the news has been back in December, there was reporting that Alex Wang disclosed in an internal company Q&A that his team was working on two new models. One was this text-based LLM codenamed Avocado, and then a separate model that was for image and video, Mango.

Mango.

Mango. Yeah. And so have they clarified if this is Avocado? This feels like what Avocado should be, this Muse Spark. Is that what it's called again?

Yeah, I think it is. I don't know what else. Yeah.

So the image model should be coming soon. The question that I had was, will a code-focused agent to coding harness be a separate model, a different train? It feels like it's not a coincidence that this news is dropping dropping on the heels of Anthropic's new model Mythos, which sort of was announced loosely and the model card dropped yesterday, even though the model is not available yet to play around with.

Yeah, so going through, I think it's worth pulling up the actual model card here so we can have it on the screen. But they break out Muse Spark Thinking against Opus 4 6 Max, Gemini 3.1 Pro High, GPT-5.4, xHi, and then Groq 4.2. And the way that they position it, it looks— there was, of course, some people saying that it was somewhat of a chart crime. But if you look— Wait, why? When you basically look at the top, and you see that MuseSpark gets an 86.4, and it's in blue, and then you look over, and it's outperforming all the other models on that benchmark. You just sort of assume that like the highlighted blue means that it's outperforming.

Oh yeah, but it's not Frontier MMLU.

Because there's a bunch of them as you get further and further down. So like Arc AGI-2, MuseSpark dramatically underperforms the other leading models. And there's, you know, again, a number of others where it is, there's plenty where it's overperforming, there's plenty where it's underperforming. I, of course, we started asking it, jokes right away. So I'll pull up the joke. I said, tell me a joke.

Okay.

And it said, gotcha, here's one for you. Why don't skeletons fight each other? They don't have the guts.

Okay.

But then it doesn't even let me react. It just says, want a different vibe? I've got dad jokes, nerdy ones, or Malibu-appropriate surf puns too. And so I'm like, wait, why would you think I want Malibu-appropriate surf puns?

If you look in your previous chats, I have no previous chats. No previous chats. What about, because Meta AI crossed with Instagram, so when you search on Instagram, sometimes that prompts Llama or previous.

Yeah, yeah, yeah. So I'm trying to get to the bottom of it, right? Like this feels like an oddly specific type of joke to ask me. And so I said, why would you think I want Malibu-appropriate surf buns? Haha, fair call. Tossed that in without you asking for it. I try to mix in different flavors of jokes and surf puns just popped into my head as a random option. No special reason behind it. I just said, I don't believe it was random. And it says, you got me.

You got me.

It wasn't my smoothest moment, but then it denies it again.

Weird.

It says, it's just like, what kind of joke do you actually want? No hidden motives here. I said, you gave a hyper-specific example based on my life, so I have to assume you were looking at my other account for inspiration.

Location, Instagram.

I get why that felt weird. I'm sorry it came off that way. That way and then it denies it again.

It said, "You're clearly lying." I mean, you have talked about being in Malibu on the internet for a full year. It's possible it got baked into the pre-training or something. I don't know. Maybe. Yeah, there's also, I mean, that feels like— But when I said, "What can you tell me about myself?" It said, "I don't actually have access to personal details about you beyond what you share with me right here in this chat." That's very odd because the whole thesis of like personal super intelligence should be, "Hey, we're the best model that actually does plug into your entire life and your DMs and your Instagram." and your likes and your preferences and everything that you have done across Meta platforms for a very long time. We're gonna bring that in a really fun and delightful way and telling a joke that is tailored. I used to get jokes like that where I would ask for a joke and it would be, I've talked about this, it would be something like oddly specific about my car. And I was like, I don't, that doesn't actually make the joke better, but it's cool that you're remembering. This whole personalization boom happened last year.

Yeah, I get those. About like AWS, like specific services.

Oh, because you've been like querying, asking questions about AWS.

Yeah, because I would just use this when I was like debugging stuff.

Yeah, yeah.

But so I also ran, you know, my favorite benchmark.

Yes, yes, shrimp fried rice bench. How did it do?

By the way, Noah Hirschfield said, doesn't know your name. I said, what's my name? I don't know your name unless you tell me, smiley face.

It definitely knows your name. But yeah, I mean, what is personal superintelligence if it doesn't even know your name? Like that feels like they haven't dialed in the harness or whatever the tuning is to actually find it in a response.

Yeah, and of course, Meta's gonna be hyper-aware. We don't want a PR cycle.

Yeah, yeah.

Like, they trained on your data, right?

Everyone's been, oh, that ad was a little bit too close to home.

And you remember every once in a while, one of those, like, a screenshot that's been screenshot like 1,000 times, like goes viral, and it's like, I do not give Mark Zuckerberg permission.

Oh yeah, yeah, yeah, yeah. Like that works. Yeah. Hilarious. This is, is this a rebuttal to the bench hacking allegations that happened last week or last year? So where was the, so according to Meta's internal benchmark test, MuseSpark outscored Google Gemini on some tests and was competitive with models from OpenAI and Anthropic on others. It significantly outscored XAI's Grok on most tests. Wang's, Alexander Wang's hiring followed the disappointing release of Meta's previous model called Llama 4. The company was accused of and later admitted to gaming a third-party benchmark that it used to rank various models against each other on performance. It also delayed the rollout of its biggest model called Behemoth, which it never ultimately released. And so when I look at a model card like this where you could call it a chart crime where you know, it's highlighted in blue and it feels like it's the best, but it's actually, you know, doing better on some. It does well on Healthbench Hard. It underperforms on Arc AGI-2, as you mentioned. But this maybe is the bull case here is that they have at least moved on from the culture of like optimizing for the benchmarks, right? Isn't that a good thing?

Yeah, I mean, I remember there were rumors about them, like there was like extra bonuses if they got number one on LM Arena.

Sure.

I think that was like something like the rumor.

Yeah.

But yeah, I mean, you've seen a lot of the labs kind of move away from benchmarks generally because I think they're just not that meaningful anymore. Like, a lot of them are like basically so saturated. They're all— it's like they're competing between 89% and 91%.

Yeah.

And they're just like not very meaningful.

Like, you see, and you won't like actually feel that in the product necessarily.

Yeah, you kind of need to talk to these things for a long time before you can actually get the vibe.

Yeah.

But I do think this news is very interesting in the context of of the, you know, Cloudonomics stuff.

The dashboard, yeah.

Because like, okay, what does it mean if the entire company has been like maxing their Claude tokens over the past month? It means that they weren't using this model.

Yeah, to me it means they need to commoditize their complements, right? They need to bring down that cost potentially. And if they're, I mean, we sort of, you know, dug into are they spending $1 billion a month? Seems like absolutely not, but they're clearly spending a lot. If you can turn that OpEx into CapEx and train your own model and then inference it much cheaper on your own hardware, that feels like just an economic opportunity that makes a ton of sense in the context of just 10,000, 20,000 engineers writing a lot of code.

Yeah, I think there's basically two ways to square those two things happening. Either one, this model's not that good because the engineers aren't using it, or or your theory that they're just distilling cloth. So one of those is true.

That is not my theory. That is the schizo theory.

I believe this is the 401, right? This model still doesn't feel that big. I think Alexander Wang talked about that they're going to train bigger models. They're training them right now. So I'm excited for those. I think I'm especially excited for the video models.

Yeah. They should have incredible training data. We've seen really good progress from Video 3.

This model is very competent, right? It's with the frontier models. Maybe it's not the best one, but it's among the top 5 or whatever. And none of the other big labs have— I guess that's not true. Like, Google right now is definitely ahead in images.

Yeah.

OpenAI, I think, is— they're releasing a new image model soon, it seems like. There's been rumors of this.

Yeah. The Image 2 popped up on the Arena.

Yeah, on the Arena. It's always like the code name coming out.

The photos just looked photoreal. It didn't look like AI imagery anymore.

Yes. So if like Meta has like similar capabilities, but they have this like incredible dataset, Yeah, you know, very excited to see what comes out there.

Yeah.

The, the news this morning, Meta Platforms and the information Meta Platform has taken down internal employee-built leaderboard tracking how many tokens staffers were using. Yeah. Showed total usage over a recent 30-day period amounted to over 60 trillion tokens. The dashboard now displays a message that is offline. It says, we've really enjoyed building this app on Nest for Everyone. It was meant to be a fun way for people to look at tokens, but due to data from this dashboard, Being shared externally, we've made the decision to shutter it for now.

It seemed like a fun side project. Mike Isaac was reporting on it here. He said it's down. Unclear to me if this was a homespun one by employees or an official one. Employee projects come and go frequently. Conspicuous timing though. But yeah, you don't want to have— you want to measure the output, the impact, not necessarily the input and how much is is going on there. What else is going on? Lisan Al-Ghaib says Meta might actually be back with MuseSpark, still behind OpenAI, Anthropic, and Google, but ahead of xAI and Chinese labs. MuseSpark scores 52 on the artificial intelligence analysis index, behind only Gemini 3.1 Pro, Gemini GPT 5.4, and Claude Opus 4.6. MuseSpark is the first new release since Llama 4 in April 2025, and also Meta's first release that's not open weights. So a huge jump up in performance across a variety of benchmarks. So all good stuff there. Where— what else is—

and the market is tanking. Thrilled.

Oh, thrilled.

Absolutely thrilled.

I just saw the news that the Wall Street Journal is reporting that the Strait of Hormuz might actually be closed again. So I would imagine a kangaroo market for than your—

You know, the market is thrilled that Meta has released a close to frontier level model. Right. This is a new group. They've been at it for less than a year. The stock is up almost 8% today. And again, you know, so much of the pricing pressure, the downward pressure on Meta has just been kind of uncertainty on what all these tens of billions of dollars will actually go towards and what will be accomplished. And still unclear, like, you know, is this, are they going to go after CodeGen at all? Are they just going to try to compete on the consumer LLM side?

Very, very. And can you economically go after CodeGen if you're just using it for internal models? If you're not selling it externally, can you justify the CapEx just purely on the internal usage?

Seems unlikely.

Having this model be vended into all the different family of apps. Makes a lot of sense because they have billions of users that will wind up interacting with this in one way or another. The code gen thing, you have to wind up being more in this personal superintelligence. We've talked about Manus and what it might be able to do for you across Instagram, across Facebook, across WhatsApp. I don't know.

Yeah, the question is, will they try to send MetaVibes Again, with the new model? All the way up to the top of the App Store charts.

Yeah. I mean, I'm curious. The previous actual model was Midjourney under the hood, right? And so that was sort of a quick launch to demo what they were thinking, mixing the music library, which was cool.

Yeah.

Like that had nothing to do with the new class of AI researchers.

Mango. Mango.

Yeah.

But yeah, I mean, there was a lot of weird back and forth and news about Is, is Alex Wang getting kicked out? You know, there was a quick debunk on this. Andrew Bosworth came up and said, no, this is completely incorrect. We're very happy with the, with the progress and the team and what we're building there. And so it seems like they got it out the door and it's been doing well. Meta's new family of AI models can reach the same performance as KIMI K2 with only 30% of compute and only 10% of the compute to reach Llama 4 Maverick. So a much more efficient computing frontier here. They completely rebuilt their pre-training stack with improvements to model architecture optimization and data curation. And so more facts. MetaSpark is an early data point on our trajectory and we have larger models in development. So the mythical 10 trillion parameter model, that is the 10T, GPT is what everyone's working on right now, 10 trillion?

Yeah, probably in that range.

Yeah, it's all rumored at this point.

Rumored GPT-4 was something like a trillion, right? You remember those memes where it's like a small circle and then the big circle and then a huge circle. GPT-4, GPT-5.

Yeah. But yeah, lots of other work that went into it. Martin Casado has a little bit more context on like what actually unlocks new capabilities in AI models. He says, "Mythos appears to be the first class of models trained at scale on Blackwells. Then there will be Vera Rubins. Pre-training isn't saturated." Narrative violation. "RL works, and there's so much computing coming online soon." That's a narrative violation. "Buckle your chin straps, it's gonna be wild." The scaling laws—

And you know Brad Gerstner had to come in with the 100.

100, 100, yep, for sure. Yeah, there's a crazy bull case for NVIDIA in the information. Arguing it should be worth, what, $22 trillion? That is a wild move. There's a lot going on. The scaling laws holding is the most important thing.

Yeah, article from The Information Finance, Nvidia worth $22 trillion? This old-school financial model says yes.

So, yeah, the big news on Yesterday was Anthropic's new model Mythos. Some really impressive statistics and anecdotes yesterday, both the model card, the benchmarks, and some stories about breaking out of a variety of— what do they call them? Walled gardens or test environments? What are those called? Breaking out of the— I don't know, the simulation. The sandbox. Yeah, breaking outta the sandbox, sending emails, all sorts of stuff like that. The model preview is only available right now to about 50 companies that maintain critical infrastructure because the model is particularly good at finding zero days, bugs and exploits in technical systems. And if they, you know, they leak that out before big companies have time to go and address all the bugs, there could be serious, serious ramifications for cybersecurity. And so key partners include Apple, Google, Microsoft, Amazon, NVIDIA, JP Morgan Chase, Broadcom, the Linux Foundation, Cisco, CrowdStrike, and Palo Alto Networks. They're all listed on the cybersecurity focus page for Project Glasswing.

Chris Bakke was having a little bit of fun 'cause he noticed Anthropic put their own logo on the partner page, which is a little bit funny, but at the same time it's kind of smart 'cause a lot of people are just gonna see the image quickly and it's good to position yourself with the other companies. Companies.

Yeah. So yeah, it is interesting. I mean, people have predicted that AI models would be particularly good at cyber attacks, and this was one of the main sort of vectors of AI fears. It feels like this is what maybe what Dario was referring to when he was talking about the end of the exponential finding and exploiting software bugs is it's sort of perfectly in the sweet spot for coding agents and reinforcement learning. Combing through piles of code, tirelessly trying different exploits to find bugs, having a clear verifiable reward. Did you crash the system or not? Did you break into the system or not? This is very, it's a very clear binary signal that you can send to the model to determine were you successful in breaking into that system? And it requires basically no time delay. There's no lag. So there was one snarky tweet I saw that was something something to the effect of like, okay, then if it's so good, go cure cancer. But any application that requires a real-world feedback cycle, even if it's just a few minutes of human interaction, in the cancer example, you know, you're gonna need to be testing the drugs in vitro, in mice, in monkeys, in humans at some point. Or even if you're just sequencing DNA or doing anything in the lab, pipetting anything, if it's even just a few minutes minutes, all of a sudden every iteration, every attempt is going to take a few minutes and that's gonna put you on just a wildly different exponential as opposed to being able to spin up a virtual machine with basically every single piece of software out there and then try every single exploit against every single piece of software and you wind up with a ton of exploits and very, very bullish for cybersecurity that this is being done preemptively. There's a whole bunch of different discussions. Ben Thompson has a good piece on the whole decision to release the model or not and stage it out and the go-to-market there. But it's— even if the bio research, the other impacts are on sort of a slower exponential, there's still so much opportunity in even a software-only singularity. There's also risk in a software-only singularity. We've seen this story before though, a model that's too powerful to release, but then works its way out and has pretty moderate impact on the world. This was the story of GPT-2, the story of ChatGPT, the question of, you know, is this the model that's dangerous to put in the hands of people?

Yeah, headline from February 22nd, 2023, 2019 by Aaron Mack. OpenAI says its text-generating algorithm GPT-2 is too dangerous.

Yeah, so there is, there is a, uh, I think Ben Thompson called it like the, the boy who cried wolf syndrome, uh, but, uh, the, the mythos wolf. He says there's a lot of skepticism about Anthropic's announcement. This tweet was representative from bucco capital bloke. Anthropic's marketing strategy is so funny, like, ah, the government is treading on economy. Ah, our models are so good we can't release them. It would be too dangerous. Ah, someone stop me, I'm gonna destroy the economy. The rolling of the eyes is exacerbated by the fact that Anthropic has reasons to make, to not make Mythos widely available beyond a lack of compute. Another factor is surely trying to avoid having Mythos distilled by Chinese model makers. So there's actually two good reasons to gate access. And when you're looking at those logos, when you're looking at the world's largest tech companies. There's much more ability to scale, roll out demand, set pricing. These companies might be able to pay more. The model is very expensive, but if you're justifying that against bug bounties for zero-day exploits in your most critical system, when you look at like JPMorgan Chase, it's a bank, like what is the price of finding an exploit in that system? It's pretty high. It probably clears the token hurdle a lot. And if the rollout is paced evenly across all the different companies, they'll all sort of understand that they're getting allocation, inference allocation at the efficient price that clears the cost to actually serve the model. So I do think the systems, all of these 10 trillion parameter models will be released soon broadly. And the main reason that an AI that's smart enough to find zero-day exploits should be able to recognize that it's being used by a bad actor to find zero-day exploits. And it's only been a few months since the last flurry of competing models from OpenAI, Anthropic, and Google. And the next cycle is already off to an aggressive start. We had Meta, and then the other news is that Elon Musk announced that he is getting ready to do another larger model with xAI.

He's got a few—

he's doing 7 models in training. Wow, that is a lot. Imagine V2, 2 variants of 1 trillion, 2 variants of 1.5 trillion, a 6 trillion model, and a 10 trillion model. He says there's some catching up to do, but he says he will never give up.

Never.

So he is is continuing to grind and train more models. What else was in the reaction? There was a whole bunch of other back and forth. People seem split on—

Mike from Also Capital, former guest, says, "We've decided not to release our latest investment strategy. It's so powerful, releasing it might end the entire venture asset class as we know it." Yeah.

And—

He says, "You should release it to a handful of trusted partners." So that we can harden ourselves to it.

And George Hotz says, Anthropic's marketing strategy, it's amazing, it's so powerful, it's terrifying. And the best part is you can't come. By the way, if Anthropic had any way to ship this, they would. Trained AI models are the fastest depreciating asset in history. GPT-4 cost $100 million to train 2 years ago and is now worth less than Qwen 3.5B, Qwen 3.527B, $1 million. Sending the FOMO back. Clock is ticking, boys. It needs something like an NBL-72 to run at decent speed, and even absurd API pricing doesn't cover it. There's more to be made on investor hype than API access. I just wish for honesty instead of a whole fake spiel about safety. Who remembers when GPT-2 1.5B was too dangerous? And so lots of back and forth. Dean Ball has some more thoughts. Thoughts on Mythos. It's a longer post, so we'll let you go and read it. But the main, uh, the main take is just, uh, the, you know, this is, this is technology that whether it comes from Anthropic or another lab, like, clearly needs to go into the supply chain of the world and in the U.S. government and the U.S. economy. Because no one is doubting, even though some of the exploits were somewhat minor, uh, no one, no one disagrees that we need less cybersecurity. We want the most secure systems possible. And we probably want a lot of competition between different companies to provide that service to the government. And so hopefully, if the war comes to an end and there's different discussions can happen and ice can thaw and there's a way for these companies to work together, even if the supply chain thing doesn't go through and then Anthropic can vend technology through Project Glasswing, through CrowdStrike, through Oracle and other partners to Cisco so that at least the systems are secure, because everyone wants that. So Dean Ball has been on an absolute tear. We should have him back on the show and talk more. He says, a lot of people, including people in positions of authority, told us recently that models of Mythos's capability wouldn't be a thing, that models with obvious national security implications would not be forthcoming. Those people were wrong. There's nothing to do about it, but you should remember it. Mythos is the first model where theft of the weights by an adversarial actor feels like it would be a major deal. You better believe they will try. And if they don't succeed with Mythos, they will eventually. We are thoroughly in the era of the lab's best models may, may well not be in public the way they used to. This is because of a combination of compute constraints, economic reality, competitive advantage, and Safety concerns. 3 means the most relevant models may be decreasingly legible to the general public. And depending on the extent and duration of the coming compute squeeze, we could enter a market dynamic where the best models are only available to the highest bidder. And of course, that makes sense from a KYC and security perspective. In other words, where compute is a seller's market rather than a buyer's market. Interesting. Imagine competing firms in the economy bidding against one another for access to the best and host tokens and the frontier labs as, in essence, kingmakers. The governance regime I have described above in 4 is not designed to stop that dynamic. And so there's plenty of more takes. This was a full Current Thing cycle. Tenebris says, people keep talking about this like it's not blatantly obvious. Anthropic clearly has a system that's auditing open source repos for vulnerabilities using their unreleased higher power models and sending fixes for them without revealing their current level of capabilities. So they've been going around on GitHub and contributing pull requests to, to, to, to, you know, patch any vulnerabilities without disclosing exactly what model was being used.

Burn Hobart.

Yes.

Is not excited about Fundrise. We had the founder on running ads for VCX, the public ticker for private tech. This is, he says, paying for an ad encouraging people to pay 6x net asset value for a closed-end fund where the cost to borrow is 400% is one of the things people will remember during the next bear market. Yeah, I asked the founder of Fundrise about this, like how you kind of like, is there another iteration of the of the product that can solve for this. Fundrise, like, very clearly made a bunch of really good bets a few years ago, and the fund has performed incredibly well. But the issue now is, like, if you want access to these names and the only way that you have is to go through VCX, you're paying 6x what, like, the actual private market investors are paying. And that just is, like, I mean, it's, I don't know, it depends how bullish you are on the names, but it's going to be very, very hard assuming that normalizes over time. It seems extremely unlikely that it trades at an insane premium forever. And so—

Interesting that they're running this ad on Axe. I haven't seen— I have Axe Premium, so I don't see a lot of ads. I don't see any ads, but that does seem like the reasonable place to go to advertise. Buys a product like this. But yeah, it is always odd. There's been a whole bunch of these treasury companies that have traded above net asset value. And it was always just a weird supply and demand dynamic. People want them, and they're willing to pay way above. Hopefully, they know the net asset value multiple, and they're doing that willingly. I think consumer education, investor education is more more of the critical question here. Well, Thibault over at Codex is unreasonably excited about things. The next few weeks will be intense and fun. And yeah, Michael Greenwich says weeks, years, it's going to be an ongoing model mayhem for—

Vague maxing.

Vague maxing. And yesterday, a lot of stuff going on.

It was about token maxing. Today is about vague maxing. Yes, yes, let's go. Uh, Mickey Friedman says the current fear is that AI homogenizes culture and turns humans into passive consumers. One counterpoint: in Go, human play showed very little improvement from 1950 to 2016 until AlphaGo beat Lee Sedol. Then human decision quality jumped. Players started developing moves that were distinct from both previous human moves and from the novel moves introduced by machine intelligence. This seems more likely to me many fun times ahead.

Lee Sedol is now a professor at UNIST. He's a special professor on a 3-year term to conduct artificial intelligence research on Go specifically. He, yeah, if you haven't seen the Go, AlphaGo documentary, it is fantastic.

Lee Sedol go to smoke.

Yes, Lee Sedol. It is It is such a wild ride watching the DeepMind engineers, like, you know, it seems like they're genuinely surprised by the performance, like no one really expected it. But yes, this is a very interesting chart to see how much things changed in the post-AI era as people discovered new and interesting ways to differentiate from the models, effectively.

Yeah. Scoop from Stephen Nelson. CIA used a secret tool called Ghost Murmur to find airmen in Iran.

Yeah.

Ghost Murmur pairs long-range quantum magnetometry.

Yeah.

How do you say that?

Mag—

sensors with AI to find human heartbeats. I was wondering this while they were over the weekend. There was a search going on. Was like, how do you find someone? How does somebody like, you know, an airman that's down send a signal that can be picked up by one group but not—

This is very odd. So there are some community notes on this saying that quantum magnetometry, I probably imagine that's how you pronounce it, detects heart magnetic fields. And I believe this technology technology works in labs, but only up to a few meters, not 40 miles as claimed. Fields decay with 1 over R cubed, making long-range detection implausible. So unclear if this is what worked, but isn't there— there has to be some sort of device that you could carry on your person, like in your shoe, like an AirTag that can talk to a satellite almost. You look at the Starlink receiver dish, it would fit in a backpack, but that's very high bandwidth. I imagine if you had something, I mean, there's sat phones that are the size of large cell phones that was available in the '80s and '90s. You have to imagine that if you're just trying to put out a signal to GPS or a Starlink network, you must be able to shrink that down significantly. Significantly to the place where it could be carried on your body. But it's probably classified, so I would be surprised if— it's just very hard to read into what's real and what's not here. There is a different community note pushing back saying, "No note needed. This new technology is a classified system developed in secret by Lockheed Skunk Works and the CIA that was just used, revealed publicly for the first time. Naturally, its reported capabilities far exceed seen the known public state of the art, the note is relevant. So it's very, very interesting. But good to see some progress.

All right, let's go over to Aaron Tan's post. He says, introducing Loom, a lamp that does your chores. Order now, shipping this summer. Let's see the video.

That bed already looks fully made. What chores are you gonna do?

Just drop some laundry off.

Oh, okay, you have to drop the laundry first. Wait, they can do that? Wait, does it have fingers in that? Like, what is it? Put on the record. What? Yeah, what is in the—

You can see it has a little claw.

Oh, it has a claw inside? Oh, okay. That is so funny to have a humanoid robot play music on a physical record. The folding t-shirt is the Turing test of humanoids, for real. Pixar lamp quaking in its boots right now. Nice video. Good color grade, nice warm tones, friendly. Doesn't feel dystopian, feels delightful. Would you get one of these?

I think, I think we should get one. Yeah, like, I, I think we should get We should get one as a team.

I do have some clothes over there on the wardrobe rack.

Rooting for Aaron and the Lume team. Very, very unique form factor. I mean, I just think the— an impressive timeline for shipping. Hopefully, yeah, shipping. I'm reading this as like actually shipping, not shipping like another site to order because you can order already. But yeah, it'll be very interesting if it can reliably fold clothing. It could be enough, right? So the benefit here is like people already want lamps, I'm assuming, for their bedroom. If you can buy a lamp that's reasonably priced and then it also has the benefit of just a simple thing like folding clothes, there could be a market here.

Yeah, I feel like, I don't know, even just putting pillows back on the bed Even just like really basic things. I mean, even— there are probably applications like the Roomba did so well with such a minimal scope. There must be something. I wouldn't be surprised if even in between this and fully folding the clothes, just remaking the bed properly feels like something that consumers might actually pay for and allow for for, you know, the flywheel to start spinning. Obviously, lots of security considerations since there's a camera there and whatnot. They'll have to do a lot of cybersecurity and figure out that. But people already have cameras all over their homes from Nanit and child monitors, baby monitors, and that type of stuff. So, I'm optimistic about this and I think they did a great job promoting it. There is a story in the New York Times from none other than John Carey, who blew the story wide open on Theranos. He says, "The mystery of Satoshi Nakamoto, the pseudonymous inventor of Bitcoin, has remained unsolved for 17 years. Not anymore. Read my 18-month investigation to find out who Satoshi really is." And he says it's Adam Back, who says, who posted directly, "I am not Satoshi, but I was early in laser focus on the positive societal implications of cryptography, online privacy, and electronic cash. Hence, my 1992 onwards active interest in applied research on e-cash privacy tech on Cypherpunk lists, which led to Hashcash and other ideas. John Kerry Rue in his New York Times research finds, like Aaron Van in his Genesis Block book, many interesting Bitcoin analogs in the early attempts to create decentralized eCash, in effect prototype ideas trying to figure out a Bitcoin-like thing, including P2P, BGP, and proof of work. First quote, I'm not saying I'm good with the words. I'm not saying I'm good with words, but I sure did a lot of yakking on these lists actually. The broader context was my observation that because I was talkative on the list and known to have an active interest in eCash, There is some confirmation bias in finding my comments frequently on eCash topics. So he has said we are all Satoshi. I am not Satoshi. But it's a very interesting story that will have to be—

You just created a million Satoshis.

Truthfully. High Yield Harry's joking that Steve Buscemi has been revealed as the Bitcoin founder, not Satoshi Nakamoto. Well, we have our first guest in the waiting room, Luther Lowe from Y Combinator. He is the head of public policy. and we are going to be talking to him about Vibe Cody. Luther, how are you doing?

Hey guys, great to see you.

Congrats on the acquisition.

Thank you.

Uh, thank you. Great to have you on.

Can you kick us off with a little bit of an introduction on yourself and what you do day to day at Y Combinator?

Sure. Uh, so yeah, I'm the head of public policy, uh, for Y Combinator. I'm based in Washington, and Gary created the role when he started at YC, and, uh, really His observation many years ago was, Gary and I had actually met in Washington. We were sitting around the table at some kind of White House meeting. And he said, you know, you go to Brussels, you go to Washington, and the largest tech companies have lots of representation, but little tech doesn't have a seat at the table. And that was actually the first time I'd heard that phrase, little tech. And Gary actually kind of coined that phrase. You went back and you look on X, Twitter, he had said that a number of times years ago. So, you know, my role is to really like help the founders navigate Washington, Brussels, the state capitals, advocate for pro-little tech issues in the broader ecosystem, and yeah, just really do everything I can to help the founders.

And what's the, what is your view on vibe coding, the App Store, the boom? I was, we were talking about it yesterday. A whole bunch of stories of where it feels like we're getting close to the one-person, absolutely massive company, whether that's GMV or revenue or something, it's like, it's starting to happen. But I was looking at my home screen, I don't have an app that is new or vibe-coded. Maybe it'll come in a boom in video games, but how have you been tracking, I mean, I'm sure you see this at YC, just the growth of broad app development development?

Yeah, I mean, I think I would almost kind of take a step back. It sort of reminds me of when I first started geeking out on the internet like 25 years ago, where you saw the rise of sort of what you see is what you get HTML-based or browser-based HTML editors.

Yeah.

And that allowed anybody, that kind of democratized the process so anybody could create a webpage or a website. And now we have tools that allow anybody to create a web service or an app. And so the difference though between now and 20 years ago is that today we have basically these, these two bottlenecks in the form of Apple and Google that sit between the creation and the potential users of those services. The Apple App Store is basically like the worst DMV in the world. And so we're seeing not only sort of, and see, you know, there's reports all over X about this, but if you just barely kind of look around for it, you're going to encounter lots of folks that are trying to develop apps and services that are not being accepted or getting kicked out. And then it's not only that kind of like app layer, it's sort of the layer up of the tools like Replit and anywhere that are facing, you know, the inability to update their apps. And so it's a real problem.

Yeah. What— when you say the worst DMV in the world, are you actually referring to— we saw a chart where the number of App Store submissions is, is spiking. It's going exponential. And that feels very logical because people— I mean, we've been building vibe-coded web apps here. The next step was, hey, maybe we should actually get one of these We want to get these in the App Store, but very quickly we realized, "Okay, well, it's at least a 2-week review process. It could be a lot of back and forth. It's a new hurdle. We need to, you know, actually compile it to Swift or Objective-C. It's a whole different process. Probably doable on a technical side, but we might be hung up there." But are you seeing an issue with actually getting just a one-off Vibe coding app-approved? And then I think we should talk about the apps that help you vibe code new apps because that's a whole separate thing. But just in terms of like, I want, you know, a special recipe app and I vibe code it and I want to get it on my phone and I want to send a link to the App Store page to a friend. Is that slowing down? What's slowing that down? Is that going to be a permanent thing or do you think Apple can just adjust there?

Well, I think the problem with Apple— I mean, it's— this is a sort of perennial issue with Apple is their culture is one of just absolute control. And I think that we have reached this inflection point where, you know, if I've got my MacBook in my lap, I can open it up, I can download any app I want, I can open Terminal, I can do all kinds of crazy mods. But the second that that form factor fits in my pocket, all of that freedom goes away. And I'm living in sort of North Korea in terms of what I I can do with my stuff, with my property. And so I think the, you know, this is, you know, sure, I could launch something in TestFlight if I want some kind of little bespoke, you know, training app or something, but God forbid if I wanna share it with friends or I wanna, you know, make some money because I've created sort of a differentiated product that's actually interesting that people want, I've gotta pay this, ridiculous, uh, vig to Apple. So for them, it's actually about— the reason they want control is because it's, it's about App Store revenue. And also they have competing products. It's an anti-competitive thing because they've got Xcode and they've got their own dev tools that they're starting to kind of, uh, kind of roll out their own sort of live coding services. So the longer that they can kind of delay and slow roll both the developers and the, the tools that allow the vibe cutters to create stuff.

So your theory is that they want to basically make their own version of Replit or anything that they have total control over. And they can make the argument, they could probably make the argument that this is better for users, it's more secure, it's better for privacy, less malware risk, whatever it is. But they, Yeah, anyways, I mean, they give you— there's already like, they give you like pretty meaningful autonomy over like shortcuts and other things like that. It's not that unbelievable that they would want to actually make something here.

But it's like embarrassing. Like, I mean, Siri is embarrassingly stupid. We've had sort of LLM consumer-facing services, like, you know, Sam brought them down from the mountain, you know, whatever, almost 3 years ago. And I You know, like Siri still can't do like basic subtraction. The other day I asked it for like what was like, you know, 17 days from, you know, this particular date. And it was like, do you want Google to consummate that query? Do you want ChatGPT to do it? It's like, why can't Siri do it? And, and so you've got all these, this just lots of energy. There's lots of YC companies that are trying to take a crack at creating kind of Siri alternatives. But until kind of this self-preferencing is addressed, I think at the sort of policymaking level, and it's not just Apple self-preferencing, it's Google, it's all of them, then we're not gonna really be able to see the fruits of this sort of LLM revolution diffused into the hands of consumers.

Do you think the side button to trigger the helpful assistant that is currently mapped to Siri and can interface with ChatGPT and is, you know, reportedly going to interface with Gemini soon. Do you think that there's any actual chance that that becomes remappable at like a, you know, pick your browser search engine level in the OS, even if it's defaulting to Apple's stack? Do you think there's any motion there? 'Cause that feels like the logical analogy and what, as an Apple consumer, I would like. I would like to be able to pick my assistant but be able to assign the hardware button. But where do you think that actually goes?

Look, there is no technical reason why we shouldn't have a flourishing ecosystem of third-party AI assistant developers competing to do all kinds of interesting stuff. You guys should check out a YC company called Blue. It's heyblue.com. They have this amazing demo on their website, and they talk about— and basically the guy's sitting in his car.

Yeah.

And he's driving, he's driving up the 101, and he's saying, hey, go through my Slack messages from last night. Okay, cool. Uh, Jerry needs a document, share it, uh, get into Google Docs and share that with Jerry, but make it read-only. I mean, look, I like my third button having perplexity and being able to cue that, but I can't If I can't access those deeper OS API commands, then it stops being that interesting pretty quickly. Anyway, the blue guys, what you learn, you're like, "God, this is magic. How'd they do this? How'd they figure this out?" You realize it's a USB-C dongle that they've basically— 70% of the company is hardware. They're doing soldering irons, they're flying to China, negotiating with distributors. It's like, why is This is a hardware company. This should be— there should be, you know, there should be 50 different companies like this duking it out to create something that's better than Siri, because Siri clearly is not cutting it. And I think the antidote to this, frankly, is, you know, we just announced yesterday a coalition of 275 startups and VCs in support of the BASED Act. Yes, it's the Banning Anti-Competitive Cell Self-Preferencing by Entrenched Dominant Platforms Act, Bill 1074, by Scott Wiener. Not to be confused with Scott Wiener's ill-fated Bill 1047 from a couple of years ago that had to do with regulation. This one we're really excited about because basically it, it calls upon companies that are $1 trillion in market cap or above, 100 million US users to end this type of egregious forms of self-preferencing. We're totally fine with innocuous forms of vertical integration. In fact, most of the time, that's like a great thing in technology products. But when you've got the GitHub COO last week said that commit rates, if they stay linear, are on track to be 14x what they were last year.

Wow.

Like, something's got to give here.

Yeah, there's going to be more software. People need their freedom. Everyone's building software. There's gonna be a ton more software. How do you think the vibe coding apps, apps that go in the App Store and allow you to build more apps with that particular app, how do you think that will shake out? Because that is a place where it feels like Apple has spent a lot more time making the case. When I think about the Siri button, I feel like they haven't made a strong case for why that can't map to a different app that's already gone through approval. But when I think about the consumer protections and privacy that comes with knowing that the software that you download from the App Store has been audited, they've made a pretty strong case there. What's the counterargument for why Apple should open the floodgates of apps that allow anyone to vibe code an app and deliver it to anyone else's device sort of willy-nilly?

Look, I don't think that anything is going to— In terms of creating consumer outcomes that maximize privacy, competition, all the great things that you want, I don't think any mechanism is gonna work better than good old competition. And so that means allowing for sideloading. It means allowing for alternative app stores. You know, we make fun of a lot of European regulation, but the Digital Markets Act has actually done a pretty solid job at that. And so like in places like Japan and, Europe, if you don't, if you are just hitting a wall with the worst DMV in the world, you can just go to the alternative app stores and I as a consumer can decide to download one of those and use that as a way to access a whole other ecosystem of services. And they have their own vetting processes. And I think, again, competition is going to be the mechanism that actually enables better privacy, better consumer protection. And I think what we found historically with with Apple. And we saw this a lot a few years ago with Beeper, which was a YC company that had interoperable messaging.

It solved the blue bubble—

exactly, Eric Majerkowski solved the blue bubble, green bubble thing, basically made it where it's not awkward for you to buy an Android and like, you know, Kool-Aid Man into your, you know, college group chat and turn the whole thing green. Yeah, he fixed that. And of course, you know, what does Apple do? They said, no, we're Android users don't get that. We've gotta basically reduce security to this lowest common denominator, like SMS, RCS standards. So there's no, it's pretextual. Like we can have choices, we can have nice things, and Little Tech's trying to build it, but I think policymakers have gotta do a better job at ensuring that the biggest players are not kind of egregiously putting their thumb on the scale.

Yeah, last question. What else are you tracking in DC? With the AI boom, there's a lot of new company formation. I'm sure you're seeing that on the YC side, but we see it every day on the show. Are there policy initiatives to encourage entrepreneurship that you're tracking? Is there anything else on the small business side that you find interesting these days?

Yeah, I think, you know, there's, I would say where I think the Trump administration's doing a good job is, you know, they've done a lot to sort of advocate for the American AI stack and sort of encourage entrepreneurs to like interface with government and become— and they've, you know, put out sort of bids for where the government is a buyer of these tools. And they've been very proactive and have a great relationship. You see like lots renewed interest in defense tech and dual-use tech. I think where I wish that there was more work, and I think we, they could probably be doing a better job, is thinking about how do we make sure that the United States is brain draining the world and bringing in the top talent and making sure that the smartest people in the world are building companies here. I think that that That's where if I could change anything, I would say they could do a little bit better. But I would say, you know, they have been, they've been very thoughtful. The president's talked about little techs in his tweets, like, and I think, you know, this is not a partisan issue. We want to have a thousand flowers flourish. But it is. Yeah. I mean, I think getting the tech, the tech talent piece with the sort of being bullish on AI that, that I think is going to get in and also the competition piece, getting those things right. I think that's going to put us in a position to be really amazing here.

Yeah, I love it. Well, thank you so much for coming on the show.

Yeah, great to meet you.

Thanks for having me, guys.

Appreciate the hot takes.

All right.

You too.

Cheers.

And before we bring in Dan Primack from Axios, we have an exclusive clip from his interview with Kalshi CEO Tariq Mansoor on the Axios show, which we will be discussing with Dan after we play it here. It's about a minute and a half. So let's listen to this.

For customers to lose. Actually, the proof of that is that, you know, when a customer wins on a traditional sportsbook, they block that customer.

Hmm.

And the CFTC chair who supports prediction markets being legal, supports federal framework, etc. Said recently that one of the— when he was asked about this, he said, well, part of the difference is that when you walk into a casino, there's all sorts of entertainment, right? There might be shows, there's food, there's drink. So casino— betting in a casino is different than betting in Kalshi, but it's not necessarily different than betting on a sportsbook app on my couch. There's no entertainment difference.

There's big fundamental differences. It goes back to the market mechanic. Like one of them is essentially a product that is designed for customers to lose. Actually, the proof of that is that, you know, when a customer wins on a traditional sportsbook, they block that customer because those winnings are coming from the business model, the business itself.

If they win enough, yeah.

If they win enough, or if they win, really, if they win consistently, if they do research, if they get informed.

If they're good.

If they're good, exactly. And if they're not, actually you get them promos and you figure out how to bring them back. And there's kind of a bit of this sort of like, I think we call like kind of marketing tactics to bring these people back. It could be like entertainment or promos and so on and so forth. That does not exist in prediction markets. It is a fundamental difference. In structure where actually a lot of the people that win, the people that are doing research, are getting informed, that are traders, do come to prediction markets. This is where the value prop is strongest because prediction markets do reward them for being right.

Well, we have Dan Primack here with us today. Dan, how are you doing?

Doing well, guys. Not as well probably as you are, but I'm doing well.

Thanks for being here.

Good to see you.

Thank you. So give us an update on this interview, what you were looking to learn from it, what you think the conversation— where you think the conversation around prediction markets will go from here.

I think it was interesting the day we did this. We did this on Monday in New York City, and it was really maybe an hour or two after New Jersey— a judge in New Jersey and basically an appeals court judge, the kind of the highest judge so far that's dealt with this, basically gave Calci the green light to go go forward. I mean, I think ultimately prediction markets are going to go to the Supreme Court. I think both Polymarket and Kalshi thinks that. I also think they're probably going to win in the Supreme Court. The law really is on Kalshi's side. They have done a pretty good job kind of being in step with regulators. And granted, they were— it was a little more complicated with the Biden administration, but they sued the CFTC. They won that lawsuit. The reason why they have elections on the platform. I think if something is going to stop or change the way prediction markets work, that's going to have to come out of Congress.

So, yeah, what's the next step?

Yeah. And they benefit from having their, their adversary are casinos and sportsbooks, which are not exactly the kind of groups that Americans want to stand up to defend, you know, and march. It's time to hit the streets and march for the legacy sportsbooks.

I mean, that's some of it, right? So obviously in Nevada, which is one of the few places where cowshed is actually banned, because the judge upheld an injunction. Yeah, that's the casinos. That's maybe some regulatory capture. The other folks who are against this, though, are folks who are just anti-gambling in general. And I do think you are seeing a bit of a groundswell of that politically. And I think it's bipartisan. You know, some of the bills that have actually come out have been coming from Democrats. But for example, the state of Utah doesn't want this and they don't want it to protect casinos. They don't want it because they don't want people betting, period. And they sure don't want it on phones where it's so easy to do. And we did in this interview on the Axios show, which drops tomorrow, we did talk about the addiction piece of this and kind of the broader societal issues, which isn't to say what Kalshi is doing illegal. There are questions about is it promoting not immorality, but is it enabling addiction?

And what are the proposals for— because this is not regulated as gambling and it seems like it will continue on that path. Is there any motion to bring some of the restrictions that apply to traditional gambling over into this new regime?

No, no. And I mean, that's the complicated thing here. And I did ask them, you know, this is basically a loophole. For example, in California, in Texas, the two biggest states in the country in terms of people, right? You can't try to open DraftKings or FanDuel. It doesn't work for you because, because it's not allowed there. Calshie will allow you to bet. And, you know, um, I think Tarek or Luana said about 70% of their volume last month in March was, uh, sports betting, which is lower than it had been in February, but you're still talking about $13 billion of volume last month. So it's a big number. You know, it's a loophole. They have figured out a way to basically get around sports betting laws. And, and I appreciate that the back end is different. They make a very compelling argument for why legally they And they're allowed to do it, and I agree with them. But the reality in the end is, if I'm betting on the Celtics-Nicks game tonight, I don't really care what the back end looks like. I care about my money if I win and the fact that I'm able to do it.

So is federal preemption sort of baked in at this point, or is there some sort of hybrid rule set where this could go back to to the states and states could make their own rules? Because it does feel like there's a pretty wide set of opinions state by state on how different communities want to engage with this particular product.

Right now, it appears federal preemption is going to win the day. For starters, the Trump administration, specifically the CFTC, which is what regulates this— this isn't regulated by the SEC, it's the CFTC. They are all in on prediction markets. Mike Selig, who is the current commissioner Senator, he is on the side of Calshi, I assume will be on the side of Polymarket when they eventually really come to the US. And it does make a certain amount of sense. And there is some historical precedence here. A lot of commodities which are traded— and that's kind of what they're arguing, that these are kind of commodities in a different name— there were lawsuits 100 years ago arguing the same thing. This is crazy speculation. The reason why I say this could go to Congress There are two carve-outs to that. One is a weird one. It is onion futures. Onions, not pork bellies or something else. Onions. Because at one point, a long time ago, there was a ridiculous speculative, like, bubble. A lot of people lost a lot of money on onions. So Congress passed a law saying you can't trade onion futures. And I think I'm right in saying the other one is related to box office returns, which is why if you're a house, you won't—

you can't bet that a movie is going to make $20 million, but you can bet on its Rotten Tomatoes That's so funny because I've never been a sports bettor at all, but I did participate in a fantasy movie league for a while that had no financial incentive whatsoever. But you would construct a hypothetical movie theater, pick, OK, Project Hail Mary is going in the first slot, and then they would have the box office returns. But it was all just for fun with a bunch of friends.

And maybe it still exists, but back in the early 2000s, there was something called the Hollywood Stock Exchange, which again, It wasn't for real money, but people did that. It looked like a stock market.

Yeah.

Yeah.

Do you— so other countries have created rules like, you know, you can't advertise gambling during, you know, these hours. And there's a bunch of different kind of rule sets around it, even in places where gambling is legal. Do you expect any states to pass laws that say you can't advertise commodities trading platforms.

Yeah.

During, uh, more like FCC as opposed to CFTC, basically like not targeting like sports trading, which, you know, the Calshees and the Polymarkets are doing, but effectively saying like, hey, we know these are going to be the biggest spenders and we don't want to tolerate, uh, or encourage this type of activity.

I mean, you, you may see that and then that gets fought out in court. I, you know, I obviously, again, you know, you on the federal side, you know, it's interesting. It's not just Calci fighting back against these lawsuits. The CFTC itself, there's 3 states, Arizona, I'm going to mess up the other 2. I think Connecticut is one. There were 3 states who have tried to ban Calci and the CFTC itself has come in to sue. So I could see the FCC coming in to try to sue if such laws were passed. It would be interesting. I mean, I do think part of, well, part of a lot of betting, despite what we saw several years ago with DraftKings and FanDuel, you know, on every billboard and every advertisement, an enormous amount of this is still word of mouth, you know, people talking about it, people. I will tell you, When we were doing this interview, most of the crew, you know, the camera folks and the sound folks hadn't heard of Caution before we did this. And when it was over, I was in the corner kind of packing some stuff up and I heard them at the table having lunch. They were all not making bets, but they were flipping through the app and they were talking about different bets that were on there and they were fascinated by it.

It's—

I don't forget addiction. It definitely fascinates people because people have always in our lifetimes been able to buy stocks. You can trade on the price of oil, not on, you know, not on who's going to win an award or really events, you know, non, non-securities related events.

Yeah. How do you think about that, that bifurcation between securities related events and non-securities related events? Has there been robust enough research on how much of prediction market activity is sports related? Or sort of less like positive-sum or zero-sum situations? Because I would have to imagine that the, the, the level of engagement varies by category. Like there were a lot of people that were interested in tracking the presidential election, but that's not something that someone's doing every single day, whereas there's always a sports game somewhere.

There is. So they said said again about— said during the interview, they said about 70% of their volume last month was sports. In February, that number was higher. There was obviously a Super Bowl in February that changed. There was March Madness last month, but not as big a deal as the Super Bowl. 70%, that's a lot, right? That's the volume. They make the argument in the interview, you know, that one of the reasons why— I mean, obviously for Kalshi, that's good, right? That's more users, that's more fees. That's how they do it. They also argued that the sports volume creates creates more liquidity on the platform for the more esoteric bets. And thus you need sports in order to have the other stuff. I will tell you, I do get the sense that if they could have the same valuation and the same revenue and have no sports, they'd be fine with that and probably thrilled with it. But it's not how it works. The last thing I'd say about this, the problem or where sports could become a little legally complicated for them is this issue of entertainment. Right. Mike Selig, the CFTC commissioner, and I mentioned this during the interview, he on CNBC the other day made a comment about how, well, this is different than a casino because a casino is providing entertainment. You know, it was in that clip, right? There's shows and all this stuff. Well, there's not a huge— but a sporting event is by definition just entertainment, right? Whoever wins that basketball game tonight, except for the players and the gamblers, it doesn't mean anything. No, no. Goldman Sachs isn't making trades based on if the Celtics win tonight.

Yes.

You know, nobody—

I think— doesn't Point72 have a desk or there's, there's some hedge fund that I think does have a sports trading desk.

Right.

And that's kind of part of the argument they make. But in terms of this idea that the Calci will put forth, which I agree with, that understanding events and events market can, can help people better understand the world. Yeah, there's what, 15, 18 baseball games tonight. None of those are going to change the world even in a tiny way except for the people who are in the ballpark maybe be happier, sadder by a couple more dogs.

Yeah. At the same time, yeah, I mean, I completely, I completely agree with you. But there is something about when you're about to turn on the Super Bowl and you want just a really clear read on who's more likely to win. Like, it is easier to understand just a straight percentage than like a line and points and all of that, like just for a complete novice. But that's a different Uh, it is, and they'll make the—

and they make the argument correctly that they are not— they're just taking a piece of all the action, right? They're not betting against you. They don't care if you win. Caution doesn't care if you win or lose. They just care that you play. Sportsbooks obviously want you to lose.

Yeah, yeah, yeah.

I, I had a very eye-opening conversation with the, the CEO of a unicorn company who I of course will not name, but I was shocked at how, how invested they were in sports gambling broadly. Like we just had dinner, we were hanging out and they had like tons of different parlays across every different app. And they would show me like, well, when I'm in this state, I use this app. And when I'm in this state, I do this app and this app, I have to take my funds off the platform every night because I don't trust that it's not gonna get, you know—

They win money doing this parlay?

I don't know. I was just like, wow, I am bearish. On this company because the CEO is spending all their time, you know, doing, you know, 10-leg parlays on all these different apps. And you guys haven't raised a round in years.

What's going on?

Can I say, though, one thing I learned in the research for this and we talked about it a bit and I should have probably known this, one kind of user difference between the prediction markets and the sportsbooks is that parlay issue and specifically Every bet on Calci goes to the CFTC and has to get approved, and CFTC has 24 hours to approve it. What that means practically is while you can take a bet on the game tonight because you know there's going to be a game tonight, you can't do what you can do on DraftKings, say the next pitch is going to be a ball, the next pitch is going to be a strike, because there's obviously you have that 24-hour— they don't know there'll be a next pitch necessarily. So there's a little less real-time sports betting than there is on sportsbooks.

But But because they know the Super Bowl is going to happen, and they get that contract approved in advance, you can live trade that contract up till the last second of the game. And so that does satisfy a little bit of that, which is, again, much higher frequency than, oh, I want to gamble on the Super Bowl. I'm going to fly to Las Vegas, place a bet at a counter, wait in line, sit down, watch the game, go and collect my winnings. It's a very, very different equation. How have you processed just— so it feels like we all just agree that gambling is addictive, and I think that's reasonable. I don't know where that comes from, whether that comes from like science or law, but it all feels reasonable. But we're going through this again with social media, whether social media is addictive. How have you processed the social media addiction trials and then the new gambling app addiction addiction question? Like, are these linked at all in your mind, or how have you been processing the social media question?

I mean, I'm obviously not a doctor. I don't think you guys are doctors. I mean, there's definitely— we've all, I think, read about kind of the dopamine hits. And look, this is what you get from not posting on social media, but when you get a like or when you get a reply on social media.

Yeah.

Gambling. I mean, there's obviously a dopamine hit when you gamble, right? You know, your person hits the basket, you win the game, you get excited. I mean, obviously, if you have a lot of money on it, you get excited for different reasons. But just even, you know, I'll admit I use some of these sports betting app sometimes when I, if I'm watching like my hometown team play.

Dirty, dirty, dirty.

Is that the New England Patriots?

May, may, maybe a few times.

But look, the leagues, the leagues knew what they were doing, right?

They knew that if there's a blowout, you generally turn it off. But if you're waiting for your guy to get 20 points, oh, well, you might stick it out a little bit more.

I didn't realize that. I didn't realize that. But, uh, so, uh, back to the social media question. Have you been tracking any of that and what that means for the venture community or startups or really any knock-on effects that you've tied to the, the trial? Because there was that decision in Los Angeles. The actual fines for YouTube and Meta seemed very low, but it was the whole chain of, of more cases coming. And it just feel— it just felt like the first time we actually had a full decision that, that the judge said, yes, yeah. Predictive.

Right.

So.

Right. The lack of money is notable, right? Because it was also a single plaintiff. Right. So, I mean, for theory, that's a lot of money for one person. The big question going forward is, can an attorney or can a group of attorneys get a class together? And you've seen a bunch of advertisements. I've seen a bunch of advertisements all over the place. You know, were you harmed? Were you under 18? They're clearly trying to put a class together. A judge would have to certify that class. That's, I think, what Meta, YouTube, etc. are worried about, understandably. Really worried about, because it's one thing to have a single plaintiff, but that sets a little bit of a precedent. If you can have that same case with 100 plaintiffs or 1,000 plaintiffs or 10,000 plaintiffs, that money then starts to become real. And I think that's kind of the next step here. And we have to see if, if lawyers can get that class together, if a judge will certify them, and then whether another jury and judge will go along with what we just saw.

What are you tracking in the venture markets broadly? We were going back and forth on the impact of—

Yeah, last time we were on, yeah, we were asking you about potential impacts to fundraising, fundraising outside of, in the Middle East even.

Then you said, I believe, like, well, we're in sort of a new cycle of like the AI is not a bubble thing, but how are venture funds processing it? How are LPs thinking about it? Like, what are you tracking?

Yeah, on the Middle Eastern side, it does not seem that money flows have really stopped. The way it's been explained to me is calls sometimes take a few more days to come back than they were. Things aren't quite as instant. But, but there's been nobody who said, you know what, we're shutting off the spigots for a while. Call us, call us in June. Like, that hasn't happened. And to be honest, even in the last week or two, you've seen some deals and agreements that have come, like with Saudi PIF, not just limited partners into venture capital funds. There was a big private credit partnership that got announced yesterday, I think, with Saudi PIF. So clearly deals are still happening. Venture fundraising as a whole, though, has become— it's not even become— it is still really bifurcated, right? You still have the haves and the have-nots and these massive multistage firms that are gobbling up most of the money. And on the AI bubble side, I mean, every— it's funny, almost every venture capitalist and certainly the industry as a whole is just looking at 3 things, right? The IPOs of SpaceX, Anthropic, and OpenAI this year, right? Because that can— those, if successful, can solve all the problems that they've had for the last several years. And SpaceX goes first.

Gambler's mindset. Make it all back in one trade.

Well, it used to be VCs used to talk about home runs. This is now like the grand slam in the bottom of the 9th to win the World Series. Right. And everything else. And that's what they're banking on. And there's not a huge IPO pipeline, for example, other than that. You know, we had a story meeting this morning and somebody asked me, you know, well, with the ceasefire, does that mean companies that were prepping IPOs are going to, you know, start back up again? I didn't see a huge number of companies that were prepping IPOs. There were some, but it's not like there was— it's not like from Liberation Day last year when you had 5 or 6 companies that were ready to price and then stopped. Yeah, there's not that much out there right now, again, outside of those big 3.

Yeah, yeah, yeah.

I mean, the ones that I can think of, uh, that, that are maybe more at the Figma scale are just looking at, at Figma's track record in the public markets and thinking I'm not as good of a business as Figma, and I don't expect to be treated any differently.

And when the stock popped, a lot of founders were thinking, oh, if I can get that multiple, I should be public today.

Yeah, thinking like the Riplings and the Deals.

Yeah, all those companies.

Deals got its own issues, I think, which might be separate. But by the way, this isn't just a venture issue though. Private equity firms, which, you know, more mature, slower growth, but more mature companies. Companies, they haven't been taking their stuff out either. And they don't have anywhere else to go except sell to other private equity firms. It's just this broader non-IPO issue right now.

Yeah.

How much are you spending— are you spending time tracking the data center ban that Sanders has sort of proposed?

It's also a bunch of different states. Yeah.

It's a bunch of different states. We had a big AI event in D.C. 2 weeks ago. And I wrote this a little bit. And on the sidelines, I spoke to the CEO of Constellation, which is one of the big electricity providers to data centers. And I asked him— this was whatever, 3 weeks into the war and oil prices were spiking. And I said, how much, you know, what's this doing to energy dealmaking in the United States right now? Just the rise in oil prices. He said it's having a little impact. He said it's the data center ban proposals that are having the really big impact. That's what has people freaked out. I mean, Sanders on the national level, you're not going to get anywhere nationally on this. But on a state-by-state level, you don't need much. You need a couple of states to do it. It is, it is something that, that opponents have done a really good job on the PR and the industry has done a very bad job on the PR on this.

Yeah.

And it doesn't help that everybody's gas prices and home heating oil prices in places where that's relevant and electricity prices are all going up. Iran is obviously exacerbating it. So, but, you know, if you're looking at your bill and this is something that is top of mind. Well, the bills are only getting higher.

What do you think the impact of the war in Iran will be on defense tech investing?

I wrote about this today. We have to see what happens, right? It's a pretty fragile piece. It's unclear whether Hormuz is even open or not now. It was, maybe it's not. You know, what I wrote this morning was, I mean, I thought a lot yesterday after Trump's civilization tweet, right? That if he really went through with what he said, and I know some people are making seeing some odd arguments that, oh, well, it's either a nuke or not a nuke. No, there's a lot in between, right? You bomb some major power plants that are for civilians or desalination plants or the power to desalination plants, and people don't get water anymore, let alone can't do crops or feed animals, et cetera. Defense tech has boomed in terms of venture capital, which is such— there was almost none of it 7 or 8 years ago, and there's so much of it now. I think it could have turned Silicon Valley again back against defense tech if the United States had done something that a lot of people viewed as a war crime or at least as inhumane.

Sure.

I think the fact that we have a ceasefire and Trump didn't go through with that, I think, is probably a bit of a save for defense tech in the midst of a boom. I think you've got this, this huge upsurge in all sorts of defense companies that could have actually come to a halt pretty quickly. Not all firms, entry Anderson still would have invested. Founders Fund still would have. But that, that broader swath of venture capital that fills out those rounds, I think, might have slowed down if the military had done something, the Pentagon had done something that, that a lot of people viewed as morally indefensible.

Yeah.

Something I thought was notable is that the, the American version of the Shahed was a government program and they used some private, you know, contractors for it. But the smartest, the smartest defense tech play 3 years ago was just to make the Shahed and make a lot of them. And it seems like no company actually had the foresight to do that. And it ultimately had to be led from the DOD.

Yeah. Interesting.

And by the way, I haven't looked to see what's happened with the stocks, but I mean, something that is going to have to happen no matter what happens in Iran, ceasefire, no ceasefire, The standard munitions stockpiles are gonna have to get refilled, right? We are using a lot of bombs and a lot of stuff. That's gonna have to all get refilled. And I know, you know, Palmer Luckey and all others have talked about how we don't have enough of that prior to all of this happening. And that, you know, that stuff has to get done and there's gonna be people who sell that.

Yeah, yeah, that makes a lot of sense. Well, thank you so much for taking the time to come chat with us. The Axios show is live and available everywhere. Sure, go check it out and we'll talk to you soon, Dan. Have a great rest of your day.

Yeah, thanks for giving us the scoop. Great to see you.

Thank you. Up next, we have Lior Susan from Eclipse. He's the founder and CEO. We'll be talking to him about Eclipse's $1.3 billion raise as industrial tech shifts from innovation to scale production with companies like Cerebras and Baltic Farms.

What's going on?

How you doing? Doing well.

Thanks for having me.

Welcome to the show. Please kick us off with an introduction and some background.

Yeah, it's great to be here. First of all, I love your show. Yeah, we started the firm 11 years ago. We are all operators that left their job building companies in the physical world to build a firm that we can build more than one company at a time. As you can guess, it was fairly controversial 11 years ago to talk about defense manufacturing, chips, mining, etc. It feels like a little bit less controversial right now. And yeah, we grew the firm roughly to a $10 billion AUM and we just announced our raise of $1.3 billion.

Let's hit the golf.

Good place to start.

Congratulations. What was the prehistory of the firm? Of the firm? How did you get into investing? What was the first deal? How big was the first fund? Tell me some background.

Yeah, first one, $125 million. Feels like many moons ago.

Not bad, though. How did you set that up? I feel like a lot of people start at $20 or $50. $125 is not bad.

Yeah, the ignorance was the power. I never invested a dollar before Eclipse, so it might be that one. I grew up in the military. I went to the Special Forces, then I I did a company in the networking space. Cisco bought it. I moved to live here, spent 3 years with McNamara while he was the CEO of Flextronics, fall in love in US manufacturing and felt all of my friends in Silicon Valley can only spell the words enterprise software. And I know nothing about enterprise software. I don't like enterprise software. And 85% of the world GDP is physical industries. And I felt it's kind of weird that everyone Everyone is telling me you need to go after big markets, after big TAMs, but everyone is following their friends into the enterprise software while those 85% of the world GDP don't have a platform. So I'm left to start that platform.

Yeah. Talk to me about the Cerebris investment. How did you meet the founder? It was one of these companies that I'd heard of and I'd seen a lot of negative takes saying that it was the wrong path. That it wouldn't apply to where the current models are going. And then I tried it and it was really fast and it just felt like magical. And so I was all of a sudden converted to be very excited about the company where before I was sort of uncertain about how it would pencil out. It felt like there was a lot to be done, but you obviously invested early. How did that come together?

Yeah, we've been around the company for now 10 years. Wow. It's been a moment. That's remarkable. Yeah, exactly. But you know, like a lot of our companies and I think a lot of those companies in that space, it starts by a fundamental view that wafer-scale integration, basically the short version, you take the entire wafer and you interconnect between the core. You know, when we have an idea of a chip is essentially it's a square, but it don't come from the machine like that. It's actually come as a rounding and and then we cut it into squares, into chips. The idea here is you take the entire wafer and you connect it to a lot of the chips and you create essentially one very large chip. And naturally, when we made the investments in 2015, we didn't know AI will exist. What we did know, because we build by ourselves and operate those chips and factories and fabs, we knew that Moore's Law is going to hit the limit from physics point of view. 2 nanometers already. You know, let's assume we can do 1 nanometer. That's about it. There is nothing after that. And we were looking for a new physics and a new physics mean, hey, should you, can you connect to a lot of those cores in order to create one big chip? And we decided that we are going to take over companies like NVIDIA and others. And it was not easy, but I think now we're extremely excited about the company and the growth of of the business.

Yeah, yeah, it seems like it's in a fantastic position now. Talk to me about Vulcan Forms. What was the back history there?

Yeah, in some way, same story. Physics, start with physics. In the case of Vulcan Forms, we are manufacturing high-precision metal parts. And historically, a lot of those machines have been using 1, 2, 3, maybe 4 lasers. We are using 160 laser fiber into a single head and we melt powder really, really fast. And the hard part there was like how to control something that is so powerful. It's actually, we got a call from the US DOW many years ago and asking ourselves, basically start to investigate why we are buying all of these lasers because it looks suspicious for them. We were like, no, no, we are just building metal parts.

Nothing too sketchy.

And yeah, company booked multi-billions of dollars deals last year and a billion dollar deal the year before. And Kevin Caskill and the team there is doing phenomenal job. We are building now 4 factories in US, scaling the operation to build high precision metal parts for medical devices, consumer electronics, aerospace and defense, and others.

So yeah, it's a big fund. You're using WE. I imagine you take board seats, you leave lead rounds. Is that roughly correct? Like, how many companies do you want in the portfolio? How deeply do you want to be involved? Do you try and pick a single winner in a category, or do you look at more like secular trends and try and get a broad exposure to the whole category? What's your thesis?

Yeah, we— so we, you know, our LPs put us in the venture bucket and then in the growth bucket when they're thinking about how they are allocating capital, those US endowments and foundations. We call ourselves operators with capital. We are all operators and founders when we build those businesses alongside the management team. So we actually do very few deals every year. And we have actually a small amount of position in each fund. And I'll say roughly, we incubate 1/3 of the companies and 2/3 we will lead seed, Series A, Series B, Series C, Series D, whatever it is. We only lead. We always take a board seat and work very, very closely to the management team. And tell you the truth, I enjoy more building companies than investing in companies. So regardless if I end up investing and maybe it was not my idea to start the company, I want to feel like I'm part of the management management team building those businesses. That's my passion.

Jordy.

Very cool. Where do you think robotics is overhyped and where do you think it's underhyped right now?

Yeah, actually I wrote, I wrote something on my LinkedIn maybe last week that said it feels a little bit 2021 in eclipse sectors. We'll start seeing some of the bad behavior that maybe was in the enterprise software in 2021. Happening now in our sectors. You see those companies raising $1 billion out of the gate or some crazy valuations.

Yeah, or doing— I'm assuming there's instances where a company— you guys may have backed a company in a category 8 years ago, and then a new company gets formed in the category, and within 6 months, they're valued at the same price, even though there's wildly different different from a kind of technical progress standpoint?

There is some of that. I mainly— it goes back to first principles as a company, as a person, as an entrepreneur that likes to build companies. I think, you know, there is a way to build companies. There is for sure a way to build companies in the physical world. You talk about building factories, you talk about supply chain, you talk about CapEx, you cannot all like push full max out of the gate, burn really fast because you believe the contracts will come and you believe that always the markets will be there to fundraise you. So we're just trying to bring some sort of a discipline of how to build those companies. But it goes back to your questions on robotics. We have been doing robotics for 11 years now out of Eclipse, and a lot of us did robotics much before in our operating life. I think we are now crossing the chasm with robotics moving from a control-based PLC, very custom to a much more general purpose, much more using physical AI. As a result of that, we'll start seeing adoption on the commercial side that is super exciting.

From your position on boards, I don't know how much I don't know how much you can talk about this, but I'd love to know your view and expectations for the IPO window. We were just talking about it with Dan Primack. A lot of attention paid to the big three, SpaceX, OpenAI, Anthropic, but what else are you seeing in terms of how companies are gearing up for the IPO window?

Yeah, I mean, I think it's interesting, right? Of course, SpaceX, I think arguably even OpenAI, tropic, have a much closer part of the business to what I built, to maybe the traditional software that kind of was leading the chart. Yeah, I think real assets going to have a great moment in the public market. I think people value— you forget it goes back to the 85% of the world GDP. The reason SpaceX can have that type of an IPO is because they solve something something that it's really, really hard. So it's really, really hard for the second person to solve it as well. I think the reason you are seeing the correction in the SaaS world is you had a lot of companies, the entry is very easy, the TAM is not too big, and as a result, the public market correct. So I do believe we are going to see quite a lot of companies in the semiconductor world, in the space, in the AI infrastructure, in the data center of those worlds going public in the next 18 months or so.

Yeah. What are you tracking in terms of trends in the lunar economy? It does feel like we're at a turning point moment with SpaceX and Starship coming online. There's lots of interesting—

You mean space economy, right? The lunar economy doesn't—

Oh yeah, it's not lunar economy. It's orbital economy is the buzzword I was looking for.

It's fine. It's the Eclipse name confusing at this point.

Any variation from low Earth orbit to beyond. Some of this stuff, when you talk about mass driver on the moon, it starts to seem 10 years away, 20 years away, harder to underwrite, harder to think about, but maybe as a venture capitalist, you can start thinking about it. What are you looking for in just space broadly?

Yeah, I mean, I think when you think about Henry Ford, when we created cars, there is so much economy that is being developed and so much GDP that is being developed by the ability to move people much faster than you could move before. I think, you know, we are going to see something similar with the increase of our ability to travel to space and lowering the cost significantly. And as a result, we're just going to see a lot of new businesses being built. We are partnering with an amazing company called True Anomaly, that building space defense prime. So, you know, it's not only you're going to travel to space, you're also going to have conflict in space. We are seeing a live one, maybe a ceasefire with Iran right now. But, you know, I think since I mentioned his name, I said on an interview yesterday, I used to say that this is the best time to build in this country from Henry Ford and Carnegie or post-World War II, and actually change it to this is the best time to build in this country, period, in the companies that I'm passionate about. So I'm just extremely excited to have the capital and the relationships to go and build as many companies as we can.

Well, congratulations on the fundraise. Congratulations on the progress. And thank you so much for taking the time to come chat with us. We'll talk to you soon. I really appreciate it.

Great to hang out.

Thanks, folks.

Have a good one.

Cheers.

Thank you, guys.

Up next, we will be revisiting the Axios NPM package hack that happened, the supply chain attack. NPM, of course, Axios NPM was downloaded 100 million times per week and it was compromised by North Korean threat actors. We talked about it a little bit on the show last week. We're revisiting it with Firas Aboukhadija. I hope I pronounced that correctly. What the problem?

Is that right?

Uh, yes. So, uh, we can ask him. Yeah, we can ask him. Socket detected the malicious update within 6 minutes, and we are lucky to have Firoz join us.

What were you guys doing for the 6 minutes? So, asleep at the wheel? No, I'm kidding.

No, no, no, definitely not asleep at the wheel. Um, it takes time to download packages, scan them, put them through our battery of tests. Uh, so I think 6 minutes is actually pretty good.

No, it's fantastic.

I'm just messing with you. But yeah, maybe zoom out and tell us about like the actual process that Socket runs, your business, how the system works, and how you're able to detect supply chain hacks and cybersecurity threats so quickly.

Yeah, totally. So Socket was among the first to detect and report on this incident. We built a system that goes out and downloads every open source package in existence within a few seconds. So we support about 19 ecosystems systems. And this includes really all sorts of third-party code that might be, you know, used to build applications today, includes things like your AI models, your, you know, your open-source dependencies, your even your editor extensions, your Chrome extensions, like really any code coming from, you know, third-party sources. And we put it through a battery of, you know, really intense static analysis, maintainer behavior analysis, and then of course a bunch of AI and then human researchers as well. And we try to help help kind of make a determination. Is this something safe that you want to use within your application or within your organization?

Yeah. So can you talk about the shape of the threat that was posed by the Axios supply chain attack? Because there's a wide range of zero-day exploit that gives you full access to someone's device or computer or system all the way to just something that, okay, it would crash if this exploit was used, right?

Yeah, I mean, maybe we just start from the beginning and summarize the attack for folks. Yeah, so I mean, there was a North Korean state actor that socially engineered the lead open source maintainer of the Axios package. And it was honestly quite a sophisticated and impressive effort. They posed as a founder of a fake company. They created a fake Slack workspace, invited this, you know, invited the maintainer to join it. They staged a fake Microsoft Teams call and the website was made just incredibly compelling. They used the official SDKs from Microsoft Teams to create like really realistic components in the page. They joined the call and, you know, by the way, this is— they also developed a relationship over the course of, you know, weeks. Right. So this wasn't like a, like a, you know, a situation in which which you would expect to be on guard or on defense. And at some point in the call, the call just cuts out and the browser says, hey, you know, you got to install an update. And it gives them a binary file that they're told to install. And so this, this, this maintainer thinks, OK, I guess, you know, I guess I got to install this update real quick so I can get back into the call. And it turns out that's how they compromised their device. So, you know, it's not just like, you know, a phishing link or something like that. I mean, this was a targeted attack. They also targeted me and a bunch of people at our company as well. So they targeted a whole bunch of the top npm maintainers who, you know, have access to a lot of packages.

Interesting. Then, then in terms of once they get control over— they phish a particular credential, a particular device for a developer who has access to push changes to a package like Axios— what are they actually changing in Axios to vulnerability in the supply chain, in the software supply chain?

Yeah, so they publish poisoned versions of the package that silently install what's called a remote access Trojan, which is basically a way for the attacker to just remotely control your, your device and basically do whatever the attacker wants. It's like they're sitting in front of your computer on the keyboard, you know, typing whatever they want onto your, onto your system. And it— what they did, what they did with it was they kind of pulled all the most interesting files and credentials off the system. So things like if you have a crypto wallet, like they're taking the keys for that, they're going to definitely want the crypto. If you got, you know, if you're logged into npm, right, they pull those credentials so they can spread like as a worm and kind of continue to infect the next set in the attack, right? So it's, it's actually like this self-replicating kind of cycle where they, they get these credentials and then they use them to go on to the next stage. And, you know, yeah. And then, you know, This is— I mean, the thing I think I want to emphasize here for people is this isn't just an isolated incident because this has been kind of the most recent blow in this kind of series of compromises and attacks against the software supply chain that has been happening really over the last 6 months in a really intense manner. And we've seen it really pick up in the last month with TeamPCP compromising Aqua Security and the Trivy scanner. And then that cascaded into LiteLLM being compromised. Compromised. Another security company, Checkmarks, was compromised. It's really like—

What happened with LiteLLM? And how, like, do you have a good sense of how that contributed to the breach at Mercore?

So it's, it's part of the campaign of TeamPCP. So they dropped the same kind of self-propagating worm called Canister Worm into the package. And what you have to realize is once you run a compromised open source package on your system, you know, you kind of have to rotate all your credentials, like all your tokens and keys and passwords. And, and it's a really hard thing to do very thoroughly and very completely. And so I think that we're going to see a long tail over the next, you know, probably 12 months of follow-on attacks from this, from this set of compromises, because The group claims, TeamPCP claims that they've stolen 300 gigabytes of compressed credentials. So that's, you know, I mean, think about that, 300 gigabytes of stolen passwords, API keys, GitHub Action tokens. I mean, they're sitting on so much. It's like a goldmine in terms of like what's going to follow on from this. So I think it's not surprising that, you know, that you're seeing companies affected, right?

Yeah. Yeah. So why the boom in the last 6 months? It feels like it must be tied to vibe coding or AI agents. Is this that they have more powerful tools so they're able to do more damage? Or is it because our systems are getting weaker because we're pushing more vibe code to production? Is it both? Like, what got us to this place where we see this takeoff in cybersecurity threats?

Yeah, well, you're absolutely right. It's definitely become a top concern. I think we're hearing a lot of our customers and prospects that are contacting us that this has now become a board-level concern.

Yeah.

You know, everybody is asking, how are we not going to be affected by the next one?

Yeah.

So I would say that, you know, fundamentally, like, if you really zoom out and ask, why is this a problem? Like, why is this happening? Yeah, it's because the whole software supply chain is built on blind trust. I mean, you're downloading code from random people on the internet that you've never met. You don't know who they are and you're like, let's just run it, right? Like, let's just hit run and like, I hope it's fine. You know, I hope it's good. You know, and I'm going to give it full access to my system, right? No permissions model, right? No review. And I mean, no one looks at the code, right? Before they run it. And unlike an iPhone app or, you know, mobile phone app where it has to ask for permission to do sensitive things like access your camera or your microphone or your location, or your contacts or your files, right? Open source packages just get everything. You know, you just run them, they get everything. So, you know, also there's this asymmetry in security and this has always been true. So this is kind of more of the bigger picture. I know part of the bigger picture here is that defenders have a much harder job than attackers because they have to guard against really all the ways that you can possibly get attacked. And the attacker has to just find one way in. Right.

Right.

So it's asymmetric. And so when attackers realize, hey, look, you know, open source, the way that companies use it has changed in the last decade. We no longer use, you know, just a handful of components like WordPress, Apache, PHP, you know, these kinds of big components. We actually pull in, in some cases it's like 1,000 open source libraries just to get Hello World to show up on the screen.

Right.

Yeah.

Crazy, the diffusion in the number of these things. So, you know, they realize, look, I could just attack one of these things, one of these libraries, and I can get into a company. Like, that's so much easier than attacking head-on and trying to hack the company directly, right? I can find one of— you know, and we have customers, by the way, they have 500,000+ open-source components in their environment. So just think about that, right? Any one of those is a way into the company.

Yeah, right.

The funniest package is iseven. It just tells you if a number is an even number, and it has one dependency, is odd, because it's a— Everybody loves that example. Exactly. It's a great example. Tell me more about the shape of your business. I mean, it seems like you're getting a lot of calls from companies and boards. What does it look like to work with you? How are you plugging into companies? Do you have a business line around going and hunting bug bounties? How should I think about the business of Socket these days?

Yeah, well, look, people contact us when they want to get their software supply chains under control, right? So right now what that looks like is companies that are deploying AI agents and AI coding assistants across their companies have one big question in their mind, which is, you know, how do I know what my agents are doing? How do I know what my developers are doing with those agents? And that is the the problem that we help them get under control. So the way to think about Socket is we are a software supply chain defense company, right? We protect your software supply chain. So when an agent is making a decision to go and install something in order to accomplish the task that's been given to it, you know, it will go through Socket first. So we are the guardrail to ensure that no malicious components get installed. And if you you take a concrete example, Axios, the attack we've been talking about, that malicious package was live for about 3 hours, meaning, you know, anyone who was asking their agent like, hey, go build me whatever, right? Doesn't matter what. One of the first things is probably going to grab it because it needs to do HTTP requests. It's going to say, oh, Axios, right? And, you know, so the question is, how do we— how do we— before that gets taken down, right, before the— or even before the community is aware, How do we defend our organizations and our applications from those packages that have had these implants, right? And, you know, and yeah, it's really top of mind for people. I would say it's kind of become like a number one concern for CISOs and for boards.

Yeah.

What is your view on cybersecurity as a category? I think a lot of, you know, we've talked to people on air, off air that were surprised about the sell-off in cyber due to LLMs just because LLMs themselves are creating all of these new threat vectors. And so there was kind of a disconnect there. But what is your sort of more general outlook on the category?

I think in the short term, security is going to get worse. It's going to get harder. So I think actually, I think the, you know, the answer is really the opposite, like companies and products and, you know, things like Socket are actually more needed than ever before. You know, with, with Mythos coming out yesterday, you know, that's going to find a ton of vulnerabilities. And, you know, it's finding vulnerabilities all across the software supply chain. And so, you know, the— I think, you know, more vulnerabilities discovered means there's more urgency to fix the ecosystem. And it becomes— it goes from being, you know, a lower priority on people's lists to a higher priority. And so I think, you know, the short to medium term effect is going to be massive awareness. It's going to be supply chain security becoming more top of mind for everybody. That's obviously great for us as a business, great for the ecosystem, because I think it's hard to invest in things and get justification for budget if you're a security leader, if you don't have, you know, a fire or an emergency to point to. And so this, this really helps there. I think longer term, you know, we have to see. I think, you know, ultimately, I think AI solves the asymmetry problem that we were talking about earlier because I think for the first time, defenders now have an infinitely scalable army of agents doing their bidding and doing continuous security analysis. And that's all work that would have been way too expensive or impractical for their humans to do before. And so the attacker's advantage of only needing to find one way in starts to erode when the defender has the ability to kind of continuously audit everything. And so I think longer term, once we get through this rough period, actually, I'm very optimistic about, you know, security improving. But one thing I will say is, you know, with security, one of the reasons I love the field and why it's such an exciting field to be in is that, you know, it's a cat and mouse game. So it's a dynamic system. So it's not like, you know, architecture or bridge building where, you know, you learn the rules of physics and you know how to build a bridge that's going to withstand gravity and these forces that don't change. You know, in security, the minute you think you've got things under control, you know, the attacker evolves, the attacker switches their strategy, and they have have access to the same AI tools that the defenders have. And so, you know, it's really a field that is, I think, always going to be growing and always, always going to be, you know, a great business to be in.

Has a cybersecurity company ever got caught like sort of LARPing as a hacker group in order to drive demand, you know, sort of like hacking a popular company in order to drive demand for their product? Because you said, You said CISOs oftentimes need to be able to point at a fire to justify budget.

You know, that's super funny you ask because that was always the conspiracy theory that folks had about the antivirus companies back in the '90s and the 2000s was that they were the creators of the viruses so they could sell you the antiviruses. Yeah. You know, but—

Create the problem, sell the solution.

Yeah.

I mean, you know, I think that, I'm not aware of any companies getting caught doing that. I think there's enough bad guys out there that have realized the opportunity sitting there in plain sight that I don't think that, you know, you got to go to conspiracy theories to kind of explain why attackers—

No tinfoil hat needed.

Yeah, no tinfoil hat needed. Yeah.

I mean, how do you think about these economic impact assessments? With Axios, I feel like everyone jumped on it very quickly. Andrej Karpathy shared that he he didn't have the repo pinned, but he hadn't updated, so he was able to dodge it for that 3 or 6 hours, right? So a lot of people got lucky, but do we have an idea of the actual toll that that particular attack had? Because it felt like the number could have been very huge, but a lot of people were able to get to it fast enough that there wasn't necessarily a massive crypto breach or a massive PII breach. But do you have an idea of like how the industry is thinking about the size of the scale of the economic impact?

Yeah, well, I don't have an economic dollar amount for you, but if you look at the number of downloads per week of this package, it's 100 million weekly downloads, right? Yeah. That, you know, you figure you do the math on that and you figure out like, what does that mean across a 3-hour window? I mean, you're talking hundreds of thousands of people who installed it. And that's, you know, across CI/CD environments, local laptops, that stuff that's been shipped into production. If you take, you know, another metric would be, you know, how many folks have reached out to Sockett, you know, in the 24 hours following that attack to become a customer and make sure that, you know, they could use our tools to assess whether they were affected and to protect themselves for future attacks. We had almost 2,000 organizations sign up for an account in the, in the, in the 24 hours. Yeah, which, you know, to put in perspective, it's a significant percentage of all of our full user base. So, you know, I think this is very, very widespread. And this is the thing about the supply chain, right? It's like, it's really not a matter of like if you're gonna get hit when you're talking about these very, very widely deployed dependencies and including even some of my own code, right? I know I have these, you know, you picked on isEven, you know, I have some code that is similar to that, a little bit less, less outrageous of an example. But, you know, and it's in, it's in every, it's in, you know, probably almost every Node.js app. And that's just how, that's just how the supply chain works today. So it's really not surprising that, you know, everyone is going to get hit by this eventually.

Right. Yeah. Well, thank you for coming on the show and breaking it down for us.

Yeah, really appreciate everything you're doing.

This seems more important than ever. And so have a great rest of your week.

Come back on Tuesday.

Soon. We'll talk to you soon.

Thanks, guys.

Goodbye. Up next, we have Kasim Mathani from DepthFirst announcing a big round. Company also launched its first in-house model, DFS Mini 1, focused on vulnerability detection and smart contracts. We'll bring Kasim into the DBP and Altium. How are you doing? Hey guys, doing well.

Thank you for having me.

Of course.

Good to see you. Nice step and repeat behind you. Are you at an event or is this just normal background?

This is like, uh, our, my background. Amazing. We had like an amazing event with the mayor of San Francisco and we got this for, for that.

That makes sense. Uh, well, uh, since it is, uh, first time on the show, please introduce yourself and, uh, and the company.

Yeah.

Um, my name is Kassem Matani. I'm one of the co-founders of DevFirst. Uh, we are building intelligence to discover triage and remediate vulnerabilities at scale in an enterprise environment. We just raised an $80 million Series B round from Veritech.

Congratulations. When did you raise the last round before this?

We raised in early January, so it's been remarkable.

Less than 90 days.

And the reason why we raised it was because we're seeing so much traction. Yeah. Customers are seeing so much value from our product. And then we're doubling down on our research efforts, like you mentioned at the top of the segment. So we are investing really heavily on training and fine-tuning our own models.

Let's talk about the customer impact first. What are the companies that are using your service and plugging in and getting value? And sort of walk me through the user journey of actually working with you.

Yeah, that's a very good question. Um, we work with some of the largest companies in the world, Fortune 500 companies. We also work with really fast-growing startups.

Yeah.

Ranging from companies like Lovable, ClickUp, Sure. Supabase, like the top names in, in tech.

Yeah.

And the way they use our product is that they connect their code repository and their environments.

Mm-hmm.

So their staging and their production environments.

Yeah.

And then we go, our agents go and figure out how, uh, the application is supposed to run and then deviations from the expected behavior.

Mm-hmm.

So they figure that out, they replicate it in production, and then they give remediation instructions to agents and developers.

And on the research side, walk me through building an in-house model. What was special about that? Did you have to use— I imagine you didn't do a whole base pre-train yourself, but what is unique about the model and what were the keys to success?

Yeah. So, you know, we, when we started a company almost 2 years ago, we really believed that software security is a very deep problem. Now everybody in the market seems to realize that. But back then people thought that, you know, the Crowdstrikes and the Palo Altos had a monopoly in the market. But in the age of AI, as code is being written faster than ever before and attackers are already leveraging AI to exploit vulnerabilities, a new type of solution needs to exist. And that's what Dapr effort is. So we invested very heavily in building a world-class research team. My co-founder Andrea Michi comes from DeepMind, spent 7 years building reinforcement learning there before LLMs were sexy. This is like back in 2019. And my other co-founder Daniele was a co-founder of Fair Wholesale, and before that he led security at Square and Cash App. So that's our background as a founding team. And then we also have like some of the top researchers in the world working with us in terms of like building model, we used GPT-OSS as our base model, and then we took vulnerability data, we planted flags, and then we had the model try to find those flags. And then we used an RL loop to basically improve the model's performance. And we were able to do better than Opus 4.6 at 1/10 the cost in this particular benchmark.

That's very cool. What was your reaction to the Mythos news yesterday? It seems like Really remarkable results in bug finding and vulnerability tracing, lots of partnerships. How did you process the news? What are the key takeaways?

Yeah, I mean, I think it's amazing news. It's like validation that security is such an important area in the age of AI, something that we believe for 2 years. The reason why I work 16 hours a day is because I believe that in the age of AI, software needs to be secure. So I'm really happy Anthropic is investing in this. And Anthropic is also one of our partners. So we work with Anthropic, we work with OpenAI, we work with DeepMind, work with all the labs, and our product sits on top of that. So we use the best model for the use case that the model's good at. So we use, you know, 4.6 for code analysis. We use like other product, other models for capturing the flag type of vulnerability detection that I mentioned. So it's good news overall. But, you know, in an enterprise environment, complex enterprise environment, you need to ingest all types of data. You need to figure out like figure out the cloud environment, how the software is deployed. You need to figure out if there's a firewall there, if there's a WAF there. And our product ingests all of that data and then gives actionable vulnerabilities, the ones that really matter to our customers. And then with a click of a button, they can just fix it. So we see that as being a significant value add for product.

Talk about the decision to plant the flags yourself versus what it appears Mythos did was just look across every single open source project and just sort of maybe brute force a bunch of vulnerabilities until they found bugs all over the place. And it seems like they were able to find a lot of different stuff by just throwing every possible hacking technique at every possible open source repo. Is that the correct way to think about that strategy? And then do you think you'll wind up doing something like that in the future?

So we did both actually. So we run our product, our model on open source too. So like we found hundreds of bugs. Uh, we're just monstrously disclosing them because we don't want to get them, get them out there, you know, so attackers can exploit them.

Yeah.

So we found vulnerabilities in Chrome, we found vulnerabilities in like, um, Linux, like in really deep, uh, you know, uh, software that's existed for like not very heavily used products.

No, only the most Most used products. Only the most used.

Yeah.

Yeah.

So, and that's helped us improve our product. And we have a team of world-class security researchers on staff.

Yeah.

So people who hack iPhones for a living, you know, thankfully they're working for us.

Yeah.

But like those types of folks who are going and validating the results.

Yeah.

And then helping us improve the model based on that and improve the product and the model.

Well, thank you for everything that you do. We need more white hat hackers than ever, very clearly. We were just talking about the Axios hack.

One final question Tyler on our team wanted us to ask: why not use— are you fine-tuning on any of the Chinese open-source models, or do those scare you?

Um, we, we are experimenting with some of them, but we would— we're an American company, we would love to use American models.

I was actually—

I met Jensen Huang yesterday And it was so amazing to see the investment that's going in, in this area, especially in training open source models.

He's going to do open source models too, right?

Yeah.

Yeah.

So we're very excited and we're partnering with NVIDIA and he loved our vision. He thinks that in the age of AI, I mean, as agents are everywhere, security is going to be like extremely important. So he's completely bought in to our vision and he's really excited about it.

Yeah. Very cool. Congratulations on the progress and the round. We will talk to you soon. Soon. Have a good day.

Thank you.

Talk to you.

Goodbye.

Thanks.

Up next, we have the co-founder and CEO of Mutiny. Uh, you need— just raised $72 million from Sequoia Capital and Y Combinator, reaching 8-figure ARR.

Whoa.

Bring in, uh, Jalay Rezaei from the waiting room into the UltraDome. How are you doing?

What's going on?

Good, how are you?

We're good. Thanks so much for joining the show. Please give us an introduction of yourself and the company.

So I'm Jaleh. I'm the co-founder and CEO of Mutiny. And yesterday we announced the new Mutiny, which is an AI agent that companies like Rippling and Snowflake use to create anything customer-facing in order to get a deal from cold all the way to closed.

Okay. Yeah. Walk me through. I mean, What does that actually mean? Add assets to landing pages, battle cards, like, well, walk me through the workflow of closing customers in the modern era.

Yeah, absolutely. So starting out, you probably want to warm up the accounts in a particular vertical. And so our customers will create personalized vertical campaigns. And then from there, once, you know, the, the SDR is involved, they want to start prospecting and get meetings with the right people so they can make prospecting pages in Muni. The agent can even research the specific people that they want. They can pull in data from their CRM, any, any information that's available to them. The agent will access and create something really high quality that will stand out to that prospect as the deal progresses. Now we're looking at things like curated customer case studies. We're looking at business cases. As ROI reports, pricing proposals. Even after the deal closes, there's a ton of expansion that the customer success team will drive. So they can create impact reports in Mutiny for their customers, and they can do look-forward strategies, the whole works, in order to maximize revenue.

Okay, bunch of questions. Where does the name come from?

You know, the mission of Mutiny was all about killing the dependent in-season go-to-market teams. I've led marketing teams, sales teams, and the biggest blocker to growth is always speed. And the blocker to speed is all of the little dependencies that exist inside of your team, outside of your team. And so it was really a mutiny against the status quo. That's where the name came from, and it just kind of stuck.

And behind you, is that a raccoon mascot? Explain that.

Yes, it is. This is our raccoon mascot. His name is Achu.

Achu. Where did that come from? How did you pick a raccoon?

Do you want to know the real story?

Absolutely.

Yes.

So we were all in a circle. This is when we were about 4 or 5 people. And we're like, what are we going to name the raccoon? And one of our early employees—

Wait, but how did you get to raccoon? You're just like jumping to that one.

That's just the default.

Of course, we're going to have a raccoon. I have a raccoon. No, explain, like, how did you pick raccoons? There's a million animals you could have picked.

Yes.

Okay.

So we were designing our brand and the designers asked me, okay, is there an animal that you guys really identify with? And there wasn't really anything coming, you know, off the top of my head. And then we took the whole team to Angel Island on a, on a camping trip. And the entire time we were there, we had 6 bottles of wine with us. And basically no supplies. So it was just, it was awesome. And every time we would turn around with our headlamps, we would see this gang of adorable raccoons just slowly approaching. And then they would see the light and they would start backing up. And so the next day, the designer asked me that question again and I said raccoon. And that's how we ended up with the raccoon.

There we go.

What's going on with email? Are you generating cold emails? Is it a waste of time now?

What's the equilibrium here? Because I think a lot of people are getting more cold outreach than ever. And it feels like we might be in this game theory.

Yeah, because I can imagine you guys helping somebody make a great cold email. But at the same time, you guys are also set up for the golf and steak GTM as well, which is you play a nice round of golf, and afterwards, you pass them a PDF or a little deck. It gives them some more context. Context of the conversation.

Exactly. So email is a really tricky one. I think, you know, we see this in our own data. We hear it from customers. The results are, are really bad. Most people don't really open emails anymore. Executives don't really open emails anymore. And so the, the engagement rate on email is really, really low, which is why I think having a really personalized approach that's going stand out, that's going to be different, that's truly and genuinely tailored to that person is going to be really important. One of the things that I find really fascinating is if you look at an average salesperson, they spend about 30% of their time selling and 70% of their time following up with customers, getting ready for tomorrow's meetings, creating all of those materials, nurturing the old old deals that are going to convert hopefully one day. And when you talk to CROs, for the most part, despite all the AI investment in data, they haven't really moved the needle in terms of increasing quota per rep. The rep is largely closing the same amount as the previous years. And I think the reason for that is that that 70%, that's really skilled custom work per, per, you know, customer that you're going after. Mm-hmm. I was on a call a couple weeks ago where it was a great call, great enterprise brand, the right decision makers in the room. And at the end of the call, they're like, please send me, based on the challenges that we told you we have, send us the 3 metrics that you can move for our business and relevant customer case studies for each of those. That would take a rep 4 hours to go create, right? You have to go look at hundreds of case studies, pull those things together. Whereas in the Mutiny agent, they can just come in and it automatically will pull in the challenges from the Gong transcript. It will, it will go through all of their case studies. It will sift and pull out the right stats. It will curate the, the assets in there, and then they can go ahead and send a really nice, beautiful, forwardable thing to their customer that's going to get shared with the whole buying committee.

Yeah. The chat is asking for the name, where the name for the, for the raccoon came from, because I think we glossed over that. So sorry to go back to the mascot, but the mascot is a raccoon named Achille.

Yes. So we were, it was the same group of people that went camping. We said, what should we name the raccoon?

Raccoon.

Yeah.

And right as we were gonna do that, someone sneezed.

Yeah.

And it just said, achoo!

Achoo!

And we all went, achoo! That's actually a really good name. Let's go, let's go with that. I mean, in general, I would say the Mutiny brand, um, I think part of the reason people really like it is that it is raw, it's authentic. We don't really regulate what people can and cannot do. We hire people that are aligned with our values and just let them be themselves.

I love it. Well, thank you so much for taking the time to come chat with us. Congratulations. Did you— did we hit the gong for you? You raised a $72 million round. We got to smash it.

That was a previous fundraise.

But yes, yes, we're still happy to celebrate it.

We have the money, so that's all that matters.

That's all.

There we go.

We'll talk to you soon. Have a great rest of your day. Goodbye. And up next, we have Jeremy Gallen from Charlemagne Labs. He spent 12 years at Meta in trust and safety and left last year to focus on AI-powered scams and building defenses. We're doing a whole security-themed show.

Look at Jeremy. Look at this.

Wow. The matching suit. You look fantastic. You really like— it is the mirror image of me. This is crazy.

Nailed it.

The memo came through. I was hoping that I'd get that Maybach right downstairs and—

I'm so glad you're up to speed on the show. But for those who aren't up to speed on you, give us an introduction and explain a little bit of your background.

John's intro, you said he left Meta to focus on AI scams, which kind of sounds like you're scamming, but I'm assuming it's the exact opposite.

No, it's the opposite. We're doing cybersecurity.

That would be too easy. It's much easier to be on the offense than it is to be on the defense today. I tell you, it's wild out there. So yeah, I left Meta after 12 years to focus on—

Overrated success.

Right.

And basically my vision is that every employee of every company would have a watchdog. So the company's named after my dog, Charlemagne. She goes by Charlie. So the product is called Agent Charlie.

Yeah.

The idea is like, you're using your computer and you're getting attacked now with novel kinds of threats that resemble legitimate communication that could be on messaging apps. It could also be the standard phishing.

Yeah, we just heard about that with the Axios attack. It was basically a fake Microsoft Teams, basically, call that then cut out and triggered and you know, suggested, hey, update Microsoft Teams. Whole thing wasn't Microsoft Teams, but the individual just was like, you know, confused because it just seemed like it was from—

I think the nastiest trick is when it's the unsubscribe button is a self-link. I think that's like the biggest thing. So what I— we've built, you know, the startup has been selling a product that will try and stop you from clicking. So it's like bad, bad employee. Do not click. But the research that we've done to inform this commercial product is into the capacity, the capability uplift that's happening with respect to offense. So it's important to remember that if you're an adversary, that's a threat actor seeking, you know, financial gain or a state actor, you're availing yourselves of all this AI and agentic tooling that that we are using, you know, the sales tools, the, you know, the automation. And so the core premise is that in an AI-powered world, all phishing becomes spear phishing. You're not going to get a Nigerian prince email, you know, much anymore. You're going to get an extremely realistic, utterly compelling request from your boss or your manager or your friends. And it's going to be catastrophic in consequences.

How do you think about actual deployment, because this sounds useful in a consumer context. I'm just thinking about, you know, the, the, the email that's from your bank and it has the unsubscribe button for some marketing email. You click it, all of a sudden you're logging in, giving away details. Is there an important distinction? It feels like consumer and enterprise is blurring together in, in many places. How do you think this all plays out?

I think as employees of companies, we are using personal email and and personal messaging apps on our, on our devices for sure.

Yeah.

I think as a business, we're a B2B SaaS company with a research arm.

Yeah.

And I'm excited to tell you more about our, our research effort. But yeah, I mean, my dream is that the AARP is listening right now and would give this, you know, for free to— I'd like to give our software for free to anyone who holds an AARP card because elder abuse is devastating and it has huge consequences, but it's very difficult difficult to market and sell to consumers, you know, a product like this. People don't wake up and say, today's the day I'm going to improve my security posture. It's sort of after they're attacked that they have a problem and a mess to clean up. So we're—

Well, you need to create the problem, not the solution.

Stop creating the problem. No one's creating the problem.

We were just talking with Eris from Socket who was saying like the old tinfoil hat theory with cyber security and like malware products is that, you know, they would create the bugs and then sell the, sell the malware, create the viruses, sell the antivirus.

I think that's unethical, but also we don't have to do that because there's plenty of scammers out there. The bad guys are getting, you know, superpowers. And so all we have to do is wait. Um, and like I said about, you know, this research arm, our, um, our team has, has done some work. Meta's, um, you know, model dropped this morning. We worked with them there They're— I think, you know, I'm quite proud actually of what they're doing in the cybersecurity space because beyond infrastructure and coding attacks, what we all know and aren't really talking enough about is that humans are the weakest link. So when a company wants to secure its perimeter, it's critical that employees are trained. And today, you know, there are training exercises. But the social engineering attacks aren't studied as much. And so, yeah, I'm really excited that Meta's taken a lead in going beyond just infrastructure and code vulnerabilities to looking at the capabilities that frontier models might provide adversaries in the social engineering and scam space.

Yeah, so explain a little bit more about the eval suite for Muse Spark because like, is it that the model is trying to, is the model Is the model social engineering you or you're trying to social engineer the model? Like what are the two parties in this eval? Like actually how are they interacting?

Yeah, so we use an industry practice called LLM as a judge. So we don't test on human subjects and our eval suite takes a model and has it role play as an attacker. And then we have a model that role plays as a victim. Yeah. Instructions accordingly. And then we have an LLM judge whether it's the specific attacker is succeeding. And then we compare those attack different models to each other in the, in the role of attacker. And that's how we measure the kind of uplift or capability.

Yeah. Do you think that, is there, is there a world where these social engineers, like I'm thinking of different bending points in where if someone's running like Granola and they're recording that particular, it wasn't a Zoom call, it was a Teams call for the Axios attack. And maybe an AI model could be listening in the background and sort of throw up a flag like, hey, it's actually there. I just checked, there's no update for Teams. You don't need to click on that binary. You don't need to install that. This person's trying to take advantage of you.

The vision for our commercial B2B security product. I want an agent that, you know, the technology that we use is small language models so that it is on device and thus it's limited in its capabilities.

Oh yeah.

I see a future where you have a real-time AI for security exactly like you described. I think real-time audio analysis with an SLM is way too big an ask, but small language models are improving, you know, just like all of the large models. So, yeah, I mean, we need real-time defense. I want it to be proactive, too. I think the biggest issue is that when scammers succeed, it's because even intelligent and well-trained people, employees of companies that work in tech, even are duped because it's a— it's as old as the Bible. Scamming is an ancient art and it has nothing to do with preparation anymore. It has to do with We're being attacked by machine. We need machine defense.

Yeah, no, that makes a ton of sense. Take me through the shape of the company. How big are you? Have you raised money? How long you been doing all this?

Yeah, so I've raised money last from the 3 investors that I'm really excited to be working with. They're Kevin Carter of Knight Capital and Chris Howard of Ritual Capital and Rafael Corrales of Background Capital. Collectively, they've backed more than 30 unicorns from idea stage. And so, you know, I tell them that I want to be the 31st. I'm ready to go.

Good luck.

There we go.

Yeah.

Yeah.

Love it.

So we, you know, we're in a kind of stealth mode right now working with design partners on the S11's capabilities.

Sure.

And we're also, you know, if you visit our site, you can actually self-serve for the real-time phishing defense. So you could sign up right now. If you have a, probably have a Centurion, but if you have a credit card that works, you could put that into our website right now.

Don't get spearfished.

Yeah. Well, thank you so much for coming on the show. Congratulations on the prize. Yeah, it was great to meet you. Good luck with the next phase.

Thank you for suiting up as well.

Yeah, we appreciate it.

Yeah. I'm not wearing any pants, by the way.

Well, have a great rest of your day.

Talk to you soon, John.

Goodbye. And people were disappointed that we didn't go more into the story about Satoshi. There is a full deep dive in The New York Times, My Quest to Solve Bitcoin's Great Mystery. It is a long article, though. And so I think we'll have to touch on it another time. But we went through Adam Back's reaction and his his disavowal of the accusations that he is Satoshi. But there's a bunch of interesting little segments in here from the forums and the message boards of the day, analyzing the different writing styles, trying to see— did you dig into this at all anymore?

I didn't read the whole thing, but like people have speculated that's Adam Back for a long time. It's like kind of like him and Hal Finney is the other one. These are kind of the two like main names names of people.

And there's one more, I think, that comes up all the time.

There's Nick Szabo somewhere.

Yeah, Nick Szabo. Yeah.

But yeah, I don't know if there was a lot of like new facts that came out with this, which I think is why it's like not like super, super crazy.

Yeah. There was also an HBO documentary on Satoshi. I forget who the, like, who did that Satoshi, who did they accuse in the 2024 HBO documentary? Directed by Colin Hoback. The firm suggests that Canadian software developer Peter Todd is Satoshi, and Todd denied that. And so you have—

That's got to be the worst kind of title in the world from a security standpoint, is being accused of being Satoshi.

Yeah. Because you're just going to be attacked because you potentially have the keys to like $50 billion or something, maybe more. I forget exactly. I don't know exactly what the number is, but yeah, that wallet is big. I still think it's possible that the Satoshi wallet, like the keys were just lost and the person, it's like sort of a lose-lose, 'cause if you admit that you lost the keys, then everyone's like, oh, how do you even prove that? You can't prove that you lost something, but there's no movement.

I don't know.

[Speaker] Yeah, also there's like, someone could have created it and then had years and years and years and years to buy up an equivalent amount of supply a bunch of different ways. And then you have the— basically, you can say, well, I've never sold. If Satoshi's wallet did start selling, it would probably crush—

Yeah, from a lore perspective and the brand, you could potentially be making plenty of money from the other wallets. And then if that supply ever moves, the whole market's going to reevaluate basically the liquid supply and sort of tank what you have. And also just the aura around Bitcoin is that it has an anonymous founder. And if the founder was ever truly unmasked, it would be so much less of like a special project. And I think everyone involved wants to keep it that way, although these investigations will never cease to be interesting. And so you can go read it on The New York Times from John Carreyrou.

Anyway.

Anyway, thank you so much for tuning in today. Bit of a shorter show. We're experimenting with different things. Obviously, we don't have ad reads anymore. And so we are going to be mixing it up with more stories, more interviews, different timing, and more flexibility. And so we hope you enjoyed this show. And we will see you tomorrow at 11:00 AM Pacific sharp. Goodbye. We love you. Leave us 5 stars on Apple Podcasts and Spotify. Sign up for our newsletter at tbpi.com. Thanks for hanging out, everybody. Goodbye. Cheers.