A.I. Safety Is So Back + Mythos Mayhem with Nikesh Arora + Hot Mess Express

26:44Google announced on Monday that for the first time ever, its threat intelligence group had identified an attacker using a zero-day exploit that the group believes was developed with AI. So that's kind of a grim milestone. And then if you're a student, perhaps you notice the cyber attack on the learning platform Canvas last week, which forced the site down for several hours. And the company behind Canvas, which is called Instructure, had to negotiate a deal with hackers for the return and destruction of the stolen data. So, you know, on one hand, there are cyber attacks going on all the time, but it does seem like some new inflection point has been reached.

27:19And of course, a reason that people think we might be seeing more of these is AI. Yes. So we have talked about Claude Mythos Preview, the model that Anthropic did not released widely, but released to a select group of companies and open source maintainers. And today we're actually going to talk to someone who has used Mythos and who has been on the front lines of this frantic sprint to secure the infrastructure of modern life. Yes, our guest today is Nikesh Arora. Nikesh is the CEO and chairman of Palo Alto Networks, the largest cybersecurity firm in the world, which supports more than 70 ,000 customers, including the vast majority of the Fortune 100.

27:57And as you mentioned, Kevin, Palo Alto was among the organizations given early access to Claude Mythos, as well as GPT 5.5 Cyber. Yes, and Nikesh is one of the people I think who is best positioned to see the effects that these models are having on cybersecurity because they do work so broadly across industries. They're also a big government contractor. So I'm just really interested in what he thinks is different about this new class of models. Yes, and something I appreciate about Nikesh is that in an industry where there is a lot of hype, because of course the more scared that a cybersecurity executive can make you, the more likely you might be to buy their software, Nikesh is somebody who I think tries to maintain an even -keeled approach here and not to ring alarm bells where none are needed.

28:41But that said, I do think that he is quite concerned about some of the things that he's saying. Well, let's bring him in.

28:53Nick Hesteroro, welcome to Hard Fork. Well, thank you for having me. I want to just start with your account of what it feels like to run a major cybersecurity company right now. Casey and I have talked with people at these companies for many years, usually because something terrible has happened. And I feel like the vibe we get is like, this is the worst, most dangerous time ever in cybersecurity. What is your subjective experience as someone who's been in this field for a long time? I'm a little more perhaps relaxed than what you're trying to ascribe, that people come here and tell us is the worst moment.

29:27Historically, what's happened is, in the last seven years, you've seen the time from somebody breaching an organization and being able to extract, let's say, crown jewels, has been measured in days. Unfortunately, with the emergence of AI, the arrival of vast technologies, that time frame has shrunk down to minutes. And when that happens in minutes, your defense systems have to be able to be activated and defend yourself for minutes. And fundamentally, the cybersecurity infrastructure was designed for days. Some parts of it are making it to seconds, the good parts where you know how to stop them.

30:01But we have to go basically overhaul the backend infrastructure to make sure it's AI ready so we can fight AI with AI. So you're seeing that. You're seeing AIs out there. You're seeing people like Anthropic launch models like Mythos. You see an open AI do that. It's 5.5 cyber. They're showing you the art of the possible from a bad actor perspective. So we have to make sure we move as fast as them or faster perhaps to try and plug those holes, make the infrastructure better. So your company recently put out a report on some patches that you all have made to your own systems. You disclosed 26 critical exploits covering 75 issues and you said that's against a typical baseline of under five.

30:43Yeah. Meaning that they discovered like five times as many in a comparable period. Five to seven times, yeah, depending. Yeah, so is that pretty standard for what kind of spike you all are seeing in exploits or discovered exploits as a result of Mythos and similar models? So what we've discovered, some of the newer models that have come out in the last few weeks, perhaps a month or so, is AI models are getting really good at coding. Well, guess what? As the models start to understand what good code looks like, they also start developing and understanding what bad code looks like. So if you point this model and say, okay, now look through all this code repository I have and find me bad code, it will.

31:20And unfortunately, humans have been writing bad code for a very long time. So on average, we'll find about one-fifth or one-seventh of what was found in the last six weeks using these models. Now, of course, remember, we ran a concerted effort to see what the models are going to find. We had hundreds of engineers working on it to make sure we look under every rock, run every product through it. It's almost like it's a great cleansing, right? So it's a great cleansing moment. we found seven times the volume that we would have normally found in a normal period. It's not going to happen again, hopefully, because we have hopefully cleared out a whole bunch of the, let's call it the tech debt or the vulnerability debt.

31:55But I think a lot of organizations will have to go through this moment to understand how much of their code written in the past suffers from these vulnerabilities. They'll have to do their own work. They'll have to make sure that it's fixed. I think the challenge we're going to run into is most companies use a large corpus of open source. And open source doesn't get bashed or remediated as quickly as your own proprietary code can. The other thing we found very interestingly with Mythos and other models is it's really good at daisy-chaining vulnerabilities. And that's what needs to be sort of contended for.

32:27I'm trying to get a sense of the scale of this issue because I feel like within the past few weeks, I've heard a lot of stories like the one you just described about your own company. You know, Mozilla has been publishing blog posts about discovering hundreds of bugs, you know, over a period where maybe previously they only would have discovered a couple of dozen. My sense is that as more companies sort of like undertake this audit, they're going to find that they have similar problems. So, like, what is the timescale that we might expect these kinds of issues to be fixed? And is there enough time to fix particularly, like, critical infrastructure before our adversaries gain access to similarly capable models?

33:07That's a great question. I think that's what should keep us up at night, right? Because not every organization has resources to fix code that could have been written 20 years ago. Now, the good news is that, you know, pretty much most of the cyber defenders have had access to the models. They understand the scale and enormity of the problem to some degree. I think what we have been able to do is we've been able to enlist the support of many of the system integrators in the world, like the IBMs, the Pricewaterhouse, the Lloyds, the Accentures, et cetera, who are all rallying to make sure they make resources available to many of these customers to be able to patch these things.

33:43But I think we are in the midst of sort of testing an interesting solve where we can, once we know the vulnerabilities in an organization, we can write signatures into our perimeter defense firewalls to say, if you see somebody trying to go in this direction, we know there's an unpatched piece of code behind it, block them. So we can create a temporary scaffolding to let organizations have a little bit more time to go fix their vulnerabilities. But it has to be done. And the risk, like you rightly articulated, is that open source or nation states or third parties can start building models that are similar to what Anthropic or OpenAI have built.

34:22And the risk is that they get there faster than the patches have been enabled in many enterprises. Yeah. I want to understand a little bit more about the defense side of this now that you have access to this Mythos model. There's been a lot written about it. It's the subject of much debate at the highest levels of power. and I kind of just want to ask, like, what is it like to use it? Does it feel different than using, like, Claude code, you know, like, if you've used another anthropic product, does it feel kind of the same? Or just like, what is it like to use Mythos? In the beginning, it was not that impactful because when you're looking for bad code, it's going to find everything.

35:01Remember, I mean, it's 30 % of false positives, right? So it's not like always going to get the right thing, but unfortunately, we've got to go test every one of them out to see which is real. But what became more and more fascinating the more context we gave it, the better it became. What do you mean? Well, it showed a piece of code. It doesn't know what the code is trying to achieve. Right. So you have to give it context. So you're not just pointing it and say, go test this firewall and tell me what you find. You're actually giving it some instructions beyond that. You have to give it context in terms of what is the purpose of the code?

35:30What does it do? What is normal behavior supposed to look like? Then you have to give it more context in terms of other threat research. The models don't have all the threat research in the world. We sit on hordes of threat data saying this is how 10 ,000 attacks have been conducted in the past five years, which is data we store, we hold, because we write machine learning algorithms to protect against those instances. So we say, well, we're arming you with all the past known techniques that have been used. Can you see if some of those known techniques can be applied in this scenario? Effectively, you're giving all the human training of the past to make sure that in the future you can build defense against those techniques.

36:04You mentioned using both Mythos and GPT 5.5 Cyber. I'm curious, like, in your mind, how comparable those models are. Like, are they in the same class or is one different than the other? You know, the most fascinating part is that they both found different things, which tells you that based on their grounding, their training, whatever they've been used to train at, one of them was better at certain things, the other one was better at some other things. But it just tells you that there is still a lot that's going to get found. I mean, one thing that stuck out to me as I was reading some of your blog posts and your sort of postmortems about your experiments with Mythos is like, if a cybersecurity company is finding five to seven times more vulnerabilities using this model, like the average bank, the average insurance company.

36:50To say nothing of Kevin's personal website. My personal website. I mean, we're going to be looking at many multiples of that, right? Or is it the case that everything is so centralized and runs through just a few platforms that the average institution is not as screwed as I think they are? I wouldn't say the average institution is screwed. I think, look, there's a lot of work that needs to be done. It's not just good at finding vulnerabilities. The other thing we also found as part of our testing, it can even take a look at products you might be using perhaps to power your website, which you may have misconfigured.

37:20That's not a vulnerability. That's human error in the way you're using the product if you've left the door open. For example, many people will take products and say, ah, it's easier if this control pane of this product was accessible from home or from the internet, so I could just go access it from wherever I am and manage this thing. Well, you should not leave control panes of most products in your company exposed to the internet. Because if I can find it, other people can find it too. Right. When Mythos was first announced, there were a lot of people who were very skeptical. They said, oh, this is just marketing hype or Anthropic doesn't have the compute to serve this model, which is why they're only releasing it to a select group of companies.

38:00A month or so later, do you still hear that kind of thing from people in your industry that maybe this isn't the sort of apocalyptic moment that Anthropic and others have said? Yeah, I look at it slightly from a longer term perspective. I think what the Mithos model showed is what the art of the possible is going to be in the future. Once we are compute unconstrained or we have better models in the future which are trained better. So it sort of gave us a window into what's coming. I think it was very useful. I think that's a bit of a tough rap towards Mithos that did this on purpose. Remember, these companies, whether it's OpenAI or Anthropic, they're sort of working their way, trying to understand how to do this.

38:45Both of them and OpenAI want to do it right. They want to do it so that AI is not used in a bad way, at least in this instance. I think they were trying to do the right thing. I think there is no easy solve to this. I give them marks for trying to do the right thing. And I think they sort of partly got most of it right. Some of it they fumbled on the way there. But in credit to both of them for trying to get it done right. Speaking of how we fix this, so for decades, cybersecurity has operated using this sort of 90-day responsible disclosure window. I find something, I find a bug, I sort of privately notify you, but in 90 days, you know, I'm going to go public with this, so you better get your act together and fix it.

39:25And companies often do take 90 days or longer to sort of implement those bug fixes. So I read a blog post this week by a researcher named Himanshu Anand who wrote that in his opinion, the 90-day responsible disclosure window is dead. I also saw that in your own company's blog post last week, you guys said that within 25 minutes in an AI-assisted scenario, somebody could get initial access to a system and exfiltrate the data. So do you agree that this 90-day window is dead? And if so, what the heck do we do about it? Like, I think the principle of the 90-day window is to allow the owners of the product or the piece of software or piece of code to have enough time to investigate, to fix it, and make sure their customers are secured.

40:08I think the 90-day window is going to shrink, as he has rightly articulated. How much does it shrink is still up for debate. How long do we have? Like, think about it for what we just did, right? We announced this morning that we've patched almost 30 critical vulnerabilities. We've known about these for two or three weeks. We've had the time to go test it. We had time to build patches. Pretty much deployed everything that's available from a SaaS software perspective. So challenge is not the SaaS software. SaaS software you can find, you can fix, you can deploy. It's not a problem. The challenge is when there's a laptop sitting in front of you and I've got to go make sure you update your laptop because you're required to do something with it.

40:42And I can tell you, he will go like six months without installing the mandatory updates. I'm not even kidding. Delay, delay, delay. I mean, I am starting to see more of those just in my products. and I'm getting more requests to update system software, is that Mythos related? No, seriously, I'm wondering to myself every time I see it, I'm like, oh, what did Mythos find now? So it's like, are we starting to see as consumers evidence that some of these systems are needing to be patched more frequently? I think there is going to be, as I said, there is going to be the cleansing of the vulnerability backlog that has been built over the years.

41:18So you will most likely experience in the next three to six months, if you're an enterprise, You'll experience it in a lot more boxes that you buy. You buy servers, you buy switches, you buy routers. All those things where you have code lying on them will have to be looked at and will have to be patched or upgraded over time. So you're going to see some of that cleansing happen, but hopefully you can power through it and get to the other side. But it sounds like it is just a good time to install those software updates when you get them. Yes, I highly recommend you do that. One persistent question about these kind of models is whether they favor attackers or defenders.

41:50So I guess I'm just going to put that question to you. Like, is this technology better for people who want to break into systems or people who want to safeguard systems? And if you had attackers and defenders with an equal model, who would win? It's a great question. The classic Batman versus Superman. Remember, it's an unbalanced fight to start with. We have to be right 100 % of the time. The bad guys can be right once. So it's an uneven playing field from that perspective. So the model, if it can find you five vulnerabilities and you can exploit one of them, it's a win for them and a loss for us.

42:26It doesn't matter if we protect you on the other four. We don't get 80 % grade for protecting the other four. We get zero because it was able to find something to reach it. So for now, the bad actor is most likely able to use it much better than the good people. That's not a model constraint or model fault. It's because the model doesn't protect. Remember, the sensors protect. The sensors we apply around your perimeter protect. The sensor has to be smart enough to understand what the model is going to find. And that's why the fact that we got this window of four to six weeks to test them, to understand them, we're busy building defense techniques to make sure that as this tsunami of AI-based attacks starts to arrive, we have enough defense capability, which is still powered by AI, to give us a real-time response that we need.

43:07Is there a sector of the economy that you're most worried about when it comes to cybersecurity and the new capabilities of the AI systems? You know, the challenge always is the companies which use technology where their core business is 95 % something else and the 5 % part is technologies. And you can take that to mean small businesses. You can take that to mean sort of core industrial manufacturing output type businesses where they're not spending as much time thinking about the technology. They're busy digging for gold or building infrastructure or something else. Or hospitals. Exactly. They use technology.

43:42So you're worried about the non-tech businesses that may not have as many resources or as many engineers working out? I'm not worried about financial institutions. They have more engineers than I do. So they will go rally against it. They'll put the resources to work. And they've been protecting themselves for a very long time. They understand the implications of these things. It's like in a poor doctor's office. Remember that there was a breach that happened, I think, almost a year ago now, slightly more, of Change Healthcare, which caused a whole bunch of the entire physician ecosystem to come to a halt.

44:10And the physician didn't know what to do about it. Yeah. Hmm. I mean, like, for the moment, like, do you sort of breathe a sigh of relief that these models are not generally available? Or do you think they could be released and it wouldn't be that big of a deal? Well, they have been released, right? Both Opus 4.7 Cyber and OpenAI's 5.5 have both been released with cyber capabilities and guardrails. But not Mythos. Not Mythos. But Mythos has another unique property, which perhaps goes towards a conversation about constraints, is that Mythos runs in ultra mode. Ultra mode is a compute consumptive mode, which allows the model to persist for much longer than the flash mode that most models are released in.

44:51So if you're... So you're saying it can just work for a lot longer, spend a lot more compute... That's right, that's right, that's right. Than other models. So the compute cost is from the persistence, perhaps, not from the capability. And the persistence allows the daisy chaining to happen much more effectively, right? Because it's trying different techniques, trying to see which one's most likely to work. So that's what causes the daisy chaining to happen in a more effective fashion. So is it a good thing that the average person doesn't have access to that right now? I think so. I think every company should have a chance to be able to fix these things in the meantime.

45:22But again, I don't know who the average person is in this case, right? Is every company out there an average person that they should have access to because they have to fix their stuff? You mean the average bad person? Basically. I mean, I'm just thinking about all of these cyber attacks that we've seen just over the past couple of weeks. And I'm assuming that they do not have access to a mythos-level model. And so I'm just asking myself, well, what if they did? Yeah, what if they did that they'll find a way to attack companies much faster? Yeah. Right. I don't think the nature of the attacks change.

45:48I don't think the nature of the outcomes change. Most likely they will be used to leverage ransomware, perhaps cause economic harm, if you're looking at it from a nation state perspective. I think the entire sort of fundamentals of how the bad actor industry works is not going to change. What it does change is the pace and the volume, perhaps, of attacks are going to be made possible because of the availability of these models. I want to talk a little bit about what, if anything, an average person can do here. I myself am the subject of an ongoing phishing attack where... Somebody must like you.

46:19I mean, I hope so. But basically, almost every day, somebody tries to get me to reset my X password from an email address that has nothing to do with X.com. And because I'm looking at my emails on the desktop, that's very easy for me to see. And I'm not fooled. You know, congratulations. That's me. I've been trying to steal your big point. How could you? But I also believe that within six months or a year, one of those emails is going to come in, and it's just going to look way more convincing. It's just going to figure out a way to trick me. And one of my frustrations with talking about cybersecurity in general is it tends to leave people with the sense of like, well, everything's really bad.

46:54Sorry, good luck to you. Usually, we give people advice like create a strong password and use multi-factor authentication. That's right. Is that good enough, or do people need to update the playbook? Look, I think one of the things to my frustration has always been that if you think about it, we have much better cybersecurity solutions in the enterprise world than we do for the consumers. For example, if you had a corporate email and all the phishing attacks will come to your corporate email, or spam is coming to your corporate email, we'd be pretty good at sussing these out because the X email address that we talk about that you're getting, which is not actually X, we see it in one customer, we'll block it everywhere else.

47:31Now, the problem is the consumer world doesn't have any such gatekeepers, right? because we're effectively the gatekeepers of enterprise, but consumer world doesn't have gatekeepers. The consumer gatekeepers are the email providers. The consumer gatekeepers are the telecom networks that give us, you know, if you were getting an attack on your corporate mobile device and we were sitting in front of it, it won't happen. But on our personal devices, we can all get spam, we can all get phished, we can all get all this stuff happen to us. I think part of the frustration I have is that there are some consumer companies that need to implement better cyber controls for all of us consumers, which they're not.

48:04Well, like any particular controls come to mind that you'd like to see out there? Well, think about the email, right? I mean, you're telling me, is it hard for the email provider to figure out that this is not an X email address? Like, we should. These same guys are building AI, right? These guys are building AI. It's going to anticipate what we want and do it for us. So somebody just needs to pay attention to it. That's sort of, I mean, like for what it's worth, so, you know, this is like my paid Google workspace for my work account. And like, you're absolutely right. Like, it seems like a very simple classifier that Google makes to just be like, this probably isn't coming from X.com.

48:36How are your engineers feeling about all this? I mean, I imagine they're working a lot these days. Are they excited because there's this new tool, new set of tools available to them? Are they stressed out because all of a sudden their workload just got five times bigger? Like, what is the mood? Yes. All of it. Look, think about it. If you're a technologist, this is a phenomenal time to be doing this, right? the amount of opportunity to learn, the amount of opportunity to understand. Some of the people are fearful. I'm like, how is this going to work? And you can find, I think, every emotion you can think of is probably in every engineering team out there.

49:13We have 9 ,000 plus technical people. I think it's not just the tool in front of us. I think it's the uncertainty of what this holds in the next two, three years. I mean, people are seeing OpenClaw being deployed. Now, OpenClaw is a scary thing from a security perspective. It's going to take all your permissions, all your credentials, do all kinds of stuff for you. But it's cool. So the early adopters are doing cool shit. I had dinner with somebody who came to my house. I got OpenClaw on my phone. It's doing everything. I've given it a name. It's called Zara. And it's doing all the things I'm asking it to do.

49:44And the guy sitting next to me said, holy shit, that's a security nightmare. You're worried about your XAI post to change your password? You don't need to change your password. OpenClaw is just going to tweet on your behalf because it's had a moment last night. Totally. Right? Yeah. Yeah. And for all of my objectionable tweets over the years, I would like to just formally say that was my OpenClaw acting autonomously. There we go. So are you personally like running any of these insecure, like are you running OpenClaw? Are you experimenting with this stuff just from like a, I need to understand the landscape perspective?

50:15On a segregated device, which has no connection to many of my things, which makes it totally useless, by the way. She can't even book a meeting on my schedule because it does not have access to my schedule. It can't respond to an email on my behalf because it doesn't have access to my email. So I'm still sort of using it the old-fashioned way, which is I'm using Gemini. I did do that. I took my earnings script, sent it to Gemini, and said, what do you think? Two quarters ago, it says, are you trying to hide something? You're too enthusiastic. Use the word momentum and excited too much more than you normally use.

50:44I'm like, holy shit. That's not bad. She's going to tone it down. That's very funny. Is it changing your hiring plans at all? I mean, you employ thousands of cybersecurity engineers and researchers. You may need fewer of those people in the future? No, I need more. I think this is the fallacy out there, right? The fallacy is that organizations are going to get 30, 40, 50, 60 % more productive from a development perspective and a testing perspective, so we need less people. The problem is every technologist that you talk to has a feature request list, which is longer than their arm. And typically people have product roadmaps that are six to 12 months out.

51:22Why is that? Because they don't have enough people or they cannot serialize something because it takes a lot of effort to get it done. So I think the first thing that's going to happen is as we create more capacity, we're going to try and fill the technological backlog and try and make that work. I do understand there are people out there, I'll call it reshaping their technical organizations by creating capacities. Everybody who's out there saying, I'm reducing my headcount by 7 % or 15 % or 20 % of you're beginning to see recently, and they're just creating capacity. They're saying that capacity allows me to hire more people and make room for people that I need who have the newer skill set.

51:59They're not just spending that salary money on tokens instead. Like, I think that the interesting part is, I was saying this earlier, I was speaking somewhere else, and the part we don't realize is that we're dealing with a tsunami of a desire to transform. I think we're in a decade-long transformation of business ahead of us. Imagine, like, you have new technology, my CFO would never come and say, I want to use AI to transform my team. He wants to transform his team and see if he can do it much more efficiently, but he wants AI. My head of HR wants AI because she wants to create an AI interviewer, an AI assessor, instead of having humans do it.

52:33So every function wants more AI to deploy. Now the question is, where's the money going to come from? It's probably going to come from efficiency in those teams, those functions. So that's what's going to pay for the tokens. I have to say, I don't think anyone wants to be interviewed by the AI assessor. That's not a good vibe, you know? I don't know. Would you want to be interviewed like for a job by an AI? I think AI is most likely going to be better at assessing my domain skills than a human being. Really? Yes. If you're trying to hire a good coder, if you're trying to hire somebody who knows agentic AI really well, I mean, sitting and talking to them is not going to get me a better answer.

53:12If they can sit and code and deploy OpenClaw in front of me, it's like, I literally have done that interview. I was like, I said, well, I'm really conversant. Yeah, I'm like, really? That's cool. What have you done for a second? Well, I built myself an agent. I'm like, show me. It's like, what do you mean? I'm like, you're on Zoom? Show me. They say there's like bizarre, like, you know, simplistic, like, oh, I got to make a shopping list from the recipe I saw. I'm like, dude. It's an AI girlfriend. It's like, actually, I shouldn't show you this. Yeah. So now we have an HR problem. Well, Nikesh, thanks so much for coming in.

53:43Really great to talk to you and good luck out there. Fascinating. Thank you, Kevin. Please tell Mythos to spare our families in the coming uprising.

53:56When we come back, it's time for the Hot Mess Express.

54:22This podcast is supported by Atlassian Rovo, AI that takes your team from AI novice to AI native. What if AI handled the busy work for you? Updating JIRA tickets, drafting campaign briefs in Confluence, writing project updates, all without you lifting a finger. Meet Rovo, AI that works where your team already works, Using your company's data and permissions to take action. Get started with Rovo at rovo.com. Running a small business means every hire matters, but finding great talent isn't easy. That's why LinkedIn built HiringPro, your new hiring partner that screens candidates for you, so instead of sorting through applications, you spend your time talking to candidates who are actually a good fit.

55:06With HiringPro, you can hire with confidence knowing you're getting the best talent for your business. In fact, those hiring with LinkedIn are 24 % less likely to need to reopen a role within 12 months compared to the leading competitor. Join the 2.7 million small businesses using LinkedIn to hire. Get started by posting your job for free at linkedin.com slash hardfork. Terms and conditions apply. This podcast is supported by MidiHealth. Are you in midlife feeling dismissed and unheard by the healthcare system? You're not alone. For too long, women's midlife health issues have been trivialized and ignored.

55:37It's time for a change. It's time for Midi. MIDI is the only women's telehealth brand covered by major insurance companies, making expert care accessible and affordable. MIDI's clinicians provide one-on-one consultations where they truly listen to your unique needs, offering data-driven solutions tailored for you. At MIDI, you'll feel seen, heard, and prioritized. Visit JoinMIDI.com to book your insurance-covered virtual visit. That's JoinMIDI.com. MIDI, the care women deserve. Well, Casey, we've got a train to catch today. The Hot Mess Express is here.

56:15The Hot Mess Express is, of course, our segment where we take a look at the various calamities befalling people in and around the tech industry. And at the end of discussing them, decide what kind of mess was this? What's pulling up to the station today? Well, let's see what's first here on the tracks. You just love the sound effect. Our first story today comes from The Verge. Oh, and this is truly the end of an era. Venmo is starting to test a big redesign of its app. And as part of the changes, Kevin, it will be implementing a major new privacy feature. The onboarding process for new users will set their posts to only be viewable by their friends by default instead of being public.

56:54And this is very sad for me because for years now, every time I've opened up Venmo to, you know, pay a friend, I've seen a recent transaction from someone I hooked up with once in 2016. And the thought that other people aren't going to have that experience makes me really sad. So, you know, as a nosy person who loves to gossip, I am sad about this story because, you know, it was always fun to see which of your random phone contacts had been paying their fractional share of the rent or back for dinner. People put various jokey things on their transactions, you know, illicit drug deal, foreign arms trade, et cetera.

57:33And it's just sad that we won't get to experience that. Yeah. Also, you know, the public by default Venmo transactions gave us many great stories over the years, including Joe Biden's secret Venmo, which was a BuzzFeed story. J.D. Vance had a public Venmo that Wired reported on. Matt Gaetz's Venmo payments were part of a federal inquiry into his payments to women, according to the New York Times. So I guess all of us investigative reporters are going to have to find a new easy way of writing a story, Kevin. Yeah, now the only baffling security breach from these apps is that Telegram still does notify you when one of your phone contacts joins.

58:10And I always love to screenshot that and send it to people and be like, crypto or drugs? What is it this week? The only two possible answers. So what kind of mess is this Venmo mess? This is unfortunately a cleanup, not a mess. This used to be a very hot mess, and now, belatedly, it is getting cleaned up. Fair enough. RIP. Let's see what else is coming down the tracks. Oh, well, this was interesting, Kevin, and ties in closely to something that you've written about recently. Amazon has started to widely deploy its in-house MeshClaw product in recent weeks, which allows employees to create AI agents that can connect to workplace software and carry out tasks on a user's behalf.

58:51But some employees are saying that colleagues are using the software to automate additional unnecessary AI activity to increase their consumption of tokens, which will then, of course, make them look better to their bosses. So did we see that one coming or what? Yes. I believe you invoked Goodhart's law about what happens when a target becomes a measure or a measure becomes a target. When a measure becomes a target, it ceases to become a good measure is, of course, Goodhart's law. Thank you so much for that. Yes. And I imagine that at the famously frugal Amazon, they are loving this era of people just spending a bunch of random tokens to move up the leaderboard.

59:33Here's the thing. I've talked to a lot of, you know, Amazon employees over the years. Tokens are the only thing at that company that is free. You want a Diet Coke from the vending machine? Get out your wallet. Okay? So these guys finally find something free and now they're getting in trouble. Yeah. The good news is they have unlimited tokens. The bad news is they can only use them on mesh claw. Yeah, I'm going to say that this is actually a hot mesh. That's what kind of mess this is. Very good. All right. Next up, Kevin. This comes to us from 404 Media. And boy, did I see this clip in about 14 different places over the past week.

1:00:09Students boo commencement speaker after she calls AI, quote, the next industrial revolution. You see this one? Yes. Yeah, so May 8th, commencement speaker Gloria Caulfield, who's the vice president of strategic alliances at Tavistock Group, told graduates of the University of Central Florida's College of Arts and Humanities and Nicholson School of Communication that AI is the next industrial revolution. She was met with thousands of booing graduates and someone in the crowd, Kevin, yelled, AI sucks. So what did you make of this commencement moment? Here's my thing. Yeah. Students are allowed to feel however they want about AI Yeah But if you boo the commencement speaker For suggesting that AI is a big deal I want to see your chat to be the history If you have used AI to write your exams To help you with your problem sets In any way for your academic work You are not allowed to boo it at commencement That is my rule I don't know I think these students were fine to boo I mean, you know, Ms.

1:01:09Caulfield was, after all Addressing the College of the Arts and Humanities who I'm guessing is probably not the group of students at the university that are most excited to see AI come into their lives. So here's the thing that I'll say that is sincere. I think people are radically underestimating how mobilized young people are against AI right now. I see this every time I go to a college to talk to students. There's like a small group of them who are like running open claws and very excited. And like 80 % of them are like, I hate this. Yeah. So look, if you have to give a commencement speech within the next few months or a highly relatable situation that many of our listeners will be in, now you know.

1:01:49Yeah. Careful how you talk about AI. Yeah. Okay. Kevin, our next story comes to us from the good folks at Variety. Dua Lipa has filed a$15 million lawsuit against Samsung for using her face to sell TVs. And this one is honestly pretty incredible. Samsung has apparently used Dua Lipa's image on the cardboard packaging of its TVs starting last year. When Ms. Lipa became aware of it, she demanded that the company stop using her image and apparently could not get through to anyone at Samsung. So Samsung finally responds on Monday and said this was all the fault of some third-party content partner.

1:02:27And Samsung said, we have great respect for Ms. Lipa and the intellectual property of all artists, and they are actively seeking and remain open to a constructive resolution with Miss Lipa's team. Well, it sounds like a constructive resolution could be taking her face off the packaging and paying her$15 million. And I understand her concern because the thing that people always forget about Samsung products is that they do explode when you least expect them. There was, of course, the famous series of explosions related to their phones. So if I see my face on a Samsung TV, I'm thinking I do not want to be the literal face of an exploding piece of hardware.

1:03:00Yeah. What kind of mess is this this is a true hot mess because the tv could have exploded yeah now here you want to read one okay okay all right this next one comes to us from our colleagues at the new york times ebay rejects game stops 55 billion dollar takeover bid last week game stop offered 55 billion to ebay in an unsolicited takeover attempt uh according to some interviews they appeared not to have 55 billion which would put a damper on their plans. This week, eBay officially said no to the GameStop offer, calling it, quote, neither credible nor attractive, which is also what our last iTunes review of this podcast said.

1:03:44And there you have it. You know, this one is an interesting story from the world of what I like to call companies that I can't believe still exist. I don't know what's happening on eBay. I don't know what's happening at GameStop. but what I do know is these companies probably don't belong together, Kevin. Yeah, I find this fascinating because it is just like the internet-brained CEO of GameStop. He's this guy, Ryan Cohen, who's like, you know, sort of rose to prominence during the meme stock mania of like 2020 and 2021. And now you can just do whatever you want. If you're the CEO of a company, you can just say, we're going to buy a company that's like five times bigger than us.

1:04:21How? Shame on you for asking. I mean, is it unreasonable, given their history to expect that they could have announced this and GameStop stock could have gone through the roof and all of a sudden they would have had$55 billion by eBay. Yeah. But that didn't happen. Well, if they had done this deal in typical GameStop fashion, they would have offered about half of what the market value for eBay was because it's used and probably doesn't even work on your console anymore. I like jokes that you'll only get if you have returned a video game to GameStop. It's kind of a... Listen, for our younger listeners, there used to be a time when you could walk into GameStop with a box of old video games that you wanted to get rid of, and they would offer you between 50 cents and$1 for each video game.

1:05:07All right. This is the sort of mess where we're explaining the joke. Okay. Okay. So we've got a few more items, Kevin. So Sheehan and Timu are fighting it out in UK courts, Kevin, as Sheehan has accused Timu of, quote, quote, astonishing levels of copyright infringement. And Timu accused Sheehan of waging, quote, an aggressive and relentless battle using copyright allegations to undermine competition. This comes to us from Bloomberg. And the whole trial revolves around thousands of photographs that Sheehan says are from its website. According to Sheehan's lawyers, Timu sold identical clothing items using the same images and is seeking to piggyback off Sheehan's own investment in building up its supply chain and training and upskilling suppliers.

1:05:50What do you make of this fight? The fast fashion brands are fighting. They're fighting. There's no one I'm rooting for in this fight. I've never bought an item of clothing from either of them. But it is very funny that two of the brands who have made their sort of entire existence ripping off the clothing from more established purveyors are now fighting each other about which one's ripping off the other one. Yeah, truly a situation where, is there a way they both could lose and learn a hard lesson about intellectual property? Yes. We're rooting for them. next up favorite story of the week Kevin and I imagine you heard about this one people are seriously pissed that Grindr outed them with its latest Madonna advert did this happen to you?

1:06:34No so this issue stems from the fact that Madonna has been doing this big campaign inside of Grindr to promote her upcoming album Confessions on a Dance Floor 2 which is a concept album about a 68 year old woman who still wants to be at a nightclub like after midnight and she's uh advertising on grinder and apparently over the past week when you opened up grinder even if you had your phone volume turned off you would hear a sound of madonna saying loudly hi grinder it's mother no which first of all it's grandmother sorry second of all apparently like you know people who are not out to their families were opening Grindr at the dinner table, which, you know, you're already sort of putting yourself in harm's way there, maybe.

1:07:21But the last thing they expected was to have Madonna being like, hey, look at this guy. He's on Grindr right now. So truly one of the most misconceived ad campaigns in recent history. Wow. Yeah. That's so wild. It's like if they put U2's Songs of Innocence on your phone, but it just outed you to your family. Yeah. The song was you're gay that was the that was the song this here's the thing this is a dangerous mess it is not always safe for people to be outed to people in their immediate surroundings so shame on grinder they really should have known better yes push notifications should be illegal all right and one more one more car coming down the train tracks here kevin this is from the elon open ai trial this week sam altman was on the witness stand tuesday and testified that at one point elon thought he should run open AI.

1:08:14Sam asked him, hey, what do you think would happen to the company if you died? And according to Sam, Elon replied, I haven't thought about it a ton, but maybe control should pass to my children? Question mark, question mark. Question mark, question mark. So what do you think? Well, let me just ask it this way. Do you think we would be better off if open AI was a hereditary monarchy controlled by the Musk clan? I do. That really is the idea. You know, we always talk about what is the ideal governance structure for AGI. Yeah. I think we can all agree that it would be best if, you know, Elon's 27 children were involved somehow.

1:08:51Yeah, or just, you know, I don't know, they pick one at random. You know, one is probably, I don't know, 11 years old and rides a skateboard around town. They're like, all right, kid, you run AGI now. Best of luck. So, yeah, that continues to be a legal mess. Yeah, the whole trial has just been fascinating to me, less because I care about the actual, like, legal issue on trial and more because it has just produced all these amazing and incriminating files from like the early days of OpenAI, including all of their texts and emails and messy dramas. I live for it. Yeah, I mean, look, it's very hard to run a successful company without a lot of executives saying a bunch of really stupid things and writing them down.

1:09:28Like we just see it over and over again. Yeah. Yeah. So let that be a lesson to us. Yep. Hot mess. And that is it for the Hot Mess Express. Thank you to all of this week's passengers and best of luck with your messes. Try to stay on the right side of the tracks.

1:09:52This podcast is supported by Atlassian Rovo, AI that takes your team from AI novice to AI native. What if AI handled the busy work for you? Updating JIRA tickets, drafting campaign briefs in Confluence, writing project updates, all without you lifting a finger. Meet Rovo, AI that works where your team already works, using your company's data and permissions to take action. Get started with Rovo at rovo.com. Running a small business means every hire matters, but finding great talent isn't easy. That's why LinkedIn built Hiring Pro, your new hiring partner that screens candidates for you so instead of sorting through applications, you spend your time talking to candidates who are actually a good fit.

1:10:36With Hiring Pro, you can hire with confidence knowing you're getting the best talent for your business. In fact, those hiring with LinkedIn are 24 % less likely to need to reopen a role within 12 months compared to the leading competitor. Join the 2.7 million small businesses using LinkedIn to hire. Get started by posting your job for free at linkedin.com slash hardfork. Terms and conditions apply. I'm Winnalou. I write the game Connections, one of the puzzles from New York Times games, and I love horror movies. I love my dog, and I love trying to trick you. I'm Tracy Bennett. I get to pick the wordle word every day, which is not as easy as it sounds.

1:11:11The fun fact about me is that I am descended from a witch who was put on trial in Salem. New York Times games are made by people like the ones you just heard from. Go to nytimes.com slash games to start playing today. Hey, before we go, one request. We want to hear what it's like for people who are undergoing major career changes in response to AI. So, for example, if you have recently left a computer or desk job to do something more manual like HVAC installation or tree trimming, we would love to hear how it's going. So anything in that realm, please send us an email. We would love for you to share your story with our audience.

1:11:55Our email, again, of course, is hardfork at nytimes.com. tell us about your career shift and why you're making the change.

1:12:29You can email us at hardfork at nytimes.com with what you would do with Mythos if you could.

1:12:59Thank you.