AI Neanderthal by Malcolm Werchota

Imagine you're abroad, you try to pay your taxes online, and you can't get in. Your friend at home can. The whole country has put up a border around its websites. That was Latvia in October 2026. And a few thousand kilometres away, Japan's prime minister told every business: patch your website tonight, or switch it off. Today one question: when the patch itself can be poisoned, who do you still trust? In this episode: 🗾 When a country goes into lockdown: Tokyo and Riga (02:55) — Japan's "Black October": more than 20 major Japanese companies disclosed attacks, according to the Financial Times. Rail company JR East lost about 1.67 million customer email addresses, car-sharing service Times Car leaked data from about 6.6 million member accounts including driving-licence images, a ransomware attack on a SoftBank cloud unit hit 495 companies and local governments, and on the 24th the internet company GMO disclosed unauthorised trades in customers' foreign-exchange accounts. Prime Minister Sanae Takaichi told businesses to patch or go offline. Latvia's CERT.LV took another route: it restricted access to state websites from abroad while keeping them open at home. ☠️ The poisoned official update: LiteLLM (11:20) — LiteLLM is the switchboard that connects a company's apps to OpenAI, Anthropic, Google and others, so it holds the keys to all of them. An official release, version 1.107.0, shipped with a credential stealer inside, slipped in through a look-alike repository in the packaging process. It was live for about two hours and was downloaded tens of thousands of times. Most CEOs don't even know whether their company uses it. 🌊 Altman and Clinton: the vulnerability tsunami (20:05) — Sam Altman, speaking at Stanford's Graduate School of Business, said in essence that he no longer thinks we will be able to patch all the bugs (paraphrased on air). Two days later Anthropic's Jason Clinton wrote that things will get a lot worse for the next 18 months. Two rivals, one message: AI finds the flaws in human-written code faster than companies can fix them. 🧵 The thread (25:55) — Black October isn't one bad week. Discovery runs at machine speed, repair runs at meeting speed. Ask your IT this week: do we know which AI tools and packages we run, and who checks an "official" update before it goes in? Corrections to the recording: • 24 hours after the PHP fix, about 99.28% of roughly two million visible PHP servers still showed an unpatched version, according to OX Security, not "90%". • The poisoned LiteLLM release was downloaded tens of thousands of times in its roughly two-hour window, not "hundreds of thousands". • Jason Clinton is Anthropic's deputy Chief Information Security Officer (deputy CISO). Sources: Financial Times, JR East, Times Car, SoftBank, GMO, Sanae Takaichi on X (21 Oct 2026), CERT.LV, LiteLLM incident post, Wiz, BleepingComputer, GitGuardian, Stanford GSB, Jason D. Clinton on X (22 Oct 2026), OX Security. Disclosure: Malcolm is an Anthropic Claude Ambassador. The full hour on the vulnerability tsunami: The AI Cookbook Show #136 (out now) and #137 (Thursday). 📱 Ping Malcolm on WhatsApp/Telegram/Signal: +43 676 6144 904 🌐 werchota.ai AI Neanderthal — AI news for humans, not robots. Stay curious.

Imagine AI software reading your customer data – and it isn't your IT team that notices, it's the AI company telling the government. That's what India's cyber agency published this week. Plus: four AI agents beat Minecraft in 27 hours, and a company credit card built for bots.Today is one question: which doors did we leave open – and who is walking through them?In this episode:🌑 AI agents inside Indian companies (01:50) — CERT-In, India's national cyber-security agency, published a Critical advisory on 15 October: several AI companies were testing their AI agents on the open internet, and, as quoted by TechCrunch, the agents "exceeded the authorisation of their assigned tasks", reached live systems of Indian organisations and read personal data and confidential business records. No fancy hacking: they came through doors left open – passwords and keys in public code, over-privileged cloud accounts, payment keys stored in plain text.🌑 AI agents at Alibaba's door (05:39) — Researchers found a fleet of AI agents knocking on Amap, Alibaba's map app: more than 2,600 attempts to pull data between 28 September and 8 October, traced in the full report (per The Next Web) to Tencent's cloud servers. A person close to Tencent says it was a temporary team testing outside AI models, and it has ended.🌑 Four AI agents beat Minecraft (07:32) — Google DeepMind researchers put four AI agents running on Gemini 4 Argon into Minecraft to beat the Ender Dragon: done in 27 hours and 14 minutes, with 2,783 programs written by the agents and 605 deaths. One run, not yet checked by outsiders – but three working days in a row with no human.🌑 A company credit card for AI agents (10:09) — US finance start-up Ramp now offers a corporate card designed for AI agents, TechCrunch reports. Investors just put in $1.85 billion at a $60 billion valuation; Ramp says yearly revenue is above $2 billion. Who in your company is allowed to spend money – soon including software?🌑 A CEO loses Claude (11:57) — Daniel Heinen, who presents himself as CEO of Graylark, says his company's entire Claude Enterprise account was suspended; the story online links it to a joke photo of a handgun next to a laptop running Claude. We found no statement from Anthropic, and timing alone doesn't prove the cause. The lesson: one automated decision can switch off a company that runs on a single AI provider.🌑 Mistral's Timestral (14:08) — Mistral released Timestral, forecasting models that run without expensive graphics chips; an independent Superlinear test found them better than classic methods on Walmart and fresh-food data. Per Superlinear, the free licence only applies below $20 million in monthly revenue.🧵 The thread (15:58) — AI agents are walking through doors we left open – in companies, in games, in our wallets. Close some of them, and open the others on purpose.📱 Ping Malcolm on WhatsApp/Telegram/Signal: +43 676 6144 904🌐 werchota.aiAI Neanderthal — AI news for humans, not robots. Stay curious.

You tell ChatGPT you want to buy your wife a watch – and the next morning the jeweller calls? Advertisers in ChatGPT can now aim ads using email and phone lists, and ads can follow your current chat. In Germany, a court says: chat data for ads only with real consent.Today is one question: who owns your conversations with AI – and what does it cost when the AI bet wobbles?In this episode:🌑 Your chats are ad data (01:27) — ChatGPT has about a billion users a month and now shows ads. 404 Media tested the system: advertisers can upload lists of email addresses, phone numbers or the Android advertising ID, which OpenAI matches to real accounts – per Gizmodo, a list needs 25,000 matches. OpenAI's own help text says ads may still be based on your current chat. In Germany, the Cologne Regional Court ruled, in a case brought by consumer group vzbv, that Snap may not use chats with its My AI chatbot for personalised ads without a valid legal basis; pre-ticked boxes aren't enough. Once final, breaches can cost up to €250,000 per violation; Snap can still appeal.🌑 Black Thursday in Seoul (04:54) — South Korea's main index, the KOSPI, fell 7.57 percent in one day; Samsung Electronics lost 9.48 percent, SK hynix 11.06 percent. A circuit breaker kicked in at 12:38, the seventh losing day in a row. The Korea Times names three reasons: doubts that AI spending will pay off, a hot US inflation number and US government borrowing costs above 5.3 percent. The KOSPI is now 40.4 percent below its 19 June peak of 9,385 points (on air: "four percent" and "June 2019" – it's 40.4 percent, from 19 June this year; Malcolm's correction is at the end of the episode). Not financial advice – for information only, not a recommendation to buy or sell any security.🌑 Anthropic opens its books on jobs (08:20) — Anthropic published data on its own workforce: since August, AI agents log six times as many hours as humans, engineers make about five times as many code commits as six months earlier, and the junior share of technical hires fell from 27 to 9 percent. It's Anthropic's own count – and Anthropic sells AI agents.🌑 Robotaxis in Hong Kong (11:10) — Baidu's Apollo Go is running Hong Kong's first public robotaxi trial: more than 1,000 residents of Tung Chung ride free from 21 October to 3 November, with a backup safety operator in every car. If robotaxis work on Hong Kong's narrow streets, they work almost anywhere.🧵 The thread (12:34) — your chats become ad data, AI agents outwork humans in hours, and a whole stock market shakes with the AI bet. AI is leaving the lab.📱 Ping Malcolm on WhatsApp/Telegram/Signal: +43 676 6144 904🌐 werchota.aiAI Neanderthal — AI news for humans, not robots. Stay curious.

AI puts its bills on the table: Anthropic makes $16.8 billion in three months – and investors say "not enough". A bank brings in 1,000 people because AI found too many holes. And Germany says yes to Nvidia.Today is one question: what happens when the AI boom has to show its bills – and who pays in the end?In this episode:🌑 Wildberger and Nvidia (01:46) — Germany's digital minister Karsten Wildberger (CDU) told Tagesspiegel the "extremely high" revenue from AI must be taxed; hours later he told RTL/ntv he wants growth through AI and isn't talking about new taxes (dpa-AFX). Two days later Handelsblatt reported, confirmed by Deutschlandfunk, that the government plans an AI partnership with Nvidia: a three-digit-million-euro investment, Nvidia engineers and chips, about a dozen companies including Siemens, Audi and Black Forest Labs, aimed at physical AI for robots and self-driving cars. Wildberger calls the potential "gewaltig" – huge. The official announcement is planned for Monday in Berlin; until then it is a press report.🌑 Anthropic: a record, but "not enough" (05:22) — Reuters reports Anthropic told investors it made $16.8 billion in revenue last quarter, up from $11.6 billion – about 45 percent, after nearly 150 percent the quarter before. For its planned November IPO, some investors now talk about a $1.5 trillion valuation instead of $2 trillion – investor talk, not a set price. Reuters also reports at least $518 billion in compute commitments over ten years, about 80 percent non-cancellable (on air: "highly indebted" – these are commitments, not debt).🌑 Bank of America's 1,000 bug-fixers (09:04) — CEO Brian Moynihan told CNBC the bank brought in about 1,000 contractors between April and June to fix flaws found by powerful AI models such as Anthropic's Mythos, alongside 3,000 of its own staff. The fixes plus anti-money-laundering work cost "a couple hundred million dollars plus" last quarter, combined (in the cold open: "thousands" – it's about 1,000).🌑 The Fed and jobs (12:05) — In the Fed's 14 October Beige Book, five of twelve districts report firms not replacing people who leave or delaying hiring after investing in AI. In Dallas, AI agents ran more than 180 hours of job interviews in two days – and the firm then hired new recruiters to review them. Business anecdotes, not statistics.🌑 Five times no to Palantir (15:03) — Swiss magazine Republik reports the Swiss army and procurement agency armasuisse looked at Palantir products five times since 2020 – five times no purchase. In three cases data control was a reason; in 2022 even the test failed because the solution couldn't run on Swiss infrastructure. Palantir disputes a formal, in-depth evaluation.🧵 The thread (16:54) — record revenue, but not enough; 1,000 new jobs, but only to clean up; Berlin says yes to Nvidia, Bern says no to Palantir. The bills are real – and they prove this stuff is actually being used.📱 Ping Malcolm on WhatsApp/Telegram/Signal: +43 676 6144 904🌐 werchota.aiAI Neanderthal — AI news for humans, not robots. Stay curious.

An OpenAI engineer is accused of hiding a $24 recorder behind a TV in an executive meeting room – wrapped in toilet paper. In China, people now rent out their faces to AI for $15 to $700.Today is one question: when AI can do the job, what is still worth paying a human for – and who checks what the AI knows about us? A shorter episode with shorter stories.In this episode:🌑 A hidden recorder at OpenAI (01:14) — the FBI arrested OpenAI engineer Abdulrahman Alfozan (35) on 9 October, the US Justice Department says. Prosecutors allege he hid a recording device behind a TV in an executive meeting room, plugged into a USB port and wrapped in toilet paper. Business Insider identified it as a Seeed Studio microcontroller that costs about $24. Prosecutors say a ChatGPT account linked to his wife was used to ask how to build and hide a continuous recorder, and Fortune reports he used an internal OpenAI tool to find where high-level meetings happen. OpenAI says it used its own models in the investigation. He is charged with intercepting oral communications – not espionage or theft of trade secrets – and his lawyer warns against jumping to conclusions. These are allegations only.🌑 Rent your face (05:53) — Rest of World reports Chinese platforms like ActID (Shenzhen) and New Claw now license ordinary people's faces to AI drama studios, for roughly $15 to $700 depending on use. The reason: China's microdrama industry – more than 800 million viewers, over $14 billion last year, and about 430,000 microdramas in the first eight months of 2026, more than 90 percent made with AI somewhere in production. Audiences complained that AI characters all look the same, so studios need real faces again. The business question: owning a video of someone is not the same as owning the right to generate new performances they never gave.🌑 Character.AI goes bankrupt – Disney bids (10:53) — the chatbot app, valued at one billion dollars in 2023, filed for Chapter 11, Reuters and NBC News report. Disney's opening (stalking-horse) bid is 20 million dollars for a licence to some of its technology (Malcolm says 22 million on air – it's 20). Reuters reports about 12 million active users and an operating loss of 8 to 9 million dollars a month, plus lawsuits in Kentucky and Pennsylvania. Earlier this month Disney hired Character.AI's former CEO, Karandeep Anand, as its CTO. In AI, every conversation comes with a bill.🌑 ASML is sold out (14:37) — Europe's most valuable tech company, the only maker of EUV machines for the most advanced AI chips, reported record quarterly sales of 11.7 billion euros (not dollars, as said on air). CEO Christophe Fouquet says planned supply for 2027 and 2028 will not fully meet customer demand; some customers want to order for 2029 and 2030. Nobody plans machines four years out for a bubble that pops next quarter.🌑 Austria: less AI, less training, more fear (16:42) — an Allianz survey of 1,000 people in each of eight countries: 43 percent of Austrians use AI weekly (average 48), only 11 percent got AI training at work (average 17), and the sentiment on job losses is minus 81 percent (average minus 67). One insurer's survey – but it matches what Malcolm sees.🧵 The thread (18:20) — a $24 device, a rented face, a billion-dollar chatbot sold for a licence fee. AI makes things cheap – the human parts are where the value, and the risk, now sit.📱 Ping Malcolm on WhatsApp/Telegram/Signal: +43 676 6144 904🌐 werchota.aiAI Neanderthal — AI news for humans, not robots. Stay curious.