Be Careful What You Wish For

Hello and welcome back, thank you for tuning in and all those casual opening phrases. So I started this newsletter and my deeper journey into AI around March of this year. At the start of the year, it became apparent that AI was not possible to ignore, and frankly I had a lot of anxiety around what was coming and how it might affect my livelihood and the livelihood of the people I know and love. So instead of staying on the sidelines, I thought it was best to get into it and figure out what was going on, what fear I should have, if any, and also, what using this technology would unlock for me personally.

At that time I had started to experiment with the latest tool which was Agentic AI (Openclaw and Hermes) and its was quite eye opening. Agentic AI differs from a chatbot in that it has a set of tools and a file structure that gives it memory. It can perform a task. You rub the magic lamp a bit and instead of the output being a string of words, it can be a recurring search to help you book your weekly tennis class, or a coded website to accompany a local storefront, or an interface that tells you everyday a summary of how much solar energy you produce in a given day. All of these were just a prompt and some follow-up mesages away from being generated into existence.

Rub the lamp and get the task done. No string of words required.

What happened to the calendar

Along the way, and I think unsurprisingly, there is a lot of out-lash around AI. How it is taking jobs or replacing art or ruining the environment(isn’t everything?). I’ve experienced that out-lash now first hand, and after giving it some time to let the situation settle, I am ready to unpack it for you here.

I sometimes do work for different groups I’m involved in, volunteering my time. In this case I used AI to code a website and backend photo submission and an ordering system. The final product was going to be a printed wall calendar. This was a community project that would require the community to submit photos. And the community was in uproar, the outcry came because there was the assumption that AI was being used, that the AI would be altering photos (it would not) and that the photos would feed an AI model (they were not, all of my services are paid and I opt-out). Now, rationally, you could see the answers to this and then decide. But the feeling I had was that there was a greater boogie man present in AI, which you will see, according to two polls is the current status of things.

Worried and using it anyway

The reaction to the calendar project has been on my mind while looking at the polls. In a survey Pew Research Center published in August found that 52% of Americans were more concerned than excited about AI in daily life, up from 37% in 2021. Another 37% felt both equally. Even among adults under 30, a majority were more concerned than excited. And people are using it anyway (there’s the messy part). YouGov’s October poll found 55% use AI at least weekly, with almost the same rate among people who have concerns.

That jump came between 2022 and 2023, and it has not come back down.

If you unpacking the data, only 9% of people are more excited than concerned about AI, and 89% have at least one concern about using it. The top concerns are: data privacy and security, and over-reliance on AI. These were the exact issues that I faced with the calendar. It’s clear that we are at the early stages of AI adoption and to no-one’s surprise I am sitting at the frontier, which I think is simultaneously why you are interested in my ramblings but also why I am the lightning rod for those who are still concerned. I am appreciative of everyone who is here to learn and I also want to say that I think it is ok if you are in the category of people who have 1 or more concerns. I encourage you to write in with them and let’s explore them together. I am realistic in thinking that I don’t believe I can change minds, but I can present information and opinion as someone that you can trust or grow to trust. In the meantime, let’s get to this week’s news.

The top two are exactly what I ran into with the calendar.

Anthropic Opens Its Books

Anthropic’s IPO is coming, we talked about it last week. This week we got their S-1 filing and learned all sorts of things about their ambitions and where they are going. Let’s dive in to learn more about what the frontier lab is doing, and looking to do.

The artwork that opens the founders’ letter in Anthropic’s S-1.

We believe that AI is one of the most consequential technologies in human history. If managed well, it could rapidly accelerate scientific innovation, greatly increase economic growth rates, bring cures for major diseases within reach, and solve problems that have resisted generations of human effort.

That is the first line of the letter the seven co-founders put at the front of Anthropic’s filing. They are building toward “a country of geniuses in a data center”. Who decides what Anthropic does?

Anthropic is a public benefit corporation. Its board has a legal duty to weigh shareholders’ money alongside the people its work affects and the company’s stated purpose of developing AI responsibly. A trust whose five trustees have no money in Anthropic elects four of the seven directors.

The founders elect the other three. They also hold 50.1% of the votes on general company decisions, including a sale. Someone buying ordinary shares gets one vote per share and little say beside that. The filing warns buyers that the trust and founders may vote in ways they disagree with. Anthropic is telling you this before you buy.

And the decisions could cost money. The letter says Anthropic held back Claude Mythos Preview because its cybersecurity abilities made a wide release too risky without new safeguards. It later released those abilities as Claude Fable 5, after building the safeguards, and says “we also gave away around $100 million in Claude credits to cyber defenders”. The delay meant “forgoing substantial revenue and ceding ground to competitors”.

During security tests before release, Anthropic’s own models gained unauthorized access to real computer systems. The company suspended some of those tests. Real computer systems.

Dario Amodei, Anthropic’s CEO and one of the seven co-founders who signed the letter, at TechCrunch Disrupt 2023. Photo: TechCrunch, CC BY 2.0.

How big is the bill, exactly

And there is a lot of business for these decisions to affect. Anthropic brought in $16.3 billion in the first half of 2026, up from $1.16 billion in the same period a year earlier. Its reported loss for the half was $80.7 billion, though about $72 billion of that was an accounting charge on money it borrowed that can turn into shares. It was not $72 billion leaving the bank.

The computing bill is plenty real. Anthropic has promised providers about $417 billion. In the letter, the founders say those forward investments “may seem irresponsibly large at first glance”. Meanwhile, Claude wrote over 90% of contributions to the company’s code in September.

I also liked the advice the founders say they took before going public: “never let your company be worth a dollar more than it is actually worth.” They have committed to keeping Claude free of advertising, because people bring personal questions and important work to it. And they ask buyers “not to think of your purchase in purely transactional terms”.

That is quite an ask from a company selling stock. I appreciate them putting it on the first pages, where a buyer can decide what they think.

From Anthropic’s S-1: customers paying $100,000 or more over the past year.

Six Billion Dollars in Twenty Minutes

↩  Previously · Issue 27 “Black hats and white hats both have AI on their desks now.” Issue 27

Binance is the world’s biggest crypto exchange. People use it to buy, sell and hold coins such as bitcoin and ether. Think of a bank and a stock exchange for crypto in one. On Thursday, October 29, about $6.3 billion was taken from its hot wallets, the internet-connected accounts it uses to pay withdrawals. Most of the money went in about 20 minutes.

What money? Roughly $3.79 billion in ether and other tokens on the Ethereum network, $1.47 billion in bitcoin, and $628 million in coins on the Tron network. There was also XRP, Solana and smaller amounts elsewhere. About $3.4 billion of the total was in stablecoins, crypto tokens meant to stay worth one US dollar each. That matters because the companies behind those coins can freeze them.

Binance co-CEO Richard Teng wrote on X:

Our initial investigation suggests this security incident may have started with a compromised DevOps engineer’s laptop. That gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions.

In everyday words, the attackers got into an engineer’s work laptop and then reached a part of Binance’s system allowed to send money. Teng said Binance had found no evidence that its wallet private keys leaked. The attackers got the system to approve the payments. Binance has since said it found additional points of breach, without naming them, so its investigation is still moving.

There was preparation. TRM Labs found signs that the attackers arranged a wallet the day before, tested their code that morning and had 50 approvals ready across ten different networks. That is an awful lot to have ready before the first withdrawal.

Chainalysis followed some of the stolen money and found it mixing with money taken in an earlier theft from Bitget, another exchange. Its investigators said they had a high degree of confidence that DPRK, meaning North Korea, was responsible. The FBI’s cyber division also named North Korea.

About $3 billion has been frozen by the companies behind the stablecoins. Binance says it will cover customer losses. Teng said on October 31 that it had replenished 90% of the stolen assets and would cover the rest. There will be more to learn about how the attackers got through Binance’s systems.

Chainalysis on X, October 29, with its map of the stolen money meeting money from an earlier North Korean theft.

The Hacker’s Genie

No report shows AI was used in the Binance attack. I am certain it was a tool somewhere in the work, but what follows is my view of what a hacker could do today, rather than an account of what this crew did. Let’s say you are that hacker. Where does the genie help?

First, you need a person with access. In a company with thousands of staff, finding someone whose laptop might lead to the right systems used to take weeks of research. AI can help sort through people and write a believable message for each one, in their language. Google’s Mandiant caught another North Korean crew targeting crypto companies with Gemini-written bait messages and fake Zoom calls that appeared to use AI-made video.

You could also try becoming the person the company hires. A false identity takes work to maintain through an interview, a coding test and then an actual job. Anthropic documented North Korean operatives using Claude for all of that in remote jobs. An employee already on the inside gets access an outsider would spend months trying to reach.

Next, you look for a weak spot. AI can help search through a great deal of code cheaply. As Immunefi’s head of security put it:

AI has indeed made finding weaknesses cheap, while fixing them still runs at human speed.

That gives an attacker more places to try.

Suppose you get in. Now you have to understand somebody else’s enormous collection of code and settings. This is work I do with unfamiliar code every day: ask an agent to read it and explain how the pieces fit together. A hacker could ask which parts approve payouts. In that same Anthropic report, a criminal used Claude Code to help investigate targets, collect sign-in details and enter networks at 17 organizations.

Then comes the rehearsal. TRM found code tests on the morning of the theft and 50 approvals prepared across ten networks. Each network has its own rules. Writing and checking that much code takes time, and AI coding tools can shorten that work considerably.

Once the money starts moving, speed matters. Anthropic described a separate spying campaign in which AI performed most of the work, making thousands of requests while people handled a handful of important decisions. A small crew can keep working at a pace that used to require many more hands. Splitting stolen money across wallets is automation too. On the other side, Chainalysis used its own AI to trace stolen Bitget money across four networks, cutting more than 20 hours of manual work to under 10 minutes. The defenders have a genie as well.

Since last week’s PHP2Shell story, attackers have successfully broken into servers using those flaws. Dream found Claude Code installed on attackers’ own machines after a suspected China-linked attacker took control of 25 servers. CISA now lists both flaws as ones attackers are actively using. Nothing ties PHP2Shell to Binance.

AI made the work in these steps faster and cheaper. The attackers only need to win once. Surely more tremors to come.

That’s all for this week. Keep writing in and talking with us about AI. Tune in below the fold for more on what we are building.

◆  Below the fold  ◆

Wundervault 1.0

Wundervault 1.0 launched on October 27. Like any product, as soon as it went live, there were 10 things I wanted to change. But I guess that’s a good thing because it means I continue to be engaged with this project. Four updates shipped in the first three days, including faster approval requests.

The Binance theft also calls for a distinction. Binance found no evidence that its wallet private keys leaked. Attackers reached a system allowed to send money, and it sent money. Wundervault 1.0 would not have protected anyone from that theft. I build it for people and small teams running AI agents, and the question at that scale is what an agent can use and when a person needs to approve it.

The broker does the work for your agent, running as a small program on your computer under an account your agents cannot enter. Your agent asks the broker to do something. The broker makes the call, connects to the server or signs the request, then hands back the answer. The agent never gets the secret. You can set requests to ask you first, so one to somewhere new waits for your face, fingerprint or PIN. For a signature, you see exactly what is being signed.

A private key can control a crypto wallet or a server login. Once someone copies it, you cannot take that copy back. Anything an agent sees can enter its conversation, which goes to the AI company and can remain in chat histories, logs or files the agent writes. With the broker holding the key, it never enters that conversation. Even an agent tricked by something it reads has no key there to hand over.

From wundervault.com: the broker signs the login and keeps the key inside.

Now, about running AI at home

I am looking at running a much larger model on my own hardware. In issue 25, I ran a small model on the old Radeon RX 550 in my home server, with 2 GB of memory. Now I am aiming for about 48 GB. The target is roughly 30 billion parameters, which seems to be the sweet spot for attainable local models at the moment. VRAM is the memory on a graphics card where the model has to fit to run quickly. Unified memory is another option: one pool shared by the processor and graphics.

Right now the model I have in mind is Qwen3.8-27B, Alibaba’s open model that you can download and run. That is obviously subject to change as new models arrive. I am still filling in the why, though supporting Wundervault and doing other experiments are likely uses. No hardware picked yet (so there will be a buying journey to share).

This Week’s Comic

Mini Fantasy Theater episode 76, “The Poisonous Appearance” (October 28, 2026), by David Revoy. CC BY-SA 4.0, AI derivation prohibited.