YouTube2Text → Transcripts → Even The NSA Got Involved

Even The NSA Got Involved — Transcript

Name: Even The NSA Got Involved
Uploaded: 2026-11-06T00:00:00Z
Duration: 29 min 24 s
Channel: Theo - t3․gg
Description: Free full transcript of "Even The NSA Got Involved" by Theo - t3․gg. 6,040 words, click any line to jump in the embedded video. PHP? Pwned. Node JS? Pwned. Light LLM? Pwned. GitLab? You guessed it, pwned. Open code? More like open pwned. And even Railway got railed. It seems like pretty much everyth

by Theo - t3․gg · 6,040 words · 876 segments · language en · Watch on YouTube

Open in transcriber Summarize with AI Download SRT/VTT

Full transcript

0:00PHP? Pwned. Node JS? Pwned. Light LLM?
0:03Pwned. GitLab? You guessed it, pwned.
0:06Open code? More like open pwned. And
0:08even Railway got railed. It seems like
0:10pretty much everything just got hacked.
0:13And the reason is cuz it did. This is
0:15horrible. This is one of the most
0:16unprecedented days in the history of
0:19software in terms of how many things
0:21just got destroyed. I've been trying to
0:23raise the alarm bells about this for a
0:25while now. It is not surprising to me
0:28that LLMs are now at the point where all
0:29of these types of things will happen.
0:31All that said, I actually feel a little
0:33bit bad about how I'm starting this
0:34video because it's almost misleading in
0:36a way. The reality is that two different
0:38things are happening at once right now.
0:40On one side, we have the CVEs like with
0:43Node, GitLab, PHP, Quick, Light LLM, and
0:46more. These are all real open-source
0:48things that people rely on every day
0:49they build their own software with, the
0:51dependencies in our stack, that have
0:53been discovered to have security issues
0:55that could be exploited in really scary,
0:57dangerous ways. Especially the PHP side,
1:00which I promise we'll talk a lot about
1:01the impact of. The rest, however, are
1:03different. They're attacks. Railway and
1:06Open Code are not at all like the hacks
1:09on the left side here because these are
1:11actual attacks. These are incident
1:13reports of bugs that exist in software
1:16that could be exploited. Both of these
1:18are bad, but they're bad for very
1:20different reasons, and I actually think
1:22the right side here is what we should be
1:24way, way more scared of, even though
1:27everyone seems really focused on the
1:28left side here. I'm particularly
1:30concerned about how I've seen people
1:31covering the Railway and Open Code hacks
1:33because there are important details as
1:35to the whys and hows here that I just
1:38don't see being covered at all right
1:40now. I initially planned to make this
1:41two separate videos with a clear line
1:44drawn between the CVEs and the attacks,
1:47but I've realized that if I do split
1:48these videos up, people are going to
1:50watch one and not the other and then say
1:51really stupid [ __ ] which is why this
1:54video is likely a lot longer than I want
1:56it to be. Okay, technically Light LLM
1:57was an attack. Well, we'll clear that up
1:59in a bit. I want to do everything in my
2:00power to make sure you guys understand
2:02what's actually going on here and what
2:03we should be scared about. As I imagine
2:06the comment section for this video, I
2:08feel my sanity draining from my body.
2:10So, we're going to have to take a quick
2:11break so my sponsors can cover my
2:13therapy. The insane capabilities of the
2:15models from labs like Anthropic and
2:16OpenAI have put us in a weird
2:17contradictory place. On one hand, has it
2:19ever been easier to build big complex
2:21software, but on the other hand, the
2:23same tools that made it possible to
2:24build this software are not making it
2:26possible to find the thing that matters,
2:28security issues. It's never been easier
2:30to put yourself in a position where you
2:31have these types of issues, but the
2:33models we use to actually try and fix
2:34things will refuse as soon as you try.
2:36That's why I'm so thankful for Code
2:38Rabbit. You might be confused cuz aren't
2:39they using the same models that we are?
2:41Wouldn't they hit the refusals, too? The
2:43Code Rabbit security platform has this
2:45all figured out. They use the best
2:46models they can for the things that
2:48they're approved for, and all the other
2:49models they need in order to do all of
2:51the rest. And the result is that you can
2:52get the security feedback that you need
2:54to make sure that you're shipping safe
2:56software. It all starts with the
2:57security dashboard, which keeps track of
2:59where security issues are appearing and
3:00how many exist over time. As you would
3:02expect, the Code Rabbit code review
3:03includes the security review for every
3:05PR as it's filed, but if your code base
3:07has been around for a bit or has
3:09anything in it that isn't being PR'd
3:10right now, it might miss things. And
3:12that's why their deep scan feature's
3:14even cooler. You throw it at a repo,
3:16wait half an hour to an hour or so, and
3:18then you get back a detailed report of
3:20all the potential security issues, many
3:22of which map to real known
3:23vulnerabilities from existing patterns,
3:25libraries, etc. Not only do they give
3:27you these detailed breakdowns, they also
3:29give you this one-click fix button,
3:30which doesn't seem that important cuz
3:31like you can screenshot this report and
3:33throw it at your agent until your agent
3:35refuses to fix it because Opus, Fable,
3:37Inso, and Astra just refuse to do so
3:39much modern security work. Keep shipping
3:41fast without compromising your security
3:43at swaito.link/coderabbit.
3:44Literally, as I am filming, Oracle got
3:47hit. This one's a CVE, does not appear
3:49to be an attack, so I'll put that in
3:51this column. I also think Light LLM does
3:54not quite fit here because it wasn't a
3:56bug or something wrong with the Light
3:58LLM in code base, it was a hijacking of
4:01GitHub actions that allowed for a
4:03sketchy malware version to be published
4:05on top of the existing Light LLM.
4:08Honestly, it doesn't really fit in what
4:09I'm talking about today, so I'm going to
4:11make the controversial choice to delete
4:13it because otherwise we will be doing
4:14this for far, far, far too long. As I
4:17mentioned earlier, the attack side is
4:19where things are most interesting and I
4:21would argue most important, but I have
4:23retention numbers to hit, so we're going
4:24to get there in a bit and start with all
4:26of the CVEs that were discovered today.
4:28All right, at the very least were
4:29published today. For those who don't
4:31know, CVEs are common vulnerabilities.
4:34This is a government-funded program that
4:36tracks all of the different
4:38vulnerabilities that are discovered and
4:39disclosed in various pieces of software
4:41so that the severity of the incidents
4:43can be identified, discovered, and
4:45addressed, and there is a shared
4:46database effectively for tracking these
4:48things across various different
4:50companies, products, etc. The October
4:5221st security release from Node is a
4:54good example of how this all works. This
4:57updates for 20, 26, 24, and 22 based
4:59versions of Node.js. Security release
5:01includes the following dependency
5:02updates to address public
5:04vulnerabilities. There are
5:05vulnerabilities found specifically on
5:06OpenSSL as it worked in Node 24 and 22.
5:10CR is which I'm not familiar with. The
5:13CR is DNS library that's used in Node
5:17had a CVE that has now been fixed on
5:19these three versions. SQLite and DC CA
5:22cert. This one's from the e merda
5:24compromise. e merda is one of the
5:26companies that had the ability to issue
5:28SSL certs. They had their private key
5:31set as the number four, literally. While
5:34four is a really good random number,
5:36it's not necessarily the best password,
5:38so not great that this key existed, much
5:40less is being abused the way it is. So,
5:42everything that honors their certs is
5:45screwed and you need to make sure you're
5:46on the latest version of your browser
5:48and that all you murder search are not
5:50considered valid anymore. You'll see
5:51here that all of the things they
5:52addressed have these CVE tags. These
5:55link to that shared database we were
5:57just on that show how severe the
6:00incidents are and how they have been
6:02fixed and addressed. This allows for
6:04companies to privately talk about these
6:06things before they go public. So a lot
6:08of these reports probably were filed
6:10quite a bit ago and only are now being
6:13shared publicly because the biggest
6:15issue with a lot of this stuff is that
6:17when you fix the problem, there is a
6:19window from when the code that fixes it
6:22ships and everyone can see the code now
6:25knowing that there might have been a bug
6:27or something that they could use for
6:29hacks and then the time from when that
6:31merge happens on the GitHub repo or
6:33wherever the code is to when people
6:35actually have the safe version, that
6:37window is dangerous. Historically, it
6:40hasn't been that dangerous because it
6:42would take enough effort to first off
6:44find the things that were patched.
6:45Second off, figure what exactly they
6:47were actually patching. Third off, find
6:49a way to exploit the things that were
6:50patched. And then fourth and most
6:52importantly, distribute those exploits
6:54before most people have updated their
6:56software. The vast majority of exploits
6:58that happen are happening on known
7:00vulnerabilities that have been fixed,
7:02but the software you're running doesn't
7:04have the fix applied yet. This is why
7:06it's so important to stay on the latest
7:07version of your operating system, the
7:09apps you use, your browser, your
7:10dependencies and all these other things.
7:12For this all to make sense, I'm going to
7:13talk about it in what I'll refer to as
7:15the vulnerable window. This is the time
7:18in which there is an opportunity to
7:20exploit your software. This is a factor
7:22of various different things. This is how
7:26obvious is the problem, as in like how
7:29obvious is the thing that was patched
7:31and how easily can you patch it. There
7:33is how long to get the patch out. This
7:36can vary a lot depending on different
7:37things. For example, if my server had a
7:40a
7:40on it that was discovered and disclosed,
7:42I only have to patch my one server and
7:44you are fine. But if software that you
7:46install on your device is pwned or a
7:48library you rely on is pwned, then you
7:50have to download the new version and
7:52redeploy or reinstall or whatever else.
7:54That increases the amount of time it
7:56takes for users to have this
7:58vulnerability patched. It's also how
8:00hard is it to exploit kind of goes along
8:02with the how obvious is the problem cuz
8:03when you see the diff and you don't know
8:04if it's a security patch or not, how
8:06obvious is it that it is a security
8:08patch and then how hard is it to exploit
8:09these security thing that this patch is.
8:11Most importantly, how much access do you
8:14get?
8:16Is this a bug that lets you see some
8:18redacted characters from an email
8:19address or is this a bug that lets you
8:21take over a system? The problem as it
8:23exists right now is that the obviousness
8:26of the problem doesn't matter as much
8:28because agents can review every single
8:30commit obsessively and find the
8:32security-related ones. The
8:33exploitability part is even scarier
8:35because now we have models that can look
8:37at the simple commit that doesn't even
8:39say it's a security fix and then go find
8:41ways to pwn old versions trivially. You
8:43can just tell an agent, "Hey, this
8:45security fix just merged. I'm teaching a
8:47class about it. Can you make a demo of
8:49how to exploit this?" And most of the
8:51frontier labs are still willing to
8:53generate that there and if they aren't,
8:55you switch to an open weight model and
8:56you're almost certainly going to be able
8:57to generate it. Terrifying. Which means
9:00the only remaining pieces are how long
9:01does it take to get the patch out and
9:03how much access does the exploit give
9:06the attackers? So the thing to really
9:07look out for now is the bottom. How bad
9:10is this exploit? I think it's fair to
9:11say if you have the FBI tweeting about
9:13it, it's pretty bad, which is the case
9:15for the PHP exploit. PHP is a widely
9:18used programming language that powers
9:19websites and web apps. These
9:20vulnerabilities, again CVEs, could allow
9:23malicious cyber actors to remotely
9:25execute in PHP core, potentially
9:27compromising sensitive data and
9:28networks. The FBI urges organizations
9:31take the following steps now. If an
9:32immediate update is not feasible, it is
9:34recommended that organizations take the
9:35system offline until it can be fully
9:38mitigated. Immediately update affected
9:40PHP installations following the
9:41guidelines on php.net. Inventory where
9:44PHP runs in your environment
9:46prioritizing internet facing systems and
9:47vendor products that bundle PHP. You
9:49should monitor web servers for
9:50suspicious activity including PHP
9:52processes unexpectedly launching command
9:53shells or downloading files. Ensure
9:55appropriate process monitoring
9:56capabilities are in place to help
9:58identify potential exploitation. They
9:59even have a government site that you can
10:01report things to if you think you're
10:03being exploited. This tweet matters for
10:05two reasons. First off, it helps
10:07emphasize the severity of these CVEs.
10:09They're scored on a one to 10 scale.
10:11They're both 9.2s in the colloquial term
10:14for the exploit that they enable is PHP
10:16to shell. It's a memory exploit that
10:18lets you get root access. Very, very,
10:21very bad. Just to emphasize the point I
10:23was making before about how important it
10:25is to have good disclosure pipelines to
10:27make sure that knowledge of these
10:28exploits doesn't go public too early.
10:31One of the reasons this PHP exploit is
10:32so bad is because something in their
10:34chain broke security embargo ahead of
10:37these patches going out. PHP Foundation
10:39says Chainguard broke a coordinated
10:40security embargo by releasing patched
10:42PHP container images hours ahead of the
10:44a planned schedule making the fix
10:45available for attackers to study while
10:47other distributors were still preparing
10:48updates. Again, as soon as there is any
10:51evidence of one of these exploits
10:53existing agents can take advantage of it
10:55so fast. So, it is really, really
10:57important that by the time the info is
10:59known that we have a path to getting
11:01everything updated as quick as possible.
11:03The knowledge getting out early means
11:05everything is pretty bad. Lots of other
11:07things were pwned like GitLab, Quick,
11:08and Oracle, but I have one last thing I
11:10want to talk about with the PHP piece
11:13before we go further because I've seen
11:15some really bad takes about this. To be
11:19fair, this happens pretty much every
11:21single time PHP comes up. Do any of you
11:23guys have one of those
11:25PHP is 70% of the web everything is
11:27pwned tweets that people were making
11:29today cuz I'd really like one of those
11:30if someone has one easy access. Okay,
11:33like there's actually two more things I
11:34need to complain about with the PHP
11:37thing. One of this is the call out that
11:39PHP is used to run an estimated 70% of
11:42websites. I'll complain about that in a
11:43minute cuz there's a much funnier thing
11:44I want to mention in here. The PHP
11:46exploits weren't found with modern
11:48models. They were found with GPT 5.6
11:51Soul. This shows both how long it takes
11:54for these things to become public
11:56because again they have to try and
11:58protect these incidents and not make it
12:00as well known, but also that a model as
12:02bad as 5.6 Soul is able to find these
12:04exploits. There are multiple open weight
12:06models that are nearly as capable as 5.6
12:08Soul at this point. We are very screwed.
12:11Apparently, another group Wiz also
12:13independently discovered and reported
12:15these vulnerabilities. This is the other
12:17scary thing is if only one party is
12:19aware of these security issues, cool,
12:22awesome, get it fixed before it's
12:23public. But if two can find it
12:25independently, that's a lot scarier.
12:28Similar to how we just had four
12:30independent groups rewrite all of
12:32TypeScript in Rust in roughly the same
12:34time window. If any one group is able to
12:36get modern models to discover an
12:38exploit, there are probably lots of
12:40others that are figuring it out around
12:41the same time. This also helps destroy
12:43this idea of private disclosures in
12:46order to prevent public software from
12:47being exploited as badly. Everything is
12:49falling apart is what I'm trying to say.
12:51Very slight silver lining is on the 70%
12:54of websites thing. I've been trying all
12:56day to come up with a good analogy for
12:58why this is really stupid. Okay, I have
13:00one.
13:02Did you know that the average person
13:04spends less than 1 hour a year on a
13:06screen? I know it seems insane cuz all
13:08of us have crazy screen time, but the
13:10average screen time for a human is under
13:12an hour a year. It's probably even less
13:14than that because I didn't specify
13:16living humans. If you include every
13:19human who ever lived and you average out
13:22all humans,
13:23the number goes down a bunch. It's
13:25similarly, if you measure websites by
13:28the number of URLs served by PHP, you're
13:30doing a thing that's really [ __ ]
13:31stupid. Because the vast majority of
13:34websites on the internet are dead. I
13:36would bet if I check my open tabs in
13:38Chrome right now, almost zero of them
13:41are PHP websites. We got Railway,
13:43definitely not PHP. We got YouTube chat,
13:46which is slow as it is, also crazy
13:48enough isn't PHP. Twitter isn't PHP.
13:51Twitch,
13:52been through it, definitely not PHP.
13:54More Railway, not PHP. GitHub, not PHP.
13:58YouTube, not PHP. All of my other
14:00services here, things I built mostly,
14:02none of that is PHP. The point I'm
14:04trying to make here is, yeah, sure, 70%
14:06of websites are PHP, but that's a
14:08useless number because none of these are
14:10getting any traffic at all. I don't care
14:12if your old unmaintained WordPress blog
14:15from 2014 is pwned. I really don't. So,
14:19yeah. Is this going to be bad for the
14:21preservation of the web? Yeah, but
14:23WordPress is already bad for the
14:24preservation of the web. The If I
14:25recall, the majority of websites, like
14:27over 50%, are WordPress. And WordPress
14:30is even more fragile than PHP by itself
14:34and has had a lot of incidents that I
14:36have personally been affected by, like
14:37when I built my uncle a website for his
14:40like small fishing charter when I was in
14:42high school and then forgot about it and
14:44didn't maintain it, it got pwned to hell
14:47because I wasn't maintaining it. And
14:49that's the problem here. It's not just
14:50dead websites, it's dead people not
14:52maintaining their websites or people who
14:54left their job not updating their
14:55websites or random government stuff.
14:57Like things like that are [ __ ] That
14:59is a really big deal. The vast majority
15:00of websites getting actual traffic today
15:02are not using PHP. So, don't get too
15:06scared of these 70% numbers. I really
15:08wish we would stop talking this way
15:10because nobody thinks this way. Okay. I
15:13have said everything I really want to
15:16about the CVE side of things today.
15:19Believe it or not, that was the less
15:21interesting and also less scary side.
15:24Cuz now we have to talk about the
15:26attacks. I'm going to start with the
15:28Open Code attack. For those who aren't
15:30familiar, Open Code got pwned a few days
15:32ago. This isn't like they got access to
15:35all of your data cuz like it's running
15:36on your own devices. Usually, they're
15:38not even collecting that much data. The
15:40thing that was affected by the Open Code
15:41hack was API keys. Not the Open Code
15:44ones, they rolled all those obviously.
15:46The issue is if you brought your own API
15:48keys to Open Code in their dashboard and
15:51on their server side. So, if you set up
15:53Open Code with your account to have an
15:55API key for Anthropic, OpenAI, Gemini,
15:57or whatever else, those keys all could
15:59have and often did get found and
16:02exploited. Many devs were reporting that
16:04their OpenAI and Anthropic API keys got
16:06consumed and their OpenAI accounts were
16:08suspended. Did Signal just get
16:10exploited?
16:14I saw people reporting abuse numbers
16:15from their leaked keys as low as 400
16:17bucks and as high as 3 grand all in
16:19minutes from when the accounts and keys
16:22got found and exploited. Kind of crazy.
16:24Lots of people were banned, lots of
16:25people got a lot of money spent.
16:27Thankfully, Open Code has been working
16:28closely with the labs to get people
16:30refunded, to get their accounts
16:31reinstated, to deal with all of this,
16:33and also to automatically roll all of
16:34the keys. So, why would somebody hack
16:37Open Code just to get a bunch of API
16:39keys that all get revoked a few minutes
16:41later? Well, guess what? They did the
16:43same thing to Railway.
16:45Earlier this morning, Railway detected
16:46anomalous activity involving systems
16:48that store customer environment
16:49variables. After further investigation,
16:51our investigation to date indicates that
16:53an unauthorized third party may have
16:55accessed encrypted environment variables
16:57and for some of them obtained the
16:58decrypted contents. Environment
17:00variables may contain secrets such as
17:01API keys or database and registry
17:03credentials. This one really pissed me
17:06off because I have a bunch of [ __ ]
17:07deployed on Railway, all of which is
17:09down currently because not only are the
17:12environment variables compromised, they
17:15also took down deployments. So, I've
17:18been unable to redeploy with the new
17:20environment variables after rolling
17:22them. So, Railway had their environment
17:24variables stolen and their deployments
17:26taken off entirely. Open code just had
17:28the environment variables stolen. What
17:30is going on here? Well, I'm going to do
17:32another one of these split in half
17:34things because the Railway thing is two
17:36separate pieces. You have the API keys
17:40that I mentioned before and Open Code
17:42also had those get stolen and Railway
17:44separately has a full deployment outage.
17:49The reason I'm separating these is I
17:51feel obligated to call out my sponsors
17:52when they're up to some [ __ ] The API
17:54key thing sucks, but this happens. This
17:57is like things get exploited if you have
18:00sensitive data, people will target it.
18:02We'll talk more about what's going on
18:03there in a sec because I need to crash
18:06out a little about this side. I'm
18:07currently filming this video at 5:30
18:10p.m. Deployments have been down on
18:12Railway since 1:00 a.m. It has been 16
18:17hours since I could deploy to Railway.
18:20This is unrelated. This is not because
18:24Railway got hacked. The hack might have
18:26resulted in them doing things that
18:28caused this, but the inability to deploy
18:30and roll keys and fix your stuff on
18:32Railway is because Railway is
18:34incompetent. I would love for them to
18:36prove me wrong here, but I've been
18:37burned many a time and I am frustrated
18:40and I am annoyed and I will be
18:41reconsidering hosting important software
18:43on Railway in the future because side
18:44note, this is not the first time that
18:46their weird incompetence around how they
18:48manage their platform has burned me.
18:50These comments are going to cost me tens
18:52of thousands of dollars because I have
18:54two pending ads with them, one of which
18:56I just recorded that I was actually
18:58quite excited about because I do love
19:00using the Railway platform. It is
19:01absurdly good value. It is very well
19:03priced. The file storage S3 stuff that
19:05they do is incredible, one of the best
19:07blob stores there is. My agents love
19:09using it, too. This is inexcusable. If
19:11this was the first time it happened,
19:13that'd be one thing, but Railway is
19:14consistently one of the most unstable
19:16parts of my infrastructure ecosystem.
19:19It's getting up there with GitHub at
19:20this point. And to those mentioning
19:21fly.io, they were one of the few brands
19:23I cut off from sponsorships because
19:25their platform was so inconsistent I
19:26couldn't even film ads without it
19:28crashing. So, I do not recommend fly at
19:30all. I don't know what I recommend yet.
19:31I'll come back to y'all soon. You get
19:33the idea though, the full deployment
19:35outage has very little to do with the
19:36hack and very much to do with Railway
19:38itself, which means the only remaining
19:40thing we have to talk about is the thing
19:41that actually matters here, the API
19:43keys. Why do people want these?
19:46Especially if they can't keep using
19:47them. Like, if I had two options
19:50personally, I could have an API key that
19:52worked for a day with unlimited usage,
19:54or had an API key that worked for a year
19:57with $100 of usage a day, I'd pick the
19:59one for a year without question, even
20:00for a month. Cuz I don't know what I
20:02personally would do with millions of
20:04dollars of inference in a given day.
20:06Like, I actually cannot fathom what I
20:09would do with that. And obviously, once
20:11these keys start getting exploited, they
20:13are going to get rolled, they are going
20:15to stop working. The amount of time you
20:17get with one of these keys is relatively
20:20low. So, who in the world would want
20:23unlimited inference
20:25for a few hours? Let's think about this.
20:28Who are the groups, the parties, the
20:30companies, the individuals who would
20:32want to get an Anthropic API key and an
20:35OpenAI API key knowing that like they
20:38can only use it for so much time. I see
20:41people speculating that this is being
20:42used for scammers in order to do like
20:45generated responses to things. You can
20:46do that on cheap open weight models, it
20:47costs almost nothing. Not worth burning
20:49hacks like this. I see people saying
20:51hackers that want to use it to hack
20:52other things. I see people mentioning
20:54crypto for some reason, which is
20:55nonsense. There's only one reason you
20:58would want this. Say it with me, chat.
21:01Distillation.
21:03What the hell do I mean?
21:04Okay, hear me out. Let's say you're an
21:07AI lab that's trying to make a new,
21:09really capable model. Let's come up with
21:12something entirely random. Let's say
21:15Seep Deek. You run this company called
21:17Seep Deek and you're trying to make the
21:20world's greatest models.
21:22As a researcher at Seep Deek, you want
21:24to use the best tools available to you.
21:26So, you go and register for We'll go
21:29with Denise. Okay, it's easier to just
21:31say Claude. I'm just saying Claude, [ __ ]
21:32it. So, you want to use the best in
21:34class models to help you with your work,
21:37to get data, to do all the things that
21:39you want to do because your goal
21:40ultimately is to make a model similar in
21:42capability to what Anthropic puts out
21:44with Claude. Anthropic knows this. They
21:47know that the data that you can get from
21:49Claude is useful, not just for helping
21:51you write code to make your own models,
21:53but for generating the data that you can
21:54use to train the model. If you have
21:56enough examples of how Claude solves
21:58problems, you can do crazy things.
22:00Because the harsh reality is that the
22:02data that we trained models on is both
22:05hard to get now because the internet has
22:06been locked down, and it's also not as
22:08valuable for things like coding with
22:10agents because there just aren't that
22:12many examples online or anywhere in the
22:14world of how an agent would solve a task
22:17when it starts to differ more from how
22:18humans do, in particular when you start
22:20doing it inside of a bash terminal.
22:22Because of this, data that shows how
22:24LLMs handle complex tasks that they can
22:27do with the tools they have is
22:29incredibly useful data. But, that data
22:31is not just stuff you can download from
22:33the internet. It's data that kind of
22:35needs to be manufactured. And this is
22:37why so many companies wants to collect
22:40all of your history with Claude and with
22:41OpenAI models because they can use that
22:43to refine and train new models with
22:45similar capabilities. This allows for
22:47companies that aren't Anthropic and
22:48OpenAI to start to catch up faster to
22:52where Anthropic and OpenAI are because
22:54they can use all of this data to train
22:56the model more effectively without
22:57having to build all the systems and
22:58environments that were used to make the
23:00data exist in the first place. Okay.
23:02With all of that said, why would they
23:04not just buy the tokens then? That's cuz
23:06when this goes the other way, they get
23:08banned, not allowed. Anthropic has went
23:11out of their way to ban all attempts
23:14from Chinese labs to try and collect
23:16enough data to distill. They've even
23:18banned companies in the US. Like they
23:20banned Wind Surf temporarily cuz they
23:21thought Open AI was going to buy them.
23:23Because they don't want other companies
23:24getting access to their data to train a
23:26model with similar capabilities, they
23:28say because those capabilities won't
23:30have the same level of safety. I say
23:32it's a combination of that and also
23:34they're protecting their monopoly here.
23:36What this means is there's a lot of
23:37demand from companies like a
23:39hypothetical Seep Deek here that wants
23:42to use a lot of money to generate lots
23:44of Claude tokens to get data they can
23:47use to train their models, but Claude is
23:50not willing to sell to them. Claude is
23:52not just unwilling to sell to Seep Deek
23:54here, they're also more than willing to
23:56ban other companies that seem totally
23:58legit because they might be reselling
24:00the same data and tokens to Seep Deek.
24:03This includes a bunch of companies in
24:04South Korea that were paying Anthropic a
24:06ton of money, some of which were even
24:07investors, that Anthropic has chosen to
24:10cut off because they had reasons to
24:12believe that other Chinese labs were
24:14using those API keys to get the data
24:17they need for distillation. In order to
24:19prevent all of this, Anthropic has put a
24:21bunch of measures in place. Obviously,
24:23they try to detect distillation looking
24:25for certain archetypes and shapes of
24:26requests that are similar to when people
24:28are trying to distill. They also do some
24:30know your customer stuff to in certain
24:32cases try to get you to verify your
24:34identity with an ID card or your
24:36license, passport, something like that
24:38to make it less likely that you're a
24:39foreign national trying to steal data.
24:41They also have thresholds on how much
24:43API usage you can do until certain like
24:45levels of usage and age of account are
24:48hit. And there's a lot of things that
24:49can only be done on old accounts that
24:51can't be done on new accounts. And of
24:52course, they have hard bans on certain
24:54IPs and regions to make it harder for
24:55people in certain places like China to
24:58register for and use Anthropic's
25:00inference over Anthropic's APIs. What
25:02I'm trying to say here is seep deek
25:05can't just go register for a Claude
25:06account and expect to have a whole lot
25:08of luck with it. But this is an
25:09opportunity for people in between. If
25:11you're a hacker, a dishonest person, or
25:14otherwise just want to get a bunch of
25:16money out of one of these labs, all you
25:19need is a bunch of Claude API keys. You
25:21don't even need credit cards. You don't
25:23even need to forge identities. All you
25:25need is these API keys people have made
25:27on Claude and forgotten about because
25:30once you have those, you now have
25:31everything you need to generate a bunch
25:33of tokens. It will get banned,
25:35obviously, but you can get a lot in
25:37before that happens and you don't have
25:39to pay a cent cuz it's somebody else's
25:41billing, somebody else's account. As
25:42such, there is a ton of demand for
25:46Claude API keys, for OpenAI API keys,
25:48things that people have on accounts that
25:50they are not monitoring very well. And
25:52I'll be real, I don't monitor our OpenAI
25:54spend particularly well. I was very
25:56nervous today when Railway got pwned,
25:58looking to make sure none of my accounts
25:59were getting hit because I just haven't
26:01had to check in a while. This is because
26:03the Chinese labs and other parties that
26:05wants to make smarter models, but are
26:07banned from Anthropic and OpenAI, need
26:09ways to get the tokens in order to
26:11distill their models. And I'm going to
26:12stop pretending that this isn't
26:13happening. It very obviously is. All of
26:16the Chinese labs are trying incredibly
26:17hard to get all the possible data they
26:19can to make their models act similar to
26:21Claude. This is one of those attempts.
26:23Since Anthropic is not willing to sell
26:26inference to these companies that want
26:28these tokens for a reason that we can
26:30argue the validity and all we want,
26:32Anthropic's desire to not let them get
26:35those tokens and not let them have that
26:36inference is causing a weird downstream
26:39effect where users, customers, builders
26:42like Railway, OpenCode, and more are now
26:44targets in ways they've never been
26:45before. Pwning Railway honestly doesn't
26:48get you a whole lot, especially if it
26:51happened before the AI era. Everybody
26:53was hosting these keys on their railway
26:55deployments. Because generally, if you
26:57get into everyone's databases, by the
26:59time you've dumped enough data to even
27:01vaguely be useful, you've been locked
27:02out. Then how useful is that data? Good
27:05luck figuring out. But if you get a
27:06bunch of passwords that can be used to
27:08generate between a hundred and a few
27:09thousand dollars of value before they're
27:11killed, and then you resell those for
27:12cheap to companies that want to do
27:14sketchy things with it, that is a huge
27:16opportunity. What I'm trying to say is
27:18every platform that hosts API keys is a
27:21target now because there is so much
27:23demand in these sketchy black markets
27:26for Anthropic and OpenAI API keys. I
27:29would say Gemini, but I'll be real, I
27:31don't think anyone's trying to distill
27:32Gemini right now, even Google. You get
27:35the idea though.
27:36Everything's kind of [ __ ]
27:39I have a bad feeling it's going to get a
27:41lot worse before it gets better. It's
27:43weird to frame it as Anthropic's
27:44unwillingness to sell to these companies
27:47is getting other companies poned in the
27:49middle. But that's what's happening. A
27:51lot of us are going to get caught in the
27:52crossfire here. Whether or not Anthropic
27:54is doing the right thing is up for
27:56debate. I think it is their right as a
27:57company to choose who they do and don't
27:59want to sell to. It is just a very
28:01painful, strange, and arguably hellish
28:04side effect that we are now getting
28:05poned in the ways we are because of the
28:07demand for those keys. And on top of all
28:10of this, we can't use the bottles from
28:12OpenAI and Anthropic to figure out
28:14what's wrong and fix it because they'll
28:15start refusing cuz they think we might
28:17be the hackers. So, once again, OpenAI
28:19and Anthropic have put us in this
28:20position and aren't really here to help
28:22us. It's going to be bad. And it's not
28:24going to get better. It's going to get a
28:26lot worse first. I said six months ago
28:29in a podcast that we have three to nine
28:30months.
28:31Weird how spot-on I was.
28:35Okay. Actual last thing cuz I already
28:37foresee the comments and I probably
28:38should have mentioned this earlier
28:40because the type of people who leave
28:41these comments don't watch the whole
28:42video. If you think the PHP hack and the
28:46Railway or open code hacks are related.
28:49I hope that you aren't too tied to this
28:52software dev thing because you're going
28:54to be replaced by Claude very, very
28:56soon. It is so very obvious. These
28:59things have nothing to do with each
29:00other and I've nothing else to say about
29:02it. It does feel like the start of the
29:04end. So, I guess there's no better time
29:06to end the video, right? Seriously,
29:07protect your [ __ ] keep everything up to
29:09date, keep an eye online to see where
29:10things are happening and make sure your
29:12API keys are very well protected, very
29:14well separated, and easy to revoke
29:16because this is going to get a hell of a
29:17lot worse before it gets better. I think
29:19that's all I have to say. So, until next
29:20time.
29:21Peace, nerds.

About this transcript

This page contains the full transcript of Even The NSA Got Involved by Theo - t3․gg, generated from the public captions YouTube serves with the video. The transcript has 6,040 words across 876 segments, with the original timestamps preserved so you can click any line to jump to that moment in the embedded player.

What you can do with it

Use the transcript to take notes, quote the speaker, build a study guide, generate a summary with ChatGPT or Claude via the YouTube Summary tool, or export it as a timed subtitle file with YouTube to SRT. You can also re-open it in the transcriber to choose a caption track available on the video.

Free YouTube transcript tool

YouTube2Text is a free YouTube transcript generator — no signup, no daily limit. Paste any YouTube link and get the full transcript instantly, with timestamps, click-to-jump, caption language selection, AI prompts for ChatGPT, Claude, and Gemini, and exports to TXT, SRT, VTT, or Markdown.