Legendary Hacker Matt Suiche on Cyberwar in the Age of AI

We tend to think of warfare in two distinct arenas: the physical and the digital. Increasingly, however, those lines are blurring. Last week, Iran launched drone strikes on data centers in the UAE and Bahrain. Israel has reportedly been hacking traffic lights in Tehran, and this week brought a suspected Iranian cyberattack on US medical device company Stryker, all underscoring long-held fears that hackers could take aim at vital physical infrastructure. On this episode, we speak with Matt Suiche, the legendary French hacker and founder of OnDB, a data infrastructure startup for agentic AI. We discuss what we know of Iran’s cyber capabilities, what digital warfare looks like today, and how AI is transforming coding and hacking. Read more:Stryker Remains Offline After Cyberattack Linked to Iran GroupGoogle to Provide Pentagon With AI Agents for Unclassified Work Only http://Bloomberg.com subscribers can get the Odd Lots newsletter in their inbox each week, plus unlimited access to the site and app. Subscribe at bloomberg.com/subscriptions/oddlots Subscribe to the Odd Lots NewsletterJoin the conversation: discord.gg/oddlotsSee omnystudio.com/listener for privacy information.

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Joe Weisenthal?

  There are some market stories where you want every detail. Tracy and I have made quite a few podcasts on that basis, but sometimes you've only got 10 minutes and need to know what's moving markets and why. That's the Barclays Brief Podcast. Every week, experts from Barclays Markets and research get you up to speed on what matters and what to watch next, about the time it takes to grab a coffee. So, search Barclays Brief wherever you get your podcasts.

• 0:26Speaker 01

  This is the Bloomberg Tech Minute brought to you by ChatGPT. I'm Carol Muster. Getting hired at SpaceX requires exceptional ability and may include having Elon Musk review a candidate's resume. So writes Bloomberg Business Week's Lauren Grush. She reports that the company culture is defined by Musk, and job candidates must understand that a commitment to SpaceX means adhering to this culture and exhibiting loyalty to Elon Musk. To get hired, candidates must demonstrate their achievements from past jobs, and hands-on experience matters more to recruiters than advanced degrees, with the company looking for people with raw, innate intelligence. A spokesperson for SpaceX didn't respond to a request for comment on its recruiting and hiring practices, but according to recruiters, advisors,

• 1:11Speaker 01

  and those who've interviewed for jobs there, it's the space exploration dream that draws people to the company, and Musk invokes that dream regularly to remind workers why they're there. Prospective hires are told that the job will require stamina, including in job ads that candidates, quote, "must be willing to work extended hours and weekends as needed." One major perk for all that hard work? Employees' access to equity, either the right to buy shares or payment in the form of restricted stock units that vest over time. That's the Bloomberg Tech Minute brought to you by ChatGPT. Get started at chatgpt.com.

• 1:51Speaker 01

  Bloomberg Audio Studios, podcasts, radio, news.

• 2:07Tracy Alloway?

  Hello and welcome to another episode of the Odd Lots Podcast. I'm Tracy Alloway.

• 2:11Joe Weisenthal?

  And I'm Joe Weisenthal.

• 2:12Tracy Alloway?

  Joe, you know I have some prepper tendencies.

• 2:16Joe Weisenthal?

  Yeah.

• 2:17Tracy Alloway?

  Slightly prepper tendencies, prepper adjacent.

• 2:20Joe Weisenthal?

  I know you do because my plan for when everything, when everything goes bad is to bring my family over to your place. So I'm relying on you, actually.

• 2:28Tracy Alloway?

  That's fine. I actually figured that and I've been building an extra store of supplies.

• 2:33Joe Weisenthal?

  I'm gonna like send you a whole list of things my kids like to eat and stuff like that, just so that we're

• 2:38Tracy Alloway?

  Just so that we're ready.

• 2:39Joe Weisenthal?

  All ready, yeah.

• 2:40Tracy Alloway?

  Okay. Well, one of the things I saw on a bunch of the prepper boards that I sometimes look at, I don't want people to think that I'm crazy about it, but I find it interesting. I find it interesting seeing how people's insecurities manifest in physical stuff. But anyway, one of the things everyone was saying was you need to start taking cash out because of the situation in Iran, because we're all expecting a big cyber attack that's going to absolutely destroy the US financial infrastructure.

• 3:08Joe Weisenthal?

  By the way, have I told you my idea for business of like, I've looked at prepper meals, like prepared meals, and they all look terrible?

• 3:13Tracy Alloway?

  They do look terrible.

• 3:14Joe Weisenthal?

  Like a slightly high-end version for yuppies, I think would be really good. Like something that, you know, like some nice.

• 3:20Tracy Alloway?

  I think it's a physical limitation on how good you can actually get, like, dry food.

• 3:25Joe Weisenthal?

  Science can do a lot of things these days. Anyway.

• 3:28Tracy Alloway?

  Freeze dry food.

• 3:28Joe Weisenthal?

  Let's talk about the actual issue at hand. Yeah. Well, are you taking cash out?

• 3:33Tracy Alloway?

  No, I haven't. I haven't yet. I'm relying on my store of gold and silver. That's right. But I think this raises a legitimate and actually very interesting topic, which is what do we know about Iran's cyber, I guess, facilities, skills, what could happen in this context? And then also. Everything that's going on with the world of AI, right? Like cybersecurity, cyber hacking. It's changing really rapidly, given this new technology.

• 4:03Joe Weisenthal?

  Totally. I mean, also, just within the context of the war itself, setting aside hypothetical doom scenarios. There's a really interesting report in the Financial Times about Israel having been able to hack into all of the traffic lights in Tehran.

• 4:17Tracy Alloway?

  Yeah.

• 4:18Joe Weisenthal?

  Almost unbelievable and shocking. But there's already within the war itself, or even over the last couple of years, there was the pager attack that Israel had executed. And so, yes, cyber is part of it. And the timing is wild here because, speaking of AI, it was just on Friday. We're recording this March 5th. I'm not exactly sure the date is coming out, but a week ago, basically, there was the news, the complete collapse of the anthropic relationship with the Department of Defense or the Department of War. And so, it's all in the mix right now. And how is AI actually going to change warfare? And what are the national security implications of AI? And AI and hacking, there is a lot in this sort of mix that's all happening right now.

• 4:59Tracy Alloway?

  Absolutely. The thing that really caught my eye was the story about a hacker using Claude to hack into like the Mexican government system. Did you see that?

• 5:06Joe Weisenthal?

  That was really interesting because it seemed like the hacker extracted a bunch of information from Claude itself. You know, I'm pretty sure you cannot go to Claude Code and say like, I want to break into the Mexican government website, help me like build this app. It won't do that. It's trained to avoid malicious uses. But people find a way to jailbreak them. People find a way to sort of extract information from the AI itself that it has in its training and so forth. And there's been examples of leaks where, you know, people upload data to the AI and somehow other people see it. Anyway, there's a lot here that we have to learn more about.

• 5:42Tracy Alloway?

  We should talk about all of it. And we do, in fact, have the perfect guest, someone who's been on the podcast before, but it's been a while. We're going to be speaking with Matt Swish. He is the founder of ONDB, which is a data infrastructure startup for Gentik AI. So honestly, the perfect person.

• 5:58Joe Weisenthal?

  And a legendary hacker.

• 5:59Tracy Alloway?

  A legendary French hacker. I should have said that first. Matt, thank you so much for coming back on Odd Lots.

• 6:04Speaker 03

  Thank you very much. It's been a while. I think it's been what, four years?

• 6:07Tracy Alloway?

  Yeah.

• 6:08Joe Weisenthal?

  Yeah, I think it has been.

• 6:08Tracy Alloway?

  The last time we spoke to you, you were still in Dubai and now you're coming to us from Sweden and a very Gustavian looking background over there.

• 6:16Joe Weisenthal?

  I think actually when we talked to you, it was right after Russia's invasion of Ukraine. So I guess, yeah, wow, that has been almost.

• 6:22Tracy Alloway?

  Every time there's a war, we call you, Matt.

• 6:24Joe Weisenthal?

  But because war is so intermixed with cyber espionage, cybersecurity, hacking and so forth, it's a natural, natural time.

• 6:31Tracy Alloway?

  So for the benefit of people who didn't listen to the episode four years ago, can you just give some context around who you actually are and your sort of history in the hacking community, including, you know, shadow brokers and the wannacry era and all that stuff?

• 6:45Speaker 03

  So I've been in enterprise software for almost like 20 years, particularly cybersecurity. And my name appeared in a few of the different leaks because of various analyses that I have done of like private information that was being leaked, but also a lot of attacks that happened, that happened to target critical infrastructure over the last 10 years. And last time we were on the podcast, one of the thing we talked about is, does cyber really matter once you enter into a kinetic war? Which is exactly what's happening now. And the main takeaway was, once you start using missiles, most of these cyber elements are not really relevant because you would use cyber

• 7:28Speaker 03

  mostly to gather information and intelligence, to prepare an attack or to disorganize an enemy or create confusion. But as we have seen now, you can use like drones that are like $20,000 and create more chaos that you would do with any sort of exploits.

• 7:48Joe Weisenthal?

  You know, I liked how you're introduced as a legendary hacker. And then you're like, oh, I've been 20 years in enterprise software. I feel like this is like the, uh, the Winnie the Pooh meme. It's like, you know, the casual.

• 7:58Tracy Alloway?

  That's right.

• 7:59Joe Weisenthal?

  And then fancy dressed up.

• 7:59Tracy Alloway?

  Hacker and then enterprise software.

• 8:02Joe Weisenthal?

  20 years in, uh, enterprise software. But this is a really interesting point that you made. This idea between, okay, mostly it sounds like when people imagined cyber attacks.

• 8:14Joe Weisenthal?

  They imagine what Tracy talked about in the beginning. Suddenly, the entire financial infrastructure, like it'll just come to a halt. People worried about, or there's gonna be a blackout, et cetera. But in reality, or what we've seen so far by and large, is that cyber in the context of war is still much more about data collection, espionage and so forth, rather than these more like, you know, the types of things you might see in a movie.

• 8:39Speaker 03

  Yeah, exactly. I mean, over the last like 10, 15 years, we have seen some like attacks, like cyber attacks against a critical infrastructure. Iran targeted like Aramco around like 2012. They were just mostly like using what we call a wiper. That was like a malware that was erasing the hard drive of most of the machines. And then we obviously have the case of Stuxnet a few years before, where it was a joint Israeli-US operation against some of the nuclear centers in Iran, where some of the PLCs were targeted. But what we have seen over the weekend is some of the drones happened to target some of the Amazon data centers.

• 9:20Joe Weisenthal?

  Right.

• 9:21Speaker 03

  And that created so much instability because multiple of the zones have been down. And I think two out of three, and the third one is still recovering days after. Because most of companies, either private companies or public companies now relying on the cloud, which is something that was not really the case before. And once you have some sort of centralization in terms of dependence, you also become an easy target. And most of governments, AI companies, cloud companies do not really have $20,000 drones in their threat models, which is like something that's pretty new, but also confirms that kinetic walls can have more impact.

• 10:06Tracy Alloway?

  So I take the point about cyber being perhaps more useful before a war when it comes to info gathering and things like that. But we have seen some deployment of cyber attacks in the past week or so. So we know Israel is attacking some cyber infrastructure in Iran. And we know that Iran has perhaps attempted some things, maybe not as successfully. But walk us through what we've actually seen so far.

• 10:31Speaker 03

  So so far, we have seen an Israeli operation where one of the prior app has been hijacked. And so message was sent to the users. So it's more like to create confusion within people.

• 10:44Tracy Alloway?

  Uh huh.

• 10:44Speaker 03

  Also, the traffic light operation to understand the position of some of the target. But it's more used for like reconing. And in term of destruction, we didn't see anything significant. Even the government itself of Iran shut down most of the internet for a lot of the users. And a lot of what we see on social media is the usual disinformation and misinformation campaign. Especially now with AI, there is so much AI slop. We've like the videos, the text, the bots. That's becoming pretty common now, even when there is no war. So it's not really like really impactful. So it's more like to create confusion than being actually destructive.

• 11:27Speaker 03

  And now we're definitely entering in a stage where it's been extremely destructive. And I cannot remember the last time we have seen so many countries being targeted. Which is pretty like a first, I would say, in term of like a war climate.

• 11:44Joe Weisenthal?

  Can you talk about, you know, people stare at their screens all day? And they fool themselves into thinking that they're quote monitoring the situation, et cetera. But mostly.

• 11:53Tracy Alloway?

  Is that projection, Joe?

• 11:55Joe Weisenthal?

  I don't delude myself. No, I like actually like I sort of look at my screen and I know that I'm being inundated with contextless garbage and slop and propaganda and so forth. I'm curious how you monitor the situation actually as someone who takes these topics seriously and doesn't just sort of become a overnight expert, you know, the day after bombings begin. Like, how do you pay attention to what matters? How do you actually know what's real and so forth? And avoid just sort of the delusion of staring at the screen and and engaging with slop?

• 12:30Speaker 03

  It's a it's a good question because there is so much of it, so. I think the default reaction is to ignore most of it.

• 12:37Joe Weisenthal?

  Yeah.

• 12:38Speaker 03

  Unless it becomes really significant. In this case, I think it comes down to looking at the actual damage. Many people from the military world, but also the intelligence community has been underestimating Iran capabilities, exactly like people used to do with North Korea. And now North Korea has some of the best hackers in the world. When we see them like targeting financial institutions, whereas before they would not do like much. So there is definitely like internal capabilities that are available. But there is so much noise now, like you say, a lot of people are monitoring the situation, giving the quote unquote like overnight expert opinions. And that's becoming a lot of noise.

• 13:20Speaker 03

  But I would say that in this particular case, we have heard of the imminent threat of Iran for around forty years.

• 13:29Joe Weisenthal?

  Right.

• 13:30Speaker 03

  And that's also not really a new situation. So most of people would have a context around it. And even for like the attack that happened last weekend, many people were expecting them for weeks, especially as they are a continuation of what happened last summer.

• 14:02Tracy Alloway?

  There are some market stories where you want every detail. Joe and I have made quite a few podcasts on that basis. But sometimes you've only got ten minutes and just want to know what's moving markets fast. That's the Barclays Brief Podcast. Every week, experts from Barclays Markets and Research get you up to speed on what's happening and what to watch next. Concise, focused, and brief. Search Barclays Brief wherever you get your podcasts.

• 14:29Speaker 04

  Running a business means keeping pace with the latest tech. You've put a lot into building your enterprise software stack and scrapping it to integrate AI is out of the question. That's why IBM technology works with all the apps, data, and models you need. It's another way IBM helps you build on the technology you rely on. Let's create smarter business. IBM. Visit ibm.com to learn more.

• 14:58Joe Weisenthal?

  Can you actually talk a little bit more about the data center attack? And because that's on cyber, really, I mean, that's just, that's just a physical, it's kinetic warfare against the data center. I was surprised, how disruptive was that? I sort of would assume that cloud service providers, that it's fairly liquid. Okay, one goes down, but you know, it can just be the same software can be run from numerous other clouds. But I saw that there were disruptions. I saw Fortnite tweeting about the fact that some of their gameplay was impaired due to the attack on data centers. How disruptive have those attacks been? Because this is of course, a very, you know. This is where kinetic meets cyber. Yeah, and there's a lot, you know, in the future, like thinking about hardening

• 15:43Joe Weisenthal?

  these data centers and as you say, like making them, they're going to be increasingly targets for war. Like, how disruptive was that?

• 15:51Speaker 03

  Very good question. So I think one of the main takeaways that it has been extremely successful. So like we said before, like a Shahed drone is around $20,000 and they managed to shut down two of the zones of Amazon. Actually, even if you look at the official report from Amazon, for like 36 hours, they were just saying, oh, some objects struck the data centers before they actually explicitly said they were drone strikes. So a lot of services that have been using them have been targeted. So from like local applications, from two banks, because in a data center, you are taking care of multiple different services.

• 16:32Speaker 03

  And even Versol had to reroute their data to Bombay and to exclude like Middle East as deployment. So even if you take the cost of most of like zero day exploits that can go up to like multimillion dollar attacks.

• 16:50Speaker 03

  If you are really aiming at disrupting things, the cost reward of using such an attack is really efficient. So you really enter into some sort of asymmetric conflict, where you can just spend like some really old material and have way more impact than someone who's gonna be like cutting edge and just trying to impress with like capabilities, because at the end of the day, it does not really matter.

• 17:18Tracy Alloway?

  How do governments actually build up their cyber capabilities nowadays? Because I have this image in my head of maybe ten or twenty years ago, you know, they would recruit like a twenty year old such as yourself at the time. And they would be working in a dark room, that sort of thing. But then-

• 17:35Joe Weisenthal?

  Drinking Red Bull.

• 17:36Tracy Alloway?

  Drinking Red Bull, that's right. But then, you know, we had the boom in Silicon Valley, and so you had competition from private companies. Now we have the boom in AI, and again, even more competition from private companies. And at the same time, governments seem to be, I guess, seeding some of their own skill set to potentially private companies like Anthropic and ChatGPT and some others. Walk us through how, I guess, the development of governmental cyber capacity has actually shifted.

• 18:09Speaker 03

  I mean, something that didn't really change over the last like years in terms of capabilities, like I guess we all remember like these Snowden leaks in twenty thirteen, when we started to see more about the inside of like capabilities from a government, including like domestic mass surveillance, global surveillance, exploitation capabilities. And since then, every other year, we have seen an history of data being leaked that belongs to the government. So in a way, things have been changing a lot, but not really much. Like most recently, there was a contractor from Health Free Iris

• 18:50Speaker 03

  that was sentenced to eighty seven months sentence because he happened to sell zero day exploits to a Russian broker. And that's for like-

• 19:04Speaker 03

  Actual exploit that belonged to the government because there was some sort of integrator. So we see like nation states or like governments like the US investing like enormous amount of money into offensive capabilities. But they also keep being burned by insiders. A lot of those capabilities are also as strong as the internal coercion.

• 19:26Tracy Alloway?

  But I guess what I'm asking is, you know, if you're the Department of Defense, or I guess now the Department of War, and you're thinking about developing in-house capabilities versus partnering with a company like Anthropic. And we should talk about all the drama that's going on there. How are you balancing those decisions nowadays versus, say, 10 or 20 years ago?

• 19:46Speaker 03

  Like, my understanding is that now a lot of it is also like outsourced. Because they cannot really develop as many capabilities internally. So now, like we have seen with Anthropic, that it had been used in the Maduro operation.

• 20:05Joe Weisenthal?

  Right.

• 20:05Speaker 03

  And then after that, like there was a pullout from Anthropic because they said it was violating their ethical, like,

• 20:15Tracy Alloway?

  Standards.

• 20:16Speaker 03

  Like policy, yeah, standards. So I would say now, something that's really changing like very fast is the incorporation of like AI into those decisions. But as we all know, like AI can also hallucinate. So even Dalio, the CEO of Anthropic, said it's definitely not in a state where it can be used for like fully autonomous decisions like that. So I would say like the AI element would be like the main difference. Even we start to see it now for like exploit development or vulnerability discovery. But it's still too early to kind of like give a definitive like opinion about it. But overall, I would say it's very similar.

• 20:57Joe Weisenthal?

  Well, talk to us about exploit development because I know that you can't just go to Claude Code and say like, I'm working on a zero-day malware attack, help me figure this out. But, you know, I also know that there are some very talented people who pride themselves in being able to jailbreak AI and illicit outputs that the labs do not want their AIs to produce. So do you have a sense how just within the pure like hacker community, AI is being employed today for these purposes or what they're able to get out of these tools?

• 21:30Speaker 03

  It's a good question. So like, we started to see people leveraging like AI for like bug discovery.

• 21:36Joe Weisenthal?

  Yeah.

• 21:36Speaker 03

  Which actually is becoming like pretty good. I think even Entropic published an article explaining how cloud can be used for discovery into smart contracts and how it found some bugs automatically. And I think even recently, they released something called Cloud for Security that was aiming at doing a code assessment. But now we're entering into this like interesting paradigm shift where the cost of software is going towards zero.

• 22:07Joe Weisenthal?

  Right.

• 22:07Speaker 03

  So if your company and if your cost of building software is becoming less and less, it's also hard to convince people that auditing software for security reasons is gonna be more expensive than developing the actual software. So I think that's one of the shifts we're gonna see. But when it comes down to.

• 22:25Joe Weisenthal?

  Can you explain, sorry, pause that, pause that last part. What what did you mean by that? It's gonna be hard to convince.

• 22:31Speaker 03

  If if you can have like to allocate budget for like building a product. So you have most of the budget that's usually allocated for like your software engineers to build the software. And then you do some code review afterwards to make sure there is no vulnerabilities before it gets released to the public. But security's risk is usually like pretty high. You cannot just rely on like AI tools, at least not at the moment. Maybe in a year from now, it's gonna be possible. So it's gonna be like really interesting to see how it's gonna like do like a market shift because now with cloud codes and as a famous vibe coder, Joe, I'm sure you know that.

• 23:15Speaker 03

  The the cost of building software is approaching like zero if you just look on the timeline.

• 23:21Tracy Alloway?

  Are you actually, on this note, are you a believer in the SaaS apocalypse? Because obviously, there's the argument that, well, now everyone can just create their own software fairly easily using natural language. But on the other hand, if you're a big corporation, or presumably a government, you're going to want to have, you're going to still want to buy software from an external provider, given some of the security concerns, given that it might not necessarily make sense for various reasons, management reasons perhaps, to recreate an entire software business in-house.

• 23:54Speaker 03

  So I'm definitely biased on that, but as someone who thinks that the cost of software is going towards zero, and as someone who is like watching the software costs like collapsing, one of the things that we realize is that data is the only durable asset in the AI economy. That's why we decided to work on DB, the current startup I'm working on, because like, that's the only thing that's really going to have value long-term if agents need something to transact or like to take decision on. Because even if you look in term of like, in any context, you know, if agents are designed to think autonomously, you need to have enough information to take those decisions whenever you're going to have your reasoning loops.

• 24:37Speaker 03

  So software itself, if you just build it, is pretty static, whereas like the agentic, like feedback loops are more dynamic, but what changes is the context they take decision on. So definitely like SaaS business are going to have a hard time, because if anyone, including the Shopify CEO, can just rewrite an MRI software in one afternoon, just to like look at his back MRIs, you can imagine like how disruptive it's going to be like by the end of this year. I think the only thing we haven't seen yet is like enterprise AI agent. So so far, I would say like since Christmas.

• 25:20Speaker 03

  People are mostly like still playing around trying to find like a proper like use case. Uh, we see a lot of like consumer like AI agent like

• 25:29Joe Weisenthal?

  Mm hmm.

• 25:29Speaker 03

  OpenClou that really made like agents uh more mainstream, but we really haven't seen yet enterprise AI agents. So as everyone is kind of scared of being replaced for their jobs. We haven't really seen like actual like AI agents replacing entire departments or full on like employees. So we have seen some disruption around like software engineering mostly to make like software engineering more efficient, especially in term of like uh development with shorter like timelines, but we haven't seen yet like proper like enterprise AI agents.

• 26:04Joe Weisenthal?

  How do you define an AI agent?

• 26:06Speaker 03

  So my view of an AI agent, and I like to remind people like what an AI agent actually is. At the moment, most of AI agent is just like a piece of code usually written in Python or in TypeScript. That's just doing a bunch of calls to like Anthropic or Pnai and running in a loop. And taking decisions and calling like third-party tools like MCPs or web searches.

• 26:31Joe Weisenthal?

  Mm hmm.

• 26:31Speaker 03

  So that's mostly what an uh AI agent is. We tend to think of AI agent as a completely like different persona, but at the end of the day, it is just like a piece of software that's running as a service on a machine or on a server. So from a security standpoint, which is pretty interesting, it's just like another service or like software. But people really like to think of it uh in another way.

• 27:00Joe Weisenthal?

  Well, just so like I'm from the security standpoint, I mean, one of the exciting aspects of AI agents is that they can work autonomously, right? You set a task and it can go out and find what it needs to do and it sees like, okay, this didn't work. I'm gonna try, it's gonna try this thing, it's gonna try this thing, oh, I need to connect to this web service to get this information, etc. The downside of AI agents is precisely the same. The downside of AI agents is that they could do whatever they want to do. And if it accidentally deletes a bunch of files because it thinks that's what's necessary to execute the task.

• 27:34Joe Weisenthal?

  So like, I'm curious, like, from a security standpoint, like, I mean, we've already seen examples of people getting private information exposed, or, as I mentioned, the example of deleting a bunch of information. Is this like a new way to think about the security threat model, the fact that the capability and the downside are one and the same? It's the same, it's sort of like hallucinations, right? The ability to like, create an output and it also, you know, is hand in hand with the ability to create a wrong output, a false output. And so, you know, the ability to do, to act on its own is also the ability to destroy on its own. Is this sort of like a novel threat model or a novel paradigm in thinking about enterprise security?

• 28:18Speaker 03

  From an enterprise security standpoint, it is pretty much the same thing in the sense of, like, if you're building software, you cannot just really like, patch software afterwards and stuff, because you never, it never ends, like, security mods be like, built in, and you need to have like, a safe design from the beginning. What we have seen now is like, whenever people do something agentic, they just give like, all permissions upfront.

• 28:44Joe Weisenthal?

  Yeah.

• 28:44Speaker 03

  Which is like, probably the worst thing you can do, and if you're an enterprise, as you can imagine, if you just give like, all permissions to an agent, it just becomes Murphy's Law. If something bad can happen because you gave it access to, it will happen. So you're gonna see like, more data leaks for sure, because there is no safety by design in those like, uh, architectures, or like, those like, agents. Which is, in terms of vulnerabilities and like, exposure, would be like, very similar to what we have seen over the last, like, 10, 20 years. But, you know, if people are ignoring what has been done in terms of software security for the last 20 years,

• 29:26Speaker 03

  that's why we're gonna have a lot of problems, and I think we're probably gonna start to see like, people, especially in enterprise, like, pushing back a lot, because there's compliance that needs to be like, you know, like, answered to. So you cannot just give like, full access to like, you know, your agent.

• 29:59Speaker 04

  Your team is on a deadline, but moving all your enterprise data will take time your business simply doesn't have. IBM Technology lets AI work with your data where it already lives, with an open hybrid cloud approach designed to build on your existing investments. It's another way IBM helps you put your data to work. Let's create smarter business. IBM. Visit ibm.com to learn more.

• 30:28Tracy Alloway?

  Speaking of the long arc of history, one thing I really wonder is you've obviously been in this space for a very long time at this point. Can you describe how you think your own career and I guess coding experience would have been different if you were, say, starting out now in 2026 versus, I guess you would have started out in like the late 90s or early 2000s, maybe even before that.

• 30:51Speaker 03

  Yeah, mid 2000s. Well, I would say like what has changed is back even like we even without going to like the 2000s, like back in the Snowden days when the global surveillance program was being exposed, like a lot of people were really like scared of it and scandalized by it and pushed back and people really cared about privacy. Whereas like now, we're entering in a new arc where very few people care about privacy, where you see like the CEO of Entropic being asked why he refused to work with the US government.

• 31:36Speaker 03

  And he says, well, they wanted to do a domestic surveillance program. So that's against or like a safety like chart. So this is all aspect of people relationship with data, which I guess is very different. In terms of software, obviously like now you can write more things. Anyone can write anything. But I think we're still in this weird adequate software phase where we know what AI can do, but it cannot really do like anything more, anything less yet. We still haven't seen like the actual like use case for it. Because

• 32:20Speaker 03

  It's obviously like very exciting and it feels like a lot of it is very different from before. But we don't really have like any evidence of how it's really helping in national security. I know it's been helping people who have been analyzing like Epstein's emails. Because there's a lot of data and that makes it faster. But in term of like real use case, I don't think. The like it feels like the current world is very different than before, but there's so much noise and so much like slop all over that. In a way, it is pretty similar. I don't know if that makes sense.

• 32:59Joe Weisenthal?

  Well, I mean, your company is O N D B dot A I. So you must think that it's going to be used or that, you know, or that there's clearly something there. Actually, tell us about, I'm actually really, I'm on, I'm on your website. Right now it looks really interesting because it's something I've been thinking about. But you must have some vision for like where it's going and that there will actually be significant demand for these services.

• 33:24Speaker 03

  Sure. I mean, like I was saying, like, I think now we've like. Anything that's agentic, building software, which is like the main use case so far for A I. It's gonna make software like going to zero. So the cost of building software is going to.

• 33:38Joe Weisenthal?

  So that's real. So like, like there's, in your view, there's no question that already. A I, I mean, talk about a use, it's a pretty big use case right there, bringing the cost of building software to zero.

• 33:48Speaker 03

  Yeah, I mean, like, even if you look at the offer of Claude Code, uh, he said they didn't write like code since November. So i- i- like a lot of people are like this, you know, even us internally, like we definitely like use Claude Code a lot. But if software is going to zero, like what's left? In term of like the internet layers. So our conclusion is that data is uh. The anything that's gonna be like timeless in the A I economy. So building like a layer for that, especially nowadays, like. Or those innovations around like payments and stablecoin that you can use to actually like pay like anything online.

• 34:26Joe Weisenthal?

  Yeah.

• 34:27Speaker 03

  So we think like, okay, if you have like issues like anthropic or like OpenAI just scrapping internet and using like public internet, so you may as well find ways of charging like bots or agents for your data. So at least you can have these new like revenue unlock that's gonna emerge in this like new economy. Because I think a lot of the traditional like economic model, like for instance, like we said like with SaaS, are gonna be like disrupted a lot. So there is a completely like new market around how people are gonna consume uh data. And I think people people would just be ready to pay like more to have high quality data.

• 35:09Speaker 03

  Because the more noise there is, the more you want to make sure that the data you have access to is gonna be uh like valuable and real. So, yeah, even from a security standpoint, you know, like once you build like an infrastructure layer, you can have this like built in security to make sure that the data you give back or the access like for the interface that you define is actually secure. Because even if you'd look at OpenClaw, for instance, one of the top skill was malware. So like people just like living in this like wild west, but they just run everything. So it's us anticipating that enterprise is gonna look very different and they won't just run like anything they find online.

• 35:52Joe Weisenthal?

  Yeah, you know, this is one of the things that I've encountered in my vibe coding forays. Is that one of the annoying things is, okay, you want the agent to like go out and grab some information or query some database or whatever. And then it's like, okay, like, let me know when you've gotten a an API. They're like, okay, come back and get an API. And then you have to like go to a website and then you have to like get out your credit card and you have to set up an account and then you like get an API key and then you copy and paste it and so forth. And that's very annoying. I want, what I want is for the agent to just be able to go there. Say, oh, you know, like, let me just pay you with some stable coins, etcetera. Just go out and get the information on its own without having this human in the loop.

• 36:38Joe Weisenthal?

  But it also occurs to me, and this is something that I've asked about with others, which is that like, once I'm just like entirely operating in the terminal and the agent is going out and scraping information for me, etcetera. Like, why do we even have a free public internet anymore? And so like, I'm curious like whether the direction of the internet and information in general is just entirely like, you know, paying microtransaction or fees for data consumption so that the data then arrives in some usable form in the terminal that I'm operating.

• 37:09Speaker 03

  Yeah, no, I think you're raising some really good points. We need to talk after. You can be our new design partner, you know?

• 37:17Joe Weisenthal?

  Yeah, I could be a consultant. I could be a consultant. No, I hate having to deal with all these API keys and why am I still using?

• 37:25Speaker 03

  Well, you're like completely right. See, I told you, your famous vibe code. It's like, but like the use case you're describing now is like makes some entire sense. That's why like we position ourselves kind of like as a trusted like provider. Where like, instead of having to go like everywhere to get data, you know, you have like this single point and unified access, a bit like open router for AI models, but for data providers. Because if you think about it, when you use like Claude now in your terminal, like the level one is basically you asking the model itself for information. But as we know, like the model may be like a few months old and does not have access to all the information.

• 38:05Speaker 03

  So like the second level is the agent like Claude Code or Claude for desktop or like ChatGPT doing web searches. And that's just them looking on the internet.

• 38:18Joe Weisenthal?

  Yeah.

• 38:18Speaker 03

  Doing like a Google search, etcetera. But that's still not giving you an access to like the actual like relevant data that you would need. Where for instance, you'd have like those API keys and stuff. So like the level after that is basically access to private information. So and private information, usually the one that's valuable. Like in the case of Bloomberg, for instance, Bloomberg has a lot of extremely valuable information, but you can only have access to it through the terminal once you have the subscription. Or like any SaaS services, if you think of like SaaS platform at just like some fancy UI where you can like browse the database. But the data that's valuable is just in the database directly.

• 38:59Speaker 03

  So if you'd have access to those APIs and would not have to create like one million subscriptions left and right. Uh, because there's already like someone who's doing the integration for that. Kind of like as a programmatic like API marketplace, but the integration now is like much easier. And especially if you trust it, because now what we have seen also is like whenever you use all those tools, they make you install like MCPs. But more and more people are like moving away from MCPs, they're just using like skills because like you just said. We start to spend more time into the terminal. So like the terminal and anything that CLA is becoming like a natural interface for like agents, even for humans.

• 39:40Speaker 03

  Because you don't need to try to understand those like fancy UI and UX. You just say like, okay, I want to do A, B, C, just do that. So I think it just makes more sense to have like this interface for it. And like, like you said, you know, like otherwise it's just like, it becomes too complicated.

• 39:58Tracy Alloway?

  Just on this note, can we talk a little bit about, I guess, institutional knowledge of code? Because I remember one of the things that happened in the early days of AI development. I mean, not that early, I think it was like twenty seventeen or something back when Facebook's AI lab still existed. What was that called again? Like the acronym was FAIR or something. Yeah, they had like a little Facebook like experimental app. Anyway, they invented a bunch of chatbots and the chatbots started talking to each other in a pretty much incomprehensible language. But like they clearly understood what each other were saying. And so I'm just wondering if you extrapolate that to AI generated code.

• 40:40Tracy Alloway?

  Could we have a situation where the models are constantly iterating on themselves? They're constantly talking to each other. And so we end up with a system that becomes very, very difficult for human engineers and coders to actually understand.

• 40:56Speaker 03

  Yeah, I mean, I think what we're gonna stop to is like hu- humans, you know, like us are gonna move towards like creating like markdown files. As like a programming language, so everything is just gonna be like normal like language. But for the machine itself, obviously, yeah, I remember that video, uh, that is like gibberish, like.

• 41:16Joe Weisenthal?

  Yeah.

• 41:16Speaker 03

  Transfer thing. Well, if you think about it, it's not that much different from voice to text in that sense. And at the end of the day, it just like beats like being transferred, because even like whenever you connect on the webpage, you know, like you write it in text, but behind it just like. Bytes that are being exchanged. So agents still need to agree on the protocol that they're gonna use. And not necessarily an encryption format, but an encoding format. So once you know what it is, you know, it just becomes like. Like a reverse engineering problem or like a forensic problem where you're just like, okay, like this is what's being used when those packets are being sent, you know, let me just decrypt it.

• 41:58Speaker 03

  Once you know the protocol, you know, like, um, that's. So I don't think we're gonna end up in a. A situation where like who would have like no idea of it, because you're always gonna have like people who are like. Pretty good like reverse engineers, but at the same time, you're also gonna have your like AI assistant who's gonna help you to like reverse engineer those things.

• 42:17Joe Weisenthal?

  Hmm.

• 42:17Speaker 03

  So in a way, even if it happens, like you are not like alone with your red bull and your.

• 42:26Speaker 03

  I know AI agents, we all gonna have AI agents.

• 42:28Joe Weisenthal?

  Yeah.

• 42:29Speaker 03

  So that's also like the reality of things. So we're far from just like. The clippy uh plugin that we used to have in Microsoft Office. Now you can have these like CLI interface which just give like commands.

• 42:44Joe Weisenthal?

  Yeah.

• 42:44Speaker 03

  And then it's led that into like, okay, I understand what I need to do, you know, and that's it.

• 42:49Joe Weisenthal?

  No, I love like interacting with just the CLI now and like every time I have to go to the web, it feels like some sort of failure. Like I'm like, oh, I have to go to this bright website. Yeah. And I just like want the information right there on the black screen, talking, you know, communicating back and forth in English.

• 43:06Speaker 03

  Background, you know, that's like feeling familiar for you.

• 43:10Joe Weisenthal?

  You know, something I'm thinking about is I imagine that there's a lot of like crusty old Linux and Unix programmers who are like, oh, this code is, this isn't high quality code that the AI, that the chatbots produce. This is slop code. It needs all kinds of fixing and so forth. From your perspective, is the code itself of good quality or of improving quality? How, just the lines of code itself, from your standards, is it good stuff?

• 43:38Speaker 03

  Yeah, it's pretty good. And even when it's bad, you just tell it, okay, like, this is bad, you know, like, just do it better, you know? Like, if you're using like negative rewards, you know, if you say, okay, like, this piece of code is garbage, you know, it's gonna understand better, because you cannot give like a strong emotion. Whereas like, if you say, oh, it's okay, you know, it's be like, okay, like, whatever, you know, if it's okay, it means it's passing like the, the adequate test. Whereas if you would say, okay, that's garbage, you write it and.

• 44:05Tracy Alloway?

  I always do this. So if I ask a bot for something, I will always say, like, after the first version, like, do better, and just see what it comes up with, and then just try to iterate on that.

• 44:15Joe Weisenthal?

  This is, this is tough, because you're talking, when you're talking in English, you, the brain deludes itself into thinking that you're talking to, or when you're talking in human language, any language, the brain deludes itself, you feel like you're talking to a person.

• 44:26Tracy Alloway?

  So you have to be nice?

• 44:27Joe Weisenthal?

  Well, then I feel like.

• 44:28Tracy Alloway?

  I don't have that problem, Joe.

• 44:30Joe Weisenthal?

  Oh, really? But then I feel like, I like, I don't want to say, oh, this is garbage. I don't, but from your perspective, it's actually sort of important to, to be firm with the bot, and you get better results by being more sharp with it.

• 44:43Speaker 03

  Yeah, because it's the equivalent of a negative reward, like, just like positive reward. If you, if it does something, you'll say, okay, like, that's great. That's exactly what I tried to explain. Then it's like, okay, like, that's like a reference point. Whereas like, if it starts to go on a tangent, you just say like, oh, that's completely like out of the line. Redo this. Like, why are you doing this? You know, like, the more explicit you are.

• 45:08Joe Weisenthal?

  Yeah.

• 45:09Speaker 03

  The better it's gonna understand how far it is from the requirements. Whereas like, if you'll be.

• 45:13Joe Weisenthal?

  I just have to get better at, you know, I'm sort of conflict avoidant.

• 45:16Tracy Alloway?

  I know.

• 45:17Joe Weisenthal?

  And I like being nice to people. So I just have to.

• 45:19Tracy Alloway?

  Joe still says please. And thank you.

• 45:20Joe Weisenthal?

  So I just.

• 45:21Tracy Alloway?

  So the basilisk doesn't get him.

• 45:23Joe Weisenthal?

  So, yeah, that's right. So I have to, I just have to be like, no, this is trash. This is garbage. You totally. We're all dumber for having seen this code. Okay, this is good to know.

• 45:31Speaker 03

  I mean, it's a good point, you know, like all those like AI companies that are recording all the prompts, you know.

• 45:37Tracy Alloway?

  Yeah.

• 45:37Speaker 03

  What knows if they are keeping it, if there is retention around it, you know, like, we know the open AI is keeping them, you know, like they can get. Supon, supony, is this how you pronounce it? Yeah. So like, who knows, you know, like in years from now, you know, if there's like full on like autonomous, like. Robots managed by the Department of War because they think it's lawful. So.

• 45:59Tracy Alloway?

  We all get social scores based on our AI prompts.

• 46:02Joe Weisenthal?

  I, I, these, these thoughts creep into my head unironically where it's like, at some point, is there going to be some, am I going to regret having? I don't know. They, I did, they, they were there in my head.

• 46:15Tracy Alloway?

  Truly a brave new world. Matt, just one last question from me, but going back to cybersecurity and the current situation with Iran. What are you on just the lookout for? Like, what would pique your interest the most to see in that particular space?

• 46:32Speaker 03

  I think now in that particular space. Because I'm one of those people who think it's related to the Epstein files, you know, like it's just more about like getting more Epstein files. Related stuff to see if there is like more connections to it, you know? So I think that would be the only thing that would kind of be like digital that will like spike my interest. Because now we have seen, you know, like, um, just those like all drones can do like so much damage and that Iran. Demonstrated that they can be like really precise with their attacks. So now I think it's more about seeing like which direction it's going to go to and how long it's going to last. Which is like the, the big like question mark because there's so many other components like.

• 47:17Speaker 03

  The energy sector, you know, like, how is it, we have seen the price of like memory, like increasing like a lot. So now, now if they are starting to block like the Detroit of almost, you know, like. What's gonna happen to like the cost of data centers and like memory and AI in general, you know, like we're going to on one side, you know, we're going towards like the cost of tokens and inference going down. But that may also like bring the cost up, you know, so if you're gonna use like AI for like your next generation wars, but if your enemy can just like increase your cost of token and inference, what does that even mean? Like, do you even need AI in the first place? Is it even relevant? So I think this is all like asymmetric like warfare that's gonna happen that we really haven't seen yet.

• 48:02Speaker 03

  And I think that's gonna be like really interesting, but at the same time, there's so much noise and so much so many things happening at once that it's becoming like extremely like hard to focus and just like extract like what's really relevant.

• 48:15Tracy Alloway?

  Yeah, definitely feels like that. Tough, tough choices potentially coming for Havelock as your

• 48:20Joe Weisenthal?

  That's right.

• 48:21Tracy Alloway?

  token costs go up. Matt, it was so wonderful to reconnect again. Thank you so much for coming back on Odd Lots. And yeah, you'll have to get back to Joe about those APIs.

• 48:30Joe Weisenthal?

  Yeah, I'm happy. Let's

• 48:32Speaker 03

  The most famous vibe for there on Twitter or not?

• 48:34Joe Weisenthal?

  Yeah, bring me on as a consultant.

• 48:36Speaker 03

  Sounds good.

• 48:37Joe Weisenthal?

  Take care, Matt.

• 48:37Tracy Alloway?

  Thanks, Matt.

• 48:38Speaker 03

  Take care. Bye bye.

• 48:51Tracy Alloway?

  Joe, always good to catch up with Matt?

• 48:53Joe Weisenthal?

  Super interesting. It's incredible how much is happening right now at this particular nexus, especially obviously the anthropic stuff. But I, you know, it's interesting, you know, you think about cyber warfare and you think about, okay, we're gonna hack into a system and take out critical infrastructure. But another thing you can do is just attack a data center directly.

• 49:12Tracy Alloway?

  Just send a drone to a data center. I thought that was really interesting, that sort of like we got very used to thinking about cyber as like this thing that exists only in

• 49:21Joe Weisenthal?

  In code.

• 49:21Tracy Alloway?

  In code. But now you have this like new front of kinetic warfare where the two like really intersect.

• 49:28Joe Weisenthal?

  Yeah, they do really intersect. And yeah, these are like huge national security vulnerabilities. And he pointed out, I mean, certainly today, but you know, was this in anyone's threat model, thinking about the Risks to it, you know, the cheapness of drones, the ability to take them out. Super interesting. Also, just this idea like, yes, you know, obviously, again, as your observation, the point we think of like cyber attacks, like we're going to take out this whole thing. But at least in the warfare context, his point, like, most of it is like before the war, et cetera. The sort of information gathering, spy craft and so forth, prior to the actual, the actual attacks.

• 50:05Tracy Alloway?

  But it is interesting to see Israel in particular, use some cyber attacks as a sort of sower of chaos.

• 50:11Joe Weisenthal?

  Definitely.

• 50:12Tracy Alloway?

  In Iran. I can't imagine what it's like to actually be on the ground there at the moment for many reasons. But like, you imagine just being there worried about your physical safety and then the traffic lights aren't working as well.

• 50:24Joe Weisenthal?

  Well, and right. And also just think like, wait, there's cameras everywhere or the, you know, like, how much is being recorded, like, create like a sense of like paranoia among everyone about, about everything.

• 50:35Tracy Alloway?

  And also, the interesting thing, obviously, this is very topical in markets, but the SaaS apocalypse idea, Matt in particular, seemed pretty bearish on the outlook for existing software companies, I guess. And I did think his comments about what that would mean for security budgets within organizations were pretty relevant and worrying.

• 50:56Joe Weisenthal?

  Absolutely.

• 50:57Tracy Alloway?

  All right. Shall we leave it there?

• 50:58Joe Weisenthal?

  Let's leave it there.

• 50:58Tracy Alloway?

  This has been another episode of the Odd Lots Podcast. I'm Tracy Alloway. You can follow me at Tracy Alloway.

• 51:04Joe Weisenthal?

  And I'm Joe Weisenthal. You can follow me at the Stalwart. Follow our guest Matt Swish, he's at M Swish. Follow our producers, Carmen Rodriguez at Carmen Armin, Dashell Bennett at Dashbot, and Cale Brooks at Cale Brooks. And for more Odd Lots content, go to Bloomberg.com/oddlots for the daily newsletter and all of our episodes. And you can chat about all of these topics 24/7 in our Discord, discord.gg/oddlots.

• 51:26Tracy Alloway?

  And if you enjoy Odd Lots, if you like it when we talk about the intersection of kinetic and cyber warfare, then please leave us a positive review on your favorite podcast platform. And remember, if you are a Bloomberg subscriber, you can listen to all of our episodes absolutely ad free. All you need to do is find the Bloomberg channel on Apple Podcasts and follow the instructions there. Thanks for listening.

• 52:17Speaker 05

  Congratulations, you've built a dashboard. But now comes the follow-up question, and the follow-up to the follow-up, and the dashboard for that. Meet Hex. Give everyone the power to ask their own questions, explore data, and build with AI, all in natural language. Because every answer should spark another question, limited only by your curiosity, not your data team's bandwidth. Go deeper than dashboards. Visit hex.ai.

• 52:48Speaker 06

  If you're a business owner, you need a card that can keep up. With the Delta SkyMiles Reserve Business American Express Card, everyday purchases transform into miles you can use towards future travel. So business as usual can lead to a well-deserved getaway. And for a limited time, card members can earn 200,000 bonus miles, the highest miles offered this year. Whether you're traveling for business or planning your next adventure, now's a great time to make every purchase go further. Apply today at www.delta.com/podcast. Offer ends November 4. Minimum spending requirements and terms apply.

• 53:24Speaker 07

  This is Robert Smith from Business History. If you're listening to this, there's a good chance you're a small business owner. And like every small business owner, you started with a dream to do what you love and watch it grow. What you probably didn't dream about? Keeping up with cyber threats. That's where MasterCard can help with access to tools that help identify cyber threats to better protect your business. Building your dream business, priceless. For cybersecurity in a changing world, there's MasterCard.

• 53:50Speaker 07

  Learn more at mastercard.com/smallbusiness.