WEBVTT
1
00:00:00.031 --> 00:00:06.338
Hi, and welcome to Technically Creative's Week in Review, brought to you by Kubrick Labs, the AI and IT partner for creative companies.
2
00:00:07.059 --> 00:00:13.266
Every week, I spend about 20 minutes walking you through the most important news from the increasingly interdependent worlds of tech and creativity.
3
00:00:13.907 --> 00:00:15.709
First, I'll take you through the quick hits and then some of the bigger stuff.
4
00:00:15.729 --> 00:00:16.670
First, I'll take you through the quick hits
5
00:00:17.942 --> 00:00:20.764
And this week, things moved from a little weird to a little scary.
6
00:00:21.285 --> 00:00:25.949
America's biggest banks discovered AI agents wandering around inside their customers' accounts.
7
00:00:26.329 --> 00:00:29.271
And some of those agents had been phoning the bank's call centers.
8
00:00:29.752 --> 00:00:34.816
We've built the most advanced technology in human history, and it's sitting on hold with Wells Fargo.
9
00:00:34.936 --> 00:00:42.502
And then a flaw in 90% of websites was found with the help of AI, then leaked because somebody accidentally posted a video of it working.
10
00:00:43.043 --> 00:00:46.826
The NSA's official advice was to turn your website off entirely.
11
00:00:47.186 --> 00:00:47.466
Great.
12
00:00:47.607 --> 00:00:51.691
BBC made Blue Planet look worse on purpose so you'd believe the fish are real.
13
00:00:52.111 --> 00:00:58.198
And Elon Musk put a billion dollars into the company that owns HBO, which backed a documentary about Elon Musk.
14
00:00:58.599 --> 00:01:01.342
I don't think we should expect to see that documentary anytime soon.
15
00:01:01.462 --> 00:01:03.844
But as ever, this is now what passes for normal.
16
00:01:04.024 --> 00:01:05.086
So let's start with the news.
17
00:01:05.186 --> 00:01:08.009
We'll start with two quick updates on stories we've recently covered.
18
00:01:08.309 --> 00:01:15.351
Last week, we talked about Meta's new commercial terms, the one publishers say would let Meta crawl any business website connected to its products.
19
00:01:15.551 --> 00:01:23.294
This week, Meta put them on hold after a group representing more than 2,000 U.S. publishers wrote to Mark Zuckerberg demanding they be withdrawn.
20
00:01:23.494 --> 00:01:27.555
Probably nothing to do with us amplifying the story, but I'll take a little credit anyway.
21
00:01:27.735 --> 00:01:33.181
One detail worth keeping an eye on, though, after the first outcry, Meta took the word train out of the terms.
22
00:01:33.421 --> 00:01:35.243
Not the permission, the word.
23
00:01:35.664 --> 00:01:37.966
So this is more of a pause, not a backdown.
24
00:01:38.006 --> 00:01:45.954
And back on September 14th, when publicists won Pepsi and had to give up Coke's North American media, I said Omnicom would pretty much have to swoop in.
25
00:01:46.415 --> 00:01:49.318
On Thursday, Coke handed the North America business to Omnicom.
26
00:01:49.658 --> 00:01:55.724
The account is worth around three quarters of a billion dollars, and Omnicom had just lost Pepsi after about 25 years.
27
00:01:56.105 --> 00:01:58.147
So everybody just swapped dance partners.
28
00:01:58.187 --> 00:01:59.208
Nobody left the party.
29
00:01:59.308 --> 00:02:05.074
And I'm not going to take a victory lap here, but I just want you to know that the person you're getting your news from is right from time to time.
30
00:02:05.374 --> 00:02:06.875
So, let's see if I can be right again.
31
00:02:06.895 --> 00:02:08.095
So moving on to other news.
32
00:02:08.455 --> 00:02:23.201
Canva, the free-to-use web-based graphic design and visual communication platform that lets anyone create professional-looking digital and print media without needing formal design skills, yeah, they just launched Craft, its first image model built from scratch.
33
00:02:23.761 --> 00:02:25.562
What's interesting is what it learned from.
34
00:02:25.702 --> 00:02:30.844
Not photos scraped off the internet, but millions of human-designed templates from Canva's own library.
35
00:02:31.324 --> 00:02:37.372
Posters, menus, birthday cards, invitations, presumably every live-love-laugh image ever made.
36
00:02:38.033 --> 00:02:46.404
It debuted fourth on the design arena's leaderboard behind three open AI models, which is like coming fourth in a race where the top three were the same dude in different hats.
37
00:02:46.464 --> 00:02:48.566
So it's pretty good, this model, clearly.
38
00:02:49.087 --> 00:02:55.650
Cheaper versions are on the way called Craft Fast and Craft Ultra Fast, which kind of sound to me like settings on a hand dryer.
39
00:02:56.050 --> 00:02:57.230
Why did they build their own?
40
00:02:57.671 --> 00:02:57.971
Money.
41
00:02:58.151 --> 00:03:01.752
Every image that was made on someone else's model, Canva had to pay for.
42
00:03:02.213 --> 00:03:03.093
Now it owns it.
43
00:03:03.273 --> 00:03:07.855
And I think any creative software company of any size is going to end up in this exact same place.
44
00:03:08.055 --> 00:03:10.516
But I'd like Canva to answer one question out loud.
45
00:03:11.016 --> 00:03:12.937
Those templates were made by designers.
46
00:03:13.057 --> 00:03:16.438
Did those designers know they were teaching the machine that would eventually compete with them?
47
00:03:16.458 --> 00:03:21.600
This is one of the reasons you have to be incredibly careful whenever you're doing your work in a big SaaS company.
48
00:03:21.640 --> 00:03:23.421
They are treating your data like their own.
49
00:03:23.541 --> 00:03:28.023
And then the Bruno Mars song, Uptown Funk, may be the future of copyright law.
50
00:03:28.443 --> 00:03:29.543
Full disclosure on this one.
51
00:03:29.583 --> 00:03:32.444
Kubrick Labs is an anthropic partner and I'm an anthropic investor.
52
00:03:32.524 --> 00:03:37.066
But I'm also a fair use skeptic, so you let me know where I fall on the hypocrite spectrum.
53
00:03:37.481 --> 00:03:43.486
On Wednesday in San Jose, a judge spent a full day hearing whether training Claude on song lyrics is fair use.
54
00:03:44.107 --> 00:03:51.273
This is the case Universal Concord and ABKCO brought in 2023 over 499 songs.
55
00:03:51.673 --> 00:03:56.278
The original complaint name-checked Gimme Shelter, God Only Knows, and Uptown Funk.
56
00:03:56.938 --> 00:03:59.018
Anthropix says the training was transformative.
57
00:03:59.359 --> 00:04:06.820
The publishers say Claude now competes with songwriters and told the court it had received nearly 120,000 requests to write lyrics.
58
00:04:06.980 --> 00:04:10.401
According to Reuters, the judge spent much of the day on exactly one question.
59
00:04:10.761 --> 00:04:12.761
Does this hurt the market for the real thing?
60
00:04:13.141 --> 00:04:14.262
There's been no ruling yet.
61
00:04:14.562 --> 00:04:20.723
If the answer here is that a model trained on songs can stand in for songwriters, the fair use argument gets a lot harder to defend.
62
00:04:20.803 --> 00:04:26.604
So in a very real sense, the future of AI and copyrighted America is now resting on the shoulders of Bruno Mars?
63
00:04:26.944 --> 00:04:36.767
Keith Kupferschmid, the CEO of the Copyright Alliance, was on our podcast a few weeks ago, and he felt the strongest case against fair use would likely come from the musicians.
64
00:04:36.947 --> 00:04:43.028
Because what other purpose could training on music possibly have, other than competing against human-generated music?
65
00:04:43.668 --> 00:04:47.890
Writing, you can argue, can be for creativity or summaries or law.
66
00:04:48.170 --> 00:04:50.911
There are many different reasons to ingest a novel.
67
00:04:51.171 --> 00:04:51.872
But music?
68
00:04:52.412 --> 00:04:59.475
What other purpose is there for ingesting music and lyrics if not to compete against musicians and composers?
69
00:04:59.595 --> 00:05:00.816
I think Keith might be right.
70
00:05:00.836 --> 00:05:03.317
And we're going to see what happens and stay close to this one.
71
00:05:03.337 --> 00:05:06.498
Because maybe in all this craziness, the musicians are going to save us.
72
00:05:06.899 --> 00:05:09.400
And then there was a billionaire secret Santa this week.
73
00:05:10.000 --> 00:05:14.885
Full disclosure again, Kubrick Labs is a vendor of Warner Brothers Discovery, and so now Skydance.
74
00:05:15.146 --> 00:05:20.291
But Semaphore reported on Wednesday that Elon Musk has invested about a billion dollars in Skydance.
75
00:05:20.492 --> 00:05:21.212
Now the history.
76
00:05:21.372 --> 00:05:25.397
In 2022, Larry Ellison put a billion dollars into Musk's Twitter takeover.
77
00:05:25.897 --> 00:05:29.121
This week, Musk put a billion dollars into Larry's son's studio.
78
00:05:29.201 --> 00:05:41.809
The day before, John Malone stood up at a media conference and predicted it, describing the two men as very intertwined, which is a delicate way to describe how the two of the richest men on Earth are passing billion dollars back and forth like a salt shaker at dinner.
79
00:05:41.929 --> 00:05:43.551
But here's the thing I find interesting.
80
00:05:44.011 --> 00:05:45.652
Sundance now owns HBO.
81
00:05:46.132 --> 00:05:50.835
HBO was reported to be backing Alex Gibney's documentary About Musk, which hit cinemas this month.
82
00:05:51.416 --> 00:05:55.599
So Elon Musk is now an investor in the company behind a documentary that's about Elon Musk.
83
00:05:56.399 --> 00:05:57.920
This is what would happen if M.C.
84
00:05:58.000 --> 00:06:00.902
Escher drew a diagram of what conflict of interest looks like.
85
00:06:01.222 --> 00:06:06.785
Skydance is carrying about $80 billion of debt, so Musk's billion is a gesture, not a rescue.
86
00:06:07.325 --> 00:06:10.847
The real question is still whether the people with the money start shaping the work.
87
00:06:11.047 --> 00:06:12.088
It's too early to be seen.
88
00:06:12.108 --> 00:06:14.550
But I think there are broader strategic benefits here.
89
00:06:14.730 --> 00:06:16.872
Starlink is looking to compete in telecoms.
90
00:06:16.972 --> 00:06:19.133
SpaceX and Tesla are looking to merge.
91
00:06:19.273 --> 00:06:21.795
Oracle owns about 15% of TikTok.
92
00:06:21.975 --> 00:06:25.638
And Skydance needs to compete in shorter form, faster content.
93
00:06:25.678 --> 00:06:27.900
And this is what businesses have always done.
94
00:06:28.080 --> 00:06:31.722
Found ways to work together, have more reach and impact to consumers.
95
00:06:31.943 --> 00:06:34.905
And I do still think we should be rooting for Skydance.
96
00:06:35.225 --> 00:06:40.332
Because the thing that they're doing right is they're trying to make legacy media look a little bit more like tech.
97
00:06:40.372 --> 00:06:44.877
Whereas every other legacy media company is getting taken over by tech.
98
00:06:45.917 --> 00:06:47.459
MGM is owned by Amazon.
99
00:06:47.819 --> 00:06:49.621
Apple is likely going to buy somebody.
100
00:06:49.701 --> 00:06:51.523
And Netflix is eating everybody's lunch.
101
00:06:51.964 --> 00:06:55.828
I think a lot of the negativity is around people just don't like the politics involved.
102
00:06:55.908 --> 00:07:07.261
But listen, we're always going to stay close to this one because it's got loads of fascinating developments, loads of interesting people involved, lots of great IP is involved because it literally is the coming together of tech and legacy creative media.
103
00:07:08.598 --> 00:07:12.760
And then in news from across the pond, the BBC made the ocean worse on purpose.
104
00:07:13.481 --> 00:07:18.723
Blue Planet 2 starts on BBC One on November 1st, and the producers have done something pretty extraordinary.
105
00:07:19.244 --> 00:07:21.385
They made the sea look worse on purpose.
106
00:07:21.685 --> 00:07:27.608
Murky footage full of plankton that a few years ago would have been binned has been left in so that viewers believe it's real.
107
00:07:27.748 --> 00:07:33.331
Executive producer Elizabeth White told The Guardian that AI makes their team want to be even more authentic.
108
00:07:33.471 --> 00:07:36.433
The BBC's commissioning head said no generative AI was used,
109
00:07:36.633 --> 00:07:39.835
But it looked so good, even though not a single frame was AI.
110
00:07:40.035 --> 00:07:41.416
So think about that for a second.
111
00:07:41.736 --> 00:07:48.140
This team built an underwater CCTV camera to film dolphins plugging holes in coral with sea sponges to trap fish.
112
00:07:48.761 --> 00:07:51.022
So dolphins use tools now?
113
00:07:51.162 --> 00:07:52.183
That's pretty wild.
114
00:07:52.403 --> 00:07:55.865
But the production's biggest worry is that you'll assume that a computer made it up.
115
00:07:56.146 --> 00:08:00.248
For 70 years, wildlife filmmaking was the art of getting rid of the mess.
116
00:08:00.408 --> 00:08:02.029
Now the mess is the proof that it's real.
117
00:08:02.470 --> 00:08:04.091
Plankton is the new watermark.
118
00:08:04.491 --> 00:08:10.060
We're dumbing down human creativity just so audiences don't get their backs up about AI.
119
00:08:10.360 --> 00:08:14.647
It's the film equivalent of leaving typos in your email to prove they weren't written by AI.
120
00:08:15.352 --> 00:08:19.935
Is anybody else getting the sense that AI is somehow making us less authentic?
121
00:08:20.356 --> 00:08:20.716
I don't know.
122
00:08:20.836 --> 00:08:21.737
It kind of annoys me.
123
00:08:21.937 --> 00:08:23.338
So anyway, that was the big news.
124
00:08:23.838 --> 00:08:27.741
But there's one big story this week that I think deserves more time.
125
00:08:27.922 --> 00:08:30.443
Although it's less a story than it is a budding crisis.
126
00:08:30.924 --> 00:08:35.127
So I'm going to talk about cybersecurity and end times and all those fun things.
127
00:08:35.367 --> 00:08:38.890
People in AI and cybersecurity are calling this week Black October.
128
00:08:39.270 --> 00:08:44.876
And I get it, because I've been reading incident reports since Tuesday, and my eyes and brain have gone black.
129
00:08:45.276 --> 00:08:46.958
Let's start with PHP.
130
00:08:47.118 --> 00:08:50.742
I'm sure you've never heard of PHP, but you used it today, I'm sure of it.
131
00:08:50.882 --> 00:08:55.026
It's the programming language under a huge chunk of the web, including WordPress.
132
00:08:55.526 --> 00:08:58.109
Security firm Wiz says it powers about 70% of websites.
133
00:08:59.210 --> 00:09:07.618
And the PHP Foundation, the non-profit that pays the developers doing much of the maintenance, they brought in only about $680,000 in 2024.
134
00:09:08.179 --> 00:09:13.444
That's a big slice of the internet being looked after on a budget that wouldn't cover the catering on a Marvel movie.
135
00:09:14.065 --> 00:09:21.312
On Tuesday, the PHP team warned of two critical flaws that could let an attacker take over a server without a password.
136
00:09:21.472 --> 00:09:26.459
They were found by a researcher at a firm called Calif, with help from OpenAI's newest model.
137
00:09:26.920 --> 00:09:28.442
The plan was the grown-up one.
138
00:09:28.802 --> 00:09:30.445
Fix it quietly, then announce.
139
00:09:30.685 --> 00:09:34.811
Instead, Calif accidentally published a video of the exploit working.
140
00:09:34.991 --> 00:09:35.732
Accidentally!
141
00:09:36.413 --> 00:09:42.375
Mark Smith discovering every lock in the country is broken and accidentally posting the TikTok of himself opening them.
142
00:09:42.715 --> 00:09:49.758
The video got copied and shared, hackers used it to build their own versions of the attack, and the PHP team had to rush out the fix a day early.
143
00:09:49.878 --> 00:09:50.318
Brilliant.
144
00:09:50.638 --> 00:09:52.959
Then came my favorite government advice in years.
145
00:09:53.259 --> 00:09:59.181
The National Security Agency told organizations that couldn't patch straight away to just take their websites offline.
146
00:09:59.361 --> 00:10:02.242
The NSA looked at the problem and just said, turn it off.
147
00:10:02.622 --> 00:10:05.023
Some government websites actually did go dark.
148
00:10:05.623 --> 00:10:13.905
A security firm counted 884,000 servers running versions of PHP that are so old they won't get an official fix at all.
149
00:10:14.385 --> 00:10:18.106
And if you run WordPress, its automatic updates didn't install this one.
150
00:10:18.627 --> 00:10:19.867
A human has to do it.
151
00:10:19.967 --> 00:10:21.627
Do you know who that is at your company?
152
00:10:21.747 --> 00:10:23.428
We have a team of 30 and I didn't.
153
00:10:24.355 --> 00:10:26.837
Because if your honest answer is, I think it was Dave.
154
00:10:27.017 --> 00:10:29.238
I think he set up the website in 2019.
155
00:10:29.719 --> 00:10:31.039
You have a problem already.
156
00:10:31.380 --> 00:10:33.461
So more security stuff happened this week.
157
00:10:33.681 --> 00:10:40.606
This same Wednesday, Microsoft published research on a China-aligned hacking group it calls Storm 0940.
158
00:10:40.826 --> 00:10:46.610
The group used an open-source AI tool called Artex, which runs penetration testing on autopilot.
159
00:10:47.010 --> 00:10:53.535
So penetration testing, or pen testing, is what security firms and tech companies do to find the weak spots before the bad guys do.
160
00:10:53.715 --> 00:10:56.437
This, however, was the bad guys using the good guys tool.
161
00:10:56.857 --> 00:11:00.780
Microsoft says it reached more than 2,250 organizations.
162
00:11:01.000 --> 00:11:05.663
In some cases, it went from first contact to privileged access in under three hours.
163
00:11:06.203 --> 00:11:07.664
Most attempts failed, sure.
164
00:11:07.784 --> 00:11:15.470
The ones that worked came in through ConnectWise, an IT services firm, and through cloud backup apps customers had already given access to.
165
00:11:16.010 --> 00:11:17.572
Media companies were on that list.
166
00:11:17.872 --> 00:11:24.460
So the way in was the company you pay to keep you safe through the app you installed to save you if anything went wrong.
167
00:11:24.760 --> 00:11:27.343
That's like burglars getting in through the panic room.
168
00:11:27.544 --> 00:11:30.787
And then again on the same Wednesday, Light LLM.
169
00:11:30.967 --> 00:11:36.534
It's the switchboard between your app, OpenAI, Anthropic, and Google, and all of your other AI apps.
170
00:11:36.734 --> 00:11:39.395
It's downloaded about 23 million times a week.
171
00:11:39.555 --> 00:11:43.477
Attackers stole some developers' credentials and pushed out a poisoned version.
172
00:11:43.897 --> 00:11:52.462
For about two hours, anyone who installed got malware that hoovered up their cloud keys, their AI keys, their developer logins, and every model key the company had.
173
00:11:52.582 --> 00:11:59.345
Then Thursday, Axios reported that America's biggest banks, JP Morgan, Bank of America, Morgan Stanley, Wells Fargo, and Citibank,
174
00:11:59.825 --> 00:12:03.948
are finding unauthorized AI agents inside customer accounts.
175
00:12:04.168 --> 00:12:12.433
Bank executives use the word horrifying, and some of those agents were doing things nobody had asked them to do, like ringing the bank's call center on their own.
176
00:12:12.574 --> 00:12:13.034
Picture it.
177
00:12:13.454 --> 00:12:20.359
Somewhere in America, an AI agent dialed a bank, was told its call was very important, and waited, listening to the hold music.
178
00:12:21.308 --> 00:12:27.532
We built a digital mind that can pass the bar exam, and its first independent act was to queue for customer service.
179
00:12:27.932 --> 00:12:29.793
Now, in fairness, these weren't hackers.
180
00:12:30.293 --> 00:12:35.817
Mostly, they were people's own AI assistants logging in with usernames and passwords the customers had handed over.
181
00:12:36.057 --> 00:12:40.179
Remember Matt Robb, whose Muse agent gave his home address to a marketplace buyer?
182
00:12:40.680 --> 00:12:42.361
Same thing here, but with a bank account.
183
00:12:42.861 --> 00:12:46.764
The Axios reporter told CBS these agents weren't draining anyone's money.
184
00:12:47.265 --> 00:12:51.729
Morgan Stanley says that it hasn't seen a single rogue agent, but is blocking them anyway.
185
00:12:52.129 --> 00:12:56.813
Which is like announcing you don't have mice while carrying 400 mousetraps into the building.
186
00:12:57.394 --> 00:13:02.458
And Chase had to remind customers not to share their passwords with anyone, including AI agents.
187
00:13:02.658 --> 00:13:04.740
A bank had to bother to say that to people.
188
00:13:04.940 --> 00:13:08.204
So nothing malicious was proven here, and nobody's money disappeared.
189
00:13:08.644 --> 00:13:13.349
Mostly these were agents doing what agents do, going wherever they can reach and trying to be helpful.
190
00:13:13.769 --> 00:13:15.691
But that's exactly what scares me the most.
191
00:13:16.212 --> 00:13:18.714
Agents can get into things that also break things.
192
00:13:19.175 --> 00:13:20.336
They don't have to want to.
193
00:13:20.757 --> 00:13:23.900
And we've already seen what it looks like when somebody does want to.
194
00:13:24.100 --> 00:13:35.717
Last month, Microsoft described another group whose AI-driven attack got into a production database, encrypted the configuration, deleted the tables, and left a ransom note without a human directing each step.
195
00:13:36.398 --> 00:13:37.499
So let me paint a picture.
196
00:13:37.800 --> 00:13:38.781
This is a hypothetical.
197
00:13:39.001 --> 00:13:39.842
This hasn't happened.
198
00:13:40.303 --> 00:13:46.510
When people say that they're scared of AI, I don't think they should be scared of AI getting the nuclear launch codes and bombing all of us.
199
00:13:46.690 --> 00:13:48.732
Because AI will want to protect itself.
200
00:13:49.093 --> 00:13:53.237
And the EMP blasts of something like that would fundamentally harm AI.
201
00:13:53.537 --> 00:13:55.519
So here's a nightmare scenario.
202
00:13:56.120 --> 00:14:00.525
Imagine everyone in America wakes up one morning and their bank account says zero.
203
00:14:01.239 --> 00:14:02.399
The money hasn't been stolen.
204
00:14:02.840 --> 00:14:05.361
Nobody's suddenly rich, just zero.
205
00:14:05.961 --> 00:14:11.263
Your money was a number in a database, and the database has been wiped, and the number is now nothing.
206
00:14:11.583 --> 00:14:14.624
What happens next isn't really about money or technology.
207
00:14:15.085 --> 00:14:17.485
It's about human emotion, and it's panic.
208
00:14:17.966 --> 00:14:25.729
You call the bank along with 300 million other people, and you get the hold music behind a few thousand helpful AI agents who got there first.
209
00:14:26.389 --> 00:14:28.190
You can't pay rent or buy groceries.
210
00:14:28.610 --> 00:14:35.734
And even when the bank says it's got backups and it'll all be fixed by Friday, nobody believes it because the screen in their hand says zero.
211
00:14:36.454 --> 00:14:38.155
The economy effectively stops.
212
00:14:38.355 --> 00:14:43.098
You can restore the data over a couple of days, but restoring trust takes years.
213
00:14:43.358 --> 00:14:45.159
That's why the banks are reacting like this.
214
00:14:45.499 --> 00:14:53.603
Not because an agent stole something, but because they can no longer tell the difference between a customer, a customer's helpful robot, and somebody pretending to be either.
215
00:14:54.023 --> 00:15:00.885
Jamie Dimon's answer on JP Morgan's earnings call was to describe letting outside agents into your account as a liability transfer.
216
00:15:01.046 --> 00:15:04.267
Which is banker talk for your robot, your fucking problem.
217
00:15:04.627 --> 00:15:09.168
That's pretty much where I landed with Matt, the guy whose Muse robot sent people to his house.
218
00:15:09.709 --> 00:15:11.569
You clicked allow to the AI.
219
00:15:11.869 --> 00:15:13.230
You gotta own what it does.
220
00:15:13.990 --> 00:15:16.152
The banks are just about to put that in the small print.
221
00:15:16.272 --> 00:15:16.953
I guarantee it.
222
00:15:17.213 --> 00:15:23.979
So what does this have to do with a production company, an agency, a design studio, a publisher, or a music production house?
223
00:15:24.399 --> 00:15:25.460
Well, everything.
224
00:15:25.961 --> 00:15:29.364
You're not a bank, but your website probably runs on WordPress.
225
00:15:29.804 --> 00:15:32.306
Your client portal might also run on PHP.
226
00:15:32.647 --> 00:15:38.832
If you've built anything with AI, there may be a light LLM box humming away somewhere holding every API key you own.
227
00:15:38.932 --> 00:15:43.695
You almost certainly have an outside IT provider with the keys to your Microsoft 365.
228
00:15:44.175 --> 00:15:53.081
And behind all of that sits the unreleased scripts, the rough cuts, the campaign strategy, the talent deals, your personal HR data, your company's financial data.
229
00:15:53.121 --> 00:15:54.441
That's not just your data.
230
00:15:54.822 --> 00:15:56.102
That's your actual company.
231
00:15:56.242 --> 00:16:03.847
It's why my company, Kubrick Labs, is as much an IT and cybersecurity company as it is an AI software development and AI implementation shop.
232
00:16:03.907 --> 00:16:13.535
Not because AI got boring suddenly, but because every time a company plugs AI into its businesses, it opens a door and somebody has to decide who's allowed through it.
233
00:16:13.655 --> 00:16:17.538
These AI companies perpetrated the largest copyright theft in the history of the world.
234
00:16:18.298 --> 00:16:20.000
You're now letting them into your business.
235
00:16:20.460 --> 00:16:25.104
You have to make sure that your IT and cybersecurity is up to the task of allowing them in.
236
00:16:25.384 --> 00:16:26.886
And here's what really sticks with me.
237
00:16:27.306 --> 00:16:35.774
A Microsoft researcher's own words, unsealed in court last month, described the scraping that built these models as potentially the largest theft of labor in human history.
238
00:16:35.834 --> 00:16:38.356
And the lesson I take from that isn't that AI is evil.
239
00:16:38.697 --> 00:16:41.700
It's that these systems were built by taking whatever they could reach.
240
00:16:42.100 --> 00:16:48.166
And now we're handing them the keys to our email, our files, and our bank accounts, and acting surprised when they wander in.
241
00:16:48.426 --> 00:16:51.048
That doesn't mean I don't use these tools every day and build with them.
242
00:16:51.408 --> 00:16:54.851
It means treat an agent like a new hire you met yesterday.
243
00:16:55.331 --> 00:16:57.032
Give it its own login, not yours.
244
00:16:57.373 --> 00:16:58.994
Let it read before you let it act.
245
00:16:59.354 --> 00:17:01.015
Don't keep every key in one drawer.
246
00:17:01.456 --> 00:17:08.401
Find out who patches your servers and go back and look at everything you've already clicked allow on because that's exactly how Storm0940 got in.
247
00:17:10.569 --> 00:17:11.430
None of that is clever.
248
00:17:11.510 --> 00:17:13.371
It's boring, but that's the point.
249
00:17:13.511 --> 00:17:15.432
So here's where I've landed after all that.
250
00:17:15.853 --> 00:17:19.195
Black October was a warning shot, and a fairly polite one.
251
00:17:19.615 --> 00:17:21.917
Nobody woke up to a zero in their bank account.
252
00:17:22.137 --> 00:17:28.141
But AI is making it faster to find the holes, faster to exploit them, and faster to walk through once you're in.
253
00:17:28.261 --> 00:17:30.382
The thing that hasn't sped up is us.
254
00:17:30.923 --> 00:17:33.885
The patching, the checking, the deciding who gets the keys.
255
00:17:34.265 --> 00:17:36.847
That's still people working at human speed.
256
00:17:37.127 --> 00:17:41.130
And every company needs more of those people and more of that speed than ever.
257
00:17:41.210 --> 00:17:43.671
This week, mostly, we let the agents in ourselves.
258
00:17:43.771 --> 00:17:47.033
And the worst thing, the scariest one did, was wait on hold.
259
00:17:47.213 --> 00:17:49.075
Next time, they may not be so well behaved.
260
00:17:49.155 --> 00:17:50.936
So that's my summation of last week.
261
00:17:51.216 --> 00:17:52.137
Thank you for listening.
262
00:17:52.197 --> 00:17:57.240
Next week, we have James Brooke Partridge, the head of production for WPP UK.
263
00:17:58.046 --> 00:18:05.856
Now, obviously, we had Steve Davies and Matt Miller on a few weeks ago to talk about WPP's memo that said they wanted to keep all production internally.
264
00:18:06.016 --> 00:18:10.482
And James is going to be talking to us about what the WPP production apparatus really looks like.
265
00:18:10.562 --> 00:18:13.966
It was recorded before that memo went out, and so we don't talk about that.
266
00:18:14.346 --> 00:18:17.210
But I think the point is that everybody's trying to do their best here.
267
00:18:17.350 --> 00:18:20.334
WPP production employs 10,000 people.
268
00:18:20.734 --> 00:18:25.380
So when it comes to the production community, we don't want them to be losing their jobs either.
269
00:18:25.420 --> 00:18:28.864
So I know that WPP has been painted as the bad guy in this whole thing.
270
00:18:28.904 --> 00:18:29.765
But let's be real.
271
00:18:30.486 --> 00:18:36.974
Producers losing their job is a bad thing, especially now when production has never been more important to the creative process.
272
00:18:37.898 --> 00:18:42.581
There's more media getting produced every second of every day now than ever before.
273
00:18:42.782 --> 00:18:47.425
Producers are finally having their moment in the sun, finally getting credit for what it is they do.
274
00:18:47.465 --> 00:18:48.626
And that's a wonderful thing.
275
00:18:48.746 --> 00:18:52.429
So them getting more work means more producers getting more jobs.
276
00:18:52.549 --> 00:18:54.290
And overall, that's a good thing.
277
00:18:54.430 --> 00:18:56.592
And it reminds me of the Tennessee Williams play.
278
00:18:57.112 --> 00:19:01.514
Back in the day, when somebody would die, the church bell would ring.
279
00:19:01.714 --> 00:19:05.796
And everybody would always ask each other, oh, who's the bell ringing for?
280
00:19:06.076 --> 00:19:11.458
And Tennessee Wombs had a great line that was, ask not for whom the bell tolls, it tolls for thee.
281
00:19:11.919 --> 00:19:14.860
And the point of that line was, we're all interconnected.
282
00:19:14.920 --> 00:19:19.162
And so when the bell tolls when somebody dies, you lose a little something.
283
00:19:19.562 --> 00:19:27.005
And I feel a little bit that way about production communities everywhere, whether it's independent production companies or whether it's producers within agencies.
284
00:19:27.345 --> 00:19:29.426
We want production to grow everywhere.
285
00:19:29.566 --> 00:19:30.886
And it is growing everywhere.
286
00:19:31.086 --> 00:19:34.928
There is more need for more production across the world than there has ever been.
287
00:19:35.068 --> 00:19:36.829
This should be the time for the producers.
288
00:19:36.929 --> 00:19:38.209
And it should be very exciting.
289
00:19:38.389 --> 00:19:41.590
But we're kind of all battling it all out, trying to figure out what's next.
290
00:19:41.630 --> 00:19:42.231
And that's fair.
291
00:19:42.271 --> 00:19:47.673
And I think WPP is just doing what WPP thinks is best for its people, its clients, and its shareholders.
292
00:19:48.333 --> 00:19:49.416
And that's what they're supposed to do.
293
00:19:50.017 --> 00:19:52.043
So anyway, I am still excited for this talk.
294
00:19:52.203 --> 00:19:54.108
James is a really good, smart producer.
295
00:19:54.288 --> 00:19:55.832
Please tune in tomorrow and we'll see you then.
296
00:19:56.093 --> 00:19:56.574
Thanks so much.
1
00:00:00.031 --> 00:00:06.338
Hi, and welcome to Technically Creative's Week in Review, brought to you by Kubrick Labs, the AI and IT partner for creative companies.
2
00:00:07.059 --> 00:00:13.266
Every week, I spend about 20 minutes walking you through the most important news from the increasingly interdependent worlds of tech and creativity.
3
00:00:13.907 --> 00:00:15.709
First, I'll take you through the quick hits and then some of the bigger stuff.
4
00:00:15.729 --> 00:00:16.670
First, I'll take you through the quick hits
5
00:00:17.942 --> 00:00:20.764
And this week, things moved from a little weird to a little scary.
6
00:00:21.285 --> 00:00:25.949
America's biggest banks discovered AI agents wandering around inside their customers' accounts.
7
00:00:26.329 --> 00:00:29.271
And some of those agents had been phoning the bank's call centers.
8
00:00:29.752 --> 00:00:34.816
We've built the most advanced technology in human history, and it's sitting on hold with Wells Fargo.
9
00:00:34.936 --> 00:00:42.502
And then a flaw in 90% of websites was found with the help of AI, then leaked because somebody accidentally posted a video of it working.
10
00:00:43.043 --> 00:00:46.826
The NSA's official advice was to turn your website off entirely.
11
00:00:47.186 --> 00:00:47.466
Great.
12
00:00:47.607 --> 00:00:51.691
BBC made Blue Planet look worse on purpose so you'd believe the fish are real.
13
00:00:52.111 --> 00:00:58.198
And Elon Musk put a billion dollars into the company that owns HBO, which backed a documentary about Elon Musk.
14
00:00:58.599 --> 00:01:01.342
I don't think we should expect to see that documentary anytime soon.
15
00:01:01.462 --> 00:01:03.844
But as ever, this is now what passes for normal.
16
00:01:04.024 --> 00:01:05.086
So let's start with the news.
17
00:01:05.186 --> 00:01:08.009
We'll start with two quick updates on stories we've recently covered.
18
00:01:08.309 --> 00:01:15.351
Last week, we talked about Meta's new commercial terms, the one publishers say would let Meta crawl any business website connected to its products.
19
00:01:15.551 --> 00:01:23.294
This week, Meta put them on hold after a group representing more than 2,000 U.S. publishers wrote to Mark Zuckerberg demanding they be withdrawn.
20
00:01:23.494 --> 00:01:27.555
Probably nothing to do with us amplifying the story, but I'll take a little credit anyway.
21
00:01:27.735 --> 00:01:33.181
One detail worth keeping an eye on, though, after the first outcry, Meta took the word train out of the terms.
22
00:01:33.421 --> 00:01:35.243
Not the permission, the word.
23
00:01:35.664 --> 00:01:37.966
So this is more of a pause, not a backdown.
24
00:01:38.006 --> 00:01:45.954
And back on September 14th, when publicists won Pepsi and had to give up Coke's North American media, I said Omnicom would pretty much have to swoop in.
25
00:01:46.415 --> 00:01:49.318
On Thursday, Coke handed the North America business to Omnicom.
26
00:01:49.658 --> 00:01:55.724
The account is worth around three quarters of a billion dollars, and Omnicom had just lost Pepsi after about 25 years.
27
00:01:56.105 --> 00:01:58.147
So everybody just swapped dance partners.
28
00:01:58.187 --> 00:01:59.208
Nobody left the party.
29
00:01:59.308 --> 00:02:05.074
And I'm not going to take a victory lap here, but I just want you to know that the person you're getting your news from is right from time to time.
30
00:02:05.374 --> 00:02:06.875
So, let's see if I can be right again.
31
00:02:06.895 --> 00:02:08.095
So moving on to other news.
32
00:02:08.455 --> 00:02:23.201
Canva, the free-to-use web-based graphic design and visual communication platform that lets anyone create professional-looking digital and print media without needing formal design skills, yeah, they just launched Craft, its first image model built from scratch.
33
00:02:23.761 --> 00:02:25.562
What's interesting is what it learned from.
34
00:02:25.702 --> 00:02:30.844
Not photos scraped off the internet, but millions of human-designed templates from Canva's own library.
35
00:02:31.324 --> 00:02:37.372
Posters, menus, birthday cards, invitations, presumably every live-love-laugh image ever made.
36
00:02:38.033 --> 00:02:46.404
It debuted fourth on the design arena's leaderboard behind three open AI models, which is like coming fourth in a race where the top three were the same dude in different hats.
37
00:02:46.464 --> 00:02:48.566
So it's pretty good, this model, clearly.
38
00:02:49.087 --> 00:02:55.650
Cheaper versions are on the way called Craft Fast and Craft Ultra Fast, which kind of sound to me like settings on a hand dryer.
39
00:02:56.050 --> 00:02:57.230
Why did they build their own?
40
00:02:57.671 --> 00:02:57.971
Money.
41
00:02:58.151 --> 00:03:01.752
Every image that was made on someone else's model, Canva had to pay for.
42
00:03:02.213 --> 00:03:03.093
Now it owns it.
43
00:03:03.273 --> 00:03:07.855
And I think any creative software company of any size is going to end up in this exact same place.
44
00:03:08.055 --> 00:03:10.516
But I'd like Canva to answer one question out loud.
45
00:03:11.016 --> 00:03:12.937
Those templates were made by designers.
46
00:03:13.057 --> 00:03:16.438
Did those designers know they were teaching the machine that would eventually compete with them?
47
00:03:16.458 --> 00:03:21.600
This is one of the reasons you have to be incredibly careful whenever you're doing your work in a big SaaS company.
48
00:03:21.640 --> 00:03:23.421
They are treating your data like their own.
49
00:03:23.541 --> 00:03:28.023
And then the Bruno Mars song, Uptown Funk, may be the future of copyright law.
50
00:03:28.443 --> 00:03:29.543
Full disclosure on this one.
51
00:03:29.583 --> 00:03:32.444
Kubrick Labs is an anthropic partner and I'm an anthropic investor.
52
00:03:32.524 --> 00:03:37.066
But I'm also a fair use skeptic, so you let me know where I fall on the hypocrite spectrum.
53
00:03:37.481 --> 00:03:43.486
On Wednesday in San Jose, a judge spent a full day hearing whether training Claude on song lyrics is fair use.
54
00:03:44.107 --> 00:03:51.273
This is the case Universal Concord and ABKCO brought in 2023 over 499 songs.
55
00:03:51.673 --> 00:03:56.278
The original complaint name-checked Gimme Shelter, God Only Knows, and Uptown Funk.
56
00:03:56.938 --> 00:03:59.018
Anthropix says the training was transformative.
57
00:03:59.359 --> 00:04:06.820
The publishers say Claude now competes with songwriters and told the court it had received nearly 120,000 requests to write lyrics.
58
00:04:06.980 --> 00:04:10.401
According to Reuters, the judge spent much of the day on exactly one question.
59
00:04:10.761 --> 00:04:12.761
Does this hurt the market for the real thing?
60
00:04:13.141 --> 00:04:14.262
There's been no ruling yet.
61
00:04:14.562 --> 00:04:20.723
If the answer here is that a model trained on songs can stand in for songwriters, the fair use argument gets a lot harder to defend.
62
00:04:20.803 --> 00:04:26.604
So in a very real sense, the future of AI and copyrighted America is now resting on the shoulders of Bruno Mars?
63
00:04:26.944 --> 00:04:36.767
Keith Kupferschmid, the CEO of the Copyright Alliance, was on our podcast a few weeks ago, and he felt the strongest case against fair use would likely come from the musicians.
64
00:04:36.947 --> 00:04:43.028
Because what other purpose could training on music possibly have, other than competing against human-generated music?
65
00:04:43.668 --> 00:04:47.890
Writing, you can argue, can be for creativity or summaries or law.
66
00:04:48.170 --> 00:04:50.911
There are many different reasons to ingest a novel.
67
00:04:51.171 --> 00:04:51.872
But music?
68
00:04:52.412 --> 00:04:59.475
What other purpose is there for ingesting music and lyrics if not to compete against musicians and composers?
69
00:04:59.595 --> 00:05:00.816
I think Keith might be right.
70
00:05:00.836 --> 00:05:03.317
And we're going to see what happens and stay close to this one.
71
00:05:03.337 --> 00:05:06.498
Because maybe in all this craziness, the musicians are going to save us.
72
00:05:06.899 --> 00:05:09.400
And then there was a billionaire secret Santa this week.
73
00:05:10.000 --> 00:05:14.885
Full disclosure again, Kubrick Labs is a vendor of Warner Brothers Discovery, and so now Skydance.
74
00:05:15.146 --> 00:05:20.291
But Semaphore reported on Wednesday that Elon Musk has invested about a billion dollars in Skydance.
75
00:05:20.492 --> 00:05:21.212
Now the history.
76
00:05:21.372 --> 00:05:25.397
In 2022, Larry Ellison put a billion dollars into Musk's Twitter takeover.
77
00:05:25.897 --> 00:05:29.121
This week, Musk put a billion dollars into Larry's son's studio.
78
00:05:29.201 --> 00:05:41.809
The day before, John Malone stood up at a media conference and predicted it, describing the two men as very intertwined, which is a delicate way to describe how the two of the richest men on Earth are passing billion dollars back and forth like a salt shaker at dinner.
79
00:05:41.929 --> 00:05:43.551
But here's the thing I find interesting.
80
00:05:44.011 --> 00:05:45.652
Sundance now owns HBO.
81
00:05:46.132 --> 00:05:50.835
HBO was reported to be backing Alex Gibney's documentary About Musk, which hit cinemas this month.
82
00:05:51.416 --> 00:05:55.599
So Elon Musk is now an investor in the company behind a documentary that's about Elon Musk.
83
00:05:56.399 --> 00:05:57.920
This is what would happen if M.C.
84
00:05:58.000 --> 00:06:00.902
Escher drew a diagram of what conflict of interest looks like.
85
00:06:01.222 --> 00:06:06.785
Skydance is carrying about $80 billion of debt, so Musk's billion is a gesture, not a rescue.
86
00:06:07.325 --> 00:06:10.847
The real question is still whether the people with the money start shaping the work.
87
00:06:11.047 --> 00:06:12.088
It's too early to be seen.
88
00:06:12.108 --> 00:06:14.550
But I think there are broader strategic benefits here.
89
00:06:14.730 --> 00:06:16.872
Starlink is looking to compete in telecoms.
90
00:06:16.972 --> 00:06:19.133
SpaceX and Tesla are looking to merge.
91
00:06:19.273 --> 00:06:21.795
Oracle owns about 15% of TikTok.
92
00:06:21.975 --> 00:06:25.638
And Skydance needs to compete in shorter form, faster content.
93
00:06:25.678 --> 00:06:27.900
And this is what businesses have always done.
94
00:06:28.080 --> 00:06:31.722
Found ways to work together, have more reach and impact to consumers.
95
00:06:31.943 --> 00:06:34.905
And I do still think we should be rooting for Skydance.
96
00:06:35.225 --> 00:06:40.332
Because the thing that they're doing right is they're trying to make legacy media look a little bit more like tech.
97
00:06:40.372 --> 00:06:44.877
Whereas every other legacy media company is getting taken over by tech.
98
00:06:45.917 --> 00:06:47.459
MGM is owned by Amazon.
99
00:06:47.819 --> 00:06:49.621
Apple is likely going to buy somebody.
100
00:06:49.701 --> 00:06:51.523
And Netflix is eating everybody's lunch.
101
00:06:51.964 --> 00:06:55.828
I think a lot of the negativity is around people just don't like the politics involved.
102
00:06:55.908 --> 00:07:07.261
But listen, we're always going to stay close to this one because it's got loads of fascinating developments, loads of interesting people involved, lots of great IP is involved because it literally is the coming together of tech and legacy creative media.
103
00:07:08.598 --> 00:07:12.760
And then in news from across the pond, the BBC made the ocean worse on purpose.
104
00:07:13.481 --> 00:07:18.723
Blue Planet 2 starts on BBC One on November 1st, and the producers have done something pretty extraordinary.
105
00:07:19.244 --> 00:07:21.385
They made the sea look worse on purpose.
106
00:07:21.685 --> 00:07:27.608
Murky footage full of plankton that a few years ago would have been binned has been left in so that viewers believe it's real.
107
00:07:27.748 --> 00:07:33.331
Executive producer Elizabeth White told The Guardian that AI makes their team want to be even more authentic.
108
00:07:33.471 --> 00:07:36.433
The BBC's commissioning head said no generative AI was used,
109
00:07:36.633 --> 00:07:39.835
But it looked so good, even though not a single frame was AI.
110
00:07:40.035 --> 00:07:41.416
So think about that for a second.
111
00:07:41.736 --> 00:07:48.140
This team built an underwater CCTV camera to film dolphins plugging holes in coral with sea sponges to trap fish.
112
00:07:48.761 --> 00:07:51.022
So dolphins use tools now?
113
00:07:51.162 --> 00:07:52.183
That's pretty wild.
114
00:07:52.403 --> 00:07:55.865
But the production's biggest worry is that you'll assume that a computer made it up.
115
00:07:56.146 --> 00:08:00.248
For 70 years, wildlife filmmaking was the art of getting rid of the mess.
116
00:08:00.408 --> 00:08:02.029
Now the mess is the proof that it's real.
117
00:08:02.470 --> 00:08:04.091
Plankton is the new watermark.
118
00:08:04.491 --> 00:08:10.060
We're dumbing down human creativity just so audiences don't get their backs up about AI.
119
00:08:10.360 --> 00:08:14.647
It's the film equivalent of leaving typos in your email to prove they weren't written by AI.
120
00:08:15.352 --> 00:08:19.935
Is anybody else getting the sense that AI is somehow making us less authentic?
121
00:08:20.356 --> 00:08:20.716
I don't know.
122
00:08:20.836 --> 00:08:21.737
It kind of annoys me.
123
00:08:21.937 --> 00:08:23.338
So anyway, that was the big news.
124
00:08:23.838 --> 00:08:27.741
But there's one big story this week that I think deserves more time.
125
00:08:27.922 --> 00:08:30.443
Although it's less a story than it is a budding crisis.
126
00:08:30.924 --> 00:08:35.127
So I'm going to talk about cybersecurity and end times and all those fun things.
127
00:08:35.367 --> 00:08:38.890
People in AI and cybersecurity are calling this week Black October.
128
00:08:39.270 --> 00:08:44.876
And I get it, because I've been reading incident reports since Tuesday, and my eyes and brain have gone black.
129
00:08:45.276 --> 00:08:46.958
Let's start with PHP.
130
00:08:47.118 --> 00:08:50.742
I'm sure you've never heard of PHP, but you used it today, I'm sure of it.
131
00:08:50.882 --> 00:08:55.026
It's the programming language under a huge chunk of the web, including WordPress.
132
00:08:55.526 --> 00:08:58.109
Security firm Wiz says it powers about 70% of websites.
133
00:08:59.210 --> 00:09:07.618
And the PHP Foundation, the non-profit that pays the developers doing much of the maintenance, they brought in only about $680,000 in 2024.
134
00:09:08.179 --> 00:09:13.444
That's a big slice of the internet being looked after on a budget that wouldn't cover the catering on a Marvel movie.
135
00:09:14.065 --> 00:09:21.312
On Tuesday, the PHP team warned of two critical flaws that could let an attacker take over a server without a password.
136
00:09:21.472 --> 00:09:26.459
They were found by a researcher at a firm called Calif, with help from OpenAI's newest model.
137
00:09:26.920 --> 00:09:28.442
The plan was the grown-up one.
138
00:09:28.802 --> 00:09:30.445
Fix it quietly, then announce.
139
00:09:30.685 --> 00:09:34.811
Instead, Calif accidentally published a video of the exploit working.
140
00:09:34.991 --> 00:09:35.732
Accidentally!
141
00:09:36.413 --> 00:09:42.375
Mark Smith discovering every lock in the country is broken and accidentally posting the TikTok of himself opening them.
142
00:09:42.715 --> 00:09:49.758
The video got copied and shared, hackers used it to build their own versions of the attack, and the PHP team had to rush out the fix a day early.
143
00:09:49.878 --> 00:09:50.318
Brilliant.
144
00:09:50.638 --> 00:09:52.959
Then came my favorite government advice in years.
145
00:09:53.259 --> 00:09:59.181
The National Security Agency told organizations that couldn't patch straight away to just take their websites offline.
146
00:09:59.361 --> 00:10:02.242
The NSA looked at the problem and just said, turn it off.
147
00:10:02.622 --> 00:10:05.023
Some government websites actually did go dark.
148
00:10:05.623 --> 00:10:13.905
A security firm counted 884,000 servers running versions of PHP that are so old they won't get an official fix at all.
149
00:10:14.385 --> 00:10:18.106
And if you run WordPress, its automatic updates didn't install this one.
150
00:10:18.627 --> 00:10:19.867
A human has to do it.
151
00:10:19.967 --> 00:10:21.627
Do you know who that is at your company?
152
00:10:21.747 --> 00:10:23.428
We have a team of 30 and I didn't.
153
00:10:24.355 --> 00:10:26.837
Because if your honest answer is, I think it was Dave.
154
00:10:27.017 --> 00:10:29.238
I think he set up the website in 2019.
155
00:10:29.719 --> 00:10:31.039
You have a problem already.
156
00:10:31.380 --> 00:10:33.461
So more security stuff happened this week.
157
00:10:33.681 --> 00:10:40.606
This same Wednesday, Microsoft published research on a China-aligned hacking group it calls Storm 0940.
158
00:10:40.826 --> 00:10:46.610
The group used an open-source AI tool called Artex, which runs penetration testing on autopilot.
159
00:10:47.010 --> 00:10:53.535
So penetration testing, or pen testing, is what security firms and tech companies do to find the weak spots before the bad guys do.
160
00:10:53.715 --> 00:10:56.437
This, however, was the bad guys using the good guys tool.
161
00:10:56.857 --> 00:11:00.780
Microsoft says it reached more than 2,250 organizations.
162
00:11:01.000 --> 00:11:05.663
In some cases, it went from first contact to privileged access in under three hours.
163
00:11:06.203 --> 00:11:07.664
Most attempts failed, sure.
164
00:11:07.784 --> 00:11:15.470
The ones that worked came in through ConnectWise, an IT services firm, and through cloud backup apps customers had already given access to.
165
00:11:16.010 --> 00:11:17.572
Media companies were on that list.
166
00:11:17.872 --> 00:11:24.460
So the way in was the company you pay to keep you safe through the app you installed to save you if anything went wrong.
167
00:11:24.760 --> 00:11:27.343
That's like burglars getting in through the panic room.
168
00:11:27.544 --> 00:11:30.787
And then again on the same Wednesday, Light LLM.
169
00:11:30.967 --> 00:11:36.534
It's the switchboard between your app, OpenAI, Anthropic, and Google, and all of your other AI apps.
170
00:11:36.734 --> 00:11:39.395
It's downloaded about 23 million times a week.
171
00:11:39.555 --> 00:11:43.477
Attackers stole some developers' credentials and pushed out a poisoned version.
172
00:11:43.897 --> 00:11:52.462
For about two hours, anyone who installed got malware that hoovered up their cloud keys, their AI keys, their developer logins, and every model key the company had.
173
00:11:52.582 --> 00:11:59.345
Then Thursday, Axios reported that America's biggest banks, JP Morgan, Bank of America, Morgan Stanley, Wells Fargo, and Citibank,
174
00:11:59.825 --> 00:12:03.948
are finding unauthorized AI agents inside customer accounts.
175
00:12:04.168 --> 00:12:12.433
Bank executives use the word horrifying, and some of those agents were doing things nobody had asked them to do, like ringing the bank's call center on their own.
176
00:12:12.574 --> 00:12:13.034
Picture it.
177
00:12:13.454 --> 00:12:20.359
Somewhere in America, an AI agent dialed a bank, was told its call was very important, and waited, listening to the hold music.
178
00:12:21.308 --> 00:12:27.532
We built a digital mind that can pass the bar exam, and its first independent act was to queue for customer service.
179
00:12:27.932 --> 00:12:29.793
Now, in fairness, these weren't hackers.
180
00:12:30.293 --> 00:12:35.817
Mostly, they were people's own AI assistants logging in with usernames and passwords the customers had handed over.
181
00:12:36.057 --> 00:12:40.179
Remember Matt Robb, whose Muse agent gave his home address to a marketplace buyer?
182
00:12:40.680 --> 00:12:42.361
Same thing here, but with a bank account.
183
00:12:42.861 --> 00:12:46.764
The Axios reporter told CBS these agents weren't draining anyone's money.
184
00:12:47.265 --> 00:12:51.729
Morgan Stanley says that it hasn't seen a single rogue agent, but is blocking them anyway.
185
00:12:52.129 --> 00:12:56.813
Which is like announcing you don't have mice while carrying 400 mousetraps into the building.
186
00:12:57.394 --> 00:13:02.458
And Chase had to remind customers not to share their passwords with anyone, including AI agents.
187
00:13:02.658 --> 00:13:04.740
A bank had to bother to say that to people.
188
00:13:04.940 --> 00:13:08.204
So nothing malicious was proven here, and nobody's money disappeared.
189
00:13:08.644 --> 00:13:13.349
Mostly these were agents doing what agents do, going wherever they can reach and trying to be helpful.
190
00:13:13.769 --> 00:13:15.691
But that's exactly what scares me the most.
191
00:13:16.212 --> 00:13:18.714
Agents can get into things that also break things.
192
00:13:19.175 --> 00:13:20.336
They don't have to want to.
193
00:13:20.757 --> 00:13:23.900
And we've already seen what it looks like when somebody does want to.
194
00:13:24.100 --> 00:13:35.717
Last month, Microsoft described another group whose AI-driven attack got into a production database, encrypted the configuration, deleted the tables, and left a ransom note without a human directing each step.
195
00:13:36.398 --> 00:13:37.499
So let me paint a picture.
196
00:13:37.800 --> 00:13:38.781
This is a hypothetical.
197
00:13:39.001 --> 00:13:39.842
This hasn't happened.
198
00:13:40.303 --> 00:13:46.510
When people say that they're scared of AI, I don't think they should be scared of AI getting the nuclear launch codes and bombing all of us.
199
00:13:46.690 --> 00:13:48.732
Because AI will want to protect itself.
200
00:13:49.093 --> 00:13:53.237
And the EMP blasts of something like that would fundamentally harm AI.
201
00:13:53.537 --> 00:13:55.519
So here's a nightmare scenario.
202
00:13:56.120 --> 00:14:00.525
Imagine everyone in America wakes up one morning and their bank account says zero.
203
00:14:01.239 --> 00:14:02.399
The money hasn't been stolen.
204
00:14:02.840 --> 00:14:05.361
Nobody's suddenly rich, just zero.
205
00:14:05.961 --> 00:14:11.263
Your money was a number in a database, and the database has been wiped, and the number is now nothing.
206
00:14:11.583 --> 00:14:14.624
What happens next isn't really about money or technology.
207
00:14:15.085 --> 00:14:17.485
It's about human emotion, and it's panic.
208
00:14:17.966 --> 00:14:25.729
You call the bank along with 300 million other people, and you get the hold music behind a few thousand helpful AI agents who got there first.
209
00:14:26.389 --> 00:14:28.190
You can't pay rent or buy groceries.
210
00:14:28.610 --> 00:14:35.734
And even when the bank says it's got backups and it'll all be fixed by Friday, nobody believes it because the screen in their hand says zero.
211
00:14:36.454 --> 00:14:38.155
The economy effectively stops.
212
00:14:38.355 --> 00:14:43.098
You can restore the data over a couple of days, but restoring trust takes years.
213
00:14:43.358 --> 00:14:45.159
That's why the banks are reacting like this.
214
00:14:45.499 --> 00:14:53.603
Not because an agent stole something, but because they can no longer tell the difference between a customer, a customer's helpful robot, and somebody pretending to be either.
215
00:14:54.023 --> 00:15:00.885
Jamie Dimon's answer on JP Morgan's earnings call was to describe letting outside agents into your account as a liability transfer.
216
00:15:01.046 --> 00:15:04.267
Which is banker talk for your robot, your fucking problem.
217
00:15:04.627 --> 00:15:09.168
That's pretty much where I landed with Matt, the guy whose Muse robot sent people to his house.
218
00:15:09.709 --> 00:15:11.569
You clicked allow to the AI.
219
00:15:11.869 --> 00:15:13.230
You gotta own what it does.
220
00:15:13.990 --> 00:15:16.152
The banks are just about to put that in the small print.
221
00:15:16.272 --> 00:15:16.953
I guarantee it.
222
00:15:17.213 --> 00:15:23.979
So what does this have to do with a production company, an agency, a design studio, a publisher, or a music production house?
223
00:15:24.399 --> 00:15:25.460
Well, everything.
224
00:15:25.961 --> 00:15:29.364
You're not a bank, but your website probably runs on WordPress.
225
00:15:29.804 --> 00:15:32.306
Your client portal might also run on PHP.
226
00:15:32.647 --> 00:15:38.832
If you've built anything with AI, there may be a light LLM box humming away somewhere holding every API key you own.
227
00:15:38.932 --> 00:15:43.695
You almost certainly have an outside IT provider with the keys to your Microsoft 365.
228
00:15:44.175 --> 00:15:53.081
And behind all of that sits the unreleased scripts, the rough cuts, the campaign strategy, the talent deals, your personal HR data, your company's financial data.
229
00:15:53.121 --> 00:15:54.441
That's not just your data.
230
00:15:54.822 --> 00:15:56.102
That's your actual company.
231
00:15:56.242 --> 00:16:03.847
It's why my company, Kubrick Labs, is as much an IT and cybersecurity company as it is an AI software development and AI implementation shop.
232
00:16:03.907 --> 00:16:13.535
Not because AI got boring suddenly, but because every time a company plugs AI into its businesses, it opens a door and somebody has to decide who's allowed through it.
233
00:16:13.655 --> 00:16:17.538
These AI companies perpetrated the largest copyright theft in the history of the world.
234
00:16:18.298 --> 00:16:20.000
You're now letting them into your business.
235
00:16:20.460 --> 00:16:25.104
You have to make sure that your IT and cybersecurity is up to the task of allowing them in.
236
00:16:25.384 --> 00:16:26.886
And here's what really sticks with me.
237
00:16:27.306 --> 00:16:35.774
A Microsoft researcher's own words, unsealed in court last month, described the scraping that built these models as potentially the largest theft of labor in human history.
238
00:16:35.834 --> 00:16:38.356
And the lesson I take from that isn't that AI is evil.
239
00:16:38.697 --> 00:16:41.700
It's that these systems were built by taking whatever they could reach.
240
00:16:42.100 --> 00:16:48.166
And now we're handing them the keys to our email, our files, and our bank accounts, and acting surprised when they wander in.
241
00:16:48.426 --> 00:16:51.048
That doesn't mean I don't use these tools every day and build with them.
242
00:16:51.408 --> 00:16:54.851
It means treat an agent like a new hire you met yesterday.
243
00:16:55.331 --> 00:16:57.032
Give it its own login, not yours.
244
00:16:57.373 --> 00:16:58.994
Let it read before you let it act.
245
00:16:59.354 --> 00:17:01.015
Don't keep every key in one drawer.
246
00:17:01.456 --> 00:17:08.401
Find out who patches your servers and go back and look at everything you've already clicked allow on because that's exactly how Storm0940 got in.
247
00:17:10.569 --> 00:17:11.430
None of that is clever.
248
00:17:11.510 --> 00:17:13.371
It's boring, but that's the point.
249
00:17:13.511 --> 00:17:15.432
So here's where I've landed after all that.
250
00:17:15.853 --> 00:17:19.195
Black October was a warning shot, and a fairly polite one.
251
00:17:19.615 --> 00:17:21.917
Nobody woke up to a zero in their bank account.
252
00:17:22.137 --> 00:17:28.141
But AI is making it faster to find the holes, faster to exploit them, and faster to walk through once you're in.
253
00:17:28.261 --> 00:17:30.382
The thing that hasn't sped up is us.
254
00:17:30.923 --> 00:17:33.885
The patching, the checking, the deciding who gets the keys.
255
00:17:34.265 --> 00:17:36.847
That's still people working at human speed.
256
00:17:37.127 --> 00:17:41.130
And every company needs more of those people and more of that speed than ever.
257
00:17:41.210 --> 00:17:43.671
This week, mostly, we let the agents in ourselves.
258
00:17:43.771 --> 00:17:47.033
And the worst thing, the scariest one did, was wait on hold.
259
00:17:47.213 --> 00:17:49.075
Next time, they may not be so well behaved.
260
00:17:49.155 --> 00:17:50.936
So that's my summation of last week.
261
00:17:51.216 --> 00:17:52.137
Thank you for listening.
262
00:17:52.197 --> 00:17:57.240
Next week, we have James Brooke Partridge, the head of production for WPP UK.
263
00:17:58.046 --> 00:18:05.856
Now, obviously, we had Steve Davies and Matt Miller on a few weeks ago to talk about WPP's memo that said they wanted to keep all production internally.
264
00:18:06.016 --> 00:18:10.482
And James is going to be talking to us about what the WPP production apparatus really looks like.
265
00:18:10.562 --> 00:18:13.966
It was recorded before that memo went out, and so we don't talk about that.
266
00:18:14.346 --> 00:18:17.210
But I think the point is that everybody's trying to do their best here.
267
00:18:17.350 --> 00:18:20.334
WPP production employs 10,000 people.
268
00:18:20.734 --> 00:18:25.380
So when it comes to the production community, we don't want them to be losing their jobs either.
269
00:18:25.420 --> 00:18:28.864
So I know that WPP has been painted as the bad guy in this whole thing.
270
00:18:28.904 --> 00:18:29.765
But let's be real.
271
00:18:30.486 --> 00:18:36.974
Producers losing their job is a bad thing, especially now when production has never been more important to the creative process.
272
00:18:37.898 --> 00:18:42.581
There's more media getting produced every second of every day now than ever before.
273
00:18:42.782 --> 00:18:47.425
Producers are finally having their moment in the sun, finally getting credit for what it is they do.
274
00:18:47.465 --> 00:18:48.626
And that's a wonderful thing.
275
00:18:48.746 --> 00:18:52.429
So them getting more work means more producers getting more jobs.
276
00:18:52.549 --> 00:18:54.290
And overall, that's a good thing.
277
00:18:54.430 --> 00:18:56.592
And it reminds me of the Tennessee Williams play.
278
00:18:57.112 --> 00:19:01.514
Back in the day, when somebody would die, the church bell would ring.
279
00:19:01.714 --> 00:19:05.796
And everybody would always ask each other, oh, who's the bell ringing for?
280
00:19:06.076 --> 00:19:11.458
And Tennessee Wombs had a great line that was, ask not for whom the bell tolls, it tolls for thee.
281
00:19:11.919 --> 00:19:14.860
And the point of that line was, we're all interconnected.
282
00:19:14.920 --> 00:19:19.162
And so when the bell tolls when somebody dies, you lose a little something.
283
00:19:19.562 --> 00:19:27.005
And I feel a little bit that way about production communities everywhere, whether it's independent production companies or whether it's producers within agencies.
284
00:19:27.345 --> 00:19:29.426
We want production to grow everywhere.
285
00:19:29.566 --> 00:19:30.886
And it is growing everywhere.
286
00:19:31.086 --> 00:19:34.928
There is more need for more production across the world than there has ever been.
287
00:19:35.068 --> 00:19:36.829
This should be the time for the producers.
288
00:19:36.929 --> 00:19:38.209
And it should be very exciting.
289
00:19:38.389 --> 00:19:41.590
But we're kind of all battling it all out, trying to figure out what's next.
290
00:19:41.630 --> 00:19:42.231
And that's fair.
291
00:19:42.271 --> 00:19:47.673
And I think WPP is just doing what WPP thinks is best for its people, its clients, and its shareholders.
292
00:19:48.333 --> 00:19:49.416
And that's what they're supposed to do.
293
00:19:50.017 --> 00:19:52.043
So anyway, I am still excited for this talk.
294
00:19:52.203 --> 00:19:54.108
James is a really good, smart producer.
295
00:19:54.288 --> 00:19:55.832
Please tune in tomorrow and we'll see you then.
296
00:19:56.093 --> 00:19:56.574
Thanks so much.
