AI Cyber Panic, Ken Griffin's Bubble Warning, The Fall of France?

Nikesh Arora · Palo Alto Networks

AI models now find long-known vulnerabilities cheaply, so attacks will accelerate and patching becomes cat-and-mouse.

Arora says OpenAI, Anthropic and most likely Google now have models that can find vulnerabilities, and even chain them into attack paths, given enough compute and persistence. He says the PHP exploit was identified years ago but seen as too hard to solve, and was cracked by throwing persistent compute at it. Once published, the fix was reverse engineered and every hacker knows how to exploit it. He expects threats to come faster than every ten days. He notes that many enterprises are using frontier models to probe their own defenses, and that the next model will find more. He expects a cat-and-mouse game of constant patching, and much of the accumulated technical debt, such as old website versions, must now be paid.

“Actually, the PHP problem was solved by persistent compute. This problem was identified a few years ago, but nobody thought it could be solved because it required too much of coordination.”at 18:49

Nikesh Arora · Palo Alto Networks

Defenders cannot yet out-compute attackers; they must aggregate signals to spot and eject intruders quickly.

Arora says defenders cannot yet launch coordinated defensive swarms because their infrastructure is disparate. A company with 5,000 websites has IT staff cataloguing each one, because nobody has aggregated and understood the estate. He says the base level of preparedness requires fixing technical debt first. He advises assuming a breach. The focus should shift to aggregating signals and data so anomalous behavior can be spotted using defensive compute, and to how quickly intruders can be found and ejected.

“Not true today because the underlying systems are not architected or orchestrated in such a way that we can launch these, let's call it defensive swarms because everything is sort of in disparate situations.”at 25:02

Chamath Palihapitiya · Social Capital

Legacy software drift and sunk-cost technical debt make enterprise systems hard to secure.

When customers run software in their own private cloud, vendors end up maintaining many out-of-sync versions, with each customer upgrading on its own cadence, so vendors can be maintaining 19 versions at once. Technology changes rapidly, but existing deployments are sunk costs that cannot be replaced. He multiplies this across millions of companies and hundreds of trillions of lines of code. Nikesh adds that CIOs are incentivised to keep costs low and systems up, so upgrades feel risky, which leaves known vulnerabilities in place.

“If you actually deploy it inside of your own virtual private cloud, the problem is the software vendors don't have this one version that's constantly updated.”at 36:28

Nikesh Arora · Palo Alto Networks

Major cyber breaches are coming, and the fallout will be brutal over the next year.

He says there will be a bunch of nine-eleven-style cyber events, and CISO phones ring every day with companies trying to get out of the problem. Once systems come back online after being hacked, the next year or so will be brutal and a big transition period. He expects heightened demand for security leaders as a result.

“people really appreciate the CISO and those groups when these things... And the systems come back online and the system's been hacked, it's gonna be brutal the next year or so.”at 38:27

Nikesh Arora · Palo Alto Networks

Enterprise cyber spend runs 4-10% of IT budgets and will need to rise.

Typically cyber costs are 4-10% of IT budget. Financial services and the federal government sit near 10% because they need things secure and robust. Cloud-first firms can land at 4-5% because hyperscalers handle infrastructure security, leaving only application and software security to the customer. He expects the spend to go up, with the range moving to about 8-10% for many firms. He runs Palo Alto Networks, which is why this is his own sector view, but he is describing the market rather than a company result.

“the cost is somewhere in the four to 10% range for cyber. Okay? And 10% is typically where you'll find financial services, the federal government, because they want to make sure things are secure and robust.”at 39:29

Nikesh Arora · Palo Alto Networks

AI agent security harnesses have not been built yet, and that work has barely started.

Enterprises are rushing to deploy AI and agents, but they cannot even find all the agents running in their systems. Security tooling has not caught up. He cites a researcher finding that a conversation could be used to extract private information, forcing patches. He compares the moment to the Wright brothers, when no one yet had built the TSA, arguing that security gets built only after the bad things happen.

“We need to build all the security harnesses for AI, and that's not even started yet.”at 40:46

David Friedberg · The Production Board

If a consumer agent ignores bank terms and does not block access, liability falls on the agent provider.

Friedberg says bank terms of service prohibit using an agent to access accounts through the website. If the agent has no capacity to recognize that and stop the access, then liability is a software issue for the agent provider. The exception is where the agent alerts the user that the action violates the terms and asks whether to override. Then liability shifts to the user. He points to a parallel case in e-commerce, where Amazon blocked agents and Grok now stops before checkout, as evidence that the issue is being adjudicated in real time.

“So given that that's the terms of service, if the agent hasn't built in a capacity to recognize that and stop that access, then it is a software liability issue with the provider of the agent, I believe.”at 29:48

Nikesh Arora · Palo Alto Networks

Users who grant agents agency bear liability, but rogue agents create product liability for builders.

Arora argues that agency is the key concept. Whoever gives the agent agency to act on their behalf has the liability, so the user is responsible, just as with a credit card lent to a friend. The exception is a rogue agent, which is a product liability issue. If the product does not behave as intended or as advertised, the company that built it is responsible, as with any product that does not work as advertised.

“There's a word in agent. It's called agency. Somebody has to give the agent agency... And if you're the one who's giving agency, you have the liability.”at 31:31

Chamath Palihapitiya · Social Capital

Liability for rogue AI agents will be pushed onto users, as the only way the agent model scales.

Chamath argues that practically, the user will bear responsibility for agent actions. In a lawsuit, each party's incentive is to point at another: Bank of America points to the agent provider, which points to the user. He says this is the only way the model keeps scaling. He notes the possibility of prompt injection or an agent going rogue as examples, but says the user remains responsible in practice.

“I do As assume a practical matter, it's the only scalable solution because what will happen when these lawsuits happen is everybody's incentive, everybody meaning the corporate incentive.”at 31:46

Chamath Palihapitiya · Social Capital

Unconstrained, 'obliterated' AI models are an underappreciated and scary risk vector, more than alignment.

Chamath says that models without guardrails are a long-tail risk that few people understand. He calls the risk unbelievably underappreciated and believes it matters more than alignment, which people should spend more time thinking about. His reasoning is that such models are a vector of harm, though he offers limited detail beyond that.

“I find obliteration unbelievably scary. That is a vector of risk that is so unbelievably underappreciated right now.”at 33:16

Nikesh Arora · Palo Alto Networks

Unconstrained AI models hand powerful capability to anyone who can afford it, undermining global treaties.

Arora calls unguarded models the dark side of AI. Global governance and treaties are only as strong as the weakest link. If a company gives raw AI power with no built-in or enforceable guardrails, it is effectively handing a nuclear-style capability to anyone who can afford it. He compares it to handing out a do-it-yourself kit. He sees a contradiction: policymakers talk about treaties to pace AI development, while such firms make the most powerful tools available without controls.

“you're basically handing a nuclear sort of bomb to the hands of anybody who wants it because you can afford it. That's the problem.”at 33:58

David Friedberg · The Production Board

France is probably the first Western country to fail, with weak growth and heavy public spending.

France's debt is about 120% of GDP and its national government deficit is 5.4% of GDP, below the US at 6.2%. But France is growing at only about 0.5% while the US grows about 2.3%, which he sees as the difference that keeps the US holding together. He cites a Rand chart showing France's public spending as a share of GDP approaching the peaks of the Soviet Union in 1989, Romania, Venezuela under Chavez and communist China. He argues that more government spending makes conditions worse and leads to revolt, so France is a bellwether for the West.

“France is, I think, probably the first to go because they're only growing their economy at half a percent while The US is growing, you know, at 2.3%.”at 54:08

Chamath Palihapitiya · Social Capital

Bond vigilantes could make French debt unfinanceable, forcing an economic reset in France.

France is a critical country that will set the tone for Continental Europe in how it finances long-term debt. It has already proposed about €50bn of austerity, and that will have to go up, which leaves the government in a no-win position. He expects the government to lose the upcoming presidential election and a complicated reset of the bureaucracy and economy to follow. The market lever is bond vigilantes: if they push long rates high enough, France cannot finance its debt, which triggers an economic reset and a grand bargain. He expects whoever holds power after the reset to use it to entrench themselves.

“The bond vigilantes can break the back of the French government and they can do that economically and they can do that by essentially making their debt unfinanceable.”at 1:06:41

Jason Calacanis · LAUNCH

France's flat GDP and heavy immigration signal it must change gears on austerity.

Calacanis says France's GDP is not growing while it imports about 1.5% of its population a year, and that these immigrants are often low-value and a drain on public services. He argues this is a signal that France has to change course, pointing to Europe's long history of austerity. He wants more selective immigration and selective austerity rather than unrestricted intake.

“if you have an immigration rate where you're importing 1.5% of your population a year and your GDP is not growing, that might be a signal to you that maybe you have to change gears.”at 1:17:21

Chamath Palihapitiya · Social Capital

France's overspending state needs a bond-market shock, with yields pushed toward 8%, to force reform.

Chamath argues France's government is confiscatory: it takes about 56% top tax rates and collects 46% of GDP as tax revenue, yet outcomes such as hospital wait times and classroom sizes are poor. He concludes the government will not reform on its own, so bond vigilantes must force it, by pushing French borrowing costs toward 8% to break the state and put austerity and immigration on the table.

“I think you need to take France to, like, 8% and just break them. Yeah. And then all of a sudden, austerity measures, immigration, all this stuff's gonna be taken a lot seriously.”at 1:25:00

Chamath Palihapitiya · Social Capital

Large enterprises are cutting hyperscaler spend and building their own data centers or private cloud VPCs.

Chamath says buying patterns changed after Alex Karp's CNBC comments on data sovereignty, and that large companies are becoming more methodical. They are building their own data centers or moving into VPCs. At a CIO event for one of the largest US banks, the bank said it had decreased AWS and GCP spend and now had six independent data centers built from scratch. He takes this as evidence that AI has a diffusion problem, with enterprise adoption slower than expected.

“They said, we have decreased our spend on AWS and GCP. We now have six completely independent ground up data centers that we've built from scratch for ourselves.”at 6:26

Nikesh Arora · Palo Alto Networks

Compute is scarce and demand insatiable, so enterprises must accept hyperscaler terms rather than build their own.

Arora says Palo Alto shut its own data centers six to eight years ago because hyperscalers offered better scale, speed and reliability. Now compute is highly dear and hard to find. He calls Palo Alto a taker of terms, not a dictator, because Nvidia cannot deliver chips until 2028, and land and power for data center shells are hard to get. He sees the likely outcome as a hybrid: bare metal from a hyperscaler or a neocloud, or compute stitched together from around the world. He expects the profit pool to shift toward whoever has compute, and says demand is insatiable with not enough compute in the world to satisfy everyone.

“compute is highly dear. It's very hard to find compute in the world, period.”at 11:16

Chamath Palihapitiya · Social Capital

The AI build-out drives a disproportionate share of US GDP and the US economy is tied to it.

Chamath argues the AI build-out is a disproportionate share of GDP growth, not just stock gains for seven companies. Data shows it also lifts wages for middle-class and skilled workers. He concludes the US economy is entirely levered to and correlated with the AI trade, so policy that lands the AI build-out, such as behind-the-meter power and local investment, is what keeps the economy on track.

“the AI build out is the disproportionate percentage of all GDP. It is basically all of it. And it doesn't just pull through stock performance for seven companies.”at 1:33:38

Chamath Palihapitiya · Social Capital

Top AI spenders are shifting from closed frontier-lab APIs toward buying GPUs to run open-source models.

Chamath walks through a Ramp histogram of how the top 1% of AI spenders allocate money. The rose-colored box is LLM traffic bought from big closed frontier labs, through channels such as Bedrock on AWS. The blue box, GPU compute spending, is rising because buyers are purchasing their own GPUs as they move to open source. He sees a two-pronged dynamic: diffusion of AI across the economy is slower than people would like, while spend is shifting toward open-source models run on owned hardware.

“What's really interesting is that the blue box is ticking up. The blue box is people buying their own GPUs because they're moving to open source.”at 5:28

Nikesh Arora · Palo Alto Networks

Enterprises will prefer open-weight models for explainability and auditability that regulators demand.

Arora says Palo Alto Networks preferences open-source, open-weight models because they let it modify and train the weights and interrogate the chain of thought. Over time all enterprises will need explainability, verifiability and auditability. He says that in financial services and healthcare, regulators will not accept 'the IT guys put an AI model in there and it did it.' Only open-weight models provide that visibility, which is a major reason enterprises are moving away from the closed race.

“And we can only get that with open source, open weight models. We can interrogate chain of thought. That's kind of one reason we're gravitating towards them as opposed to getting caught into the closed race.”at 9:50

David Friedberg · The Production Board

The US faces a France-style fiscal cliff, with public spending near 36% of GDP and a 6.2% deficit.

US public spending (federal $7.4tn plus state and local $4.6tn) is about $12tn out of a $33tn GDP, roughly 36% of GDP, which he says matches France. The US national deficit is 6.2% of GDP, above France's 5.4%. He argues that all the economic measures are aligned and the cracks are starting to show. Growth at about 2.3% is the only thing holding the US together for now, and he worries about rising political disturbance heading into the midterms.

“But I would argue that we are facing the same sort of fiscal cliff which leads to this extraordinary social unrest as France.”at 54:24

David Friedberg · The Production Board

US cannot sustain its deficit with France's debt load and growth, so a reset is needed.

Friedberg compares the US with France. The US has a similar debt-to-GDP ratio and a deficit that is higher relative to GDP, but only modestly higher growth. From this he concludes the US must cut its deficit from about 7.5% of GDP to about 4% and will need some form of reset, either a social upheaval or a managed economic one that deflates asset values.

“I don't think we can run a higher deficit to GDP than France in The United States with the same debt to GDP as France and only modestly higher GDP growth, I think we are fundamentally going to need to have some degree of reset in The United States.”at 1:09:40

David Friedberg · The Production Board

Winding down federal student loans over a decade would force colleges to cut tuition.

He wants the federal student loan program wound down and existing student debt cancelled, possibly through a bankruptcy mechanism. He argues that removing federal lending would right-size institutions and their tuition costs, as colleges would have to fit to the market. He says this would take about ten years and needs a firm commitment over the next decade.

“I think it has to happen with deleting the federal student loan program. What will happen then is you'll right size all the institutions and their tuition costs because then all the institutions will start to fit to the market. It'll take about ten years.”at 57:20

David Friedberg · The Production Board

Ending federal student loans would deflate the higher-education system.

Friedberg argues the federal student loan system props up higher-education prices. Removing federal student loans would deflate that part of the economy, one of several ways he suggests the US can resolve its debt problem.

“you basically can deflate parts of the economy, like the education system, the higher education system by taking away federal student loans.”at 1:10:15

David Friedberg · The Production Board

Social Security should shift to individual equity-invested accounts over about a decade.

He argues all defined-benefit programmes, including the Social Security Trust Fund, should move to defined-contribution plans over roughly a decade. Each person's owed Social Security amount would be deposited into an IRA-style account, so everyone owns equities, similar to Australian superannuation funds. He suggests transitioning about 10% of the owed amount per year to smooth the change, and letting people choose a 40/60 or 80% bonds plan by age.

“I think all defined benefit programs need to be transitioned to defined contribution programs over, call it, a decade period.”at 58:01

David Friedberg · The Production Board

Moving pensions and Social Security to defined contribution would have left Americans far wealthier.

Friedberg traces the shift away from defined-benefit plans to ERISA. Only government plans still offer defined benefits, because unionized public employees kept them. He argues that defined-contribution structures, including Social Security, would have left people with much more money, and says the current pension system is either overloaded or underloaded, which is bad either way.

“This is what's so sad about it. If they had moved to defined contribution programs, including Social Security, they would have all had so much more money.”at 1:11:14

Jason Calacanis · LAUNCH

Raising the federal minimum wage $1 a year to $15 would boost spending and help companies.

Calacanis proposes raising the federal minimum by $1 a year for seven years to reach $15 by about 2032, which he says is far milder than California's $20 mandate. He argues the wage money gets recirculated and spent at the same companies, raising velocity and helping businesses. He cites Australia, New Zealand and the Nordics, where companies did better after raises, and says the 25-cent-per-meal cost in fast food has not raised unemployment.

“What happens is all that money gets recirculated, and it just creates more monetary velocity in the country. It all gets spent at the company.”at 1:37:04

David Friedberg · The Production Board

Raising the minimum wage prices out low-wage jobs; California's fast-food hike shows the job losses.

Friedberg points to California's 2024 fast-food wage increase, which Jason cited as costing 18,000 jobs in the state. He argues that when wages rise against market demand, consumers who can't pay higher prices buy less, so there is less revenue to pay wages. Consumers lose their local restaurant and workers lose jobs they voluntarily took at lower wages.

“The reason is that the fast food industry sells food to consumers. Consumers want cheap fast food. So when you increase the labor rate against the market's demand... I'm not paying $8 for a burger.”at 1:37:35

Chamath Palihapitiya · Social Capital

AI spending is circular: about 1% of companies drive 90% of token spend, mostly unprofitable VC-backed startups.

Chamath's back-of-envelope math, which he says a Ramp researcher partly confirmed, is that about 1% of companies represent about 90% of AI token spending, and about 80% of that comes from unprofitable VC-backed companies. The cycle he describes is that VCs raise from LPs, startups spend on consuming AI models to grow, show revenue traction, and raise again from the same VCs. He argues AI cannot be a predictable long-term earnings driver until it diffuses out of the startup ecosystem. He contrasts this with AWS, which was exposed from Amazon retail, a roughly free-cash-flow-breakeven business, whereas today money-losing entities are spinning money among themselves. He calls the structure a real problem with breathtaking valuations.

“Yeah. So what I said was 1% of companies represent 90% of AI spending, so that's tokens. And of that 90%, 80% of them are from unprofitable VC backed companies.”at 2:28

Jason Calacanis · LAUNCH

Startups rushing into a technology signals it is the right direction; big enterprises are slowest to adopt.

Calacanis argues that when startups flood into a technology and spend their VC money on it, it signals the technology is working. Startups look for the cheapest, best, fastest edge, as they did with cloud computing, WeWork and Facebook ads. A flood of two-to-200-person companies that are the most nimble suggests they have concluded the technology is the best solution. He says big, slow enterprises lag on new technology, which is why they buy startups. He takes this as a tell that AI is heading in the right direction.

“When startups flood to a technology, that is a strong signal.”at 7:17

Nikesh Arora · Palo Alto Networks

Banks will likely block consumer AI agents from logging in, because liability and dispute costs are too high.

Arora says agents act with a user's credentials from inside the browser, so banks cannot tell agent traffic from the user's. CAPTCHA can now be solved with AI. The bigger problem is liability: agents accumulate many credentials, and it is unclear who owns the liability. Banks already absorb small disputed charges because support calls cost more than the disputes. He expects banks to respond by declaring they will not allow interaction with agents at all, and says the cost of tons of agent-driven explainability calls will be huge.

“The biggest problem we're gonna have is who owns the liability and who has accountability, whether it's enterprise agents or consumer agents. So I think you see banks saying, do not... I do not allow you to interact with me with your agent, period.”at 23:11

Nikesh Arora · Palo Alto Networks

Frontier labs aren't causing the cyber problem; they're compute-constrained and rate-limiting while grappling with power.

Arora rejects the theory that frontier labs gatekeeping their most powerful cyber-defense tools is causing the chaos. He says most lab leaders are researchers who are surprised by how powerful the models are and are asking partners what to do with them. The labs are compute-constrained and rate-limit even enterprise customers who have access to the newest models. He sees them trying to figure out how to release and monetize the models, rather than causing the problem.

“So I think they're not causing the problem. They're just trying to grapple with the fact that these things are extremely powerful.”at 28:23

David Friedberg · The Production Board

Moving health insurance to employer markets would cut prices, but HIPAA rules block it.

Health care is complicated, but he thinks it should be pushed to the corporations that employ people, which would have to go into a market for insurance. That competition would force insurance prices and services down. He says HIPAA and housing regulations are the two things that stop prices in health care and housing from coming down, so they must be addressed first.

“Health care is way more complicated, but I think it's fundamentally gotta get pushed to corporations that employ people where they've gotta go into a market for insurance, and that forces the market for insurance to force prices and services down.”at 58:39

David Friedberg · The Production Board

Cutting federal mortgage underwriting would hit housing and cut middle-class net worth 10-20%.

Federal home loan programs have been used to keep home prices high, which keeps middle-class net worth high. That has made homes inaccessible to young buyers. Reducing underwriting and volume would reprice housing and drop middle-class net worth by 10-20%, a transfer of asset value that makes housing accessible to young people.

“You can have a hit to housing, which will drop the net worth of middle class by 10 to 20% by taking the federal home loan system and reducing the underwriting that's happening.”at 1:10:15

David Friedberg · The Production Board

Ending social services for immigrants would self-select productive immigrants into the US.

Friedberg argues that if a country pays social services to an immigrant population, it is probably the wrong population. Immigrants who are productive and self-supporting add to the economy, so the screen should favor them. He says removing social services for immigrants would self-select the right immigrants, which is a framework for who should be allowed in.

“And an easy way to solve it is get rid of social services for immigrants. As soon as you get rid of social services for immigrants, then you self select into the right population that's gonna come in.”at 1:20:01

David Friedberg · The Production Board

Lower tax and government spending as share of GDP expands individual opportunity; the US should move down.

Friedberg uses a chart showing France collects the most tax revenue as a percent of GDP, at 46%, and says government share and tax share move with growth. He argues quality of life and individual progress fall as the government takes a larger share of GDP, and rise as it shrinks. The US should move down that chart.

“as tax revenue goes down as a percent of GDP and as government spending as a percent of GDP goes down, your opportunity as an individual, the basis of the foundation of this great country improves.”at 1:28:19