Property AI Report
00:19:23 · Matt Goddard
But I guess what's interesting is like given it was discovered two months ago, given the number of companies involved trying to shut all of this down before they sort of announced the patch, because um obviously if PHP the business and and sort of the people fix the protocol and put that out in their release notes that there's a patch to fix a vulnerability, suddenly everyone spots it and they'll start they'll start working on it. And I was I was listening to a podcast with Matthew Prince, who's the CEO of Cloudflare, who support about a third of the internet, and he was saying that in the build-up they'd had maybe thousands of attacks on their their sort of their clients' data and people trying to use this. And as soon as the patch was released, it was tens of millions a minute of um people trying to exploit the vulnerability. And I think to summarize what can happen without having credentials or keys or or any of the normal sort of things you put in place for security, people for using this vulnerability could start running code on your server, just like literally walking through the front door and start maliciously acting. And um, obviously that's extremely dangerous. I know you you had to start um working, didn't you? Because some of the the platforms you rely on were exposed with this vulnerability as well.
00:20:31 · Mal McCallion
[00:20:31] S0: Yeah, it's exactly that. So there's kind of two layers, right? That there's you, so you know we've got absolutely no PSP in it, we're all fine, absolutely rock solid. But we use um certain price suppliers, as pretty much everybody else does. And one of them in particular a company called Railway, they that that went down very quickly. So they took it down very quickly, and then they kind of slowly put it back up again. So what that meant was we weren't able to update certain bits and pieces, but it was all business as usual and all fine. And what we found then the next day was that actually what happened with Railways, it got attacked, it got broken into, and and essentially all of the API keys for various um like like Chat GPT and uh other APIs that we run, those keys got exposed. So people were able to use those keys to run their own stuff. So what we found the next day was that um $266 of our Chat GPT OpenAI account had been used to help somebody to build a wizard game called Golem. All right, and that that was obviously what what OpenAI was able to tell us. Now, luckily, we did not have auto um auto refill on the account, otherwise, they could potentially have taken much more. But I think you know, to your point and also to reflect on the Google Cloud, as you say, that incident last week, which were separate. This is a time where things are going to go quite weird. Cybersecurity is going to be huge, and we are all gonna have to be a lot quicker and a lot better at understanding what's in our stacks, what we actually rely on, and which particular vendors, as you say, Matt, are very open about when things go wrong versus which ones just kind of hand wave it away. Hope nobody notices because it is um yeah, where you have um really where you rely heavily on different parts of your business, now is probably a good time to actually really review everything and every company that you are using because over the next month, three months, six months, year is probably going to be the max in terms of danger because we haven't.
00:22:23 · Matt Goddard, Mal McCallion
[00:22:23] S1: I reckon. [00:22:23] S0: You reckon, yeah, yeah. Because we we haven't got the we we we we don't know how to deal with this well enough yet, and but the knowledge is coming thick and fast from AI. So, yeah, uh yeah, Matt, in terms of what what you'd sort of um uh recommend for people, what's um what should people out there be doing?
00:22:37 · Matt Goddard
[00:22:37] S1: I d I think before we move on to that actually, because it's and then and just to put the like a couple of years, I think this was such a standout because of it's the first one we've really had since all of this came along, right? And just the sheer impact it had on on the internet companies. You know, street took itself offline, Alto wasn't accessible, you know, all these CRMs that sort of unpin our our industry suddenly disappeared, and people are apparently putting on Facebook groups, you know, I'm having to use paper and pen and they're going back. And it's always worth having that sort of disaster recovery scenario, right? It's not disaster recovery, sorry, like high availability of what do you do in the scenarios where you can't go through, you know, if you've got access to your diary offline and if you'd be able to you know continue progressing things. But it was more a case of at the same time this PHP one was hitting, and I was on the train back from Manchester thinking, fortunately, I don't have an HP in any of the stuff that we've built. I was uh sort of emailing devs, um, and then there was an issue with Node.js, which we do use, which is another technology that powers millions of web applications. Um, and it's like one of those things where it took me back actually, and hopefully you won't mind me saying this was years ago when when we were sort of in uh RePIT, like 2015, 2016. I remember Jupyts went down for about five days, and no one could access Dupex, which is like the sort of uh it's a part of Alto group now, isn't it? Web-based CRM and it was down. And Whaley, Sam and Whale, who was our sales director, was like, this is brilliant, and I was like, Don't tweet anything about it, you know, glass houses, it could easily be be us tomorrow because you just like don't literally don't know what's going to be, and you can do all the prep and everything else. Just as I was thinking that on the train to Manchester, there's a Node.js issue sort of highlighted a vulnerability. And I think it's really important to highlight that these vulnerabilities don't mean there's been breaches, it doesn't mean there's been significant issues and your data's been lost. It means that they've been brought to our attention and we need to act fast to close them down.
00:24:32 · Matt Goddard
And the Japanese Prime Minister woke up at and tweeted at five to six on that morning and said, take everything down if you think there's even a risk. The Dutch cybersecurity website got taken down. And and I was listening to something this morning as I've come back from my run where it's saying the NSA are actually annoyed because they've been exploiting these vulnerabilities for years to get access to people's data, allegedly, and then now they're like, You you now know our back doors. Um you don't need AI to exploit these vulnerabilities, these can be scripted once you know they're there. So you don't need to. And but I think the good news at the moment is our our good guys have got more and more powerful AI than the bad guys, and therefore they're they're ahead of the curve. And I will come on to Kimmy uh in a bit, and we're having to use sort of unblocked models to deal with it. But coming back to your question of what should we be doing? Um and I think this is always worth doing, you know, if you if you're using Microsoft, if you're using Google, if you're using any of the CRMs, look at what you've allowed access to your data. Um be having a look, did I enable Fixer AI? What can fixer AI read of my Microsoft data, of my Google data? Have I got any third parties in my my CRM looking at my data? Like make sure you go in, look, are they current? Do they have access to data they shouldn't have? If it's a tenants progression application, do they have access to data points they don't need to? Close those down, ask those questions you third parties. But also make sure you understand all the companies you are interacting with and and what they're relying on so that if somebody is using, take June of last year, for example, companies who are on Salesforce's Heroku platform went down and they weren't able to trade for a day. Are you aware of like these things that will cause interruption to the way that your business runs? And do you have approaches that can go manual if necessary or can fall over somewhere else?
00:26:15 · Mal McCallion, Matt Goddard
[00:26:15] S0: Yeah, really wise words, my friend. Wise words, yeah. It it is a it is a good moment now, and particularly perhaps as we sort of head into a bit quieter Christmas sort of time to really take stock, do an audit of everything, understand who you're working with, what, as you say, what access they have, and then just yeah, just be make some good decisions for 2027 because it could be a little bit wild out there. All right, next up, um, we want to talk about anthropic. So anthropic, there's a few stories uh floating around, but one from yesterday is that they are going public. Their IPO um is now announced uh in the next week or so, I think, and um it's gonna be a big one. So they're talking about um many uh trillions, I think, in terms of um the overall um value and some of the numbers that have come out in terms of what today are um generating. 80 billion in first half losses, uh 900% revenue retention is a I I read somewhere saying that this this is the most successful scaling of a business in capitalist history because it's basically got itself up to you know, kind of broadly almost positive run rate, um, with you know, uh I thought 14 billion or however many billion in terms of um 140 billion in terms of investment in it, but yeah, this is gonna be um what's the word blockbuster is uh is made for in it. [00:27:34] S1: That's it, and I th I guess I didn't get a chance to read it in depth. How's it gonna stack up against Elon Musk's SpaceX or SpaceX SI as it is now um debut? Uh is it on a similar level?