Your AI budget might already be funding someone else's chatbot.

Google's Mandiant and Threat Intelligence Group say hackers are hijacking company access to AI models and reselling it, with some victims hit for more than $100,000 a day and up to $1 million. Plus a UK school ransomware attack where AI may have written the hacker's commands.

In rapid fire: Binance's postmortem on the $6.3 billion North Korea heist, Anthropic's $17 billion quarter and shrinking IPO price, and CrowdStrike paying $495 million for two AI agent security startups.

In the Build Window: a kill switch for runaway AI spending.

IN THIS EPISODE

0:00 Cold open and today's stakes

0:40 Google warns of LLMjacking attacks costing enterprises up to $1 million (Google, LLMjacking)

5:50 Rapid Fire: Binance Suffers, Billion Crypto Heist Linked, Anthropic, Q3 Revenue Soars, Cyber Agency Warns, AI-Powered Ransomware Attacks

10:20 UK School Estate Hit by 3AM Ransomware in Suspected AI-Assisted Attack (UK School Estate Hit, Ransomware, Suspected AI-Assisted Attack)

14:55 The Build Window: AI Spend Circuit Breaker, Dev Download Gatekeeper

18:20 What to do this week and our prediction

WHAT TO DO THIS WEEK

If you run cloud or platform engineering, this week put a budget alert and a per-key usage limit on every AI model account you pay for, and rotate any long-lived API keys.

OUR PREDICTION

By 2027-03-31, at least one of AWS, Microsoft Azure or Google Cloud will announce a new default spending limit or usage alert built specifically for generative AI model usage. (we'll check by 2027-03-31)

SOURCES

- SiliconANGLE: https://siliconangle.com/2026/11/02/google-finds-llmjacking-attackers-running-up-100k-a-day-in-fraudulent-cloud-charges

- BleepingComputer: https://bleepingcomputer.com/news/security/uk-school-estate-hit-by-3am-ransomware-in-suspected-ai-assisted-attack

- theverge.com: https://theverge.com/news/1025576/binance-cyrpto-theft-explained

- The Information: https://theinformation.com/briefings/anthropics-revenue-surged-17-billion-q3-swung-back-operating-loss

- The Register: https://theregister.com/security/2026/11/03/britain-on-notice-ai-powered-ransomware-attacks-to-arrive-by-2028/5307200

- SiliconANGLE: https://siliconangle.com/2026/11/03/crowdstrike-to-acquire-cybersecurity-startups-fiddler-ai-dreadnode-for-reported-495m

New episodes every Monday, Wednesday and Friday. Follow Release Candidate so you don't miss one.

Someone just stole $6.3 billion from Binance, and the exchange says it has covered 95% of it. Is that a recovery or a press release?

North Korean state hackers are suspected in the biggest crypto theft ever, more than four times the previous record. Withdrawals are back on. Tamar and Eitan do not agree on what that proves.

Also: a tampered Claude Code extension on Cursor's marketplace that planted backdoors, Sierra adding $150 million in annual revenue while ServiceNow stock drops 27%, a Chainalysis data breach, OpenAI's new usage caps, and Meta's humanoid robot built with Fourier.

In the Build Window: a safety check for AI coding tool add-ons before they hit your laptop.

IN THIS EPISODE

0:00 Cold open and today's stakes

0:35 Binance hit by record $6.3 billion crypto breach, North Korea suspected (Binance, North Korea)

4:55 Rapid Fire: Sierra Adds, One Quarter While ServiceNow Drops 27, Chainalysis, OpenAI, Pricing Model Shift Signals End, Meta

8:45 Malicious Claude Code Extension on Cursor Marketplace Exposed Thousands of Developers (Malicious Claude Code Extension, Cursor Marketplace Exposed Thousands, Developers)

12:35 The Build Window: Extension Gatekeeper, Exchange Exposure Monitor

15:25 What to do this week and our prediction

WHAT TO DO THIS WEEK

If you are a CFO or treasury lead at a company holding crypto on an exchange, this week list every exchange balance, its share of your holdings, and what written proof you have that the venue can cover a loss.

OUR PREDICTION

The FBI or US Treasury will publicly attribute the Binance theft to a named North Korean hacking group by December 15, 2026. (we'll check by 2026-12-15)

SOURCES

- Geektime: https://geektime.co.il/binance-largest-crypto-hack-history-6-billion

- BleepingComputer: https://bleepingcomputer.com/news/security/malicious-claude-code-extension-on-cursor-planted-ssh-backdoors

- cnbc.com: https://cnbc.com/2026/10/29/servicenow-now-earnings-q3-2026.html

- BleepingComputer: https://bleepingcomputer.com/news/security/chainalysis-discloses-data-breach-from-offensive-agentic-techniques

- The Decoder: https://the-decoder.com/openais-upcoming-chat-and-work-merger-in-chatgpt-signals-the-end-of-all-you-can-prompt-pricing

- The Information: https://theinformation.com/articles/meta-built-humanoid-prototype-chinese-startup-ramp-robotics-push

- TechCrunch: https://techcrunch.com/2026/11/01/openai-might-rebrand-its-data-centers-as-ai-compute-campuses

- OpenAI News: https://openai.com/index/helping-websites-express-ai-training-preferences

New episodes every Monday, Wednesday and Friday. Follow Release Candidate so you don't miss one.

Google built an AI that finds security holes, tests exploits and writes the fixes. Who gets to verify it works?

Google DeepMind's Gemini 4 Carbon scored 88.2% on a vulnerability-finding test and is going only to selected defenders through the Fairwind program. An ML researcher's take on what tests run without guardrails really prove.

Also: hackers exploit the Node2Shell flaw in Node.js, a claimed Okta route into data on 40,000 DHS employees, another Cisco firewall zero-day, Microsoft's $10 billion from OpenAI, Salesforce's metered AI agents, and Upwind turning down Datadog.

Plus two startup ideas, including one for anyone tired of trusting AI security scores.

IN THIS EPISODE

0:00 Cold open and today's stakes

1:10 Google unveils Gemini 4 Carbon for cybersecurity tasks (Google, Gemini 4 Carbon)

12:00 Rapid Fire: Okta, US, Cisco, SSL VPN, Microsoft, OpenAI

22:45 CISA warns of hackers exploiting critical Node2Shell flaw (CISA, Node2Shell)

32:35 The Build Window: Guardrails-On Bench, Agent Meter Watch

40:25 What to do this week and our prediction

WHAT TO DO THIS WEEK

If you run application security at a SaaS company, list every Node.js service and client that uses Brotli compression this week and patch the Node2Shell flaw before CISA's November 10 federal deadline, because attackers are already exploiting it.

OUR PREDICTION

Tamar predicts Google will not announce general availability of Gemini 4 Carbon to all developers and businesses by January 31, 2027; access will remain limited to the Fairwind program and selected partners. (we'll check by 2027-01-31)

SOURCES

- securityweek.com: https://securityweek.com/google-says-gemini-4-carbon-leads-in-finding-exploiting-and-fixing-vulnerabilities

- cisa.gov: https://cisa.gov/known-exploited-vulnerabilities-catalog

- techcrunch.com: https://techcrunch.com/2026/10/28/hacker-stole-personnel-data-about-thousands-of-homeland-security-employees-including-cbp-and-ice-agents

- The Robot Report: https://therobotreport.com/white-house-makes-section-232-determination-regarding-foreign-made-robots

- BleepingComputer: https://bleepingcomputer.com/news/security/cisco-warns-of-firewall-zero-day-exploited-to-crash-ssl-vpn-devices

- TechCrunch AI: https://techcrunch.com/2026/10/28/microsoft-recorded-10-billion-in-revenue-from-openai

- SiliconANGLE: https://siliconangle.com/2026/10/28/microsofts-stock-rises-on-solid-earnings-and-revenue-beat-with-azure-growing-48

- salesforce.com: https://help.salesforce.com/s/articleView?id=005360285&language=en_US&type=1

- Geektime: https://geektime.co.il/upwind-nabs-another-100m

New episodes every Monday, Wednesday and Friday. Follow Release Candidate so you don't miss one.