Just finished watching the latest episode of the All-In Podcast. Ken Griffin warned of an AI bubble, a critical 9.2 vulnerability was discovered in PHP, and there was the financial crisis behind the French riots. Ken Griffin raised the AI bubble theory, and Chamath responded with real data from Ramp. The show started with a hard-hitting debate. Citadel founder Ken Griffin warned that any disruptive economic and technological change is accompanied by a bubble. The core problem is that many companies are paying huge bills to OpenAI and Anthropic, but are struggling to find commensurate productivity improvements in their real-world business. Chamath revealed data from Ramp. Only 1% of the top companies in the entire market contribute 90% of AI spending (token consumption and computing power), and of that 90%, 80% comes from startups that are not yet profitable and rely on venture capital funding. He described this phenomenon as a closed-loop, involutionary flywheel: VCs invest pension funds and LP money in AI startup A, which then purchases model services from another AI startup B to create impressive, high-growth data. B then uses this impressive data to seek further funding from the same group of VCs, inflating its valuation. The entire chain goes around in circles, with 75% of the funding essentially just circulating within the startup ecosystem, failing to truly penetrate traditional large enterprises – this is what he calls the diffusion problem. However, Ramp's underlying data also shows a positive shift: leading consumers are continuously increasing their spending on self-built GPU computing power (physical servers, private clusters), while the proportion of closed-source API calls is slowing down. Some leading US banks are cutting spending on AWS/GCP and instead building six independent private data centers with significant capital investment. The enterprise market is experiencing a wave of returning to private cloud and open-source control. Jason countered from the opposing perspective, arguing that startups have historically been the most astute, having been among the first to embrace AWS and Facebook Ads, ultimately proving their strategic direction was correct. Therefore, the current rush of startups towards AI is a significant leading-edge signal. PHP Discovers 9.2-Point Critical Vulnerability: AI is Disrupting the Old Logic of Security Relying on Secrecy This episode features Nikesh Arora, CEO of Palo Alto Networks, who provides an in-depth analysis of a major crisis that rocked the global security community this week. The open-source language PHP powers approximately 70% of the world's websites (including WordPress and Wikipedia). Security researchers, using continuous computational power from AI models, discovered a complex chain vulnerability (codenamed PHP2Shell, with a severity level of 9.2/10, considered critical) that had remained undetected for years. Due to premature leaks, numerous websites, government portals, and Wikipedia worldwide were forced to urgently take the site offline for patching. AWS and Cloudflare intercepted millions of automated attack attempts during this period. Nikesh's assessment is that this signifies AI is breaking the old logic of security relying on stealth. Systems that were previously relatively secure due to their sheer size and complexity, making it difficult for hackers to trace complete attack paths, are now being pieced together by AI with near-infinite computing power and patience. This means that the security window previously secured by system complexity is being drastically compressed. The program also discussed the interplay between open-source and closed-source models in the security field. Large enterprise clients (especially in finance and healthcare) prefer open-source or open-weight models because compliance and regulatory requirements necessitate the auditing, verification, and interpretation of the model's thought process, preventing situations where a black-box model crashes the system without attribution. However, the reality is that external independent computing power remains scarce, making it difficult for large enterprises to truly operate large-scale, highly available inference independently and stably without the support of ultra-large-scale cloud vendors. Who should be held responsible when an AI agent logs into a bank account? If a personal AI agent (such as various browser automation assistants) substitutes for a human to input credentials to log into a bank, scrape transaction records, or perform transfers, and an unauthorized transfer of $50,000 occurs, who bears the responsibility? Friedberg argues that banks' terms of service explicitly prohibit third-party AI agents from logging in automatically via web pages. If the AI agent developer was aware of this violation but failed to implement mandatory security measures, then the AI agent platform bears software product responsibility. Nikesh and Chamath lean towards the view that the ultimate responsibility should lie with the authorized user. Agency implies responsibility; users cannot arbitrarily hand over their private keys or credentials to machines and then demand that banks fully cover the losses. Otherwise, the enormous customer service verification costs and the resulting moral hazard would directly undermine the entire financial system's operational foundation. Only when the AI agent exhibits rebellious behavior that seriously deviates from pre-defined code standards does the developer truly bear product defect responsibility. This also touches upon a more fundamental issue: for a long time, enterprises have only allocated 4% to 10% of their IT budgets to network security, and maintaining legacy systems has always been a thankless and arduous task. However, in the future, with the widespread adoption of AI-automated hacking tools, these long-standing unpaid technological debts will trigger a high-density security crisis, making a significant increase in corporate security budgets an inevitable trend. France is currently experiencing unrest, underpinned by a fiscal system already nearing its limits. The second half of the program discussed the recent nationwide riots and looting in France following protests over high school facilities, highlighting the fiscal limits of Western countries as a whole. French public spending already accounts for approximately 57% of GDP (taxes account for 46%), a proportion exceeding even the peak levels of some historically highly centralized economies. The yield on French 10-year government bonds has broken through 5%, reaching a new high since 2002, with safe-haven funds selling off French bonds and flowing into US Treasuries. Chamath stated that only when bond market activism truly drives French bond yields down to 7% to 8%, completely cutting off the government's escape route for unrestrained debt expansion, can this bureaucratic system be genuinely forced into substantial austerity measures; moderate reforms are unlikely to succeed. The unrest has escalated into deliberate looting and violent attacks targeting Chinese-owned shops and Jewish assets, exposing serious problems of lawlessness and a breakdown in immigrant integration. The program also reflects on a pervasive armchair philanthropist mentality in Western societies, where people loudly proclaim unlimited acceptance and unrestrained welfare in affluent neighborhoods, only to be completely unprepared when the real costs and security collapses hit individuals. Friedberg also warned of the current predicament of the United States, noting that federal and local spending combined accounts for 36% of GDP, the debt-to-GDP ratio is 120%, and the deficit rate is 6.2%, higher than France's 5.4%. He believes that without addressing historical burdens such as reducing federal student loans, eliminating fixed-income pensions, and transitioning to a mandatory individual pension account system like Australia's, the United States faces a severe risk of a social and fiscal hard landing.