Oct 22, 2026 · 1h 16m
Weak keys expose the internet’s automation problem
Uneasy Money: Is the Internet Breaking Because Bots Never Get Lazy?
The episode connects certificate failures, vulnerable legacy software, drained wallets, and AI systems to a security model built around human inattention.
- 1Automated attackers turn trivial cryptographic mistakes into immediate losses, shrinking the margin for human laziness.
- 2Legacy infrastructure makes widespread PHP vulnerabilities difficult to patch, while centralized certificate trust remains hard to revoke.
- 3AI memory, government restrictions, and frontier-lab economics raise questions about privacy, control, and who captures the value.
Don't miss
Austin Griffith reports that ten-digit private keys were drained quickly while twelve-digit keys had not yet been hit, turning an abstract weakness into a live experiment.
The brief
Kain Warwick, Taylor Monahan, and Austin Griffith examine a cluster of security failures: a certificate authority used the number four, PHP flaws exposed legacy infrastructure, and weak Ethereum keys were drained.
The common thread is not merely bad engineering but a changing threat model: systems designed around human laziness now face automated bots and AI agents that search relentlessly for exploitable mistakes.
The hosts connect certificate revocation, Ethereum attestations, multisigs, and decentralized governance while questioning whether internet trust can become more resilient without creating new coordination problems.
The discussion then turns to Paper Trade’s leverage and incentive mechanics, using DeFi’s speculative return as a case study in how crypto experiments reveal failures of intuition and mechanism design.
DeepSeek’s releases, AI assistants’ expanding memory, and the economics of OpenAI, Anthropic, and other labs broaden the stakes from software security to privacy, policy, and concentrated technological value.
The closing experiment supplies the episode’s sharpest evidence: ten-digit keys were drained quickly, while twelve-digit keys had not yet been hit, underscoring automation’s practical reach.
What was said on this episode
36 statements · 12 positive · 22 negative · 2 neutral
The recent internet security incidents appear unrelated.
“as of right now, it does actually seem like all these things are unrelated”
Listen at 4:12
eMudhra generated a certificate private key equal to four.
“the private key was just the number four”
Listen at 7:34
The weak eMudhra private key signed certificates since April 2025.
“the private key has been the number four for over a year. it's been signing stuff for since april 2025 apparently”
Listen at 8:07
Eight eMudhra certificates used weak numeric private keys between zero and 256.
“There was actually eight. No, there's eight certificates that were all weak. They were all numbers between zero and 256.”
Listen at 11:04
The NSA could have retained the weak certificate vulnerability for later use.
“It seems like a great little thing for the NSA to have in their back pocket, in my opinion.”
Listen at 13:14
Internet certificate revocation processes are severely inadequate.
“the revocation schemes for this is the most ghetto atrocious process that you've ever heard about”
Listen at 18:05
Revoking compromised certificates is difficult because software handles revocation inconsistently.
“they can't necessarily do so very easily because each piece of software does so differently and some of them just don't”
Listen at 18:30
Automated agents can exhaustively test systems humans previously left unchecked.
“we've got people that are not as lazy as us”
Listen at 24:36
PHP powers approximately 70 percent of websites.
“php runs like 70 percent of the web or something like websites are just php”
Listen at 25:38
Two PHP vulnerabilities enable anyone to remotely execute server code.
“they found not one but two rcs so this means that anyone in the world can remotely be able to execute code on your server”
Listen at 28:07
Unpatched exposed PHP admin panels allow remote code execution.
“if they're not patched, anyone can basically just go hit that. hit it with the with the exploit and then they'll be able to like run code on that server remotely”
Listen at 28:58
WordPress has historically been relatively insecure.
“wordpress has always been i don't know i guess like relatively insecure”
Listen at 29:47
Failure to promptly address PHP vulnerabilities will worsen their consequences.
“if the system admins and the DevOps guys do not go in and really take this seriously right now, it's going to be worse than just like”
Listen at 31:16
Cloudflare rules temporarily shield sites from the PHP exploit during patching.
“they're like protecting people as people are updating the rollout. they're like this first initial shield”
Listen at 34:00
Patching PHP can break dependent applications and infrastructure.
“you don't actually know what that PHP is powering. And if you update it, you might break like the web app or like the thing that's, I don't know, powering ATMs or the banks”
Listen at 35:36
Ethereum private keys below 256 are already exploited or monitored.
“there's not a number less than 256 that doesn't already have a nonce. And you can see clearly that it's already exploitable.”
Listen at 36:11
A dollar sent to a weak Ethereum key immediately attracted three theft attempts.
“As soon as the dollar landed, there were three transactions in the mempool pending trying to steal it.”
Listen at 36:39
Automated attackers may brute-force keys with roughly eight to sixteen digits.
“I would say between eight and 12. Yeah. Same thing with past being brute forceable. Right. Or maybe eight and 16.”
Listen at 37:05
Crazy DeFi yield-farming schemes will return.
“i do think that this is going to make a comeback”
Listen at 40:37
The current bull market will produce more Ponzi-like yield-farming schemes.
“I expect that there will be a lot more crazy. ponzi yield farming schemes”
Listen at 41:20
Highly leveraged systems with dynamic inputs are easy to manipulate through oracles.
“when you have a system that has these kind of dynamic inputs to it that is highly levered then It's very easy for people to manipulate the Oracle”
Listen at 42:43
Recursive incentive structures can become attack vectors.
“the incentive structure is somewhat recursive as well, right? Where the incentives can become an attack vector”
Listen at 45:17
Paper Trade has sustained 1,000x leverage.
“the fact that they're able to get 1000X leverage and it's kind of sustainable, right, is pretty amazing”
Listen at 52:00
DeepSeek keeps releasing progressively better models.
“they keep releasing better and better models and like this model is like fucking insane man it's so good”
Listen at 56:25
DeepSeek’s latest model is exceptionally capable and inexpensive.
“this model is like fucking insane man it's so good It's one of the smartest models, but also one of the cheapest models”
Listen at 56:29
Chinese government inputs are being routed into U.S. models through distillation attacks.
“the Chinese government is putting stuff in the Chinese models, which is then actually getting routed to the US models”
Listen at 58:17
DeepSeek can run locally, unlike Opus.
“you can run DeepSeek locally. And you can't run Opus locally.”
Listen at 58:50
The government needs frontier AI models from U.S. providers.
“the government actually needs our models”
Listen at 59:28
AI assistants have reduced Taylor Monahan’s prompting discipline.
“My personal discipline with like prompting and asking questions, and especially for like the general talky questions. has gone so far into the pits of hell.”
Listen at 1:04:18
Anthropic resembles Sam Bankman-Fried’s policy posture.
“anthropic gives me such spf vibes”
Listen at 1:05:17
Anthropic appears close to becoming profitable.
“they do seem to almost be. on a path to like profitability”
Listen at 1:09:35
A profitable Anthropic would have effectively unlimited value.
“if they suddenly weren't losing money because they have a model that's like so much cheaper to run, they're worth like infinite money”
Listen at 1:10:12
Any frontier AI lab reaching profitability while staying frontier-capable would be infinitely valuable.
“any frontier lab that has the ability to make frontier models and stay at the frontier that flips from like cash burn to, you know, cash flow positive is worth infinity”
Listen at 1:12:11
New OpenAI and DeepSeek models are compelling enough to adopt immediately.
“any new open ai or or or even like deep seek model i'm like fuck i gotta have that on day”
Listen at 1:13:59
Ethereum keys with ten-digit values were drained immediately.
“And 10 digits right away.”
Listen at 1:14:24
Automated theft currently targets keys between ten and twelve digits.
“12 digits, not yet. So our sweet spot is between 10 and 12.”
Listen at 1:14:27
Statements are attributed to the speaker as said on the episode and reflect their view at the time, not PodLume's. They are not advice.
Weekly email
State of the Pod, every Monday
The week's most-discussed names and stories from podcasts, with the moments behind them. Free, five minutes, unsubscribe in one click.