Gutenberg Lab — Morning Paper

AI Attacks Move at 70x Human Speed — Autonomous Defense Is No Longer Optional

Speakers

David George (a16z partner) × Kevin Mandia (Founder & CEO of Arminin, founder of Mandiant)

Bottom line

Cyberattacks in the AI era move at machine speed rather than human speed, rendering 30 years of defensive playbooks obsolete.

3-Line Summary

Kevin Mandia, founder of Mandiant, launched Arminin to continuously test enterprise networks with AI-driven offensive systems. Since January 2026, they have found over 90 zero-day vulnerabilities in production at Fortune 500 companies. With attackers now able to probe thousands of entry paths simultaneously via AI, Mandia declares that human-in-the-loop detection and response is "too slow to function."

3 Key Points

1. Speed differential of AI attacks: What would require 70 humans and still be impossible, AI executes in microseconds. "It's apples to oranges. Humans can't even do it," says Mandia. Attacks shift from sequential to parallel execution, probing thousands of paths simultaneously with a comprehensiveness beyond human capability.

2. Zero-day discovery track record: Since January 2026, Arminin has found over 90 zero-day vulnerabilities in production at Fortune 500 companies. All discovered via black-box testing (no source code access, external penetration), with CISO notification within 48 hours. "These are not rinky-dink companies. These are Fortune 500."

3. The turn to autonomous discovery: Of the 90+ zero-days, the majority were found by humans automating 90%+ of work with AI, but "the last few zero-days, tech found it. We've made the turn," says Mandia. The era of fully autonomous vulnerability discovery by AI has begun.

Editorial Perspective

This is the "window of exposure" in a platform transition. The period when offense dominates defense always exists, and the years before defense catches up are the most dangerous. In the birth and rise of the internet and the App Store economy, new attack surfaces opened the moment they launched, creating defensive vacuums. The difference this time is that the offensive advantage expands at "machine speed." The scene Mandia describes—"CIOs, CISOs, product teams, business lines all war-rooming fixes"—is evidence that defenders recognize their structural disadvantage. Arminin's thesis—training defensive AI with offensive AI—reflects the inevitability of this transition: machine-speed attacks demand machine-speed defense.

Source: a16z Podcast "Building Defense for the Agentic Era: Kevin Mandia" (October 6, 2026)

https://a16z.simplecast.com/episodes/building-defense-for-the-agentic-era-kevin-mandia-4ylPD1X6

Spoken source: a16z Podcast, episode "Building Defense for the Agentic Era: Kevin Mandia" (October 6, 2026), guest Kevin Mandia

AI Disclosure: Produced with AI assistance; facts and analysis reviewed by our editorial team.

• --

The Structural Collapse of Podcast Discovery: How a Million-Listener Show's Playbook Failed in 2024

Featuring

Marques Brownlee (MKBHD) × Alex Goldman (host of *Hyperfixed*, former co-host of *Reply All*)

Bottom line

The playbook that built a million-listener podcast in 2014 is completely obsolete in 2024, not because of execution failure but because the platform economics have fundamentally changed — discovery is worse, ad rates have cratered, metrics have regressed, and tech companies refuse to engage with journalists even when they own them.

Three-Line Summary

• Alex Goldman launched *Reply All* in November 2014 with three compounding structural advantages: his boss was making a hit meta-podcast about the company, that boss had 20 years of *This American Life* credibility, and their first episode dropped during *Serial*'s original 9-episode run when 70-80% of podcast listeners used iTunes
• In 2024, Goldman tried the exact same playbook with *Hyperfixed* — cross-promotion on flagship shows, investigative storytelling, premium subscriptions — and found that listener acquisition costs had increased 10x, platform share had fragmented to 40% Apple with a long tail, and analytics tools had regressed from 2015 levels
• Short-form video (TikTok, Instagram Reels) generates millions of views but doesn't convert to podcast listens; tech companies won't talk to journalists even when they own the media outlet; and Goldman's conclusion is stark: "The new meta of the Internet is you need to be monetizing your reels and shorts and TikToks because those people are not going to make their way back to your show"

Three Key Points

1. Podcast analytics have regressed, not progressed. Tracking tools that existed around 2015 — showing when listeners tuned in, what they skipped, where they dropped out — were bought by major platforms and shut down. No replacement has emerged. Current data from Apple and Spotify is "really pretty bad," Goldman says

2. Cross-promotion effectiveness has dropped by 90%. In 2014, a single placement on *This American Life* or *Radiolab* brought ~50,000 new listeners. In 2024, Goldman used the same strategy with *99% Invisible* and "didn't get the same number of people over." Market saturation and discovery collapse are the culprits

3. Tech companies won't talk to journalists, even when they own them. Spotify bought Gimlet (*Reply All*'s parent company) in 2020 but still declined multiple *Reply All* interview requests afterward. In a decade of tech journalism, Goldman got YouTube on record once and Google never. "Really embarrassing to be on a show that was owned by Spotify and have to say more than once, 'Yeah, they declined a comment for this.'"

Editorial Perspective

This is a textbook case of creative destruction. The transition from a new medium's "land grab" phase (where talent and timing dominate) to its "mature market" phase (where distribution power and capital dominate) turns the skills that made you successful in one phase into liabilities in the next. Goldman's experience makes visible the hidden costs platform economics impose on creators — relentless self-promotion, non-fungible attention currencies, and the absence of accountability from owners. The lesson extends beyond podcasting: When platforms consolidate, the early winners often become the next wave's casualties.

Source: Waveform, "How to Start a Podcast (Then vs Now) w/Alex Goldman" (October 6, 2026)

https://www.youtube.com/c/Waveform

AI Disclosure: Produced with AI assistance; facts and analysis reviewed by our editorial team.

• --

Seven Working Apps Built by Non-Coders — "Vibe Coding" Demonstrates AI-Assisted Development Has Reached Product-Market Fit

Featuring

David Pierce (The Vergecast host) × Hayden Field (The Verge senior AI reporter) × seven listener-builders from Washington DC, Chicago, New Jersey, Georgia (country and state), UK, and Illinois

Bottom line

AI development assistance has moved beyond experimentation to enable non-technical users to build functional software solving real, specific problems in daily use.

Three-Line Summary

The Vergecast held a Shark Tank-style competition for "vibe-coded" apps, where seven listeners with no traditional programming background pitched working applications. Projects ranged from hacking a proprietary home tablet, tracking toddler meals, searching church sermons, gathering funeral photos, tracking chronic pain, visualizing Pokemon card markets, to calculating bike ride turnaround points. Host David Pierce called it "the first way in which AI has really found product-market fit," awarding the highest bid of $250 million (fake investment capital) to a photo-gathering app for funerals and weddings.

Three Key Points

1. Personal solutions to vendor lock-in — John from Washington DC wiped his Skylight calendar tablet (proprietary OS) and rebuilt the interface via Claude server to route grocery lists to TickTick (for himself) and Trello (for his wife). A non-technical user escaped ecosystem lock-in by rebuilding functionality on open platforms — a pattern impossible before AI-assisted development.

2. Cognitive load reduction as the killer use case — Sarah from Chicago built a toddler meal tracker to address "the cognitive load... the million things you have to remember, the 200 decisions you make every single day" as a parent. The same framing appeared in pain tracking (Mils from Illinois) and photo gathering (Simon from UK), suggesting AI tools' value lies not in automation but in externalizing mental overhead.

3. Semantic search of personal archives is an unfilled professional need — Eddie from New Jersey built a sermon search tool (Whisper transcription → Claude summarization → Gemini Notebook semantic search). Pierce immediately bid $100 million, confessing "I have spent a lot of time looking for a tool that does almost exactly this thing" to search interview transcripts by topic and speaker. The gap between full-text search and "when was I talking about X with Y person" remains unfilled by commercial products.

Editorial Perspective

What vibe coding success stories reveal is not so much the democratization of technology as the democratization of problem definition. Problems that mass-market apps don't solve — routing family grocery lists to different apps, calculating bike ride turnaround points to hit exact mileage numbers — are visible only to those experiencing them. By lowering development friction, AI enables the people who know the problems best to write the software directly. This is the long tail of demand beginning to appear on the supply side as well.

Source: The Vergecast, "We hear pitches on the best vibe-coded apps" (October 5, 2026)

https://www.theverge.com/the-vergecast

AI Disclosure: Produced with AI assistance; facts and analysis reviewed by our editorial team.