3.6% of global PII in one database
Truffle Security found a leaked database credential that granted access to a database containing the PII of 3.6% of the world's population.
Snapshot · The a16z Show
The Reality of AI-Powered Cyberattacks | Truffle Security & Socket
Explore episode
Aug 7, 2026
Where this was said
Black Hat 2026 Observations: Supply Chain Goes Mainstream
At 21:29 · chapter starts 20:17
The final section of the main conversation is a Black Hat debrief. Feross observes that attackers seem to deliberately time their npm worm launches to coincide with RSA and Black Hat — the security community at its least attentive to production systems. But the bigger observation is cultural: in prior years, he had to explain from scratch why supply chain attacks were real risks. This year, mainstream business publications are covering them without prompting. That shift matters enormously for practitioners: executive attention and security budget follow press coverage, and coverage follows incidents. The painful attacks happening right now, he argues, will ultimately accelerate meaningful security improvements across the industry. [1] — Feross Aboukhadijeh "2026 declared 'year of software supply chain': Feross Aboukhadijeh declared 2026 the year of the software supply chain, noting supply chain…" 20:17
2026 declared 'year of software supply chain'
Feross Aboukhadijeh declared 2026 the year of the software supply chain, noting supply chain attacks have broken into mainstream business press coverage for the first time.
3.6% of Global PII in One Leaked Credential
A single leaked database credential found by Truffle Security granted access to a database holding the personally identifiable information of 3.6% of the entire world's population. The credential was found while scanning platforms like Hugging Face for exposed secrets.
Similar snapshots
MVP built in one week
Sam's initial MVP was coded in approximately one week using ChatGPT voice mode and copy-pasting code, with no prior technical experience.
Discord vs email for young users
Sam argues Discord is 10x better than email for building relationships with younger users who rarely check their inbox.
Monthly infra costs ~$780–$980
Sam's monthly operating costs include Cursor ($200), AI image generation ($100), AI video generation ($200), hosting ($100), email marketing ($80), and AI compute ($300–$500).
ChatGPT-powered pain point research
Sam recommends copying days of Discord chat history into ChatGPT and prompting it to list recurring pain points as a fast, free market research technique.
50 free tools built total
Bhanu and his team built approximately 50 free tools to attract search traffic, each linked back to SiteGPT.
New tool built in under 5 minutes
With AI coding tools like Cursor, Bhanu can now create a new free marketing tool in less than 5 minutes by referencing existing tools.
KD filter < 10 for rankable keywords
Bhanu filters Ahrefs keyword results to show only those with a keyword difficulty below 10, making them realistic ranking targets for any decent website.
Minimum 1,000 monthly search volume
Bhanu sets a minimum search volume of 1,000 monthly searches when selecting keywords to target with free tools.
20 downloads/day at launch
PropGPT averaged 20 downloads per day right after launching on the App Store through influencer marketing.
