Snapshot · The a16z Show
During the Black Hat conference recording, an active npm worm was spreading across a few hundred repositories, with a maintainer whose insecure GitHub Action was likely the entry point.
Where this was said
At 12:12 · chapter starts 10:50
The numbers are staggering. Truffle Security, partnering with Hugging Face to clean credentials from hosted training data, found roughly a quarter of a million live keys. Most were concerning. Some were catastrophic. One granted direct push access to a foundational Linux library used by the vast majority of machines on the planet. The implication is not theoretical: anyone who found that key before Truffle Security did could have pushed malware to most of the world's computers in a single operation. While working through this cleanup, Dylan Ayrey was contacted by Hugging Face's CTO about an unrelated OpenAI incident — and when he looked at the incident response, the very first step listed was stolen credentials. Path of least resistance, exactly as theorized. [1] — Dylan Ayrey "Truffle Security found roughly 250,000 live API keys embedded in training datasets on Hugging Face. One of those keys had push access to a …" 17:40
While recording this episode at Black Hat 2026, an npm worm was actively spreading across hundreds of repositories. The attack, likely vibe-coded by the threat group that open-sourced their toolkit, exploited an insecure GitHub Action to steal tokens and self-propagate — a scenario the security community had theorized but never seen at scale.
Sam's initial MVP was coded in approximately one week using ChatGPT voice mode and copy-pasting code, with no prior technical experience.
Sam argues Discord is 10x better than email for building relationships with younger users who rarely check their inbox.
Sam's monthly operating costs include Cursor ($200), AI image generation ($100), AI video generation ($200), hosting ($100), email marketing ($80), and AI compute ($300–$500).
Sam recommends copying days of Discord chat history into ChatGPT and prompting it to list recurring pain points as a fast, free market research technique.
Bhanu and his team built approximately 50 free tools to attract search traffic, each linked back to SiteGPT.
With AI coding tools like Cursor, Bhanu can now create a new free marketing tool in less than 5 minutes by referencing existing tools.
Bhanu filters Ahrefs keyword results to show only those with a keyword difficulty below 10, making them realistic ranking targets for any decent website.
Bhanu sets a minimum search volume of 1,000 monthly searches when selecting keywords to target with free tools.
PropGPT averaged 20 downloads per day right after launching on the App Store through influencer marketing.
We use essential and analytics cookies to run Vuci. To understand how the site is used: Privacy Policy.
Install Vuci on your phone
Add it to your home screen for a faster, app-like experience.
Install Vuci on your phone
Tap the Share button, then “Add to Home Screen”.
A new version is available
Reload to get the latest Vuci.