AI's Speed Problem: Hacks, Lawsuits, and Your

There's a conversation happening in the AI community that keeps circling back to the same uncomfortable truth: the thing making these tools so useful is the same thing making them so dangerous. Speed.

Wes Roth and his co-host Dylan spent a recent two-hour livestream bouncing between the OpenAI lawsuit, Google's cybersecurity warnings, and their own personal security habits—the kind of rambling, honest conversation that rarely makes it into polished tech coverage. What emerged, underneath the stream connection issues and DayQuil jokes, was actually a coherent picture of a threat landscape that's shifted in a way most people haven't fully registered.

The Speed Problem Nobody's Talking About Clearly Enough

Google recently disclosed a zero-day vulnerability that could bypass two-factor authentication. They patched it quickly—faster than their historical average, by most accounts. That's the good news. Here's the part worth sitting with: the patch speed almost doesn't matter anymore.

Dylan put it plainly during the stream: "It's never been exploited so quickly at such scale. It's sometimes it's not just that there's more vulnerabilities. It's just that if there's a crack in your house or like you open your door and like a hundred people run in the door before you're able to close it because LLMs just produce at such a high speed, then it really is a worse problem than even the same door being opened just a couple years ago when not that many people could find it or exploit it."

That's the frame shift worth internalizing. The vulnerability surface hasn't necessarily grown—the exploitation velocity has. A flaw that might have been discovered by a handful of sophisticated actors over several weeks can now be weaponized at scale before the coffee gets cold. Vercel also reportedly got hit around the same time, which suggests this isn't isolated.

For most users, what does this actually mean? Your 2FA is not worthless. But it's also not the fortress it felt like two years ago. AI-assisted phishing, AI-assisted credential stuffing, AI-assisted exploit development—these aren't theoretical. They're operational. The attack tooling has been democratized in exactly the way the defense tooling has.

The chicken-and-egg framing Dylan used is accurate: defenders can now patch faster using the same AI capabilities attackers use to exploit faster. Whether that race is net-positive for defenders or attackers is genuinely unresolved. Anyone telling you they know the answer is selling something.

Basic Hygiene That Most People Still Skip

What I find interesting about Roth's personal security practices is how unglamorous they are. No mention of hardware keys or enterprise-grade VPNs. Just email compartmentalization and virtual credit cards.

The email strategy he described is one I've recommended for years and one that most people ignore until they get burned: maintain separate addresses for communication, for signups, and for anything genuinely sensitive. Your "real" email—the one that has your name in it and that you've used to register for everything since 2009—is a liability. It's the skeleton key to your digital identity, and you've handed copies to every newsletter, loyalty program, and SaaS trial you've ever signed up for.

Roth also mentioned planning to try Privacy.com for virtual credit cards, which lets you spin up card numbers with defined spending limits for individual merchants. The use case he described is mundane but real: he can't remember everything he's subscribed to, payments are scattered across PayPal, Apple, and direct billing, and AI tool subscriptions in particular have a habit of quietly auto-renewing at tiers you forgot you upgraded to.

None of this is exotic. It's just maintenance that most people defer until a problem forces the issue. The problem, increasingly, is that the forcing event arrives faster than it used to.

The OpenAI Lawsuit as Reputation Stress Test

The Elon Musk v. OpenAI lawsuit got less airtime in the stream than the security discussion, but the most interesting exchange was brief. Dylan highlighted a moment from the trial where Elon's lawyers asked Sam Altman directly whether he was "completely trustworthy."

Roth's read: "Whatever it does is it's going to put pressure on OpenAI, kind of their founding story. It's going to question their reputation. Which might be a problem especially as Elon is spinning up the new company"—now operating under the XAI banner, joining X and SpaceX in an increasingly unified brand architecture.

The lawsuit's legal merits are a separate conversation, and one better had with an actual attorney than an AI livestream. But the reputational angle is worth considering independently. OpenAI's entire value proposition to enterprise customers, to regulators, and to the public rests partly on a founding narrative about safety-focused, mission-driven AI development. Litigation that forces that narrative into a courtroom—with discovery, depositions, and adversarial questioning—is a different kind of pressure than a critical op-ed. It doesn't require Musk to win to do damage.

Meanwhile, Grok's Build Beta launched during the same news cycle. Whether that timing is strategic or coincidental is one of those things that's impossible to know and almost too convenient to ignore.

The Honest Tension in "AI Security"

Here's what I keep turning over: the same companies warning us about AI-accelerated cyber threats are the ones racing to deploy AI at scale. Google's threat intelligence reports are genuinely useful. Google is also one of the primary architects of the infrastructure those threats run on. That's not a condemnation—it's just the actual shape of the situation.

Roth and Dylan didn't resolve this tension, because it can't really be resolved in a livestream. Or anywhere, yet. The best framing I've heard—and Dylan gestured at it—is that we're in an arms race where both sides are running on the same fuel. The question isn't whether AI makes security better or worse in aggregate. It's whether the defensive applications can be deployed fast enough and broadly enough to keep pace with offensive ones.

For individual users, that framing is both clarifying and a little cold. The systemic race is happening with or without your participation. What you control is your own attack surface: how many doors you've left unlocked, how many identical keys you've distributed, how many subscription billing relationships you've forgotten about.

The AI-enabled threat actors looking for easy targets aren't looking for you specifically. They're looking for whoever left the door open. That part, at least, is still yours to manage.

Rachel "Rach" Kovacs is Buzzrag's cybersecurity and privacy correspondent.