Fraud, hacks, and cyberattacks

Good morning,

Meet the corporate press release of fever dreams, courtesy of food giant Conagra Brands: “Slim Jim Makes Snacking History with World's Longest Meat Snack Stick.” The company’s 429-foot meat stick broke a Guinness World Record. Conagra had 11 employees working on it.

In today’s edition:

• Cybersecurity’s double-edged sword
• “Slop grenades” and “meat proxies” in the workplace
• The city least likely to spend on corporate fun
• Beware of the infinite AI spending loop

Cybersecurity companies rise along with AI hacking fears

p(doom) problems: Everyone’s been talking about the probability that AI will kill us all, also known as p(doom). Rival AI CEOs Sam Altman and Dario Amodei both agreed that we (but more specifically, they) need to slow the pace of frontier AI development as fears of an eventual apocalypse mount. Meanwhile, companies are dealing with a less catastrophic but significantly more imminent concern: the threat of cyberattacks perpetrated or facilitated by AI.

Cybersecurity anxiety exploded after the Hugging Face incident, where a swarm of OpenAI agents broke out of their testing environment and launched an attack against another company. New data from Ramp Economics Lab shows that firms are buying more AI security software in the months since that breach:

• On Ramp’s latest Top SaaS Vendors list, three of the trending vendors (DepthFirst, Monte Carlo, Antithesis) offer tools meant to monitor agents in production environments and detect vulnerabilities before they spiral.

“Defensive stocks” have taken on a new meaning. Cybersecurity stalwarts like CrowdStrike, Palo Alto Networks, Fortinet, Okta, and Zscaler gained last week after unsettling warnings from AI CEOs. These companies are poised to take advantage of AI hacking fears, which started long before the Hugging Face incident.

The big “yikes” moment was Anthropic’s April announcement of Mythos, a model deemed too dangerously powerful to release to the public. Anthropic said Mythos was able to autonomously identify thousands of previously unknown software vulnerabilities: that’s a positive tool when used to patch security flaws, but a dangerous one when used to exploit them (which is already happening).

• “The Mythos moment translated into mass-market acceptance that AI adoption needs security,” said CrowdStrike CEO George Kurtz while announcing the company’s best quarter on record.
• "The latest advancements in AI are elevating cybersecurity to the top of the CIO priority list,” Palo Alto Networks CEO Nikesh Arora said in the company’s earnings. “I’ve been trying for eight years to tell customers they’re not ready, and [Anthropic CEO Dario Amodei] did it in one event,” Arora told CNBC, referring to Mythos.

The Nasdaq CTA Cybersecurity Index is up nearly 11% over the past month, significantly outperforming the Nasdaq-100. Shares of CrowdStrike, Palo Alto Networks, and Fortinet have more than 2x’d over the past six months, while Nvidia is up 29% over that period.

The bottom line:

AI is cybersecurity’s biggest frenemy. It could be the industry’s biggest tailwind or its biggest disruptor. On one hand, AI hacking fears are pushing more companies to invest in cybersecurity. On the other, models like Mythos could be so good at catching security flaws that they disrupt or overtake traditional vendors (the familiar “SaaSpocalypse” discourse). The market for securing AI is still a small fraction of total cybersecurity spend, but Gartner projects it will reach ~$4.8B in 2027, up 68.7% from this year.

Watercooler Data

San Francisco’s not much of a happy hour town.

Out of ten major U.S. cities, the AI capital of the world is dead last for putting bars and entertainment on the company card. For every 10K Ramp card transactions, SF employees expensed just 89 bar or entertainment purchases.

Miami leads in fun transactions (no surprise there). Miami employees put bars and entertainment on the company card at 2.2x the rate of their SF counterparts. Picture: beachfront cocktail hours and team karaoke nights.

Term sheet: “slop grenade” and “meat proxy”

AI slop is all over social media feeds, but now it’s infecting the workplace in a uniquely infuriating way.

Ever had a colleague send you a 30-page Claude report or an AI-generated Notion doc coupled with the message “plz review”?

That’s what Shopify CEO Tobi Lutke says his company calls a “slop grenade.” In an interview with author Shane Parrish, Lutke said: “The failure case of lazy work is not lack of output, it’s actually over-output now.”

A “slop grenade” happens when someone puts a prompt into AI, doesn’t check the output or barely checks it, then passes it off as a deliverable for a colleague to deal with.

People who just forward AI responses are being called “meat proxies” — the flesh-and-blood humans who pass off silicon-and-steel machine outputs.

A colleague who receives a slop grenade can either spend time trying to review and parse through the output vomit, or they can lob another slop grenade back, and so on and so forth.

This removal of human judgment can add unnecessary work to everyone’s plate, erode critical thinking skills, and foil a project’s success. Until someone steps in to detonate these slop grenades.

Beware of the infinite AI spend loop

Agentic AI is impressive, but it can also be impressively expensive when an agent gets stuck in a loop trying to solve a problem.

Signals Shortlist

• For the first time since 1999, the S&P 500 had more 52-week lows than highs (CNBC)
• AMD joins $1 trillion club as chipmakers rally on AI-driven demand (Reuters)
• Hackers used Anthropic’s Claude to break into OpenAI (Wall Street Journal)
• Record U.S. diesel prices squeeze farmers; food prices may rise (Reuters)
• Auto industry urges Trump to bar Chinese automakers in U.S. ahead of Xi visit (CNBC)

🗓️ Leading Events:

Tuesday, September 22: Earnings expected from KBHome, AutoZone, and Thor Industries

Wednesday, September 23: Meta Connect conference keynote. Earnings expected from Paychex, General Mills, Cintas, and Cracker Barrel

Thursday, September 24: New home sales. Earnings expected from Darden Restaurants and Costco

Friday, September 25: University of Michigan Consumer Sentiment (final)