Hi there,
This week I’ve rotated more passwords than I ever have in my life.
What I'm Seeing in AI
Everyone's getting hacked
On Wednesday, Railway, the platform a lot of startups run their apps on, disclosed that attackers may have accessed customers' stored secrets: API keys, database passwords etc. They paused all projects and told every customer to rotate everything.
The interesting part is why. Railway says it's part of a wave of attacks on platform companies, aimed at getting to the keys for AI providers. AI access is now valuable enough to be worth stealing.
The same week, two critical flaws in PHP leaked before they were meant to be announced. PHP runs about 70% of global websites, especially older ones, and attacks started almost straight away.
Most of this is happening because AI is now so good at finding security vulnerabilities in software, so hackers are super powerful.
Claude wants to be your assistant
Anthropic launched Claude Duet this week, their own personal agent for work, similar to OpenAI Dots, Meta Muse, Instinct and the 1000 other AI agent products released recently.
It feels like every lab is giving away an agent now. I've tried a few of them, like OpenClaw and Instinct, and they're all genuinely good but they're hard to fit into your day-to-day life. Most of us have never had a personal assistant, so we don't really know what to hand over, and there are only so many things you can get it to do.
What I'm Building
Why service businesses win the next decade
I wrote an article this week on why I think boring services businesses + AI is the future.
For twenty years, the startup was simple: raise VC money, build software, find product-market fit, scale. Service businesses like accounting firms, healthcare, coaching never fit this model and were relegated to a different world of business.
AI flips that from both sides. Software (startups) can now adapt to each user, and service businesses can run their admin and ops on AI agents and productise the parts that repeat. What's left in the middle is a new kind of business: a productised service. It looks like a service from the outside and runs mostly like a product on the inside.
As Sequoia put it: "For every dollar spent on software, six are spent on services." This means there’s massive opportunity for traditional services businesses to streamline their operations with AI and capitalise.
Have a read of the full article if you’re interested (going out around 10am).
Putting a private AI inside a law firm
We just signed one of our more unusual projects: an AI that lives entirely inside a law firm's office. Their data can't leave the building, so traditional cloud AI is off the table.
Instead, we're putting a powerful GPU on site and running an open-source model on it. Open models still trail the best paid ones, and it'll be slower. But when privacy matters more than anything, they're now good enough to do real work.
The GPU we bought (looks cool right?)
After the week of security issues we’ve had, I get the appeal of keeping everything in the building.
The tricky part however has been acquiring the hardware to build the server, since AI and its compute is in such high demand right now.
If you know someone that has an old website, forward this to them :)
See you next Friday,
Finlay
Explore the rest of my writing here → finlayekins.com/writing
Want this running in your company? → thehourglass.ai/call/finlay