Everything Is Getting Hacked (it’s over)

Summary

David Ondrej describes a surge in cybersecurity incidents that he partly attributes to AI agents making it easier to scan software for vulnerabilities. He argues that organizations should use agents defensively too, by repeatedly auditing their own code rather than relying only on occasional security reviews.

Incidents discussed

• PHP vulnerabilities: The speaker says critical remote-code-execution flaws affected PHP, which he says is used across a large share of the web. He emphasizes the risk of attackers exploiting the flaws before patches were available and cites Cloudflare statistics showing exploitation attempts increasing rapidly after disclosure. He also mentions a separate, long-hidden critical GitLab vulnerability.
• eMudhra certificates: He describes a certificate authority incident in which weak private-key generation allegedly made some certificates guessable. Because browsers rely on certificate authorities to establish website identity, compromised keys could enable forged certificates and impersonation.
• Railway breach: He says attackers accessed a system holding customer secrets, some of which were reportedly decrypted. Exposed deployment credentials and API keys could put connected services at risk. He criticizes the storage and retention of old keys and recommends treating secrets as sensitive data that must be protected.

These are the speaker’s accounts of the incidents; the subtitles may contain transcription errors.

Security guidance and agent-loop approach

The video’s main recommendation is to run recurring AI security checks against your own repositories:

1. Use capable models with strong reasoning for important security reviews. The speaker recommends frontier models and says different models can catch different issues.
2. Split a codebase into focused areas—for example, authentication, billing, frontend, backend, and APIs—so each recurring check has a narrower scope.
3. Schedule checks frequently. Examples shown include scans every few hours, along with separate checks for dependencies and emerging supply-chain issues.
4. Use a second model as a reviewer. A lead model reports a possible vulnerability; another model checks whether it is genuine and important. Findings that pass review can be presented for human approval, while empty or unconfirmed runs can be archived.
5. Choose the level of automation carefully. The speaker says loops can either propose fixes for review or, where appropriate, make changes and deploy them automatically.
6. Review third-party dependencies. He argues that every package adds to the attack surface and predicts that more teams will audit and reduce unnecessary dependencies.

Product and tutorial content

The speaker demonstrates Cloudroom, a tool he says supports cloud-based AI agents in isolated sandboxes, recurring “cycles” or loops, and templates for security and supply-chain checks. He presents it as open source with a free plan and says the templates can be added to repositories with one click. These are product claims made by the presenter.

The practical walkthrough covers:

• Setting up a recurring web-security check.
• Creating a dependency-review cycle.
• Using a scraping- or API-based cycle to monitor security news and supply-chain incidents.
• Adding a general security-check template and configuring model review, scan frequency, and whether fixes require approval.

Main speaker/source: David Ondrej (identified in the subtitles as “David Andre”), presenting the video’s analysis and a Cloudroom product demonstration.