Episode Three

Google's 32-billion-dollar purchase of Wiz is framed as a bet on Google Cloud security and enterprise trust. Cloud migration does not transfer every responsibility, yet customers expect more than raw compute protection. Almost simultaneously, a compromised GitHub Action exposed the software supply chain: malicious execution could print secrets from workflow memory across thousands of repositories. The remaining question concerned exploitation and the information that actually escaped. The stories expose two sides of the same market. A platform buys security expertise to strengthen its enterprise promise, while an attacker exploits trust in a small automation component that teams installed and stopped noticing. Inventories must cover action versions, workflow permissions, and secret paths as well as major cloud vendors.

The United Kingdom's post-quantum roadmap for critical infrastructure adds a longer horizon. Quantum computing threatens schemes based on calculations being impractical for conventional machines, while transport, payment, and government systems cannot change algorithms overnight. The response is a calendar for moving the entire infrastructure to new algorithms. Protection depends on the whole chain and its ability to update before risk becomes an incident. Migration starts before a capable quantum machine exists: organizations locate cryptography in code and devices, test replacement paths, and plan a period of interoperability. An algorithm embedded in hardware or a partner protocol cannot be fixed with one library update. The long schedule reflects infrastructure coupling, not a lack of urgency.

A specialist holding several full-time jobs reportedly ran a hidden outsourcing business: a relative attended meetings, others completed tasks, and the organizer found roles. The group earned about 800,000 dollars annually, leaving roughly half a million with its founder. The hosts ask why he did not sell the service openly. A full-time employee is paid for immersion and team participation, not only throughput; disguising contractors captures that premium without the promised relationship. Productivity cannot be separated from the contract. The customer expects availability, confidentiality, accumulated context, and personal accountability from a named employee, while the hidden team optimizes utilization and task flow. Delegation is not the problem; selling one relationship and delivering another is.

Engineering pay also separates into local firms, global Big Tech, and a small tier of funds building trading systems. Fund output maps directly to money, so salary and cash bonuses make up most of the package, while one faulty deployment can destroy the business. Another path appears when a former OpenAI researcher starts a materials-science company with OpenAI's backing. Models help with forward and inverse problems such as finding molecules with target properties, but laboratory evidence, clinical trials, and patent economics remain. In both examples, unusually high value comes from proximity to a scarce, measurable result rather than a fashionable title. A financial engineer affects trading returns; a scientist changes the speed of selecting candidates for physical experiments. A tighter link raises both potential reward and the rigor required around failure.

Vibe coding extends into design when Cursor and Figma turn text into an interface; the pattern also reaches testing, operations, and product management. Yet downloaded models, rules, and generated fragments are dependencies of uncertain origin. The attacks discussed could steal wallets or introduce increasingly harmful code after reviewers ignored early vulnerabilities. A benign model promises functioning code, not dependable code, while advertising a vibe-coded product may invite attackers to test an easy target. The new attack surface appears before generated software runs: an instruction, model, or extension may already have permission to read a repository and environment. Reviewing the final diff is therefore insufficient. Teams need provenance checks, least privilege, secret isolation, and a record of the actions taken on the path to the result.

Reports that DeepSeek employees restricted travel from China move the issue to the state level; whether the action was voluntary remains unclear. The reaction shows a frontier AI team treated as a strategic asset. Tim Berners-Lee's question—whom should AI serve?—exposes the economic side. Foundation models require capital, energy, and infrastructure held by large companies. Without access and accountability, returns may concentrate with compute owners and widen the divide around participation. Control over people, chips, and data becomes one policy because a model cannot be separated from the conditions of its creation and operation. Users therefore need to evaluate access rules, data portability, and the ability to switch providers alongside answer quality. Technical efficiency does not answer how power is distributed.