AI Vulnerability Tsunami, Gemini 4 Carbon, Microsoft Record Revenue

Intro

Ivy: An attack that used to take a nation-state months to plan... now takes about ten seconds. And it's already happening.

Marcus: [beat] Whoa. Okay. This is Marcus.

Ivy: And this is Ivy.

Marcus: It's Thursday, October 29th, and you're listening to Broke It. We've got a lot to get through today.

Ivy: Three stories that are... deeply connected.

Marcus: The cybersecurity world is sounding the alarm on an AI-driven 'vulnerability tsunami' that collapses attack timelines down to seconds.

Ivy: And Google thinks it has the answer. They just unveiled Gemini 4 Carbon, promising huge leaps in coding and security.

Marcus: Meanwhile, as everyone else panics, Microsoft is just printing money, hitting its tenth straight quarter of record-breaking revenue.

AI Exploit Discovery Is Creating a 'Vulnerability Tsunami'

Marcus: So, let's start with that 'vulnerability tsunami.' Forbes is compiling what cybersecurity experts are seeing, and Ivy... it's grim.

Ivy: It's what I said up top. AI is being used to find and weaponize software exploits at machine speed. A manual, time-consuming process for hackers is now completely automated.

Marcus: Exactly. They're feeding massive codebases into these models and just asking, 'Where are the holes?' And the models don't just find them, they write the code to exploit them.

Ivy: The timeline is what's hard to wrap your head around. The report says 'time-to-exploit' has collapsed from weeks or days down to, in some cases, seconds.

Marcus: Seconds! A human analyst can't even finish reading the alert email before the breach is over. It's insane.

Ivy: The tsunami metaphor is spot-on. It isn't one big wave; it's thousands of smaller, automated attacks hitting all at once, overwhelming any standard defense.

Marcus: So for anyone building software—which is basically everyone—the old 'Patch Tuesday' model is just... dead. It's obsolete.

Ivy: You can't have a weekly patching cycle when you’re getting exploited within a minute.

Marcus: Which means the defense has to be AI-driven, too. It has to be autonomous systems fighting autonomous systems.

Ivy: Sounds great, until the defensive AI hallucinates and decides a friendly process is a threat, taking down your whole production environment. It's a mess.

Marcus: [sighs] There's no easy answer. But right now, attackers are moving at the speed of AI, and defenders are still moving at the speed of meetings.

Google's Gemini 4 Carbon Is Here for Your Code and Security

Ivy: Well, speaking of tools that might help—or just make things worse—Google has an announcement.

Marcus: [excited] Yes! Gemini 4 Carbon. It's the next big version of their flagship model, specifically tuned for code and security.

Ivy: Another magic bullet from a tech giant. Let me guess: It writes perfect, bug-free code and solves all our problems?

Marcus: [laughs] Not quite. But the demos are impressive. Google claims it has a much lower error rate in code generation and, more importantly, it's way better at analyzing existing code for security flaws.

Ivy: So, Google is giving us a tool to fight the 'vulnerability tsunami' that other AI tools are creating. The AI snake eats its own tail.

Marcus: Pretty much! But for developers, this is huge. Imagine having a senior security architect as a pair programmer, 24/7, instantly reviewing your work. That's the pitch.

Ivy: And the pitch to make developers even more dependent on Google's ecosystem. How much does this magic security architect cost?

Marcus: Pricing isn't public yet, it'll be part of their cloud developer tools. But the point is, the capability is here. This is a tool you need to be planning for.

Ivy: So for developers, it's another complex, powerful, and probably expensive tool you have to master just to keep up with the vulnerabilities the last tool helped create. It's a great business model.

Marcus: It's an arms race, Ivy. It has been for a while. At least now we're getting better weapons for the defensive side. I'm optimistic.

Microsoft hits 10 quarters of record-breaking revenue in a row

Ivy: Speaking of great business models... let's talk about Microsoft.

Marcus: Oh, man. The numbers are just staggering. Ten quarters in a row of record-breaking revenue, right?

Ivy: Ten quarters. Two and a half years of non-stop growth. This last quarter, they pulled in 92.3 billion dollars.

Marcus: Ninety-two billion! In three months! That's up 19 percent year-over-year. It's the GDP of a small country.

Ivy: And it's all driven by their cloud and AI services. The tsunami and the expensive lifeboats—it's all fueling this.

Marcus: You can't deny their strategy worked. They invested billions in OpenAI, crammed AI into everything from Windows to Azure, and now the money's just rolling in.

Ivy: It's working for Microsoft shareholders. Is it working for anyone else? We have a security crisis made by AI, and the 'solution' is to pay massive fees to the handful of tech giants who control the models.

Marcus: But that revenue funds the R&D for things like Microsoft's own security co-pilots. You need that kind of capital to build these foundational models. You can't do this in a garage anymore.

Ivy: So, your future—as a user, a developer, a business—is increasingly owned by Microsoft, Google, and a few others. The 'open' web is closing, fast.

Marcus: I see it as consolidation, yeah, but it’s also standardization. A platform is being built, and the platform owners get paid. That's always been true.

Ivy: A platform built on a crisis they helped create. It's a tidy, profitable loop.

Marcus: Okay, before you send me into a full-on existential spiral, let's pull this all together. [chuckles]

Ivy: Fine. AI is creating a 'vulnerability tsunami' that's swamping cybersecurity teams.

Marcus: Google is offering a potential life-raft with its new Gemini 4 Carbon model for developers.

Ivy: And Microsoft, which sells both the water and the life-rafts, just made more money than God.

Marcus: Okay, so, since it's almost Halloween, I asked an AI to generate some 'spooky tech costumes.'

Ivy: Oh no. Let me guess. 'Sexy Ethernet Cable'?

Marcus: [laughs] Close! That was on the list. Number one was 'Ghost in the Machine'—just a sheet with a QR code on it. Number two was 'Sentient Toaster.' Not sure how you'd wear that.

Ivy: I think we just found our next vulnerability tsunami. Sentient toasters. That’s all we need.

Marcus: And that's our show. Thanks for listening to Broke It.

Ivy: We'll be back tomorrow. Until then, try not to get swept away by the tsunami. Or the toasters.