Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.

Start free trial →
IL Ian Landsman Ian Landsman Founder of HelpSpot, a bootstrapped help desk software company he has run since 2005 with no outside funding.

“We're only a short time away from AI being cheap enough, and all the stuff being cheap enough, to just pound everything fully all the time: go crawl around, try to post every form, put weird stuff in the forms, try to get in somehow. You're just going to be under constant attack. And your vibe-coded app that nobody's ever security tested, that you built to replace Less Annoying CRM, is going to get hacked and ransomwared. And there's going to be 10 news stories about this.”

Mostly Technical · Bootstrapped & Indie SaaS · November 2026

“We're only a short time away from AI being cheap enough, and all the stuff being cheap enough, to just pound everything fully all the time: go crawl around, try to post every form, put weird stuff in the forms, try to get in somehow. You're just going to be under constant attack. And your vibe-coded app that nobody's ever security tested, that you built to replace Less Annoying CRM, is going to get hacked and ransomwared. And there's going to be 10 news stories about this.” — Ian Landsman, Mostly Technical

Context

The hosts were discussing how much of the web is already being scanned for easy exploits. Ian predicts what happens when AI makes broad automated attacks cheap, and ties it to companies replacing SaaS with homegrown software.

Transcript

Mostly Technical Around 1:10:33 into the episode
Ian Landsman

all those things. So I just get a huge list. Here's a million sites. Crawl them. Just crawl them for like all kinds of weaknesses that are common in web apps. And I see this in

Aaron Francis

the Laravel Cloud logs. But like blocked WP admin, blocked live wire/slash upload, blocked all of this stuff. Yep.

Ian Landsman

And today they just still go after those like the easy exploits, right? Like, okay, WordPress, you know, it's got a million easy exploits. We're just going to go out there and pound everything for WordPress fine. But we're only a short time away from AI being cheap enough and all the stuff being cheap enough to just like pound everything fully all the time, like go crawl around, try to post every form, try to do, put weird shit in the forms, try to get in somehow. Like that's all just coming where you're just going to be under constant attack. And your vibe-coded app that nobody's ever security tested, nobody's ever looked at a second time after you vibe coded to replace less annoying CRM is going to get hacked and they're going to get ransomwared. And there's going to be 10 news stories about this. And that's, they were already getting ransomware before. But anyway, I good job with your batting down the hatches. I'm also batting down the hatches. This is, I don't love saying this because of who we are in this podcast, but the local development, very bad. I don't like the local development. I got the local development, unfortunately. I don't want anything but a browser really at all running on a computer at this point. I don't want to run any servers…

Aaron Francis

It is bad. It's already bad.

Ian Landsman

And it's going to get worse.

Aaron Francis

Railway, North Flank, Trigger.dev, Ubuntu, Chrome. And that's in like the past three days. That's over the weekend. Yeah.

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

More from Mostly Technical