Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.

Start free trial →
JL Jason Lemkin Jason Lemkin Founder of SaaStr, a community and media platform for B2B software founders, and managing director of SaaStr Fund; he previously co-founded EchoSign, acquired b...

“Everyone's trying to steal API keys for inference. They're all trying to steal Anthropic and OpenAI keys, with massive swarms of bots. I didn't even know my spending limit was set at $100,000 by default. These crime syndicates steal the keys, scrub them, and sell cheap inference, and they can spend that $100,000 in seconds. It's the most lucrative criminal trade you can do right now. This is better than snatching Rolexes off someone's wrist in London. This is the crime of the year.”

The Twenty Minute VC (20VC): Venture Capital | Startup Funding | The Pitch · Startups & Venture · November 2026

“Everyone's trying to steal API keys for inference. They're all trying to steal Anthropic and OpenAI keys, with massive swarms of bots. I didn't even know my spending limit was set at $100,000 by default. These crime syndicates steal the keys, scrub them, and sell cheap inference, and they can spend that $100,000 in seconds. It's the most lucrative criminal trade you can do right now. This is better than snatching Rolexes off someone's wrist in London. This is the crime of the year.” — Jason Lemkin, The Twenty Minute VC (20VC): Venture Capital | Startup Funding | The Pitch

Context

The hosts were discussing Fireworks AI, which has had two security breaches in 30 days. Jason says the cause is a wave of attacks aimed at stealing frontier-model API keys, made very profitable by high default spend caps.

Transcript

The Twenty Minute VC (20VC): Venture Capital | Startup Funding | The Pitch Around 40:10 into the episode
Rory O'Driscoll

…Revolut, even though we call it a bank, it's mainly money movement. It doesn't do a ton of lending, but over the next 10, 20 years, all those customers who are 19 to 25 today are just going to get older. They're going to want mortgages. They're well positioned to be the biggest bank in Europe.

Harry Stebbings

…Do not let him leave the building. I want him near no roads, cars, any moving objects. Okay, Jason, you mentioned fireworks and the security incident there. Do you want to touch on that? Or we can touch on the security MA because CrowdStrike and Palo Alto have been making it. Well, I think the

Jason Lemkin

fireworks thing is interesting from a security perspective. It's niche, but fireworks has had two major breaches this month or in the last 30 days. It's pretty bad. Two things that are interesting to me. One is that everyone's trying to steal API keys for inference. They're all trying to steal Anthropic and OpenAI keys and they have massive swarms of bots and everyone's been hit by this, right? Railway was hit by this. North Zone or Northgate, the other competitor is hit by this. They've been hit by this. And the genesis of this is trying to steal any Anthropic or OpenAI tokens you can. And I, as an individual user on Ultra on Claude, my spending, I didn't even know it was set at $100,000 by default. So if someone stole mine because it was on fireworks and eval, they could have charged $100,000 in minutes. That's what they do. These crime syndicates steal these, they scrub it, you can get cheap inference, and there's so much demand for it, as we're talking about, right? They can spend that $100,000 in seconds. It's gone. And that's what happened. And Fireworks was hit twice. Everybody's been hit. And any way you can get inside of someone's infra and take these keys, people are going to do it. It's the most lucrative criminal trade you can do right now, right? This…

Harry Stebbings

That was point one. Was there a second point?

Jason Lemkin

Oh, just that it's going to happen to everybody, man. Listen, fireworks is not that old of a company, right? So maybe as embarrassing it is their SecOps and DevOps teams a little bit immature, right? I guarantee you it's better than 99% of SaaS companies that just laid off their whole SecOps team…

Harry Stebbings

Wow.

Speaker names come from our own diarization. The position is estimated from where the line sits in the episode.

More from The Twenty Minute VC (20VC): Venture Capital | Startup Funding | The Pitch