Connect your Claude, Codex or OpenClaw for full transcripts on millions of podcasts. Two week free trial, cancel anytime.
Start free trial →The Twenty Minute VC (20VC): Venture Capital | Startup Funding | The Pitch · Startups & Venture · November 2026
The hosts were discussing Fireworks AI, which has had two security breaches in 30 days. Jason says the cause is a wave of attacks aimed at stealing frontier-model API keys, made very profitable by high default spend caps.
…Revolut, even though we call it a bank, it's mainly money movement. It doesn't do a ton of lending, but over the next 10, 20 years, all those customers who are 19 to 25 today are just going to get older. They're going to want mortgages. They're well positioned to be the biggest bank in Europe.
…Do not let him leave the building. I want him near no roads, cars, any moving objects. Okay, Jason, you mentioned fireworks and the security incident there. Do you want to touch on that? Or we can touch on the security MA because CrowdStrike and Palo Alto have been making it. Well, I think the
fireworks thing is interesting from a security perspective. It's niche, but fireworks has had two major breaches this month or in the last 30 days. It's pretty bad. Two things that are interesting to me. One is that everyone's trying to steal API keys for inference. They're all trying to steal Anthropic and OpenAI keys and they have massive swarms of bots and everyone's been hit by this, right? Railway was hit by this. North Zone or Northgate, the other competitor is hit by this. They've been hit by this. And the genesis of this is trying to steal any Anthropic or OpenAI tokens you can. And I, as an individual user on Ultra on Claude, my spending, I didn't even know it was set at $100,000 by default. So if someone stole mine because it was on fireworks and eval, they could have charged $100,000 in minutes. That's what they do. These crime syndicates steal these, they scrub it, you can get cheap inference, and there's so much demand for it, as we're talking about, right? They can spend that $100,000 in seconds. It's gone. And that's what happened. And Fireworks was hit twice. Everybody's been hit. And any way you can get inside of someone's infra and take these keys, people are going to do it. It's the most lucrative criminal trade you can do right now, right? This…
That was point one. Was there a second point?
Oh, just that it's going to happen to everybody, man. Listen, fireworks is not that old of a company, right? So maybe as embarrassing it is their SecOps and DevOps teams a little bit immature, right? I guarantee you it's better than 99% of SaaS companies that just laid off their whole SecOps team…
Wow.