Craig Peterson - Secure Your Business, Your Privacy, and Save Your Sanity

Anthropic has released an AI model built specifically for cybersecurity work, and it's already turning up major, remotely-exploitable vulnerabilities in every operating system researchers have pointed it at — Linux, BSD-based systems, and Windows alike. Craig's read: this kicks off roughly a year, maybe longer, of an arms race. Vendors patch what the AI finds; attackers reverse-engineer those same patches to hit anyone who hasn't applied them yet.

The part people miss, Craig says, is that Windows Update only covers Windows itself — not the other software sitting on the same computer. That's the gap his newsletter is built to close, and it's also the idea behind a new tool he's building called Assure, which checks a computer against whatever attacks are actively happening right now, rather than waiting for a scheduled patch cycle.

Also in this segment:

• Apple bringing on a new executive to lead its AI push, and why Craig thinks Apple's strategy of leasing AI from OpenAI and Anthropic — rather than building its own — may turn out to be the smart move
• Microsoft's heavier, more tightly integrated bet on OpenAI, and the backlash it's drawn from users
• Birthday banter about the exact cutoff between Baby Boomer and Gen X, and some good-natured ribbing about Craig's eight kids

Free newsletter and Insider Session announcements: CraigPeterson.com

Maine has passed a first-in-the-nation ban on data centers, now awaiting the governor's signature. The concerns behind it are real and Craig says so plainly: electricity prices do go up. What he disputes is the shape of the response.

His industry view is that it barely dents the AI business. These companies save money siting in cold places — it is why data centers went to Iceland and Greenland — but with current high-speed networks they do not need to be near anyone. If most states did this it would matter; Maine alone declining mostly means Maine declining. He puts the job loss in the hundreds, and notes what the state is turning down given its geography, cold water and cold air, and its existing technology base.

The interesting part is his alternative. Craig has been a proponent of new nuclear for over a decade, and the argument he makes is not the one people expect. Plants of this generation now in service are producing more power than they consume and feeding the surplus back to the grid — so a data center in Maine with its own reactor could mean more jobs and electricity costs going down rather than up. He is careful that the technology isn't quite there yet, and honest about the alternative that has actually been built: natural gas turbines, which are why neighbourhoods near several existing data centers have been complaining loudly. Matt frames the choice as banning a thing because it has problems versus solving the problems, and Craig lands on premature — require them to generate their own power instead.

The strongest technical item is elsewhere. Anthropic has released a model trained specifically on cybersecurity problems, and it is genuinely expensive to run — roughly $250 per million output tokens against about $15 for a normal model. What it bought is the point: it has already found thousands of significant bugs in operating systems, including OpenBSD. Craig has run OpenBSD himself for years precisely because it is considered exceptionally well-built, and the bugs found there allow full access to everything. Being carefully written by good people, reviewed for decades, was not sufficient.

Also in this segment:

• Grok still generating sexual deepfakes despite the guardrails, per NBC News. Craig's explanation of why the fix isn't coming soon is about compute, not intent: catching it requires a second model policing the first, and nobody has the spare capacity — Sora was cancelled for exactly that reason, and Anthropic is straining to serve the users who left OpenAI
• Roughly 60% of the data on some networks is now slop, in an internet that once had Netflix alone at 60% of its traffic
• Air conditioning as underrated infrastructure — it made the American South habitable at scale, and it began as a medical treatment. Craig runs through what heat still exacerbates: cardiovascular disease, asthma and COPD, multiple sclerosis, chronic kidney disease

Free newsletter: CraigPeterson.com

Maine has passed a first-in-the-nation ban on data centers, now awaiting the governor's signature. The concerns behind it are real and Craig says so plainly: electricity prices do go up. What he disputes is the shape of the response.

His industry view is that it barely dents the AI business. These companies save money siting in cold places — it is why data centers went to Iceland and Greenland — but with current high-speed networks they do not need to be near anyone. If most states did this it would matter; Maine alone declining mostly means Maine declining. He puts the job loss in the hundreds, and notes what the state is turning down given its geography, cold water and cold air, and its existing technology base.

The interesting part is his alternative. Craig has been a proponent of new nuclear for over a decade, and the argument he makes is not the one people expect. Plants of this generation now in service are producing more power than they consume and feeding the surplus back to the grid — so a data center in Maine with its own reactor could mean more jobs and electricity costs going down rather than up. He is careful that the technology isn't quite there yet, and honest about the alternative that has actually been built: natural gas turbines, which are why neighbourhoods near several existing data centers have been complaining loudly. Matt frames the choice as banning a thing because it has problems versus solving the problems, and Craig lands on premature — require them to generate their own power instead.

The strongest technical item is elsewhere. Anthropic has released a model trained specifically on cybersecurity problems, and it is genuinely expensive to run — roughly $250 per million output tokens against about $15 for a normal model. What it bought is the point: it has already found thousands of significant bugs in operating systems, including OpenBSD. Craig has run OpenBSD himself for years precisely because it is considered exceptionally well-built, and the bugs found there allow full access to everything. Being carefully written by good people, reviewed for decades, was not sufficient.

Also in this segment:

• Grok still generating sexual deepfakes despite the guardrails, per NBC News. Craig's explanation of why the fix isn't coming soon is about compute, not intent: catching it requires a second model policing the first, and nobody has the spare capacity — Sora was cancelled for exactly that reason, and Anthropic is straining to serve the users who left OpenAI
• Roughly 60% of the data on some networks is now slop, in an internet that once had Netflix alone at 60% of its traffic
• Air conditioning as underrated infrastructure — it made the American South habitable at scale, and it began as a medical treatment. Craig runs through what heat still exacerbates: cardiovascular disease, asthma and COPD, multiple sclerosis, chronic kidney disease

Free newsletter: CraigPeterson.com

Craig walks through just how international the Artemis 2 mission really was. The European Space Agency, through Airbus, built the service module — the piece carrying the engines and life support. Japan contributed environmental control systems, other life-support hardware, and the batteries for the Gateway station. The UAE's Mohammed bin Rashid Space Centre — the team behind the Hope probe now studying the Martian atmosphere — helped provide higher-resolution radar and laser data on the Moon itself.

For Craig, the real headline isn't the hardware; it's that so many countries and people worked closely together on something this hard, at a moment when trust between groups at home feels harder to come by than it used to.

Also in this segment:

• An extended conversation on growing up in Quebec's French-language school system, Bill 101's restrictions on English in business, and Craig's own move to the United States in the 1970s
• A wide-ranging discussion of Canadian health care wait times, immigration policy, and Canadian media funding — flagged below for Craig's review before publishing
• His son-in-law's green card frustrations at the border, and a story from a water taxi in Venice about meeting two Iranian graduate students
• This week's newsletter item on a Chinese breach of an FBI system used to monitor wiretaps

Free newsletter and Insider Session announcements: CraigPeterson.com

Brockton Hospital was hacked, and Boston television stations spent the morning doing live shots out front. Jim reminds Craig that he called this years ago, predicting health care would become the next big hacking target. Craig lays out why: a hospital licensed for roughly 230 beds is sitting on tens of thousands of patient records, and attackers going after health data usually want one of three things — a ransom payment, the data itself for fraud, or simply chaos.

The mechanism Craig comes back to is a business decision, not a technical one: a client tried to save money by hiring a single full-time IT employee instead of outsourcing. It backfired. IT coverage needs at least two people, because someone always needs to be reachable, and roughly 30 percent of an IT person's time goes to ongoing training just to keep pace with attackers who are constantly adopting new tools. The client's own bookkeeper concluded they'd actually been undercharged for outsourced support all along.

Also in this segment:

• A recommendation for the medical drama "The Pit," passed along by longtime listener Cheddar, who's tuning in from Paris on the iHeartRadio app
• Microsoft and Nvidia using AI to speed up nuclear plant permitting — paperwork that used to take ten to twenty years, now sped along by AI reviewing submissions and documentation
• Elbit Systems of Merrimack, New Hampshire, the military contractor behind equipment used in the recent rescue of captured airmen
• A quick aside on where astronaut space suits are made

Free newsletter and Insider Session announcements: CraigPeterson.com

This one is a departure from the usual security conversation. Artemis II launches the afternoon this segment aired — a crew around and beyond the moon, not landing, the way Apollo 8 preceded Apollo 11. It is the first time humans have left low Earth orbit since the moon missions, and the furthest any of us have ever gone. Craig's advice at the close: download the NASA app, or go straight to YouTube, and watch it.

He watched the original landing live on television, and remembers the morning after as the first time he ever saw colour in a newspaper — a photograph of the astronauts. His case for why this matters is about the kind of work it is. This is pure science, and pure science reliably ends up helping people whether or not anyone can say in advance how. He points to a structural problem behind that: big businesses no longer do it. The closest thing left in the private sector is pharmaceuticals. Everyone else relies on government for the fundamental research and on small startups for new ideas, which they then acquire.

The best technical passage is about Elon Musk's proposal to put data centers in orbit. Craig grants the appeal immediately — unobstructed solar power, potentially 24/7. Then he names the problem nobody expects: in space the hard part is getting rid of heat. There is no atmosphere to carry it away, and the water we currently use to cool data centers on Earth isn't an option, so the design ends up dominated by enormous radiating surfaces — which means still more of the sky obscured.

That connects to the risk he thinks is under-appreciated. One satellite going wrong in its orbit is enough to start a cascade, and the figure he cites is that the right few collisions could destroy 80% of everything in orbit. GPS stops working. Communications break. The more we put up there, the worse the exposure gets.

Also in this segment:

• What is actually on the moon worth going for: helium-3, and water at the South Pole — between them the ingredients to sustain a settlement, plus manufacturing advantages in low gravity, particularly for medications
• Why Musk frames Mars as insurance for the species, and that his stated worry is the same one shared by most of the people running AI companies
• Matt's challenge — why spend billions up there with homelessness, addiction and housing problems down here — and Craig's answer through JFK's 1963 commitment, and what it pulled out of an entire country
• The Saturn V was designed with Mars in mind. It never happened

Free newsletter: CraigPeterson.com

FBI Director Kash Patel's personal Gmail account was compromised — reportedly by Iran — and attackers pulled emails and photos out of it before it was discovered. Craig uses the case to explain why seniors, not officials, are now the number one target of AI-driven fraud: retirement-account fraud attempts are up more than 1,200 percent. The account itself isn't the prize. It's the key to everything downstream.

Here's the mechanism: once someone controls your email, they can see your bank's statements landing in your inbox, then go to your bank's site, enter your email, and click "forgot password." If your only second factor is a text message, that's hackable too — attackers call your cell carrier, pose as you, and get your number transferred to their phone. Craig's fix is two steps: switch to an app-based authenticator like Duo or Google Authenticator instead of SMS, and call your own cell carrier to set a password or passcode on your account so nobody can talk their way into a transfer.

Also in this segment:

• A family-photo detour into Craig's eight kids and some good-natured ribbing about "handsome young Craig"
• How military bombs actually crack solid granite — not by hitting a crack, but by drilling into solid rock and letting a second charge follow the first, cracking it from the inside
• UnitedHealth Group's exposure of 3.4 million medical records in a single week, and why that record set fuels Medicare and hospice fraud, not just identity theft
• Good news on the nuclear front: ten more small, factory-built reactors coming online, and Meta buying enough nuclear power to run five million homes

Free newsletter and Insider Session announcements: CraigPeterson.com

OpenAI is discontinuing the products built on Sora, its video generation model. Matt's disbelief is the right reaction: five or six months ago Sora was all over social media, and in December OpenAI signed a billion-dollar partnership with Disney around it. Disney has now cancelled the entire agreement. You sign a deal in December, a major piece of it is withdrawn, and the partner walks.

Craig's read is that the whole category is being commoditised faster than anyone can build a position in it. The price of these models is falling literally by the day — he cites roughly a fivefold improvement for the same money on some large language models — and video generation is a pig for resources compared to everything else you could spend those resources on. If the industry is turning into a public utility, the survivors are the ones who pick a niche and defend it. His guess is that OpenAI is retreating from video to plant everything on the agentic bet: tie into every part of your life and handle it for you, from tomorrow's calendar through medical diagnoses.

Asked whether OpenAI will still matter in five years, Craig's answer is "probably not," and his supporting case is Apple. Apple did not invent the MP3 player or the mobile telephone. It arrived afterwards and won on a well-integrated ecosystem. First-mover advantage is real but it is not durable, and someone else steps in. He notes the split now visible in practice — OpenAI leaning toward military and government work, Anthropic toward business and civilian, and the professionals who work with these tools daily having moved to Anthropic almost entirely.

The financial picture is the sharpest part. OpenAI is running roughly $20 billion in annual recurring revenue and still not turning a profit. Craig's point is that the same speed that built the industry faster than any industry in history is now the thing driving it into the ground, and there is no comfortable exit: America once had something like 500 car makers and consolidation solved it, but you cannot buy an AI company and simply bolt it onto your product line. The way out is cutting the least profitable things and focusing — which is precisely what killing Sora looks like.

Also in this segment:

• New figures on AI and productivity from the Wall Street Journal, extending what Craig reported a month earlier. The old number was that 80% of businesses with a serious AI initiative failed at it. The new angle measures time saved, and finds that almost all businesses using AI have ended up with employees working more — it added to the workload
• Politicians discovering AI as a topic, and Craig's question for Matt: how long before the moderator asking the questions at a debate is itself an AI?
• Craig's wife, reading the news that morning, asking why OpenAI was cancelling its "Soros project"

Free newsletter: CraigPeterson.com

Ransomware crews have been breaking into Cisco firewalls since January, Craig told Jim, using a vulnerability that was fixed months earlier. The fix was published. The door stayed open because nobody installed it. Craig runs Cisco gear in his own business and still calls Cisco the 800-pound gorilla of network security — which is the point: the equipment was not the weak part.

That is the same gap Craig keeps coming back to. A patch that exists and a patch that is installed are different things, and the distance between them is measured in months. He paired it with a bug in Chrome that lets an attacker onto a machine with no click at all — no attachment, no link, nothing the user does wrong — where the patch is already available and the only remaining question is whether anyone applied it.

The mechanism worth repeating: attackers have moved upstream into the open-source libraries that almost every modern program is built from. Nobody writes software from scratch anymore — you pull in a library that handles credit cards, or customer names, and it does that job for you. So the attackers poison the library itself, and the businesses that build on it ship the compromise without ever touching a line of the bad code.

Also in this segment:

• Medical device maker Stryker, whose products reach roughly 150 million Americans, breached by a group that posed as ordinary financially motivated criminals, later disclosed as part of Iran's military — and which wiped thousands of machines rather than ransoming them. Even with backups, restoring at that scale runs to weeks
• Craig's own network fields about six million probes a day — a probe being nothing more than someone checking whether your defenses are current
• North Korean operatives getting hired as remote tech workers, drawing a salary while quietly taking company IP
• French municipal elections, European politics, a detour into Quebec-versus-Ontario bilingual packaging, and Craig's years living in southern France

Craig's newsletter this week has the full rundown, including what to watch for when hiring remote tech workers.

Free newsletter and Insider Session announcements: CraigPeterson.com

Craig opens on a health care breach from his newsletter, and the detail that bothers him is not the size of it — it is the year. HIPAA requires continuous monitoring of that data, specifically so somebody notices when it walks out the door. This organisation took a year to notice. Had it been a small doctor's office, Craig points out, the doctors themselves would be looking at fines and potentially jail. This was a huge corporation, so his expectation is that nothing happens at all. Millions of records, lost through negligence, against regulations written precisely to prevent it.

He sets a second story directly against it. A client of his runs a pizza shop. Some card information appeared to have been stolen, the payment card industry audited them, and the business simply lost the ability to take credit cards until Craig's team came in and cleaned up the mess. A small operation gets its livelihood switched off in days; the large one is still explaining itself a year late. Craig's conclusion is unsentimental — until heads actually roll, none of this improves.

The number from his own network is worth writing down. Craig monitors his own and his customers' networks closely, and his business network is currently absorbing six million probes a day, essentially all of which he is blocking. He noticed the increase begin before the current conflict broke out. He is careful about attribution — these things are genuinely hard to trace, and taking credit is not the same as having done it — but he is clear that something changed and that he can see it in his own logs.

His answer to what actually stops it is deliberately unglamorous, and it is the same answer every week: patch your machines and monitor your logs. The organisations in the news were not doing either, and for most of them it is not optional — it is required by law, down to the smallest practice.

Also in this segment:

• The SEC and CFTC finally moving to define which digital assets are securities, roughly sixteen years after Bitcoin. Craig owns none of it and explains why: buying a stock gets you hard assets and people working to improve a company, while buying crypto gets you the hope that someone else buys it next
• Thousands of cryptocurrencies have launched and most have gone to zero, taking everything their holders put in
• Virtual game items are already taxed by the IRS, which gives regulators more precedent here than people assume
• NVIDIA's pivot, and the question Craig leaves hanging: Google, Amazon, Microsoft and Apple all now design their own AI silicon, none of it dependent on NVIDIA — so why would any of them keep paying NVIDIA's markup for chips they can have made themselves?

Free newsletter: CraigPeterson.com