Three in the morning. The CEO calls the head of IT: governments around the world are shutting down their websites, do we need to do this too? The head of IT is called Werner. He has eight people in his team, two of them install printers all day, and his hosting provider's hotline opens at 8 a.m.
Part 2 of the AI Drama double on the Vulnerability Tsunami. In Part 1 we watched the digital doors swing open. Now we walk through the door on the other side, into the IT department. AI finds the bugs faster than ever, but fixing, testing and deciding is still done by humans. And that is where the bottleneck sits.
In this episode:
☎️
"Can we keep working today?" (
00:55) — meet Werner, head of IT at a family-owned supplier with 600 people and three plants. What he can actually answer at 3 a.m., why he can't reach his hoster or his CEO, and why most heads of IT aren't even allowed to decide whether to switch the website off. Within hours, public scanners for the PHP flaw were on GitHub, not on some dark web forum.
🏦
The machine finds. The bank needs more hands. (
07:59) — Bank of America's CEO Brian Moynihan told CNBC the bank brought in about 1,000 external contractors to work through fixes, on top of its existing teams. And Werner? He might get three more developers in nine to twelve months, at local salaries.
📥
The inbox is not the repair (
12:17) — a code landscape the size of France, and you're looking for one toxic pen. Libraries, staging, and Susie, who looks after a library in the evening while Werner calls three times about the PHP patch. AI brings crazy visibility, and IT departments aren't built for it.
🩻
Who gets to use the X-ray machine? (
17:14) — Copilot in this context is your grandmother in 2026 saying black-and-white TV is incredible. Why you need an agent on the command line, not a chat window. Data protection, IT security, the works council and procurement all say no, and your developers already use the tools on private accounts. Plus Stack Overflow and Bitkom.
🧪
A good fix proposal is not a safe change (
23:08) — the AI finds a weakness in the customer portal and wants to change twelve lines. Then come tests, staging, new bugs and a business in the middle of a big tender. The bottleneck isn't electronic, it's human.
🏚️
"Herbert's father built it. Please don't touch it." (
25:54) — legacy code with knowledge nobody wrote down: always wait half an hour, because the machine needs to warm up. The US government's own audits found critical systems on decades-old languages like COBOL. AI will find the holes in your old systems. Fixing them is another story.
📋
Approved, governed, company accounts (
31:01) — start hiring developers now, approve one tool for everybody (yes, the secretary too), use enterprise licences instead of private credit cards, and build your rules into a skill, not a slide deck. In the end, everybody is accountable for cybersecurity. Then the full song.
🧵 The thread — finding is no longer the bottleneck. Reviewing, deciding and changing is. Whoever sets up tools, rules and accountability now will get faster. Part 1 (#136) explains how the doors swung open.
This week, turn "should we use AI in IT?" into a project: approve one tool on company accounts, write the rules into a skill, and let it look at one system.
Corrections to the recording:
• Anthropic's disclosure dashboard (as of 2 October) lists 6,157 findings submitted to open-source projects, with known fixes for 516 of them. Not every finding is a confirmed vulnerability.
• Google's model is called Gemini 4 Argon; OpenAI's frontier model is GPT-6.1 Sol.
• The JPMorgan figure is secondary reporting, not an original interview, as said on air.
Sources: CNBC (14 Oct 2026, Brian Moynihan, Bank of America); TechRadar/Yahoo (15 Oct 2026, Jamie Dimon, reported); red.anthropic.com disclosure dashboard (as of 2 Oct 2026); Stack Overflow Developer Survey 2026 (6 Oct 2026); Bitkom (14 Sep 2026); US GAO-25-107795 (Jul 2025); Jason D. Clinton on X (22 Oct 2026). Disclosure: Malcolm is an Anthropic Claude Ambassador.
📱 Ping Malcolm on WhatsApp/Telegram/Signal: +43 676 6144 904
The AI Cookbook Show — AI for humans, not robots. Stay curious.