Latest / Tech Talks With Kinsoft / Last Week in Tech – Copilot's Billing Backlash, SoftBank's €75B France Bet, and the Klue OAuth Supply-Chain Hit
Transcript
- 0:00So today, an AI coding assistant just build a
- 0:02small startup like $800 just for processing math.
- 0:06Yeah, casual $800. Right. While at the same time,
- 0:09a 75 billion euro power grid expansion is literally
- 0:13being mapped out in France just to keep that
- 0:16kind of math running. It's massive. And on top
- 0:19of all that, Wikipedia volunteers are actually
- 0:21striking because human workers are being laid
- 0:24off to pay for it all. So, welcome to the Deep
- 0:27Dive. Glad to be here. We are so glad to have
- 0:30you with us today. We've got a stack of sources
- 0:32to go through, anchored by a really revealing
- 0:34briefing from Kinsoft Tech Talks. It's dated
- 0:37June 8th, 2026. Right. The Kinsoft briefing.
- 0:40Yeah. And our mission today for this deep dive
- 0:43is to look at the severe structural reality check
- 0:47that is hitting the tech industry right now because
- 0:49we are definitely moving past that honeymoon
- 0:51phase of the seamless AI -powered upgrade. Oh,
- 0:54the honeymoon is definitely over. Totally over.
- 0:56We're entering this era of steep, multifaceted
- 1:00consequences. So we're going to track the shock.
- 1:03of metered ai billing models yeah the actual
- 1:06physical limits of global infrastructure and
- 1:08and this is a big one how our rush to integrate
- 1:11all these powerful tools has created just catastrophic
- 1:14blind spots in corporate security it's a really
- 1:17critical set of sources to synthesize i mean
- 1:20because it forces us to look at the hidden causality
- 1:23of the tools we use every single day right because
- 1:26we tend to treat software as you know infinite
- 1:29and weightless like it's just magic in the cloud
- 1:31exactly magic but But what this briefing exposes
- 1:34is that we are slamming into hard physical and
- 1:36economic limits. The entire tech ecosystem is
- 1:39currently scrambling to re -architect itself
- 1:42before those limits completely break the current
- 1:45business models. Yeah. So let's start with that
- 1:48economic limit, which really hits right at the
- 1:49developer's wallet. Where it hurts. Exactly.
- 1:52The Kinsoft briefing details what happened on
- 1:54June 1st. So GitHub changed the billing structure
- 1:57for its AI coding assistant, Kotilot, for a really
- 2:00long time. This was just a flat monthly subscription.
- 2:04Twenty nine dollars. Nice and easy. Super predictable.
- 2:07Right. You put it on the corporate card and you
- 2:09just forget about it. Yeah. But then they flipped
- 2:11it to a token based pay as you use billing model.
- 2:14Yeah. And I mean, the reaction was explosive.
- 2:17Oh, people were furious. Yeah, because developers
- 2:20were opening their dashboards expecting that
- 2:23standard twenty nine dollar charge. And instead
- 2:25they're seeing. bills for hundreds of dollars
- 2:28a month. Yeah, which fundamentally shatters the
- 2:31financial predictability that, honestly, the
- 2:34entire software as a service model has been built
- 2:36on for the last 20 years. Right. Okay, let's
- 2:39unpack this. Because, you know, if you're listening,
- 2:41think about it like this. It's like going to
- 2:43your favorite all -you -can -eat buffet. Okay,
- 2:46I like buffets. Right. You pay your 20 bucks
- 2:48at the door, you eat as much as you want. But
- 2:50suddenly management decides to change the rules
- 2:53and now they're charging you per individual bite
- 2:55you take. That is a fast way to ruin a dinner.
- 2:58Exactly. How are everyday businesses supposed
- 3:00to budget for these tools when AI powered suddenly
- 3:04means it's metered? Well, when you shift from
- 3:07a flat sauce license to metered token billing,
- 3:11you are exposing the end user to the raw fluctuating
- 3:16cost of compute. But I want to push back on that
- 3:18justification a little bit because I get it.
- 3:20AI inference is expensive. Sure. Right. But we've
- 3:23had cloud computing and massive database lookups
- 3:26for. decades, right? And we didn't suddenly start
- 3:29billing users per keystroke. So why does generating
- 3:32a line of code in an IDE suddenly require like
- 3:35a taxi meter? That's a great question. It's because
- 3:38the mechanics of inference are entirely different
- 3:40from traditional compute. And that's the core
- 3:42issue GitHub is actually trying to offset here.
- 3:44Okay. How so? So when you execute a traditional
- 3:47database query, the server locates the data,
- 3:49retrieves it, and the transaction is done. Super
- 3:51efficient. Highly efficient. Yeah. But when an
- 3:54AI assistant generates code, it isn't just...
- 3:56looking up an answer in a filing cabinet, it
- 3:58is continuously processing tokens. And tokens
- 4:01are what, like fragments of words? Exactly. Fragments
- 4:04of words or bits of code. It's processing those
- 4:07through billions of parameters. And to do that,
- 4:10the model has to be loaded into the incredibly
- 4:12fast, highly constrained VRAM of specialized
- 4:16GPUs. Right. So it's monopolizing hardware in
- 4:20a way a standard web request never does. Exactly.
- 4:22For the entire duration that the AI is streaming
- 4:25that code back to your screen, it is locking
- 4:27up prime real estate on a GPU cluster somewhere.
- 4:31Wow. It's performing continuous matrix multiplication.
- 4:34And that requires an amazing... So when GitHub
- 4:38was charging just $29 a month. They were heavily
- 4:42subsidizing the variable cost of that math. I
- 4:44mean, it was a loss leader to get developers
- 4:46addicted to the workflow. OK, that makes sense.
- 4:49But now that the tool is deeply embedded in enterprise
- 4:51pipelines, you know, they're passing the actual
- 4:53literal cost of hardware utilization directly
- 4:56onto the user. Which creates a massive operational
- 4:58nightmare for anyone running a business. Oh,
- 5:00absolutely. I mean, if I'm a CTO at a startup
- 5:03and AI powered. Suddenly means I have this uncapped
- 5:07metered liability running in the background of
- 5:09every single developer's machine. I can't forecast
- 5:12my burn rate. You're flying blind. Yeah. Like
- 5:15one month my team is doing light bug fixes and
- 5:18the bill is 50 bucks. But the next month we have
- 5:22a massive crunch to ship a feature. The AI is
- 5:25generating massive blocks of context and suddenly
- 5:28my infrastructure bill is $1 ,000 higher. And
- 5:31that unpredictability is the exact vulnerability
- 5:33that the big tech giants are desperately trying
- 5:36to patch right now. Because they know it's going
- 5:38to scare people off. Exactly. They know metered
- 5:40billing will stall enterprise adoption. In fact,
- 5:43the Kinsoft source notes that at Microsoft's
- 5:45Build Conference, they spent an enormous amount
- 5:47of time showcasing homegrown, smaller coding
- 5:50models. Oh, interesting. Yeah, they are specifically
- 5:53designing these to be cheaper to run than the
- 5:55big name generalized state of the art models.
- 5:58But wait, are those cheaper models? actually
- 6:00any good? Well, that's the debate. Because, look,
- 6:03if I'm a developer relying on Copilot to catch
- 6:06security flaws or write really complex back -end
- 6:09logic, I don't want some lobotomized, lightweight
- 6:13AI writing my code just because Microsoft wants
- 6:16to save margins on their GPU clusters. Right.
- 6:18I mean, isn't the industry just... Offering a
- 6:21substandard product to fix a billing problem
- 6:23they created themselves. That is the multibillion
- 6:26dollar tension right now. I mean, they are aggressively
- 6:28pushing small language models or SLS. Right.
- 6:31Under the premise that you don't need a trillion
- 6:35parameter model that knows the history of the
- 6:37Roman Empire just to write a simple Python script.
- 6:40Fair point. So by training highly specialized
- 6:42narrow models, they can reduce the VRAM requirements
- 6:46and execute the inference much faster and much,
- 6:49much cheaper. But it's risky, right? You are
- 6:51absolutely right to be skeptical because the
- 6:53boundary of where a small model fails and, you
- 6:56know, hallucinates is much narrower. The industry
- 6:58is really trying to thread the needle here. They
- 7:00have to drop the compute cost so they don't bankrupt
- 7:03their users with token fees, but they can't degrade
- 7:06the product so much that users just abandon it
- 7:08completely. Right. And the reason they are so
- 7:11desperate to drop that compute cost brings us
- 7:14to the second major theme of the briefing. Because
- 7:17the scarcity that's driving these token prices
- 7:19up, it isn't just server availability. No, not
- 7:22at all. It's the physical limits of the planet's
- 7:25infrastructure. Yeah. We have to look at the
- 7:27staggering scale of capital being deployed just
- 7:29to keep this math running. So the Kinsoft briefing
- 7:33highlights this announcement from SoftBank. This
- 7:36is a huge one. It's wild. They have committed
- 7:39up to 75 billion euros to build five gigawatts
- 7:42of AI data center capacity in France. It is almost
- 7:45impossible to overstate how massive five gigawatts
- 7:48of power consumption actually is. Put that in
- 7:51perspective for us. Well, to ground that in reality,
- 7:53a typical large scale nuclear reactor generates
- 7:55about one gigawatt of power. Wait, really? One
- 7:58gigawatt per reactor. Yeah. Yes. So SoftBank
- 8:01isn't just building a standard server farm. They
- 8:04are proposing an energy footprint equivalent
- 8:06to five nuclear power plants. That is just wow.
- 8:10And it's dedicated entirely to the matrix multiplication
- 8:13required to train and run these models. Here's
- 8:16where it gets really interesting. That explains
- 8:18why they are targeting France, specifically.
- 8:21Exactly. Because if you need 5 gigawatts of continuous,
- 8:24unbroken baseline power, you can't rely entirely
- 8:28on intermittent renewables. You need the robust
- 8:31nuclear grid that France has built. You need
- 8:33that stability. Yeah, but think about the sheer
- 8:35volume of concrete, steel, cooling systems, and
- 8:39grid -level transformers required to build a
- 8:415 gigawatt footprint. It's mind bending. Yeah.
- 8:45I mean, we always talk about the cloud as if
- 8:46it's weightless. Like it's just floating up there.
- 8:48Right. But this is a 75 billion euro industrial
- 8:51megaproject. If we connect this to the bigger
- 8:54picture, it's the most aggressive mobilization
- 8:57of private capital into physical infrastructure
- 8:59we've seen in decades. Yeah. What we are witnessing
- 9:02is the collision between exponential software
- 9:05demands and linear physical reality. That's a
- 9:08great way to put it. Because you can update software
- 9:10overnight, right? But you cannot build a gigawatt
- 9:14substation overnight. Definitely not. The supply
- 9:16chains for industrial cooling, for high voltage
- 9:19transformers and for the specialized cabling
- 9:22required for these data centers, they're backlogged
- 9:25by years. So that's why the tokens are so expensive.
- 9:28Exactly. The token prices we discussed earlier
- 9:31are high precisely because this physical infrastructure
- 9:34is fundamentally bottlenecked. And while 75 billion
- 9:37euros is flowing into concrete and copper wire,
- 9:40the Kinsaw briefing contrasts that with a deeply
- 9:43sobering human. This part is really tough. It
- 9:47is. Over at Wikipedia, their volunteer editors
- 9:50actually went on strike. Yeah. And the core issue,
- 9:53they were protesting layoffs among the paid staff,
- 9:55which they blamed directly on AI driven cost
- 9:58cutting. It is a perfect distillation of the
- 10:01broader capital shift happening across the entire
- 10:03economy right now. Well, on one side of the ledger,
- 10:06you have unprecedented fortunes being poured
- 10:09into energy grids and GPU clusters. And on the
- 10:12exact opposite side, you have the human. element
- 10:14being systematically squeezed out just to free
- 10:18up the capital to buy that compute. I mean, the
- 10:20irony with Wikipedia is incredibly thick here.
- 10:23Yeah. You have a platform that represents the
- 10:25absolute pinnacle of collaborative human curated
- 10:28knowledge. The best of the Internet, really.
- 10:30Yeah. And the volunteers, people who dedicate
- 10:33their time for free are having to strike to protect
- 10:36the paid administrative roles. It's backwards.
- 10:38They're being displaced by the exact same generative
- 10:41AI models that were literally trained. on the
- 10:44free labor of those very same Wikipedia contributors.
- 10:46Yep. It feels less like an upgrade and more like
- 10:49an extraction, to be honest. That's a highly
- 10:51accurate way to frame the mechanics of what's
- 10:53happening. When an organization automates a human
- 10:56role with an AI tool, the savings rarely just
- 10:59sit in a bank account. Right. They spend it.
- 11:01They spend it immediately. That capital is almost
- 11:04instantly reallocated into purchasing more software
- 11:07licenses, more compute power, and more token
- 11:10usage. Wow. The Wikipedia strike is a clear indicator.
- 11:14that the infrastructure arms race is not happening
- 11:16in a vacuum. It is being directly subsidized
- 11:19by the restructuring of human labor. I mean,
- 11:23we are literally transferring wealth from payrolls
- 11:27to power grids. Which is a very heavy macroeconomic
- 11:30reality. But I want to bring this back down to
- 11:33the operational level for you listening right
- 11:34now, because there is an immediate... technical
- 11:37fallout to this massive AI adoption. And it's
- 11:40messy. Super messy. As organizations adopt these
- 11:43expensive tools and desperately try to squeeze
- 11:46productivity out of them to justify that, we
- 11:51wire the AI into our CRMs, our email servers,
- 11:55our cloud drives. We just want all the tools
- 11:57talking to each other. Seamless workflow. Exactly.
- 11:59But the third pillar of the Kinsoft briefing
- 12:01makes it very clear that this obsession with
- 12:03seamless integration has created a catastrophic
- 12:06security landscape. So we really need to talk
- 12:08about OAuth supply chain attacks. This is undoubtedly
- 12:11the most critical and actionable threat vector
- 12:14mentioned in the sources. The attack surface
- 12:16of the modern enterprise has completely shifted.
- 12:19OK, so anyone managing a SOSDAQ knows OAuth.
- 12:23It's that protocol that allows you to click.
- 12:25integrate with Salesforce or connect to Google
- 12:28Workspace. We all use it. It's incredibly convenient
- 12:31because it allows third -party apps to talk to
- 12:33your central databases without you having to
- 12:35hand over your actual master password. Right.
- 12:38But the briefing details a major incident with
- 12:41a sales intelligence company called Clue. Right.
- 12:43And Clue is a practically legitimate platform
- 12:45that sales teams use to aggregate data. But the
- 12:48attackers didn't breach Clue because they cared
- 12:50about Clue's internal memos or anything. No,
- 12:52they didn't care about Clue's data. They breached
- 12:55Clue to get access to the Oeth integrations that
- 12:58Clue's customers had authorized. And by hijacking
- 13:01those integrations, the attackers were able to
- 13:03siphon highly sensitive Salesforce data directly
- 13:06out of the systems of Clue's customers. And this
- 13:09requires us to look really closely at how Oeth
- 13:12scopes are actually implemented in the wild.
- 13:14Okay, bring that down for us. So when a user
- 13:16clicks allow access on one of those pop -ups,
- 13:20they are generating an authorization token. Right.
- 13:23That token dictates exactly what the third -party
- 13:26app is allowed to do. That's its scope. The fatal
- 13:29flaw here is that the industry has a really bad
- 13:31habit of blindly over -provisioning these scopes.
- 13:35Oh, like giving them too much permission? Way
- 13:37too much. A basic analytics plugin might request
- 13:40full read and write access to an entire CRM database,
- 13:44and a rushed employee will just click approve
- 13:47to get the pop -up out of the way and get back
- 13:48to work. So what does this all mean? To visualize
- 13:51the mechanism here, let's look at how hotel key
- 13:53cards work. Okay. When you check into a hotel,
- 13:56they don't give you the physical master key to
- 13:58the building, right? They program a temporary
- 14:01key card that is supposed to only open your specific
- 14:03room for three days. Right. Very limited scope.
- 14:05But what we're doing with OAuth is the equivalent
- 14:08of an employee going to the front desk, programming
- 14:11a key card that inexplicably grants permanent
- 14:13access to the penthouse, the security room, and
- 14:16the financial vault. And then handing that key
- 14:18card over to a third -party dog walker or vendor
- 14:21just because the vendor asked nicely. That's
- 14:23exactly it. If that vendor's pocket gets picked,
- 14:26the burglar doesn't have to break your windows
- 14:28or bypass your alarms. They just swipe the perfectly
- 14:31valid key card you created for them. And because
- 14:33it is a valid cryptographically signed token,
- 14:36it completely bypasses your multi -factor authentication.
- 14:40Wait, really? It bypasses MFA? Yes, it bypasses
- 14:44MFA. It bypasses your biometric logins. The system
- 14:47assumes that because the token is legitimate,
- 14:50the traffic is legitimate. That is terrifying.
- 14:53This is the very definition of a supply chain
- 14:55attack. The attackers target a mid -tier vendor
- 14:58with weaker security specifically to harvest
- 15:01the high -level tokens belonging to their much
- 15:03larger, much more secure enterprise clients.
- 15:06Which brings me to the detail in the briefing
- 15:08that is just staggering. The victim list. Yes.
- 15:11The victims of this clue breach. The companies
- 15:14that had their core Salesforce data exfiltrated
- 15:16included several dedicated security firms. Yeah,
- 15:19that's the part that hurts. How is that even
- 15:22possible? These are companies selling zero -trust
- 15:25architectures and advanced threat detection.
- 15:27Don't they audit their own integrations? What's
- 15:30fascinating here is it perfectly illustrates
- 15:32the concept of shadow IT and the total collapse
- 15:35of the traditional security perimeter. Shadow
- 15:37IT meaning stuff happening under the radar. Exactly.
- 15:40In a modern organization, it is rarely the IT
- 15:44department actually provisioning these OAuth
- 15:47tokens. Right. It's a marketing manager connecting
- 15:49a new SEO tool or a sales director integrating
- 15:53a productivity app. Just trying to get their
- 15:55job done. Right. So the security firms were compromised
- 15:58because the technical enforcement of their perimeter
- 16:01was bypassed by human convenience. They trusted
- 16:04a vendor, the vendor got compromised, and the
- 16:07blast radius traveled directly down the supply
- 16:09chain right into the security firm's database.
- 16:12It renders the entire concept of a firewall almost
- 16:16irrelevant. Pretty much. You were only as secure
- 16:18as the weakest marketing plug -in your intern
- 16:20connected three years ago and forgot about. That's
- 16:23the reality. Yeah. And the Kinsoft briefing emphasizes
- 16:26that this is not an isolated incident. They explicitly
- 16:29tie it to the repeating pattern of the Shiny
- 16:32Hunters threat group, who utilized identical
- 16:35methods to execute massive Salesforce thefts.
- 16:39It's a known playbook now. And to show just how
- 16:41relentless this broader perimeter collapse is,
- 16:44the source notes two other major breaches from
- 16:47that exact same week. Which ones? Nintendo getting
- 16:50hit by ransomware and losing employee data and
- 16:53Oxford University's careers platform being breached
- 16:55to expose student details. Oh, wow. I mean, whether
- 16:58it's global gaming giants or ancient universities,
- 17:01the data is just bleeding out from every conceivable
- 17:04vector. It's the inevitable result of hyper connectivity.
- 17:07I mean, we. have prioritized seamless API communication
- 17:10above literally everything else. Right. But every
- 17:13single one of those API connections, every OAuth
- 17:16token is a potential doorway. Just waiting to
- 17:18be opened. Exactly. The attackers have realized
- 17:21that trying to batter down the front door of
- 17:24a highly secure enterprise is a waste of time.
- 17:26It is infinitely more efficient to quietly slip
- 17:30through the side doors that were just left propped
- 17:32open by third party integrations. Which brings
- 17:34us to the synthesis of what this June. June 2026
- 17:38briefing is really telling us today. Yeah, bringing
- 17:41it all together. We started by looking at the
- 17:43economic reality of the tools we use, right?
- 17:45The shift to unpredictable metered token billing
- 17:49that forces users to absorb the raw cost of compute.
- 17:52And the sticker shock that comes with it. Then
- 17:54we traced why that compute is so expensive. Because
- 17:57it requires the deployment of massive gigawatt
- 18:00scale physical infrastructure that is actively
- 18:03displacing human labor in the pursuit of capital
- 18:05efficiency. The Wikipedia strike being the prime
- 18:07example. Exactly. And finally, we looked at how
- 18:10our rush to integrate these powerful, expensive
- 18:12systems has basically weaponized our own connectivity
- 18:16against us through Outh supply chain attacks.
- 18:18The overarching narrative across all these sources,
- 18:21if you look at them together, is friction. Friction,
- 18:24yeah. The era of frictionless tech adoption is
- 18:26over. Every computational choice now carries
- 18:30a distinct, measurable weight, whether that weight
- 18:33is measured in euros, in human jobs, or in security
- 18:36vulnerabilities. Which means we have to move
- 18:38from observation to action. The practical takeaway
- 18:41from listening to this right now is immediate.
- 18:44You need to audit your digital blast radius.
- 18:47Do it today. Yes, literally today. Log into your
- 18:50core platforms, whether that's Google Workspace,
- 18:53Microsoft 365, GitHub, Salesforce, whatever you
- 18:56use, navigate to the security settings, and pull
- 18:59the list of connected third -party applications.
- 19:01You might be surprised by what you find. You
- 19:03are almost guaranteed to find integrations that
- 19:06were authorized years ago by employees who may
- 19:08not even work there anymore. If an app doesn't
- 19:10have a strict operational necessity today, Revoke
- 19:14its token immediately. Revoke it. You have to
- 19:16aggressively deprecate the lingering access keys
- 19:18you've left scattered across the supply chain.
- 19:20That kind of aggressive digital hygiene is really
- 19:23the only defense when the perimeter itself is
- 19:26decentralized? But, you know, looking at the
- 19:28entirety of what we've unpacked today, it raises
- 19:30a really profound structural question. Oh, what's
- 19:34that? Well, we are rapidly moving into an environment
- 19:37where every interaction with an interface might
- 19:40incur a metered token charge, right? Where the
- 19:42underlying infrastructure requires city -sized
- 19:45power grids, and where simply connecting two
- 19:48apps exposes your core data to global supply
- 19:51chain attacks. It's exhausting just thinking
- 19:53about it. Right. So if being plugged in... means
- 19:56absorbing constant financial and security liabilities,
- 19:59will the ultimate luxury in future technology
- 20:02be the ability to completely disconnect and execute
- 20:05your work locally entirely offline? Wow, that
- 20:08is a brilliant angle. If connectivity becomes
- 20:10a liability and cloud compute becomes a metered
- 20:13utility bill, perhaps the most premium feature
- 20:16a piece of software can offer is isolation. Isolation
- 20:19as a luxury. Yeah, because as the Kintop briefing
- 20:21makes abundantly clear, the plumbing connecting
- 20:24our digital world is expensive, it is leaking,
- 20:27and the bill has finally arrived. It definitely
- 20:29has. Thanks for taking the deep dive with us
- 20:31today. Take a hard look at your integrations,
- 20:34and we'll see you next time.