Matthew Prince, co-founder and CEO of Cloudflare, said attacks on a newly disclosed flaw in PHP, the programming language behind WordPress and much of the web, went from thousands across Cloudflare's network in the hours before the patch to millions a minute after it.
Prince was among 27 people quoted in this issue. The others ranged from George Kurtz, who said attackers now move from the first computer they break into to a more valuable one in 29 minutes on average, to Bill Ackman, who said releasing Fannie Mae and Freddie Mac from government control before the Trump administration ends is politically critical, and C.S. Venkatakrishnan on the £300 million of Barclays' private-credit financing that drew questions from the Bank of England.
"We went from hours before the patch was released, we were seeing thousands of attacks across our network. At this point, we're now seeing millions of attacks per minute." — Matthew Prince, Co-Founder and CEO at Cloudflare, on TBPN (Read summary)
We scanned 804 shows and 9 hours of audio, wrote 20 summaries, and pulled 52 quotes into this 20-minute read.
Here is what mattered.
Macro
AI spending now supplies 1 point of a normal 2% US growth rate, Apollo's Slok says
Torsten Slok said the build-out of data centers and power supply has become central to any economic forecast.
"Growth normally is 2%. And now one percentage point of growth is coming from AI spending." — Torsten Slok, Partner and Chief Economist at Apollo Management, on Bloomberg Surveillance
The S&P 500 has returned more on average while the 10-year yield rises than while it falls
Charlie Bilello noted the 10-year Treasury yield went from below 4% to above 5% over the past year while stocks climbed. Peter Mallouk said rates usually rise because the economy is strong enough that the Fed wants to cool it.
"We're seeing a higher return on average for the S&P 500 when that 10-year yield is rising versus falling." — Charlie Bilello, Chief Market Strategist at Creative Planning, on Signal or Noise
International
Barclays puts the private-credit financing the Bank of England asked about at £300M of £15B
C.S. Venkatakrishnan was answering reports that a Bank of England official had flagged derivatives Barclays used to finance private-credit loans. He said the exposure is disclosed in the bank's earnings, and that he judges AI-linked lending loan by loan rather than as a sector.
"The amount in question here is 300 million pounds out of a 15 billion pound private credit exposure." — C.S. Venkatakrishnan, CEO at Barclays, on CNBC International Live (Read summary)
Barclays will return £10.7B to shareholders this year, £700M more than it promised
Venkatakrishnan rejected the view that Barclays is shrinking its investment bank, and pointed to profitability up 13% and loan growth of 7% in its UK corporate and retail banks.
"Capital return... including dividends for this year is 10.7 billion pounds, 700 million pounds more than what we promised." — C.S. Venkatakrishnan, CEO at Barclays, on CNBC International Live (Read summary)
Only 10% of the companies using AI most heavily are in Europe, OpenAI's CFO says
Sarah Friar said the top 10% of companies by AI use on OpenAI's platform, which she called frontier firms, are mostly outside Europe. That is part of why she visited Ireland's prime minister during its EU presidency.
"In that top 10% of frontier firms that we see, only 10% of them are European-based." — Sarah Friar, CFO at OpenAI, on Masters of Scale (Read summary)
Financials
Affirm underwrites every purchase on its own, unlike a revolving credit-card balance
Max Levchin spoke after Affirm became Sam's Club's exclusive buy-now-pay-later provider, on Sam's Club's website within weeks and in stores from 2027. He said the price of credit is fixed once Affirm quotes it.
"Every transaction with Affirm is entirely separate... We underwrite every transaction." — Max Levchin, Founder, Chairman and CEO at Affirm, on Bloomberg Talks (Read summary)
Affirm passes higher retailer fees through to borrowers, Levchin says
Some retailers pay Affirm more than a card network would charge. Levchin said Affirm does not keep the difference.
"We use that extra spread to make the cost of credit lower for the consumer." — Max Levchin, Founder, Chairman and CEO at Affirm, on Bloomberg Talks (Read summary)
Pinnacle's deposits are up 9% this year and its earnings per share more than 20%
Kevin Blair said the growth comes less from the economy than from the 222 revenue producers Pinnacle Financial Partners hired this year, who bring their own loans and deposits.
"We've had three quarters in a row of strong loan growth. Our deposits have grown 9% this year, our EPS is up over 20%, fee income up 15%." — Kevin Blair, CEO at Pinnacle Financial Partners, on Squawk on the Street
Pinnacle's clients expecting growth outnumber those expecting decline by 38% to 15%
Blair said the share expecting their business to shrink is up 4 points from last quarter.
"About 38% of our clients believe that their business will grow over the next 12 months, compared with only 15% that believe it will decline." — Kevin Blair, CEO at Pinnacle Financial Partners, on Squawk on the Street
Consumer
e.l.f. answered Dior's $36 lip oil with its own formula at $8
Tarang Amin said e.l.f. never copies a prestige formula. Its customers asked for a cheaper Dior lip oil, and its chemists built a more hydrating one to fix the dryness buyers had complained about.
"It was a completely different hydrating formula, a much bigger doe foot... and an $8 price point instead of $36. It went viral instantly." — Tarang Amin, Chairman and CEO at e.l.f. Beauty, on CNBC International (Read summary)
Target told Amin that e.l.f. sold more per foot of shelf than any other brand
Before he put his family's money into e.l.f., Amin called Christina Hennington, then head of beauty at Target. She told him the brand outsold everything on the shelf even though its average price was about $2.
"On a dollar per linear foot, which is the key measure of retail productivity, it outsells everything." — Tarang Amin, Chairman and CEO at e.l.f. Beauty, on CNBC International (Read summary)
Airbnb listings make up about 5% of a city's housing, Chesky says
Brian Chesky accepted some responsibility for housing costs but said Airbnb is not the main cause. He announced a $250 million fund to provide the last dollar of financing for stalled housing projects, money Airbnb expects back.
"We typically comprise about 5% of housing in a city, and of that 5%, quite a lot of it is somebody's primary or secondary home." — Brian Chesky, Co-Founder and CEO at Airbnb, on The CEO Signal (Read summary)
Bartlett started his show with a $100 microphone; it now reaches about 200 million people a month
Steven Bartlett said creators who rely only on an algorithm are renting an audience that can disappear when the algorithm changes.
"A kid like me in my bedroom with a $100 microphone... could start a show that now this month will get close to about 200 million people." — Steven Bartlett, Founder at steven.com and host of The Diary of a CEO, on Inside the ICE House (Read summary)
Bartlett's media company has a team whose job is to fail faster than competitors
Bartlett said his team is about to scrap its own playbook, from trailers to how it books guests, rather than defend what took the show past 20 million YouTube subscribers.
"We have an experimentation and failure team in our media company whose sole objective is to out-fail our competition." — Steven Bartlett, Founder at steven.com and host of The Diary of a CEO, on Inside the ICE House (Read summary)
Technology & AI
Agent traffic could be 1,000 times human traffic within 5 years, Cloudflare's CEO says
Matthew Prince said the internet's business model will have to change within the decade if that happens.
"If current trends continue, in five years automated traffic, agent traffic, is going to be a thousand times human traffic... the internet almost collapsed when during COVID traffic doubled." — Matthew Prince, Co-Founder and CEO at Cloudflare, on TBPN (Read summary)
Prince expects AI agents to pay a tiny sum each time they use a website
He said sites could offer discounts, or even pay an agent to visit, in exchange for the agent saying what it is shopping for. He sees that as the successor to today's advertising.
"My hunch is probably some version of micropayments, where every time you access a resource, your agent pays a 10,000th of a penny to be able to see the menu." — Matthew Prince, Co-Founder and CEO at Cloudflare, on TBPN (Read summary)
An OpenAI model found the full PHP exploit with no person guiding it
Greg Brockman said a security researcher first found part of the bug in August using OpenAI's models, with about 75% to 80% of the work down to the researcher's own expertise. A month later OpenAI's newest internal model found the complete version on its own.
"We set up an environment and we took our most capable model with a lot of compute behind it. And that autonomously was able to find the full exploit." — Greg Brockman, Co-Founder and President at OpenAI, on Bloomberg Talks (Read summary)
CrowdStrike says intruders reach a second computer in 29 minutes on average
George Kurtz was describing breakout time: how long an attacker who has broken into one machine takes to move to a more valuable one.
"That used to be days and hours and now it's minutes. On average it's 29 minutes, but we've seen it as quick as 27 seconds." — George Kurtz, Co-Founder, President and CEO at CrowdStrike, on No Priors (Read summary)
Attacks are now written as prompts, not reusable malware, Kurtz says
Kurtz said each attack now carries a new signature generated on the spot, rather than a piece of code defenders can recognize and block.
"What people have to keep in mind is it's not malware anymore, it's prompts. They can basically engineer prompts that would create a totally unique signature of what direction they're going to go in, how they gather information, where they pivot." — George Kurtz, Co-Founder, President and CEO at CrowdStrike, on No Priors (Read summary)
Frontier AI models refuse so much security work that defenders use open-weight ones, Kurtz says
Frontier models are the most advanced ones from the leading labs. Kurtz said attackers already run open-weight models such as GLM and Qwen, which anyone can download and run with the safeguards removed. CrowdStrike's own researchers now use them too.
"If you look at the guardrails on the latest generation of any of the frontier models, to be candid, you can barely create a PowerPoint that has cybersecurity in it. I mean, it literally rejects you and bumps you down to a lower model." — George Kurtz, Co-Founder, President and CEO at CrowdStrike, on No Priors (Read summary)
A security task that costs about $10 on a top frontier model costs CrowdStrike about 3 cents
CrowdStrike built its own pair of attack and defense models with Nvidia, trained on 15 years of its own threat data.
"If you use the highest caliber frontier cyber model, probably cost you about ten dollars. Ours is like three cents." — George Kurtz, Co-Founder, President and CEO at CrowdStrike, on No Priors (Read summary)
Proofpoint and Varonis will have almost $3.5B of annual recurring revenue combined
Sumit Dhawan said Proofpoint is buying Varonis for about $6.3 billion in cash and expects to close in the first half of 2027. The rule of 40 means revenue growth plus profit margin of at least 40%.
"We anticipate... the combined company is going to be almost 3 and 1/2 billion dollars in ARR... with north of rule of 40 right away." — Sumit Dhawan, CEO at Proofpoint, on theCUBE (Read summary)
Proofpoint's CEO says AI agents cannot yet run security without people
Dhawan said Proofpoint's agents will sort most alerts themselves and pass the rest to people, who can set new rules for the agents to follow.
"Taking the humans out the loop for governance, monitoring, as well as ongoing training of agents — it's not ready in our perspective." — Sumit Dhawan, CEO at Proofpoint, on theCUBE (Read summary)
Nadella says companies need controls outside an AI model before deploying it
Satya Nadella said research into making models safe from the inside has not kept pace with their gains in capability. Microsoft now tells companies to treat models like insider threats, with limited access, identity checks and a record of what each agent did.
"Unless and until I have a control system that is independent of the model that gives me assurance that I can deploy these models, I'm going to have a tough time deploying these models." — Satya Nadella, Chairman and CEO at Microsoft, on Semafor (Read summary)
Microsoft is not matching the frontier labs' spending dollar for dollar, Nadella says
He said Microsoft's own models run about 3 to 6 months behind the frontier at roughly 20% of the cost, while its partnership gives it access to OpenAI's models through 2032.
"I also want to do something which makes sense for Microsoft to do, make this more like a software business, make this more like a tools business. I have bigger goals." — Satya Nadella, Chairman and CEO at Microsoft, on Semafor (Read summary)
The heaviest AI users now use 8x the agent tokens of an average company, up from 2x in January
Tokens are the units of text an AI model reads and writes. Friar was citing new research by OpenAI's own economists on use of its platform. She said OpenAI itself uses 33 times as many as those leading companies.
"The frontier firms... the number of agentic tokens they're using today versus even just an average firm is about 8x... that number's gone from about 2x back in January." — Sarah Friar, CFO at OpenAI, on Masters of Scale (Read summary)
Job titles understate what people now do with ChatGPT, OpenAI's CFO says
Friar said OpenAI's research compared what people do on ChatGPT with their job titles. She takes the result as evidence that everyone has become a builder.
"As a finance person, if you show up with a finance job title today on our platform, you do about 25% of your tasks on Chat GPT that are truly financial... 25% are engineering tasks... 25% is marketing." — Sarah Friar, CFO at OpenAI, on Masters of Scale (Read summary)
IBM's data chief says AI agents in production are a different problem from a chatbot
Shaun Clowes said autonomous agents need guardrails and tightly governed data that personal-productivity tools do not.
"One problem I see people make over and over again is they think that AI in production for autonomous will look something like AI being used by you or me for personal productivity. They're completely different things." — Shaun Clowes, General Manager of Confluent and Data at IBM, on theCUBE (Read summary)
Google's flood forecasts let Nigeria send money to villagers before a flood hit
Yossi Matias said predicting where a flood would hit the next day was out of reach when he visited India about 10 years ago.
"The government of Nigeria sent millions of dollars to villagers ahead of a flood that we use again our API for what we call flood hub." — Yossi Matias, VP and Head of Google Research, on I've Got Questions with Sinead Bovell (Read summary)
Gates expects a 20-year transition with winners and losers before AI brings abundance
Bill Gates said that even in the best case this will be among the most turbulent periods in history. He based the 20 years on disputed timelines for humanoid robots.
"My big concern is this 20-year transition period, where they'll have winners and losers and a lot of disruption, and we have to get through that in order to get to that period of abundance." — Bill Gates, Co-Founder and Former CEO at Microsoft, on Decoder with Nilay Patel (Read summary)
Ackman compares neoclouds to highly leveraged real estate developers
Neoclouds are companies that rent out AI computing, much of it bought with borrowed money. The hyperscalers, the biggest companies building AI data centers, are different, Bill Ackman said. Their balance sheets are far stronger.
"The neocloud play is a bit like investing in a real estate developer in a highly levered format. If you get it right, the levered equity returns are enormous. If you get it wrong, you can get wiped out." — Bill Ackman, Founder and CEO at Pershing Square Capital, on Squawk on the Street (Read summary)
SpaceX makes about $20B of contracted revenue per gigawatt, Josh Brown says
Brown said the real contest in AI infrastructure is over who captures the economics: SpaceX, Oracle or whichever cloud builds fastest and cheapest.
"Look at the credit that SpaceX got this week for saying we are going to build ten gigawatts. They make about $20 billion per gigawatt in contracted revenue." — Josh Brown, CEO at Ritholtz Wealth Management, on Halftime Report (Read summary)
Investors no longer tolerate a hyperscaler burning cash, Ethridge says
Malcolm Ethridge said that is what hit Meta, which has guided to negative free cash flow with no return expected until 2029.
"There's now a zero tolerance policy for... hyperscaler companies going cash flow negative. And that's basically what we got on this last earnings call." — Malcolm Ethridge, Managing Partner at Capital Area Planning Group, on Halftime Report (Read summary)
Chip earnings growth slows from over 100% this year to 50% in 2027, NewEdge's Dawson says
Cameron Dawson was citing the Philadelphia Semiconductor Index, and said investors are pricing 2027 as the peak year for AI infrastructure earnings.
"It's going to grow earnings by over 100% this year. That's expected to slow in 27, but to just 50%." — Cameron Dawson, CIO at NewEdge Wealth, on Bloomberg Surveillance (Read summary)
Strong chip earnings may not hold up chip stocks, Dawson says
She said this year's earnings beats came from wider margins, which the market doubts will last once new memory capacity arrives in 2027 and 2028.
"Semiconductors trade with counter-cyclical multiples. So you put the lowest multiple on the highest earnings." — Cameron Dawson, CIO at NewEdge Wealth, on Bloomberg Surveillance (Read summary)
Only 25% to 50% of planned data centers may get built, Apollo's Slok says
Slok was citing reporting on power shortages, and said estimates for growth and capital spending would come down if it holds.
"Only 25% to 50% of data centers may ultimately end up being built." — Torsten Slok, Partner and Chief Economist at Apollo Management, on Bloomberg Surveillance
VC & Startups
Xona's next satellites fit 50 to 60 on a rocket, halving launch cost per satellite
Brian Manning said Xona launched 6 navigation satellites this week and raised $250 million at a $2.45 billion valuation.
"Our current generation satellites, we can fit in the neighborhood of 30 into a rocket. Our second generation satellites... we can fit 50 to 60. And so that means you effectively cut your launch prices in half." — Brian Manning, Founder and CEO at Xona Space Systems, on TBPN
PlantSwitch makes its plant-based packaging from raw material to finished product
Dillon Baxter said the company first tried to sell its material to existing packaging makers, but those deals stalled, so it built its own plant.
"We set up a fully vertically integrated production site. We do everything from the raw material to the finished goods, which I think we're the only ones that are doing that for a whole portfolio of products today." — Dillon Baxter, Co-Founder at PlantSwitch, on TBPN
Industrials and Transport
Stelius builds microwave weapons to stop cheap drone swarms without costly missiles
Richard Starson said the company has a $2 million contract for pilot systems, and that its largest units could protect fixed sites such as bases, borders and data centers.
"If you've got thousands of drones flying at you that are extremely cheap to produce, you want to be able to take them down without expending extremely expensive munitions. And megawatt-class microwaves are uniquely... capable of taking down those large swarms of drones." — Richard Starson, Founder and CEO at Stelius, on TBPN
Materials & Energy
Oklo's CFO says demand for nuclear power is effectively unlimited
Craig Bealmear, who spent 28 years at BP, said AI accounts for about a third of the new power demand he expects. What limits Oklo is supply, above all regulatory approval and nuclear fuel, which is why it makes its own.
"In this business, I don't go to bed worried about demand. It's a little bit like we've got unconstrained demand." — Craig Bealmear, CFO at Oklo, on Run the Numbers (Read summary)
Oklo's first test reactor went from bare land to a nuclear reaction in 11 months
Bealmear said the Lockhart, Texas, site held only trees, dirt and rocks on Labor Day 2025. Oklo's first full power plant is due in 2028.
"Our first radioisotope test reactor went critical two weeks ago. We took an asset live, with fuel in the reactor core, and generated a controlled nuclear reaction." — Craig Bealmear, CFO at Oklo, on Run the Numbers (Read summary)
Policy
Gates says the AI labs' founding rules worked only while there was one frontier lab
Gates said that once several labs compete, responsibility for safety has to move to government, as it has for cars and planes.
"The OpenAI structure, which is, 'We may choose never to productize this and to ignore the capitalistic incentives,' only works if there's one company. That's where it's broken down." — Bill Gates, Co-Founder and Former CEO at Microsoft, on Decoder with Nilay Patel (Read summary)
Gates would require safeguards on any model capable of sophisticated cyberattacks
He said the rule should be enforced at platforms such as Hugging Face and GitHub, which would have to stop users stripping safeguards out, rather than at the chip level.
"A sovereign country says that models that are capable of sophisticated cyberattacks have to have safeguards kept in them." — Bill Gates, Co-Founder and Former CEO at Microsoft, on Decoder with Nilay Patel (Read summary)
Ackman says Fannie and Freddie must leave government control before Trump's term ends
Ackman said the two stocks, his fund's biggest drag this year, have gone from $3 to $15 and back to $3. He said a future Democratic administration could otherwise use the companies to control who gets a mortgage, and called the White House's proposed holding company unworkable.
"It's actually absolutely politically critical for Fannie and Freddie to be released from conservatorship before the end of the Trump administration." — Bill Ackman, Founder and CEO at Pershing Square Capital, on Squawk on the Street (Read summary)
Nuggets of Wisdom
e.l.f.'s CEO learned cash flow at 14 at his family's motel
Amin's family, expelled from Uganda, bought the motel in 1979, when interest rates were about 18%. He said he later learned that business school calls the idea economic profit.
"My parents sold our house, took every penny we had, and we bought our first motel on Route 1 in Alexandria, Virginia... I developed an intuitive sense of what cash flow was at the age of 14." — Tarang Amin, Chairman and CEO at e.l.f. Beauty, on CNBC International (Read summary)
Chesky says a CEO's first job is recruiting
Chesky spends 2 to 3 hours a day on it. He personally helps hire the top 200 people at Airbnb.
"The number one thing a CEO does is recruit talent. If I were starting a company today, my first employee would be a recruiter." — Brian Chesky, Co-Founder and CEO at Airbnb, on The CEO Signal (Read summary)
Disclose a problem rather than hide it, Oklo's CFO says
Bealmear described an earnout, extra shares owed to Oklo's earlier owners once set targets are met, that was triggered without warning to analysts. Oklo laid out how it worked, and one analyst thanked him afterward.
"If you do have a mess, the worst thing you can do is hide it, because you take the narrative out of your hands and you put it into somebody's hands to interpret for yours." — Craig Bealmear, CFO at Oklo, on Run the Numbers (Read summary)
More risk does not guarantee more return, Creative Planning's Mallouk says
Mallouk pointed to long-dated Treasury bonds, which have been far more volatile than Treasury bills over 6 years without paying more.
"Risk does not always mean more reward... there are a lot of stupid things you can do with your money where you're taking more risk with a higher probability of doing worse." — Peter Mallouk, CEO at Creative Planning, on Signal or Noise (Read summary)
Stocks rise in 3 of 4 single years and in 93% of 3-year spans, Mallouk says
Mallouk said this is why a long holding period matters more than predicting the market.
"We know three out of four years, we have a good outcome. Over three years, it's 93% of the time." — Peter Mallouk, CEO at Creative Planning, on Signal or Noise (Read summary)
An investor who ignored politics ended with over $26M, Bilello's study found
Bilello's chart compared investing only under Republican presidents, which ended at $380,000, and only under Democratic ones, at $693,000.
"If you just ignored all of it... who's in power, what's the split in power, you're over 26 million." — Charlie Bilello, Chief Market Strategist at Creative Planning, on Signal or Noise
Cramer learned not to turn an investment into a trade
Jim Cramer told of a Goldman Sachs client who berated him for selling Kimberly-Clark early for an $8,000 gain, on a stock Cramer had sold him as a long-term holding. The stock later doubled.
"He questioned my integrity... I was scorched. I was burned. But it taught me a terrific lesson: just as you don't want to turn a trade into an investment, you also don't want to turn an investment into a trade." — Jim Cramer, Host of Mad Money at CNBC, on Mad Money (Read summary)
If this was worth your time, send it to someone who has to follow all of this too.
What did you think of today’s edition? Hit ‘reply’ to this email, send us a message, leave a comment, or join the chat!
Get the latest market chatter as it happens: