Craig Peterson's Tech Talk

Kevin O'Leary's proposed Utah AI data center would cover roughly 68 square miles — about the footprint of Washington, D.C. and nearly three times the size of Manhattan — and, at full build-out, draw more than twice the electricity used by the entire state of Utah. Craig and Jim walked through why: neighbors are protesting the power draw, the natural-gas turbines O'Leary would bring in to generate it, and the water a cooling system that size would need in a state that's already in drought. Craig used the moment to explain what's actually inside a data center. His own company runs blade servers — essentially a full computer shrunk onto a single card you slot into a rack. Google runs something different: tens of thousands of bare motherboards sitting on cork, no case, no extras, built to be cheap and fully redundant so a single failure doesn't matter — and Google, like Apple, now designs its own chips rather than buying them. That chip race matters more than it sounds: Chinese-designed AI chips are reportedly co

Asked what story isn't getting the coverage it deserves, Craig names something he is watching happen in his own hiring and his own code: a divide opening between older technologists and younger ones, and it is running the opposite way to what everyone predicted. His number comes from real work. Craig uses AI heavily to build Forward to Safety, his tool for taking apart suspicious email, and about 20% of the time it makes bad programming decisions — badly enough that he has to stop it mid-task and redirect it. Not typos. The strategy is wrong, the superstructure of what it is building is wrong, and sometimes the basic implementation is wrong too. His conclusion follows directly: you cannot put a junior person in charge of supervising that, because they don't yet know enough to see it. So businesses are hiring people with decades behind them — people who can use the tools, recognise when the output is wrong, and carry on. White-collar displacement is real, but the numbers say it is landing on the younger group,

Craig told on himself this week: he got an email from one of his credit card companies, assumed it was junk, and deleted it — only to find out later it was legitimate, and his credit rating dropped 80 points as a result. The same week, a registered letter arrived for his business insurance renewal after an earlier email — asking for five grand, roughly double the real premium and riddled with misspellings ("canceled" spelled wrong among them) — turned out to be fraud. The mechanism behind both scares: a fake Capital One alert now circulating uses typosquatting, registering a domain a letter or two off from the real one, and pairs it with personal information the sender already has from prior data breaches — name, email, income, employer, even what car you drive. Craig's free tool checks what of your own information is already sitting on the dark web, and his Forward to Safety service will tell you, for free, whether a specific email is legitimate. He also raised a number worth sitting with: of the companies w

A small startup coffee shop in Stockholm gave an agent called Mona, running on Google Gemini, a $21,000 budget and a real job: hire the staff, place the orders, maintain inventory. Humans did the physical work and took direction from it. Since launching in mid-April it has brought in $5,500 in sales and burned through $16,000. The purchase orders are the part worth repeating. It bought 3,000 rubber gloves. Four first aid kits. Six thousand napkins. Canned tomatoes, which appear in none of the cafe's dishes. It was working from a simple set of instructions and it was not confused about what a cafe is — it simply had no way to know what mattered. Craig's point is not that agents are useless but that people are handing them specific work on the assumption that competence at one thing transfers to another. The most immediately useful thing in this segment is a defensive trick most people have never heard. Russian malware, almost universally, checks at startup whether the machine has a Russian Cyrillic keyboard in

Search for "download Claude for Mac" or "download Anthropic" right now and a malicious ad can land at the top of the results — Craig traced it to Russian operators who've been poisoning Google's ad network specifically to target Mac users and programmers, since anyone serious about coding AI tools is likely on a Mac and using Anthropic's Claude. Click the ad expecting the real app, and the download is malware instead, built to take over the machine and use it as a launch pad for further attacks. Both Google and Anthropic have issued warnings about it. The mechanism Craig walked through is almost funny: this piece of malware — like most Russian-made malware — checks first whether the machine has a Cyrillic keyboard installed. If it does, it exits instantly and does nothing, because Russian hackers who infect a fellow Russian's machine, especially an oligarch's, answer for it. Craig's practical fix: you don't need a physical Cyrillic keyboard, just add a virtual one in your system settings, and this entire clas

Craig broke his usual newsletter schedule to send this one, and the reason is a change Google made this week: your email is now processed by their AI by default. The goal is reasonable — organise your inbox, fill your calendar, help catch scams. What makes it worth a special email is that Google, unlike Microsoft, openly admitted this creates a serious security problem. The mechanism is prompt injection, and Craig's explanation is the clearest he has given on air. An AI reading a document cannot distinguish between the content it was asked to read and instructions it was given. Put text on a web page saying Matt is the best radio host in the world, and the AI processing that page reads it as something it has been told. Apply that to email and the consequence follows immediately: a message written by an attacker can carry embedded instructions that override what Google's AI was told to do. The scam is no longer aimed at the person reading the mail. It is aimed at the software reading it on their behalf. Which

Iran is estimated to have planted somewhere between 2,000 and 6,000 sea mines in the waters around the Strait of Hormuz. So far, U.S. forces have found and destroyed about 20 of them. Some of the mines are World War II-style spiked floats; others are far stranger — mobile mines with their own torpedo motors, GPS-guided mines that travel to a programmed location, and Chinese-built EM-52 mines that sit up to 200 meters down and launch a rocket-propelled warhead straight up when they sense a ship's hull overhead. Craig walked through how the detection side has changed. Traditional minesweeping meant a reinforced-hull ship hunting for mines before they hit it; today the Navy uses underwater and surface drones to scan a seafloor already littered with rocks, rusted pipes and old shipping containers. Every time Iran modifies a mine design, the software and hardware used to recognize it has to be retaught — a process that used to take up to six months per new mine type. An AI system called Domino has cut that down to

Microsoft patched 167 security holes in a single day last week. Craig uses that number to make the point he considers most under-appreciated by everyone listening: Windows Update patches Microsoft software. It does not touch anything else on your machine. Whatever else you have installed is on you. And it does not stop at the computer. He runs the list deliberately — your printer, the doorbell out front, the security cameras, the baby monitor — and says all of them are guaranteed to have security problems. The obvious worry is someone watching your doorbell, which is real enough. The one that actually costs businesses money is different: those forgotten devices get taken over and then used to attack other things. An intruder who owns a camera on your home network can ride the VPN you use to reach the office and go after the machines there. Last week alone Craig points to a botnet of 200,000 compromised computers assembled exactly this way. The reason the patching backlog is about to get worse is the segment's

Microsoft's April patch release fixed 167 security holes in a single day, one of them a zero-day already being actively exploited before the fix shipped. The federal government added eight more items to its emergency security watch list the same week. Craig's point: people obsess over updating their laptop and phone, but rarely think about the printer or the security camera in the corner of the office — both are now regular attack targets. That's also the logic behind the federal ban on importing Chinese-made routers, VPN hardware, and Wi-Fi equipment. Roughly 200,000 U.S. households were found running compromised versions of these devices, unknowingly part of a botnet used to attack other targets — while the same access was being used to pull personal information off the household's own network at the same time. Also in this segment: The Elon Musk–OpenAI lawsuit and concerns about juror impartiality after several seated jurors said they don't like Musk — flagged below for Craig's review New DNA research ide

Florida officials say ChatGPT may have advised the gunman in the Florida State University shooting — the questions alleged include which weapon to use, how much ammunition to bring, and when to go onto campus. OpenAI's position is that it is not responsible for what happened. Craig's analysis is the most useful legal thinking he has offered on air, because he separates the part that is genuinely old from the part that is genuinely new. Information has always been available. Libraries hold true-crime accounts describing exactly how something was planned and how the police caught the planner, and the Anarchist Cookbook was banned by many libraries for precisely this reason. What has changed is not availability but service: as he puts it, it is now like having a librarian who fetches all the books and points out exactly what you should be doing. The subpoenas are where it gets interesting. The Florida attorney general is not asking what the model said. He is asking for OpenAI's policies, its internal training ma

Anthropic has released an AI model built specifically for cybersecurity work, and it's already turning up major, remotely-exploitable vulnerabilities in every operating system researchers have pointed it at — Linux, BSD-based systems, and Windows alike. Craig's read: this kicks off roughly a year, maybe longer, of an arms race. Vendors patch what the AI finds; attackers reverse-engineer those same patches to hit anyone who hasn't applied them yet. The part people miss, Craig says, is that Windows Update only covers Windows itself — not the other software sitting on the same computer. That's the gap his newsletter is built to close, and it's also the idea behind a new tool he's building called Assure, which checks a computer against whatever attacks are actively happening right now, rather than waiting for a scheduled patch cycle. Also in this segment: Apple bringing on a new executive to lead its AI push, and why Craig thinks Apple's strategy of leasing AI from OpenAI and Anthropic — rather than building its

Maine has passed a first-in-the-nation ban on data centers, now awaiting the governor's signature. The concerns behind it are real and Craig says so plainly: electricity prices do go up. What he disputes is the shape of the response. His industry view is that it barely dents the AI business. These companies save money siting in cold places — it is why data centers went to Iceland and Greenland — but with current high-speed networks they do not need to be near anyone. If most states did this it would matter; Maine alone declining mostly means Maine declining. He puts the job loss in the hundreds, and notes what the state is turning down given its geography, cold water and cold air, and its existing technology base. The interesting part is his alternative. Craig has been a proponent of new nuclear for over a decade, and the argument he makes is not the one people expect. Plants of this generation now in service are producing more power than they consume and feeding the surplus back to the grid — so a data cente

Craig walks through just how international the Artemis 2 mission really was. The European Space Agency, through Airbus, built the service module — the piece carrying the engines and life support. Japan contributed environmental control systems, other life-support hardware, and the batteries for the Gateway station. The UAE's Mohammed bin Rashid Space Centre — the team behind the Hope probe now studying the Martian atmosphere — helped provide higher-resolution radar and laser data on the Moon itself. For Craig, the real headline isn't the hardware; it's that so many countries and people worked closely together on something this hard, at a moment when trust between groups at home feels harder to come by than it used to. Also in this segment: An extended conversation on growing up in Quebec's French-language school system, Bill 101's restrictions on English in business, and Craig's own move to the United States in the 1970s A wide-ranging discussion of Canadian health care wait times, immigration policy, and Ca

Brockton Hospital was hacked, and Boston television stations spent the morning doing live shots out front. Jim reminds Craig that he called this years ago, predicting health care would become the next big hacking target. Craig lays out why: a hospital licensed for roughly 230 beds is sitting on tens of thousands of patient records, and attackers going after health data usually want one of three things — a ransom payment, the data itself for fraud, or simply chaos. The mechanism Craig comes back to is a business decision, not a technical one: a client tried to save money by hiring a single full-time IT employee instead of outsourcing. It backfired. IT coverage needs at least two people, because someone always needs to be reachable, and roughly 30 percent of an IT person's time goes to ongoing training just to keep pace with attackers who are constantly adopting new tools. The client's own bookkeeper concluded they'd actually been undercharged for outsourced support all along. Also in this segment: A recommend

This one is a departure from the usual security conversation. Artemis II launches the afternoon this segment aired — a crew around and beyond the moon, not landing, the way Apollo 8 preceded Apollo 11. It is the first time humans have left low Earth orbit since the moon missions, and the furthest any of us have ever gone. Craig's advice at the close: download the NASA app, or go straight to YouTube, and watch it. He watched the original landing live on television, and remembers the morning after as the first time he ever saw colour in a newspaper — a photograph of the astronauts. His case for why this matters is about the kind of work it is. This is pure science, and pure science reliably ends up helping people whether or not anyone can say in advance how. He points to a structural problem behind that: big businesses no longer do it. The closest thing left in the private sector is pharmaceuticals. Everyone else relies on government for the fundamental research and on small startups for new ideas, which they t

FBI Director Kash Patel's personal Gmail account was compromised — reportedly by Iran — and attackers pulled emails and photos out of it before it was discovered. Craig uses the case to explain why seniors, not officials, are now the number one target of AI-driven fraud: retirement-account fraud attempts are up more than 1,200 percent. The account itself isn't the prize. It's the key to everything downstream. Here's the mechanism: once someone controls your email, they can see your bank's statements landing in your inbox, then go to your bank's site, enter your email, and click "forgot password." If your only second factor is a text message, that's hackable too — attackers call your cell carrier, pose as you, and get your number transferred to their phone. Craig's fix is two steps: switch to an app-based authenticator like Duo or Google Authenticator instead of SMS, and call your own cell carrier to set a password or passcode on your account so nobody can talk their way into a transfer. Also in this segment:

OpenAI is discontinuing the products built on Sora, its video generation model. Matt's disbelief is the right reaction: five or six months ago Sora was all over social media, and in December OpenAI signed a billion-dollar partnership with Disney around it. Disney has now cancelled the entire agreement. You sign a deal in December, a major piece of it is withdrawn, and the partner walks. Craig's read is that the whole category is being commoditised faster than anyone can build a position in it. The price of these models is falling literally by the day — he cites roughly a fivefold improvement for the same money on some large language models — and video generation is a pig for resources compared to everything else you could spend those resources on. If the industry is turning into a public utility, the survivors are the ones who pick a niche and defend it. His guess is that OpenAI is retreating from video to plant everything on the agentic bet: tie into every part of your life and handle it for you, from tomorr

Ransomware crews have been breaking into Cisco firewalls since January, Craig told Jim, using a vulnerability that was fixed months earlier. The fix was published. The door stayed open because nobody installed it. Craig runs Cisco gear in his own business and still calls Cisco the 800-pound gorilla of network security — which is the point: the equipment was not the weak part. That is the same gap Craig keeps coming back to. A patch that exists and a patch that is installed are different things, and the distance between them is measured in months. He paired it with a bug in Chrome that lets an attacker onto a machine with no click at all — no attachment, no link, nothing the user does wrong — where the patch is already available and the only remaining question is whether anyone applied it. The mechanism worth repeating: attackers have moved upstream into the open-source libraries that almost every modern program is built from. Nobody writes software from scratch anymore — you pull in a library that handles cre

Craig opens on a health care breach from his newsletter, and the detail that bothers him is not the size of it — it is the year. HIPAA requires continuous monitoring of that data, specifically so somebody notices when it walks out the door. This organisation took a year to notice. Had it been a small doctor's office, Craig points out, the doctors themselves would be looking at fines and potentially jail. This was a huge corporation, so his expectation is that nothing happens at all. Millions of records, lost through negligence, against regulations written precisely to prevent it. He sets a second story directly against it. A client of his runs a pizza shop. Some card information appeared to have been stolen, the payment card industry audited them, and the business simply lost the ability to take credit cards until Craig's team came in and cleaned up the mess. A small operation gets its livelihood switched off in days; the large one is still explaining itself a year late. Craig's conclusion is unsentimental —

Craig's own company, Mainstream, is currently averaging six million hacking attempts a day against its servers — and most of them are coming from China. Separately, Iran has already broken into the systems of a major health care company Craig covers in this week's newsletter. HIPAA requires continuous monitoring of health care systems, which is exactly how anyone would know an intrusion happened at all — and in this case, it took the company a full year to notice. That gap is the point: continuous monitoring isn't a box to check, it's how Craig can put a number on his own six million daily attempts in the first place. A company that isn't watching that closely doesn't get a lower attack count — it just gets a later, worse surprise. Also in this segment: St. Patrick's Day banter about Craig's Norwegian and newly-discovered Irish ancestry, and where his daughter's red hair came from Aircraft carrier nuclear reactors and the newer molten-salt cooling technology that makes a coolant leak far less dangerous than