Is the AI bubble starting to burst, or is the industry just beginning to question the cost of artificial intelligence? Google's parent company, Alphabet, reported $51.4 billion in quarterly capital expenditures, raising questions about AI spending, profitability, and when investors will see meaningful returns. Meanwhile, Anthropic has filed for its IPO, revealing risks that have cybersecurity leaders questioning the future of the AI industry. And at GitHub Universe 2026, the explosion of AI-generated code is raising another concern: are developers shipping better software, or just more of it? In this episode of ShipTalk, hosts Adam Arellano and Martin Reynolds are joined by Jake Bernardes, CSO at Gambit, to unpack the biggest developments in AI, cybersecurity, and software delivery. They debate whether we're entering an AI bubble correction, the risks behind Anthropic's IPO, why traditional shift-left security may be failing in the age of AI coding agents, and whether enterprises are measuring AI productivity all wrong. The conversation also explores software supply chain security, enterprise AI ROI, and the growing risks of giving developers and AI agents access to critical infrastructure. **ShipTalk is brought to you by Harness.** Real conversations about what's changing in AI, DevOps, cybersecurity, and software delivery.

Critical PHP vulnerabilities discovered with AI. A major LiteLLM software supply chain attack. Unauthorized AI agents accessing US bank accounts. October 2026 delivered a remarkable week of cybersecurity news—but is AI creating new security threats or exposing weaknesses that have existed for decades? Martin Reynolds and Adam Arellano break down the PHP2Shell vulnerabilities, the Chainguard patch controversy, AI agent security risks, and the growing tension between software engineering and cybersecurity teams. As AI accelerates vulnerability discovery and raises new questions about software security, the hosts debate who should be responsible for securing the next generation of applications—and whether this is just the beginning of a new era in cybersecurity. ShipTalk — https://www.shiptalk.io Harness — https://www.harness.io Follow Adam Arellano: https://www.linkedin.com/in/adamrossarellano/    Martin Reynolds: https://www.linkedin.com/in/martinreynolds/    Brought to you by Harness.

An OpenAI engineer is arrested after a hidden recording device is discovered in an executive conference room. Who was he recording, and who was the information intended for? Microsoft releases a record-breaking 1,400+ security fixes in a single Patch Tuesday, including three zero-day vulnerabilities. Is AI helping discover security flaws faster than companies can fix them? Meanwhile, Japan declares a cybersecurity emergency as AI threatens to make large-scale attacks easier than ever. And the ShinyHunters hacking group claims to have stolen sensitive FBI personnel records, raising serious national security concerns. Martin Reynolds and Adam Arellano break down the latest cybersecurity headlines, the growing risks of AI-powered attacks, and whether defenders can keep up. ShipTalk is brought to you by Harness. ShipTalk, AI security, cybersecurity, Five Eyes, AI national security, Fable, Mythos, security workforce, ISSA, software delivery, DevOps, AI jobs, CISO.  Adam Arellano: https://www.linkedin.com/in/adamrossarellano/ Martin Reynolds: https://www.linkedin.com/in/martinreynolds/

A hacker used Claude Code to help attack nine South Korean banks. Citrix finally released a security patch, but attackers may still be inside. And OpenAI reportedly lost $20 billion more in a single year than expected. Is the AI spending boom sustainable? This week on ShipTalk, Martin Reynolds and Adam Arellano break down the biggest stories in AI, cybersecurity, and software delivery. We cover how a 26-year-old hacker paired Claude Code with an open-source penetration testing agent, why Citrix's delayed patch raises bigger questions about software security, and whether OpenAI's mounting losses point to an AI infrastructure bubble. Plus, we discuss Harness's acquisition of Augment and the future of AI software factories, Google's AI medical assistant, and whether OpenAI's model safety announcements are becoming the new normal. Also in this episode: How AI agents are lowering the barrier to cyberattacks Why faster software delivery could be the key to better security What AI software factories mean for developers Whether massive AI investments are producing real breakthroughs The privacy tradeoffs of AI in healthcare ShipTalk is brought to you by Harness. Join us as we break down how software delivery is changing in the AI era. Learn more: https://shiptalk.io Powered by Harness: https://www.harness.io

Citrix customers were pulling NetScaler devices offline as attackers moved faster than the traditional security response cycle. This week on ShipTalk, Martin Reynolds and Adam Arellano are joined by Starr Brown, Director of Open Source Projects at OWASP, to break down the latest Citrix NetScaler security crisis, why exploitation is happening so quickly, and what it means when defenders may have only hours — or less — to react. They also dig into the rise of AI-powered cyberattacks, whether human security teams can realistically respond at machine speed, why resilience may matter more than shipping the next feature, and whether AI companies can really be trusted to regulate themselves. Plus: who actually writes technology regulation, Wall Street’s push to secure investment-grade ratings for OpenAI and Anthropic, and the biggest mistake companies are making when they assume security simply comes with their AI tools. ShipTalk explores how software delivery, AI, security, and engineering are changing in real time.