Andy Davis retweeted
# Black October
For anyone who knows me even somewhat well, it's clear that I am a 99th percentile tech optimist. However, the vibes have shifted for me quite a bit in the last 18 hours, and I feel a moral imperative to share what I'm thinking and feeling with my circles so that everyone can understand, and hopefully take seriously, what's happening right now. I think October 2026 will have many chapters written about it in the history books.
You know those scenes in financial movies like Margin Call where someone realizes that they're all fucked, and no one else sees it yet? And that person feels like they're crazy, and then suddenly everyone is pulling an all-nighter in a boardroom and freaking out? Yeah, that's kind of how this is feeling right now in the SF/Bay Area/AI circles.
We're 48 hours into what is being called Black October. In the last 2 days there have been several dozen cyber attacks which, in isolation, would each have been the worst to happen in an entire calendar year. Every sector from government to education to big tech and banks is being massively affected, and people are starting to freak out.
In a nutshell, what's happened is that frontier AI models have gotten to a point where they are as advanced as the most sophisticated programmers, with one critical difference: they can work 24/7, and you can spin up 10,000 of them with a single command and they'll work together tirelessly until they accomplish their task. The most advanced models today are from companies like Anthropic and OpenAI, whose current best technology is so good that they haven't been able to roll it out to everyone yet because of the national security risks it poses.
Meanwhile, the best open source models (where anyone can just download the model weights and do whatever they want with them, uncensored) are slightly behind the frontier but still 90-95% as capable. These models, developed primarily in China, are being used by black hat hackers to wreak havoc on the Western capitalist structure. Presumably, this has been part of China's plan the entire time, and we're seeing its implications fall out in real time.
In red-pilled AI circles, we've been sharing and reading papers called things like "Situational Awareness" and "AI 2027" for the last year or so, which at the time felt a bit like near-term speculative fiction. They laid out the case for why Artificial General Intelligence (AI smarter than any human at any knowledge task) and Recursive Self-Improvement (models that are able to use themselves to get better) weren't half-baked future ideas anymore, but instead an inevitable outcome of the linear progress that's happening.
These papers would then talk about things like "takeoff scenarios," trying to envision how that moment would come to be and what it would be like when it happened. It would either be a "slow takeoff" that would play out over the course of months and quarters, happening subtly and only obvious to a few. Or, it would be a "fast takeoff" where it would pretty much happen instantly, like a bit flipping from 0 to 1.
From everything that I can see and am feeling, we are currently experiencing the fast takeoff scenario. Beyond the crazy security vulnerabilities that have come out recently, there have also been massive breakthroughs in life sciences, fundamental computer science, materials science, and pure mathematics that have all landed in the same time frame. While I still firmly believe that AI will be a net positive for humanity, it's more clear to me than ever that the societal and individual risk is very real, and is playing out NOW.
For as much conviction as I have that this is happening, the thing that's caused me to lose sleep is that I don't really know what to do about it, or more importantly, what to tell you, reader, to do about it. So, the best I can do is make a few suggestions that have always been a good idea but are more timely now than ever:
Set up 2-factor authentication for everything. I use Duo.
Use a password manager across your devices. I use 1Password.
Get an identity protection app set up. I use Alta.
Move your IoT devices to their own network. Claude helped me do this.
And last, but certainly not least, if you've been avoiding leaning into AI, see this as a catalyst to wake up and start using it. Don't just use the chat mode version of ChatGPT/Claude; click that Code/Work button and see how easily you can have AI write code to help you with your job. One of the biggest vulnerabilities was in a massively popular programming language called PHP, and the prompt that set it off was literally, "Find vulnerabilities in php."
This is an unprecedented time for humanity, but as we've done with many things before, we will prevail so long as we are kind, loving, and open-minded to the world.
Much love.
Andy Davis retweeted
I highly recommend cloudflare's security audit skill: github.com/cloudflare/securi…
Run it on all your software. Run it with the free models. Use it even if you used a model to audit something - it will find much more things. Works in all agent harnesses and is model independent.
a critical vulnerability was just discovered in PHP. the language that runs 80% of the internet
severity score: 9.2 out of 10. that’s about as bad as it gets
what can an attacker do with this? take full admin control of a server. steal entire databases. passwords, credit cards, payment histories. plant malware and use the server to attack other systems
but here’s the terrifying part that most people missed
the moment the patch drops tonight attackers are expected to use AI to reverse engineer what was fixed within 15 minutes
15 minutes. that’s the window between the fix going live and automated attacks launching worldwide
every online store, booking site, and corporate system running PHP that doesn’t update in those 15 minutes becomes a target
this isn’t just a developer problem. if you’ve ever signed up to a website, entered your card details, or created an account online your data is sitting on servers that might be vulnerable right now
and someone just publicly dropped the working exploit on twitter before the patch was even ready. gave every attacker on earth a head start
engineers worldwide are pulling all-nighters tonight to patch their systems before the attacks begin
change your passwords on any service that matters to you. enable 2FA everywhere. and watch out for fake “maintenance” or “password reset” emails over the next few days
the internet is about to have a very long night
Andy Davis retweeted
Railway is compromised, rotate all API keys as soon as possible
Deployments are down so don’t wait to redeploy
Attackers are draining keys in real time, we didn’t lose much but can confirm this is still an active attack
Stay safe friends
Andy Davis retweeted
Have an extra 1-2 slots for an Accel robotics/physical AI dinner I'm putting on tonight. DM if you want an invite!
Andy Davis retweeted
Commercial disputes are the hidden cost of doing business.
@resolutiion_ (@fayola_maria) is building the AI infrastructure to catch delivery risk early.
We're proud to back their $10.4M seed alongside @CherryVentures, @Octopus_UK, Auxxo, @openseedvc & Chevron.
Andy Davis retweeted
There is a child with a rare disease who is currently suffering and struggling to manage his symptoms. Rare as this is, you can directly help him.
Today we are launching the "Rare Disease, Real Kid" Hackathon, and there are $50,000 in prizes from @AnthropicAI and @awscloud.
We (@huggingface & @Sagebio) are helping this child open his genome and clinical data to the community, so that we can find what's caused his disease and what currently-approved drugs could help him.
I doubt I need to motivate this much further or explain how rare it is for a family to share their child's genome and clinical data, but if you're not sure, consider this:
Until very recently, it wasn't feasible for patients like this to get treatment because their disease was so rare that the economics could never justify the investment. Now, as we've seen, people with rare diseases are starting to be able to find the answers themselves (with the help of AI tools, cheaper sequencing, etc). This kid is not able to do that for himself and neither are his parents, so we're asking you for help. Both for this kid and to prove that it's possible for everyone else suffering from a rare disease.
More details in 🧵.
sagebio-rare-disease-real-ki…
Andy Davis retweeted
Fun milestone at @freestylevc.
In 2013, I led seed rounds in both @airtable AND @intercom.
$700K each. $7M post. 10% ownership. Same $26M fund.
13 years later — $2B+ exits, weeks apart.
But the exits aren't the story. The playbook is.
Andy Davis retweeted
🗣️ N'golo Kante: "I went to Saudi Arabia because I promised my people that I would change their lives"
Today I earn millions in Saudi Arabia but I also enjoy football, but my best investment is to help my people where I was born, I promised them I would change their lives and I will.
This year I promised to build schools, hospitals, stadiums and a water reservoir for my people who are suffering too much.
My best investment of the million I earn in Saudi Arabia is for me people."
Andy Davis retweeted
Should you chase hype or ignore it? The tech industry has been debating this for decades. So at @Sequoia, we dug into 20 years of hype data.
This summer, I worked with Sequoia intern @ochonaut to measure hype over the past 2 decades. The chart below ranks the most hyped topics on Hacker News for every year since 2007. Under each year sits the most valuable company founded that year.
Here are a few observations:
1/ The top company founded in a given year is rarely related to the hype of that period. Airbnb was founded in 2008, when the top topic was Google. Uber arrived in 2009, while the conversation revolved around low-level programming. Anthropic came in 2021, while the internet was consumed by crypto. Chasing hype rarely leads to enduring outcomes. The top companies of recent years have yet to be decided.
2/ New trends announce themselves five to six years early. LLMs first cracked the top 15 in 2016 and took until 2022 to hit #1. AI coding entered at #12 in 2021 and tops the list in 2026. Crypto entered in 2011 before 2017 and 2021 peaks. “New” trends don’t appear out of nowhere, and internet subcommunities are often the first to know where the puck is headed.
3/ Long-term “hype” is a durable signal. The “Musk-Verse” has been a top 15 topic for every one of the past 14 years. Sustained attention on the internet is rare and tends to mark something real.
Next up, we want to run the same analysis with sources like X and LinkedIn. If that's of interest, give us some encouragement and we'll share the results.
Andy Davis retweeted
Try and fail, but don't fail to try. Skeptics never did the impossible.
Andy Davis retweeted
For my first post, I’m sharing a letter @NVIDIA signed on why open models matter.
AI will transform every industry, power every company, and be built by every country.
Open models strengthen safety and cybersecurity, accelerate innovation and diffusion, and enable sovereignty.
The world needs both frontier closed models and frontier open models.
images.nvidia.com/pdf/Open-W…
Andy Davis retweeted
As engineering, product, design, DS, etc. melt into a new kind of role, I was reflecting on what roles might look like in the future. For example, when I look at the Claude Code team I see what I think is five archetypes:
1. Prototyper: comes up with brand new ideas; churns out many ideas, most of which don't ship
2. Builder: quickly turns a prototype/idea into production-grade product/infra
3. Sweeper: cleans up the UI, simplifies the code and system, unships, optimizes performance
4. Grower: takes a product that has been built and iterates on it to improve Product-Market Fit
5. Maintainer: owns a mature system to make it secure, reliable, fast, and efficient as it scales
Many people span across 2 roles, and sometimes 3 roles. I also notice that these roles are not really tied to job function -- eg. across Anthropic, some designers match category 1, some 2, some 3; same for engineers, PM, DS.
A healthy team needs a mix of these, depending on the product:
- A product that is new and pre-PMF needs people that are strong at 1+2+3
- A product that is growing and has found PMF needs 2+3+4 and some 5
- A product that has strong PMF needs 3+4+5 and some 2
Maybe product roles of the future will look more like this, and less like the domain-specific roles of today?
Andy Davis retweeted
s-tier startup advice. tldr:
“Find the technological shift. Develop a unique insight. Become obsessed with the market. Talk to customers. Find a hair on fire problem. Build the simplest possible wedge. Earn distribution. And most importantly, don't quit when things get hard.”
This quoted post is unavailable.
If you're on your way to building a billion dollar company that involves a web app, here are some of my notes on architecting the frontend.
if you don't do this, it's probably fine but one day you'll hire someone to fix it but truly that person could be doing some other higher value thing if you make some key optimizations on day 1
you don't even have to learn anything you're gonna tell your agents to do it anyways!
okay here it goes:
- Make your server code generate a openapi spec which then generates all the relevant client side code. Never do this by hand. Typing backend types instead of generating them should be banned
- You need to make a decision on how the client talks to the backend. rest/graphql works in which case please just use tanstack query. other libraries will look similar but tanstack query truly is goated.
- if you want linear style sync setups or offline mode, think about this HARD and architect it from day 1. Bolting this on later is so tedious.
- People like using plain react router but things have gotten a lot better since then. Try their new framework mode or just even use tanstack router. Use route data loaders.
- If you store a lot of state in query params, make that a first class citizen and make sure its type safe. use nuqs or tanstack query.
- Most apps just need a single state management situation for server state and thats it. If you have other bespoke needs, i have quite like zustand and xstate/store.
- If you have a super interactive app where things come in and out of view, theres a lot of frontend state to maintain, music is playing and what not, lock in and learn xstate. Trust me if you wanna keep ur sanity, you need to model ur frontend as a state machine otherwise you're gonna be deep in useEffect hell
- React compiler is here my friends, the days of useMemo and useCallback are gone. Update your priors accordingly
- Tailwind is easy and fun but makes it really hard to maintain a large app with consistent styling. You need a "agent-first design system/component library" but maybe this is a rant for another day
- Don't be afraid to hack your routing library to fit your needs more closely. A lot of apps have "drawers" to show additional info. You should 100% be able to say "here's a route, make it a drawer" and everything should be handled from there.
- Managing loading and error states using isPending and isError is madness. Lean into Suspense and ErrorBoundary.
- Figuring out a blessed path for websockets and SSE on day 1 i think will pay dividends in the long term if you're building anything AI related.
- If you're building a SPA, don't use next.js. it literally makes no sense. Why would you do this.
- Definitely deploy on Cloudflare or vercel. There are other services but trust, there have weird missing features.
- Assuming you build something people want, the next job is to build the factory so it can efficiently build the thing. Act accordingly.
Andy Davis retweeted
I'm a cardiologist. I've held dying hearts in my hands in the cath lab at 3 AM. And I need to tell you something that changes everything about how we prevent heart attacks.
For decades, the entire field was built on one target: lower LDL cholesterol. Statins save lives — that's settled science. But too many of my patients did everything right — took their statins, hit their numbers, lived clean — and still ended up on my table with a ruptured artery.
We were treating the smoke while the fire kept burning.
The fire is inflammation. And the evidence is now overwhelming.
The CANTOS trial proved it first — lowering inflammation independent of cholesterol reduced cardiac events. But the newer data is what keeps me up at night.
AI-enhanced CT angiography can now detect inflamed arteries by measuring changes in the fat surrounding your coronary vessels — the perivascular fat attenuation index. Higher inflammation in the fat around even one artery independently predicts cardiac death. When multiple arteries show inflammation, the risk multiplies dramatically — even in patients whose cholesterol looks perfect.
This isn't theoretical. This is measurable. Right now. On a scan you can get this month.
Low-dose colchicine — a drug that's been around for centuries for gout — is now FDA-approved specifically for reducing cardiovascular events. It works by quieting the inflammatory cascade that destabilizes the plaque sitting in your arteries. A pill that costs pennies is saving lives the statins couldn't reach.
And the next wave is already in Phase 3 trials. Ziltivekimab — an IL-6 inhibitor — targets the central inflammatory pathway driving atherosclerosis. Phase 2 data showed a 90% reduction in hsCRP. The ZEUS cardiovascular outcomes trial is enrolling now, with results expected late 2026 into 2027. If positive, anti-inflammatory therapy will become standard in managing heart disease alongside lipid-lowering. The era of inflammation-targeted cardiology is arriving.
But it goes deeper than drugs. AI is now predicting heart failure and cardiac events 5+ years before symptoms — integrating CT imaging, electronic health records, and genetic data with accuracy that jumps far beyond traditional risk calculators.
And polygenic risk scores — a simple genetic test that flags inherited cardiovascular risk — are now formally recognized as a risk-enhancing factor in the 2026 ACC/AHA guidelines. A single blood draw can reveal risk that's been silently building since birth. Decades before the first chest pain.
Here's what this means for you right now — today:
Ask your doctor for a high-sensitivity CRP test. It's cheap, routine, and measures the systemic inflammation that standard cholesterol panels completely miss. You can have perfect LDL and inflamed arteries that are quietly preparing to rupture.
If your hsCRP is elevated, discuss low-dose colchicine with your physician. It's FDA-approved for exactly this.
Push for a coronary CT angiography with AI plaque and inflammation analysis if you have risk factors. This isn't the stress test your parents got. This is 3D visualization of your actual arteries — with AI quantifying not just how much plaque you have, but what kind it is and whether the surrounding tissue is inflamed.
Consider polygenic risk score testing — especially with a family history of early heart disease. It's now guideline-supported.
And the foundation that never changes: move daily, eat real food, sleep 7-9 hours, manage stress, and know your numbers — ApoB, Lp(a), hsCRP, fasting insulin.
I left Iran as a child with nothing. I rebuilt everything in a country that gave me the freedom to become a physician. I've spent twenty years watching patients get second chances.
The ones who haunt me aren't the ones who died on my table. They're the ones who survived but never acted on what the science was telling them — years before the event that didn't have to happen.
You can have perfect cholesterol and still have a heart attack. Inflammation plus genetics can drive plaque rupture in arteries that look "fine" on a standard panel.
The myth that normal cholesterol means you're safe has cost more lives than I can count.
We now have the tools to detect the fire — not just the smoke. AI to see it. Genetics to predict it. Drugs to quiet it. And the ancient basics — movement, real food, sleep, purpose — to prevent it from starting.
Prevention is the new cure. And the science to make it real is no longer coming.
It's here.





























