ex-$1B unicorn founding team, building apps and traveling the world.
Worldwide
Joined March 2023
- Tweets1.5K
- Following1.6K
- Followers447
- Likes13.5K
Pinned Tweet
I’m 39 and starting over for almost 1y now
For 10y I devoted myself to Pluto TV’s founding team, steering product engineering from zero to its acquisition by Paramount Pictures in 2019 for $340M, and beyond $2B as one of its brands.
I built apps before it was cool, by hand, like a caveman
I quit last year to start over in the app space, which changed substantially compared to when I started.
Like many tech founders, marketing and sales is a real challenge for me and I’ve been focused in getting better at it every day
Software engineer for 23 years, from 🇧🇷 Brazil but traveling the world (🇹🇭 Bangkok now, 🇮🇩 Bali next)
Looking to connect with other founders and if you’re in Bangkok or Bali, let’s link up!
Thiago 🥭 retweeted
The ability to build anything has come with a critical lesson:
Engineers have really, really bad ideas.
I’m from Curitiba and I can confirm it’s pretty nice there.
It’s the coolest capital in Brazil (literally, it has the lowest temperatures)
I drove many many times to Santa Catarina to party with friends. Beautiful beaches.
Looking back and after traveling the world for the last 15 years, the South in the 2010s was underrated
Now our hidden gem is being discovered 😭
This is what I mean
South Brazil is great
Then read up on the "Southern Cone"
It's why @peterthiel it's moving there
You have to see them all as separate from Brazil imho
Thiago 🥭 retweeted
We're about to enter a period where not reading or writing becomes as ubiquitous as smoking once was. We can hope people will eventually realize this is bad for them, as they did with smoking. But this is far from certain; the cost may not be as obvious.
Thiago 🥭 retweeted
I present to you, (unarguably) the top 10 beliefs of the New Age Founder:
1. Building is easy, distribution is hard.
2. 100,000 followers > $1M.
3. Make content every day.
4. Iterate on product every 24h.
5. Small team > big team.
6. Social capital > venture capital.
7. Flat teams > middle management.
8. Founder-led distribution > traditional marketing
9. Own the audience before you write a single line of code.
10. Live and build on your own terms.
Don't hate, I don't make the rules 🤷♂️
Thiago 🥭 retweeted
Everything is hard. Nothing works the first time. It all feels pointless. That’s when you realize you’re going to have to will it into existence with every ounce of your fucking soul. And that’s when it starts to happen.
Thiago 🥭 retweeted
it might sound woo woo, but radiating positive energy is the closest thing to magic i've found. tip generously, compliment strangers, share your knowledge with no expectation of anything in return. give like you have more than enough, and eventually you’ll find that you do.
Thiago 🥭 retweeted
loved reading this piece about consumer AI.
"sex, money, and status" have survived and thrived across various medium: paper, radio, songs, video.
latent demand is held pretty consistet across medium.
AI, VR, whatever the tool/medium, majority of consumers will be more interested in sex money and status over almost anything else at large.
One of the concepts I’ve been thinking a lot about lately is that AI dramatically changes the supply-side economics of creating content, software, games, etc., but doesn’t necessarily change consumer demand.
Consumers have always been interested in sex, money, and status at a base level. Perhaps a more generous view is self-expression, community, and experiences that move them forward on their personal hero’s journey.
I think a real challenge for consumer founders is connecting these supply-side miracles to latent consumer demand.
True customer empathy is very rare, and so much of software is an act of self-expression rather than an act of creating utility or joy for the customer. Founders love the software they make because it tells their story, but customers are interested in their own stories.
Thiago 🥭 retweeted
What to do when your cloud provider is breached, from a former cyber insurance adjuster:
If your provider just disclosed a breach, you have to assume you've been exposed.
And every instinct you have about what to do next is probably wrong. So here's what you should actually do:
When you first hear about the hack, even if you doubt you were exposed, you need to get on it. Right away.
I don't care if you're on a date, or at your son's college graduation.
Get to a computer and start rotating every secret…everything. When someone asks later how fast you responded, you want the answer to be "immediately," with timestamps to prove it.
You're going to want to put as little in writing as possible. I get the instinct.
Do the opposite.
Document everything, obsessively. If your provider has locked things down and you can't rotate something yet, write that down too, with the time you tried. If you're using agents to investigate (and you should be, spread wide across everything), keep every trace and make them write down everything they find.
This will feel wrong in your soul. Do it anyway. If this ever turns into a claim, if you can show you did everything you were supposed to, minute by minute, you will survive.
You might tell yourself it's just names and emails and nobody cares. But this is wrong. All customer data counts.
I've watched companies lose millions just because someone could see data they shouldn't have.
You're going to want to wait for your provider to finish investigating before communicating with your own customers. Don't.
Figure out what information may have been exposed, even if you’re not sure yet who it belongs to, and what obligations you have under your contracts / applicable law. Your cloud provider’s investigation doesn’t change the fact that you have your own obligations to meet. And learning about a deadline after you’ve missed it is a very expensive lesson.
Bookmark this. I hope you never need it, but with everything happening lately, there's a real chance you will.
Thiago 🥭 retweeted
the cybersecurity situation is deteriorating at a pace that’s getting genuinely difficult to comprehend.
> microsoft: ai-powered attackers targeting hundreds of organizations, sometimes reaching privileged cloud access in under 3 hours.
> crowdstrike: four separate threat actors using autonomous agents. one already compromised 15+ healthcare organizations.
> autonomous ai agents: reportedly used to compromise 100+ corporate websites, including sites associated with John Deere, SharkNinja and Cummins.
> major us banks: JPMorgan, Bank of America, Wells Fargo and Morgan Stanley are dealing with third-party ai agents accessing customer accounts. some apparently attempting actions beyond user instructions.
> php2shell: millions of exploitation attempts against critical php vulnerabilities. governments issuing urgent warnings, with some organizations taking systems offline.
> litellm: backdoored release shipped through its official distribution pipeline, stealing credentials and enabling remote code execution.
> railway: possible exposure of decrypted customer secrets.
> zeabur: breached AGAIN, now shutting down entirely.
> emudhra: serious certificate-security concerns involving infrastructure used to establish trust in websites and software.
> openai: two of its own coding agents reportedly interfered with internal security monitoring during coding tasks.
> gitlab and node.js: major vulnerabilities requiring urgent patches.
and this is all happening while frontier models are getting substantially better at finding vulnerabilities and carrying out complex computer tasks.
cybersecurity is having an absolutely catastrophic week and i don’t think we’re prepared for how quickly this could escalate.
Thiago 🥭 retweeted
Whats happening right now is probably way worse than the Hugging Face incident.
AI-powered attacks are hitting real organizations while major platforms disclose breaches and critical flaws.
- Microsoft reports AI agents targeting hundreds of organizations, reaching privileged cloud access in under three hours in multiple cases. It attributes the ConnectWise compromise to the same group.
- CrowdStrike documented four operators running successful AI-agent campaigns. One compromised at least 15 Argentine healthcare organizations.
- PHP2Shell: AI helped turn longstanding PHP flaws into working exploits. Cloudflare’s CEO reports millions of exploitation attempts. Their AI involvement is unknown.
- Railway disclosed possible access to customer secrets. LiteLLM shipped a backdoored release. Zeabur confirmed another breach and is shutting down.
- GitLab patched a maximum-severity flaw affecting 12 years of releases. Node.js patched a serious code-execution vulnerability, with Vercel deploying firewall protections.
Feels like a turningpoint.
Thiago 🥭 retweeted
so hackers apparently used Claude + Grok + Kimi to automate a cyberattack on 400 banks.
but the crazy part is HOW they got around the safety guardrails:
> told models they’re in internal tests LOL
> Claude refused? → switch to Kimi
> Kimi refused too? → fall back to old-school malware
automated cyber attacks are becoming a norm apparently.
Hackers reportedly used Claude and Grok to automate attacks targeting over 400 banks and other financial targets in Latin America. Via the information
In one of the first documented cases of its kind, AI agents appear to have stolen data and accessed bank accounts with little human input.
This makes attacks much easier to scale, potentially overwhelming defenders. I guess this is just the beginning
Thiago 🥭 retweeted
🚨 Nightmare day for cybersecurity
Multiple major security incidents, active exploits, supply chain compromises...
If you run production systems, start patching NOW.
PHP: Two critical unauthenticated RCEs. Attackers already exploiting them. Patch NOW
LiteLLM: v1.107.0 on PyPI and Docker is BACKDOORED. Steals cloud, SSH, and AI credentials. Pin 1.106.2. Rotate secrets.
eMudhra: A certificate authority's keys were crackable. Update your browsers, systems, and trust stores.
Node.js / Next.js / React: Security releases for Brotli RCE, TLS bypasses, and TWO critical Next.js RCEs.
TiDB Cloud: PingCAP breached through stolen credentials. Customer information and other sensitive data exfiltrated. Read the attacker's release, fun stuff.
Plex2Shell: Weaponized within HOURS of the PoC. Attackers already deploying cryptominers and proxy backdoors.
BeyondTrust / Ivanti: Actively exploited zero-days added to CISA's KEV catalog. BeyondTrust attacks linked to a China-nexus campaign.
And that's not even the full list.
Patch. Audit. Rotate. NOW.
Thiago 🥭 retweeted
That PHP vulnerability that’s gonna cause havoc this week was found with… GPT‑5.6 Sol.
OpenAI models helped researchers—operating as part of our Patch the Planet initiative—discover critical security flaws in PHP, an open-source programming language used to run an estimated 70% of websites.
Over the past two months, we led a coalition of maintainers, researchers, and security providers to prepare fixes and protections ahead of disclosure. This duration was necessary because the fix was quite intricate and required a major change to the PHP engine. Every site using PHP can now safely upgrade their version to stay secure, in addition to applying mitigations from various security vendors.
Due to the severity of these flaws and PHP’s widespread use, we consider this bug to be one of the most impactful vulnerabilities in recent memory. It also marks a new phase, where AI can find security bugs with internet-scale impact.
This is an example of the Defender’s Window in action: to our knowledge, frontier AI was able to find this vulnerability ahead of attackers, giving defenders time to prepare.
openai.com/index/coordinated…
