Ep #35 Your AI Tools Are Leaking and Nobody Told You

Every organization with 50 or more people probably has someone quietly building AI tools right now. The question isn’t whether it’s happening it’s whether there are any guardrails around it. Kevin Williams and Matt Graham get into the governance gap that almost nobody in the ‘just start building’ conversation is talking about honestly.

Matt runs a security firm and watches the dark web. What he’s seeing in terms of exposed API keys, hard-coded credentials, and applications built without basic security hygiene has reached a level he’s never seen before. This episode is the conversation business owners and executives need to have before the next thing gets built.

The conversation covers the full picture: why citizen development concentrates key-man risk instead of reducing it, how to think about deterministic versus probabilistic workflows, what the Anthropic copyright settlement means for companies plugging their data into frontier models, and the practical governance steps any organization can take right now.

✅ Why vibe coding without documentation creates key-man risk

✅ How API keys get exposed and why it doesn’t require a hacker

✅ The five-minute cost cap task most organizations haven’t done

✅ Deterministic vs. probabilistic workflows: why the distinction matters for accuracy, liability, and cost

✅ What the $1.5B Anthropic copyright settlement signals for SMBs

✅ The Basecamp framework for governing citizen developers before things get complex