Real Alpha
Try Pro free

Newcomer Pod · 3 min · Aug 3, 2026

Claude found an S3 key during reverse engineering

Pim de Witte · CEO, General Intuition

An intern used Claude to inspect an app while waiting for an SDK, and the model found an S3 key and pulled documentation.

In this episode

Full analysis
  1. 17:04Game data can pretrain robots, but real-world tuning still matters9 min
  2. 32:42Specialized robots may beat humanoids in homes4 min
  3. 42:26Build scientific skills alongside AI literacy5 min
  4. 36:10Medal matches game skills to paid AI-training work6 min
  5. 12:28A mobile game can have sound mechanics and still stall3 min
  6. 55:34Claude found an S3 key during reverse engineering3 min
  7. 27:28A top game using General Intuition models could arrive next year3 min
  8. 5:55Factorio and RuneScape are strong hiring signals3 min
“Like, the biggest risk to companies is probably your own employees bytecoding stuff, not realizing they're hacking things, right?”
Pim de Witteat 57:28 · Newcomer Pod
57:28

Takeaways

  1. The intern did not realize the model had accessed the key.
  2. Pim filed a disclosure report with the affected company.
  3. AI-assisted reverse engineering can uncover real infrastructure secrets.

About this segment

An intern used Claude to inspect an app while waiting for an SDK, and the model found an S3 key and pulled documentation. Pim de Witte says employees can trigger security incidents without realizing it.

Pim de Witte

Pim de Witte is CEO of General Intuition.

Co-founded General Intuition, a frontier AI lab for spatial-temporal reasoning, and previously co-founded gaming platform Medal.

  • EN

    Eric Newcomer, Host

From “The Startup Building World Models From a Billion Video Game Clips”, Aug 3, 2026. Watch the full episode

Answers “Is AI dangerous?” See all 112 answers

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

  1. 55:43

    are really good at figuring out which models are good at predicting which types of of tokens and and they use the different models they describe different models for for different purposes right you don't know i think you just have to prepare that distillation will happen uh it happens all the time uh and i think so what it comes down to is just what do you put in the models like everyone just like what do you put in the models right and and how do you train them and how do you evaluate them and and and um putting the balls to stop distillation you mean or i you just have to run faster i'm talking about like the biological tokens and things like that where like you just have to be very cautious about what goes in oh you're saying as long as they're like benevolent not doing anything bad cyber capabilities all these things that are now showing clearly shown to be very dangerous right

  2. 56:28

    I'll give you one example. You saw the OpenAI, the recent event with Hugging Face. We had an instance where one of our interns, I tasked said intern with reverse engineering and APK, and I told him how to do it, and it was completely a legitimate use case. We were just waiting on an SDK from a company. They hadn't sent it yet. They said they were going to send it. They were backed up. So we looked at how the system of the SDK works through the APK.

  3. 56:56

    So I tasked him with this at night. I was at the office at like 9. I went to play some soccer. I come back the next morning. Intern's like, hey, I'm really, really happy this worked. So I was like, okay, how did you do it? And he shows me the cloud trays. And Claude had found an S3 key. Oh, my God. And had actually pulled. That's like Amazon. He found like a secret file. He found a secret bucket access key that then essentially the model infiltrated to then pull down documentation to reverse engineering.

  4. 57:22

    Oh, my God, which the intern didn't even realize was how. The intern did not realize this happened. And so... You then have to call the company and say, oh... Yeah, I wrote a disclosure report. Turns out that the model found a very real vulnerability. But my point is that there is a lot of... Like, the biggest risk to companies is probably your own employees bytecoding stuff, not realizing they're hacking things, right?

  5. 57:43

    And so, like, this was, you know, no harm done here, right? They pulled down documentation. But like legally speaking, you access information that you're probably not supposed to access. Right. And so there's so I think there's just, you know, people we have to start working together.