Damian Figiel

Infrastructure Architect. Web3, Cloud, AI. I build and ship reliable platforms.

[Damian Figiel @DamianCTO]

The next billion-dollar data company won't have a human-readable UI.

We are entering the era of machine-native data, where the primary consumer of information isn't a pair of human eyes, it is an autonomous agent. High-performance indexing and decentralized data layers are the new plumbing.

If your data strategy depends on a "clean dashboard" you're optimizing for the wrong species.

Is your data layer ready for the machine-native era?

[Patryk Iwaszkiewicz @iwaszkiewicz_p]

Today we shipped our first app to the App Store.

I don't write code. My cofounder does.

The problem: managing medical documentation for a sick family member is a full-time job nobody trains you for.

The solution: @Healthkin_app - AI copilot that replaces the paper folder.

From personal pain to digital product.

[Damian Figiel @DamianCTO]

Open-source infrastructure for health products on top of wearables

[Patryk Iwaszkiewicz @iwaszkiewicz_p]

Most healthtech startups I know burn their first month on the same boring problem.

Wearable APIs.

The team I work with at @themomentum_ai just shipped the fix I've been quietly excited about for months.

Open Wearables.

Open-source infrastructure for anyone building health products on top of wearables.

Free. MIT. Live on Product Hunt today.

🧵👇

[X Freeze @XFreeze]

Interesting how it works

Elon puts up his own money, rounds up the absolute best AI talent on the planet, leverages every connection he has to secure serious resources, and launches OpenAI in 2015 as a pure non-profit explicitly created to develop AI for the benefit of humanity, with zero profit motive and open research

Then the “team” decides they want the bag
They push Elon out, take control, and quietly flip the entire thing into a for-profit machine

All while preaching the same sanctimonious lines on repeat: “We’re still mission-driven!” “AI for the good of humanity!” “We’d never abandon our principles!”

The ultimate betrayal:
Elon got zero equity. Not a single share. He funded it. He built the foundation. He got nothing while they turned his non-profit into their personal cash cow

This is the level of betrayal and hypocrisy we’re dealing with

And for the record.... this lawsuit doesn’t put a single penny in Elon’s pocket. Any win goes straight back to the non-profit to restore the exact mission he founded

[Damian Figiel @DamianCTO]

@Azure just lost its most valuable competitive edge.

@OpenAI officially ended its cloud exclusivity with Microsoft. Their models can now be deployed on any cloud provider, and AWS CEO @ajassy already confirmed GPT models are coming to Bedrock "in the coming weeks."

This was always going to happen. You can't build a $150B AI company and let one vendor own your distribution channel forever. The 2019 Azure exclusivity deal made sense when OpenAI needed survival compute. In 2026, it was just dead weight.

The real lesson is that single-cloud dependencies in AI were always a bad bet. Model access, GPU availability, data sovereignty, you want optionality in all three. Anyone who locked their AI stack to Azure assuming exclusivity would last is doing some uncomfortable math right now.

Is your AI stack still locked to one cloud or are you already spreading the risk?

[Damian Figiel @DamianCTO]

@HangZheng855161 Can you share your findings when you finish?

[Damian Figiel @DamianCTO]

OpenAI shipped GPT-5.5 yesterday. T.

It's designed to do work. Give it a messy multi-step task, and it plans, picks the right tools, checks its own output, and keeps going until it's done.

82.7% on Terminal-Bench 2.0. Claude Opus 4.7 scored 69.4%. That gap is not a rounding error.

And somehow it matches GPT-5.4's latency while doing more. Faster inference, fewer tokens per task. The performance/cost curve just keeps bending.

I run infrastructure. The honest question is "which parts of the pipeline do I hand over first, and what guardrails do I put in place before I do?"

What part of your infra would you actually trust an AI agent to run autonomously today?

[OpenAI @OpenAI]

Introducing GPT-5.5

A new class of intelligence for real work and powering agents, built to understand complex goals, use tools, check its work, and carry more tasks through to completion. It marks a new way of getting computer work done.

Now available in ChatGPT and Codex.

[Damian Figiel @DamianCTO]

France's national ID database got breached. 19 million records. Names, addresses, dates of birth, phone numbers. Up for sale on the dark web.

The vulnerability? Someone changed a number in a URL and got another user's data.

The hacker literally described it as "a really stupid flaw."

This is the third French government breach in four months by the way. OFII immigration office in January. Interior Ministry email servers in December. Now the national ID agency, roughly a third of the entire country's population.

Someone's having a rough few weeks in Paris.

[Damian Figiel @DamianCTO]

@Tech_girlll Are they using ONLY Python? I bet not

[Damian Figiel @DamianCTO]

Anthropic built a cybersecurity AI so dangerous they refused to release it to the public.

A Discord server cracked it on launch day by guessing a URL.

An anonymous group inferred the model's API endpoint from patterns in Anthropic's other models.

Just pattern matching and a Discord channel.

And Anthropic said they've found "no evidence this impacted our systems." Meanwhile, the group has been using the model since launch day and gave Bloomberg a live demo.

Third-party vendor access is the biggest hole in enterprise AI security. You can build the most locked-down internal controls imaginable, hand API credentials to a contractor, and your entire perimeter is gone.

Anthropic kept Mythos from the public to prevent it being weaponized. Then a third-party vendor with access to their infrastructure made that decision irrelevant in 24 hours.

How many of your vendors have access to something they shouldn't?

[George Pu @TheGeorgePu]

Anthropic just pulled Claude Code from the Pro plan.

Pro users wanting it need Max now.

$100/month minimum. 5x jump.

I'm on Max 20x so I'm fine.

Flagging for anyone on Pro who's about to find out.

No announcement. Just a pricing page edit.

[Damian Figiel @DamianCTO]

AWS just quietly validated everything the multicloud crowd has been saying for years.

Yesterday, AWS Interconnect went GA.

Private Layer 3 connections between your AWS VPC and Google Cloud, no public internet, MACsec encrypted, running over the AWS global backbone. Azure and OCI support coming later in 2026. And they open-sourced the spec under Apache 2.0 so any cloud can become a partner.

For a decade, cloud providers built proprietary silos on purpose. Lock you in, upsell you forever. Now the biggest one is literally shipping the bridge to its competitors.

Because enterprise customers are done picking one cloud and praying.

Outages happen. Costs spiral. Compliance requirements force geographic distribution. The "all-in on AWS" pitch doesn't close rooms anymore.

Multicloud is the future. AWS just made it the present.

[Damian Figiel @DamianCTO]

Attackers didn't breach Vercel's core infrastructure. They compromised Context AI, a third-party AI tool used by a single employee via a Google Workspace OAuth exploit. That got them inside.

From there, they accessed environment variables that users hadn't flagged as "sensitive", API keys, database credentials, secrets that power Web3 app backends. Chainlink rotated their keys immediately. Smart move.

Vercel has ISO 27001 and SOC 2 Type II certifications. Didn't matter. The weak link was an AI tool sitting on the edge of their trust boundary with OAuth access to internal systems.

Think about how many AI tools are running in your environment right now. Connected to Slack, GitHub, your cloud provider. Each one is a new attack surface that didn't exist 18 months ago.

This is the new supply chain attack vector. AI tooling.

If you're running Vercel-hosted crypto infrastructure or Web3 frontends rotate your keys today.

When did you last review what OAuth permissions your AI tools actually have?

[Damian Figiel @DamianCTO]

Someone forgot to lock the door.

CVE-2026-33032 critical Nginx UI vulnerability. CVSS 9.8. Zero authentication required. Complete server takeover.

The flaw lives inside the Model Context Protocol endpoint, the exact protocol that is wiring infrastructure to give AI agents control over servers.

One unprotected /mcp_message endpoint. An attacker hits it with a single request, no credentials, and they own your nginx: rewrite configs, restart services, full takeover. Recorded Future confirmed active exploitation. 2,600+ exposed instances sitting on the open internet right now.

[Damian Figiel @DamianCTO]

78.6 million Rockstar records leaked yesterday. Through a cloud cost monitoring tool.

That should really bother you.

ShinyHunters hacked Anodot — an AI analytics SaaS Rockstar used to track its own cloud spending. Extracted auth tokens from there, walked straight into Rockstar's Snowflake environment as a trusted internal service, and silently pulled 10 years of GTA Online and Red Dead player data.

Anodot flagged connectivity issues on April 4th. 10 days before the ransom deadline. The breach was already underway before anyone raised an alarm.

Supply chain pivots through SaaS integrations are now one of the most effective entry points into large orgs. And most companies aren't even auditing their third-party token inventory.

Do you actually know how many external services have active access to your cloud environments right now?

[Damian Figiel @DamianCTO]

Two days ago I was at my friend’s wedding.
He is 33, just got married, no kids yet.

I am 32, married 5 years already, with two kids.

When I compare my circle vs my wife’s circle, the contrast is huge.

Most of my city friends:
not married, no kids yet.

Most of her countryside friends:
married for years, already raising children.

Environment seems to shape life timeline more than we admit.

What is your observation?
How does it look in your circle?

[Damian Figiel @DamianCTO]

We're entering a phase where AI defines the attack surface. The orgs that figure out how to deploy this defensively, on their own terms, with their own data, are going to leave everyone else behind.

[Damian Figiel @DamianCTO]

Claude Mythos just scanned common software systems and found thousands of critical zero-day vulnerabilities, some of them sitting unpatched for 10 to 20 years.

Not obscure niche tools. Widely used software. The kind of stuff running your infrastructure right now.

[Damian Figiel @DamianCTO]

If a general-purpose AI can autonomously hunt zero-days faster than any red team on earth, the same model in the wrong hands becomes the most powerful hacking tool ever built.

[Damian Figiel @DamianCTO]

So what did Anthropic do? They locked it down. A consortium of 12 companies, Amazon, Apple, Cisco, Microsoft, CrowdStrike, the Linux Foundation gets controlled access. Everyone else? Waitlist at best.

The fact that they're gatekeeping this model is a signal.

[Damian Figiel @DamianCTO]

Enterprise AI adoption is going to look like hybrid everything, private network boundaries, heavy logging, and controls

[Josh Schlisserman @jslishi]

People are underestimating how regulatory-constrained enterprises will adopt AI.

I don't think it will be “cloud vs on-prem.”

My best guess: It’ll be privately hosted, VPC-isolated, audit-heavy deployments that look on-prem but run like cloud.

Still developing thoughts here.