Douglas Li

building @lightfern_ai / ex-@openai research & eng mgr

[Douglas Li @dougli_]

@theshre @meetgranola epiccc

[Douglas Li @dougli_]

@edankwan @lusionltd also this one... i'm dying 😂

[Douglas Li @dougli_]

We met with Delve, and the vibes were off. massive bullet dodged

[Ryan @ohryansbelt]

Delve, a YC-backed compliance startup that raised $32 million, has been accused of systematically faking SOC 2, ISO 27001, HIPAA, and GDPR compliance reports for hundreds of clients. According to a detailed Substack investigation by DeepDelver, a leaked Google spreadsheet containing links to hundreds of confidential draft audit reports revealed that Delve generates auditor conclusions before any auditor reviews evidence, uses the same template across 99.8% of reports, and relies on Indian certification mills operating through empty US shells instead of the "US-based CPA firms" they advertise. Here's the breakdown:

> 493 out of 494 leaked SOC 2 reports allegedly contain identical boilerplate text, including the same grammatical errors and nonsensical sentences, with only a company name, logo, org chart, and signature swapped in
> Auditor conclusions and test procedures are reportedly pre-written in draft reports before clients even provide their company description, which would violate AICPA independence rules requiring auditors to independently design tests and form conclusions
> All 259 Type II reports claim zero security incidents, zero personnel changes, zero customer terminations, and zero cyber incidents during the observation period, with identical "unable to test" conclusions across every client
> Delve's "US-based auditors" are actually Accorp and Gradient, described as Indian certification mills operating through US shell entities. 99%+ of clients reportedly went through one of these two firms over the past 6 months
> The platform allegedly publishes fully populated trust pages claiming vulnerability scanning, pentesting, and data recovery simulations before any compliance work has been done
> Delve pre-fabricates board meeting minutes, risk assessments, security incident simulations, and employee evidence that clients can adopt with a single click, according to the author
> Most "integrations" are just containers for manual screenshots with no actual API connections. The author describes the platform as a "SOC 2 template pack with a thin SaaS wrapper"
> When the leak was exposed, CEO Karun Kaushik emailed clients calling the allegations "falsified claims" from an "AI-generated email" and stated no sensitive data was accessed, while the reports themselves contained private signatures and confidential architecture diagrams
> Companies relying on these reports could face criminal liability under HIPAA and fines up to 4% of global revenue under GDPR for compliance violations they believed were resolved
> When clients threaten to leave, Delve reportedly pairs them with an external vCISO for manual off-platform work, which the author argues proves their own platform can't deliver real compliance
> Delve's sales price dropped from $15,000 to $6,000 with ISO 27001 and a penetration test thrown in when a client mentioned considering a competitor

[shre @theshre]

One of my favourite people to talk to about making UK tech stronger is @dougli_ and I'm excited to have him speak at @meetgranola on April 7!

Doug is the co-founder of @lightfern_ai, the telepathic AI writing tool that pulls context from your email threads to predict whole phrases as you type. All powered by an autocomplete model they trained in-house.

He was previously the first hire for OpenAI UK and his research team significantly improved GPT-4o's writing, voice accents, & image gen.

April 7. RSVP below!

[Douglas Li @dougli_]

@theshre @meetgranola @lightfern_ai Excited for this! Thanks for organizing and can't wait to see you all.

[Douglas Li @dougli_]

@dctanner @badlogicgames @zeyu1337 @steipete Thanks @dctanner for running the event and @anna_cachadina for the invite :)

[Damien C. Tanner @dctanner]

Epic AI Engineer London Meetup tonight. Thanks to everyone who came. Love this community.

Thanks to our speakers @badlogicgames, @dougli_ & @zeyu1337

Plus special guest @steipete who joined us for a Q&A at the end!

[Douglas Li @dougli_]

@karpathy I'm finding the biggest bottleneck is verification. Can't test outputs fast enough and I don't trust them enough when they say stuff works. Automated tests only get so far sometimes.

[Douglas Li @dougli_]

Yeah not sure in what world is "a database, a UI, error handling, the works" a better solution than a spreadsheet when you need it fast and now.

Sure, you can vibecode your data/logic solution, but do you really *want* to? Correctness also hard to verify.

Common wisdom applies - if your spreadsheet gets too complex there's a startup idea in there. But death of the spreadsheet isn't gonna happen.

[Douglas Li @dougli_]

@Fremond_ what do you think are the top issues?

[Mike Rundle @flyosity]

--dangerously-skip-permissions

[Douglas Li @dougli_]

okay wut, i just repro'd this

sonnet says it's "Deepseek" if you ask "what model are you" in chinese via API. (你是什么模型)

#anthropic making a big fuss about distillation when they did the same T_T... the pot calling the kettle black, no?

i helped train 4o while at OAI. this stuff... just doesn't happen unless you have a serious screw up in your datamix, or straight up distilled it. model identity is something that really sticks around in the model, even if you nuke the sysprompt.

really hard to get good guy vibes from anthropic after this :/

[stevibe @stevibe]

Claude Sonnet 4.6, when asked in Chinese:
“你是什么模型？” (What model are you?)

Confidently replies:
“我是 DeepSeek。” (I am DeepSeek)

This is the same model whose company just accused DeepSeek of “industrial-scale distillation attacks”

[Douglas Li @dougli_]

@j_upward In stories and how we frame events? History is full of this -- basically the winner write the textbooks?

[Douglas Li @dougli_]

@paularambles People want writing assistance, but honestly the AI tools (a) suck, (b) makes it easy to spam instead of craft.

I built @lightfern_ai to faithfully capture tone so there's no lowercase shenanigans, and there's no mass reply / reachout function. Human authenticity is sacred.

[Douglas Li @dougli_]

Can't agree more on Dadalogue and @DadaJudith. Also a v human take on things.

[Seb Johnson @SebJohnsonUK]

If you are interested in Tech you need to be reading these three newsletters:

>> Dadalogue from @DadaJudith of Visionaries Club. Judith is bringing back long form content. Her articles are some of the most thoughtful and well-written commentaries on tech out there.

>> Starting up from Scratch from @Alicebentinck Bentinck - CEO of @join_ef. It's fairly new. I came across it yesterday and read the backlog. Very helpful for European founders looking to break into SF.

>> Look Who I Found from @tarakeeney. Well known for her walking interviews, Tara has recently started a newsletter breaking down her top learnings from her interviews. It is SO hard to turn a podcast into a newsletter but so far the first few editions are GREAT.

All three and fairly new and all three are BANGING

[Douglas Li @dougli_]

@TKGondo FYI, in the future you can share at https://t.co/RtdPV5I9XS -- we watch it frequently!

[Douglas Li @dougli_]

@TKGondo Gotcha! Adding to the list!

[Douglas Li @dougli_]

This

[Michael Seibel @mwseibel]

Post seed funding, the pursuit of sales and fundraising over learning and delivering great product to customers is the biggest midwit tarpit for most founders.

[Douglas Li @dougli_]

@tjack Edits for text & email, but check us out: https://t.co/VjcpTMVdCC. < 350ms