AIHOY, AInauts!

This week, we had video calls with four people who don't exist.

We chatted about hacks and forgotten passwords, and one of them signed off by explaining why connection matters more than perfection. They laughed, nodded, and let us finish our sentences. None of them could speak German.

Griffin is the most lifelike AI avatar experience we've had so far. And it isn't the only thing this week that sounds a little wild but actually works: AI finds bugs in German laws, an agent files a lawsuit, and 20 minutes later the company wants to settle.

To wrap up, Sam explains over his first Guinness why there are far more security vulnerabilities out there than we think. We'll also show you how to turn your agent into a security watchdog.

Here's what we've packed for you today:

Let's go!

The 8-hour workday is becoming a 4-hour workday for people who know how to use AI.

Everyone else is still catching up.

This AI work playbook shows you exactly how to cut your work hours in half using AI.

Sign up for Superhuman AI and get:

Claim your AI playbook

A few weeks ago, we introduced Griffin from Tavus: an AI counterpart for live video calls that fooled almost one in two people. We applied as testers and promised to report back once we got access. Now we're in.

In the research preview, the model is called Griffin-Lite. But you don't talk to “Griffin.” You talk to Pals, Tavus's name for its AI conversation partners. We tried all four: Ashley, Ben, Kenji, and Andrea.

Each has a biography. Ashley makes internet-culture videos in Brooklyn. Kenji is a fitness coach. Andrea is a photographer in Porto with two cats. Ben grew up in Lyon.

First things first: Griffin is the most impressive thing we've seen in this category. It didn't take long to find the rough edges, either.

The timing works. The Pals don't interrupt when you pause to think. They nod, laugh at the right moments, and pick up on things you said a few minutes earlier.

Ashley felt the most authentic in our test. We told her we'd been researching hacks and security vulnerabilities. Her instant response: that sounded intense, and she could barely remember her Netflix password!

When we pointed out that you're not supposed to remember it, you're supposed to use a password manager, she admitted we'd caught her out. Those little moments decide whether a conversation feels real.

Ben got almost philosophical at the end. We gave him a minute on stage, and he used it to pitch connection over perfection. A little cheesy, but well put and fluently delivered.

Here are a few clips from our spontaneous conversations with the Pals. Language note: our commentary in this video is in German; the conversations with the Pals are in English.

First question: Do you speak German? No luck. None of the four Pals managed a proper sentence.

Ashley tried “Wie geht es dir?” Kenji produced a broken “Guten Tag” and openly said he was stuck in English. Ben grew up in Lyon and has a French accent, but still couldn't understand our French. Was that our fault? Not this time.

So Griffin isn't usable in other languages yet. If it works this well in English, surely the rest is just a matter of computing power. Right?

The facial expressions are mostly convincing, even when mouths and faces occasionally blur or a frown looks a little too artificial. Think of a Zoom filter that smooths a face too much.

The hands still aren't quite natural. Ben says he knows only a handful of gestures. No peace sign, no using both hands at once. He put it well himself: the hands are usually where the illusion breaks. Kenji had the same problem.

Because it looks so deceptively real, the new Griffin model isn't publicly available yet. Once Tavus opens the technology for custom applications, it gets interesting for businesses.

We don't need this kind of counterpart in our own daily work yet. Griffin gets interesting wherever people would rather talk than type.

A few roles come to mind immediately: an expert you can quiz on video. A coach to think through a problem out loud with. A training partner for difficult conversations in sales, customer service, or consulting.

And we wouldn't rule out the occasional long-distance relationship, either...

To try it yourself, you can join the waitlist here.

Most teams add a second database for analytics. Then manage sync, lag, and drift forever. TimescaleDB extends Postgres instead. Hypertables, 95% compression, aggregates. No pipeline.

Get $1000 Credit

Now for something completely different.

At its core, law is text. A lot of text, full of references, exceptions, and cross-references. Pretty dry for most of us.

Exactly the kind of material language models like!

Two German builders used AI to comb through German regulations and say they found a whole series of potential loopholes.

The idea: a regulation has to state which law authorizes it. If the reference is missing, the rule may be on shaky ground. It's like code calling a function that was never imported.

They published three noncritical examples from their analysis:

The pair are deliberately withholding the more critical potential loopholes. And to be clear: this is their assessment, not a binding court ruling.

The jump is still notable. A little over a year ago, the best models found just 2 to 10 percent of the planted errors in a test using deliberately flawed laws. Now people are finding real candidates.

The raw material is out in the open. Global Law puts the laws of nearly 200 countries in a GitHub repository with a history of changes, queryable through MCP.

Switzerland is fully covered, Germany partly, and Austria currently has its constitution and data protection law.

Finding loopholes is one side of it. The other is using AI to pursue a claim.

In the US, an entrepreneur says he had Meta's Muse agent file a lawsuit. Twenty minutes after the company was served, it offered to settle. Ten days later, the money was in his account, including his costs. No lawyer or legal fees.

There are routes that don't always require a lawyer: an online payment-order application in Germany, for example, or certain lower-value cases before a local court. In Switzerland, many disputes start with a conciliation authority. The right route depends on your country and case.

What flight-compensation services demonstrated for delayed flights could now extend to unpaid invoices, withheld deposits, or subscriptions that refuse to go away.

After marketing, legal work looks like the next domain getting shaken up:

Law is becoming accessible in a way that used to be reserved for code. That cuts both ways: people looking for loopholes can find them faster, and lawmakers will need to run their own texts through AI, too.

You may have written off an unpaid €200 invoice because a lawyer would cost more. AI can help you assess whether pursuing it is worthwhile.

Does that replace a lawyer when things get serious? Of course not. But you can start with the question, “Is this worth pursuing at all?” Here's a prompt for a dispute with a retailer, landlord, or over a contract:

AI models are scanning other people's code for vulnerabilities at scale. And finding them everywhere, including the recent critical PHP vulnerabilities. For you, that means patches arrive faster, but so do attacks.

What matters is noticing in time when one of your tools is affected.

There are official, publicly accessible vulnerability databases: Google's OSV.dev for software and packages, US cybersecurity agency CISA's Known Exploited Vulnerabilities catalog for vulnerabilities already being exploited, and ENISA's European EUVD. Free, no account required.

Now someone just needs to check whether you're affected. Spoiler: not you. Your agent.

Give your agent the instructions below.

It works through four stages: inventory, initial scan, fixes, and monitoring.

You can optionally connect the OSV MCP server.

No agent? Create a free OpenCVE account and subscribe to your vendors and products, such as WordPress, Synology, or AVM. You'll get an email when a new vulnerability appears. Matching it to your setup is still your job.

An agent that patches without permission can take down your website just as effectively as the vulnerability itself. We use the same probation period as for any AI employee: alerts and drafts first, permissions later. Start with the setup so you hear about critical vulnerabilities early.

OpenAI CEO Sam Altman had his first Guinness at the pub with Stripe co-founder John Collison this week, spending nearly an hour talking about PHP vulnerabilities, agent teams, and cheaper AI. It's worth watching.

Three things caught our attention:

Sam doesn't believe in one all-powerful AI. He'd rather have a trillion slightly superhuman AIs than one AI with a trillion IQ.

His argument: society is resilient because its members keep each other in check.

On the PHP vulnerabilities in our Black October Deep Dive, he says the models have been capable of this for a while. Nobody had pointed them at everything yet. He expects us to discover that we live with far more serious vulnerabilities than we realize.

He isn't giving the all-clear. Patching individual bugs is a bandage; architectures built up over decades need to change. Code, laws, contracts: wherever rules live in text, AI is now finding the errors.

Sam sees more companies with the problem of using too little AI than too much. He'd be happy never to do fake work at a computer again. Same, Sam.

That's work you do only because two systems don't talk to each other: typing invoice details from email into accounting software, copying contact-form inquiries into a CRM, renaming files, moving numbers from one spreadsheet to another.

That's the first job for your agent. We keep saying it: in principle, your agent can do the things you do on a computer. You have to teach it how.

You don't even have to find the busywork yourself:

The other side of it: the more agents work for you, the more their permissions and oversight matter. See the watchdog above.

You made it! If you've read this far, which topic interests you most?

Drop us a reply. We read every one.

See you in the next issue.

Reto & Fabian, your AInauts