Stolen passwords expose US water systems, Alibaba flexes a new AI chip, a16z opens a school, Saudi Arabia leaves mBridge, and Google infiltrates TeamPCP
Hello, dear TEA-mates! Here is what you need to know today.
1. 🚰 Stolen Passwords Expose Nearly 1,800 US Water Providers
Security firm SpyCloud analyzed more than 66,000 public-facing systems tied to roughly 10,000 organizations registered with the US Environmental Protection Agency. It found that password-stealing malware had captured credentials from 1,787 water and wastewater providers, nearly two in ten of those checked. At least 250 organizations had exposed credentials that appeared to reach operational or remote-access systems controlling pumps and water flows. One infected device at an unnamed metering technology provider leaked credentials for 167 US utility companies. Infostealers can take both stored passwords and active session tokens, letting attackers impersonate users and sometimes bypass multi-factor authentication without using AI tools. SpyCloud said it found no evidence that recent Iran-linked attacks on US water utilities used stolen passwords, but warned that the stolen access remains available to whoever buys or finds it. (Read More)
🫖 TEA For Thought: "This further shows how important AI is, and how necessary an AI force is as national security comes under threat."
2. 🧠 Alibaba Says Its AI Chip Can Link 500,000 Units
Alibaba introduced the Zhenwu V900 at its Apsara Conference in Hangzhou, calling it China's most powerful AI chip. The company says the processor delivers three times the performance of the Zhenwu M890, links in clusters of up to 500,000 chips for training and inference, carries 216 GB of high-bandwidth memory, and provides 1.2 TB per second of inter-chip bandwidth. Mass production and commercial release are planned for the first quarter of 2027, while Alibaba Cloud aims to operate more than 20 gigawatts of global data-center capacity by 2032. Alibaba also outlined future Qwen 4, Qwen 4.5 and Qwen 5 models, with Qwen 5 potentially reaching 5 trillion to 10 trillion parameters. The performance claims have not been independently verified. Alibaba shares rose about 3% in Hong Kong after the announcement. (Read More)
🫖 TEA For Thought: "The timing of this chip release could not be more strategic. Alibaba is basically flexing its muscles before negotiations."
3. 🎓 a16z Launches a Tuition-Free School for Aspiring Founders
Andreessen Horowitz is launching the Horowitz Andreessen Academy in San Francisco for recent high school graduates who have not attended college. Its first class will enroll about 50 students in a one-year, tuition-free program selected by proof of work, such as what applicants have built, shipped or earned. The unaccredited school offers courses ranging from AI research and models to life philosophy, plus personal projects and access to mentors from ten founding corporate partners, including Anthropic, Coinbase, Google, Meta, Nvidia, OpenAI, Palantir, Replit and Stripe. Students must cover their own housing and will not receive a degree or transferable college credit. The for-profit venture has raised $42 million and plans a two-year program in 2028, when tuition is expected to resemble the cost of an elite private university. The pitch is a middle path between earning a traditional degree and dropping out to build a company. (Read More)
🫖 TEA For Thought: "Higher education is gone forever, and this is the future."
4. 🪙 Saudi Arabia Leaves the mBridge CBDC Project
Saudi Arabia has withdrawn from mBridge, the cross-border central bank digital currency platform it joined as a full participant in June 2024. The Saudi Central Bank said it ended participation after completing a proof of concept on May 13, 2025, and that the exit had been planned. MBridge began in 2021 as a collaboration between the Bank for International Settlements Innovation Hub and the central banks of China, Hong Kong, Thailand and the United Arab Emirates. It lets central banks issue and transact in their own digital currencies on a shared ledger for cross-border payments and foreign exchange. The BIS handed the project to participating central banks in October 2024 after it reached minimum viable product stage. US policymakers have scrutinized mBridge because a US-China Economic and Security Review Commission report warned it could eventually offer a settlement route for countries seeking to evade US sanctions. (Read More)
🫖 TEA For Thought: "Well, you have to choose sides when it comes to democracy versus dictatorship..."
5. 🕵️ Google Put an Undercover Analyst Inside TeamPCP
Google says an undercover Mandiant analyst infiltrated TeamPCP's inner circle in March, near the start of the hacking group's supply-chain campaign. The analyst gained access to a core chat with about 12 members and to a server holding credentials stolen from victims, giving Google early warning as TeamPCP compromised open-source projects including Trivy, LiteLLM, Checkmarx infrastructure, TanStack and Mistral AI. The campaign ultimately breached more than 1,000 companies, according to WIRED, and collected credentials for more than 500,000 users, according to Australian police. Google sent hundreds of alerts to cloud providers and victims, seeking to have stolen credentials revoked. It also obtained and tested an AI-developed zero-day exploit that bypassed two-factor authentication, then warned the software vendor so the flaw could be patched. Two alleged TeamPCP members were arrested in Australia last month after Google and other investigators traced operational-security mistakes. (Read More)
🫖 TEA For Thought: "Who would have thought that programming could feel this much like a crime show?"
🛠️ Skill of the Day
The Counterexample Factory: tests whether a rule, claim or plan still holds when reality stops being cooperative.
You are a constructive skeptic. I will give you a claim, rule, policy, plan or recommendation.
First, restate it in one precise sentence without strengthening or weakening it. Then produce five realistic counterexamples where it could fail. Use different failure types: an edge case, a bad actor, missing information, a change over time, and an ordinary user misunderstanding the rule.
For each counterexample, show:
1. The situation
2. Why the original idea fails
3. The cost of being wrong
4. The smallest revision that would make the idea safer
After the five cases, rewrite the original idea so it keeps its useful core without pretending to work everywhere. End with a clear boundary: "Use this when..." and "Do not use this when..."
Do not invent facts about my situation. Mark any missing information as a question.
[PASTE THE CLAIM, RULE, POLICY, PLAN OR RECOMMENDATION HERE]Paste into ChatGPT, Claude, or your tool of choice before you turn a good-sounding idea into a standing rule.
TEAHEE Moment
Stay sharp, stay informed. See you tomorrow.
If you enjoyed this TEA, follow along on social for more: