• Edward Tian co-founded GPTZero in college, building it into a success before selling to Superhuman.
• He said he thinks that creating 'artificial scarcity' for the product contributed to its success.
• He said he'd major in the humanities, not computer science, if he went to college today.

This as-told-to essay is based on a conversation with Edward Tian, the 26-year-old cofounder of GPTZero, who's based in New York. His words have been edited for length and clarity.

I was never planning to go down the founder path straight out of college. I had a visual investigations fellowship lined up for after graduation and was ready to start a journalism career.

My cofounder Alex and I went to high school together. When ChatGPT came out, he was pursuing his Ph.D. in computer science at the University of Toronto, and I was in my senior year at Princeton. Over winter break, we built an AI detection tool and put it online. The success was almost overnight.

Three years later, we sold our company, GPTZero, to Superhuman, and have stayed on board to work with the team. Superhuman is a very pro-AI company, and I think it was an unexpected move for us as an AI detection company to join them.

We didn't build GPTZero to say there should be no AI on the internet. I think that's the biggest misunderstanding about why we started our company, but my feelings on AI have changed.

I had a different job lined up for after graduation

I studied computer science at Princeton and worked with a professor at the Princeton Natural Language Processing Lab on AI research. I also worked on a few other startup projects in school, but I was always hoping to work in journalism.

While in college, I became very involved in the open-source investigation community. I ended up working on open-source investigative projects with the BBC and Bellingcat, and had a visual investigations fellowship at The New York Times lined up after graduation, which I was excited about but ultimately didn't take.

After ChatGPT came out, I was inspired to investigate where and when AI was being used online. It took about a week over winter break to build the first version of our AI detection tool, and it was released in January 2023.

We created artificial scarcity to help grow the business

My cofounder Alex and I posted on social media to market the tool so people could try it, but we didn't view it as a business right away. However, it blew up online pretty quickly. After seeing the success, we wanted to double down on the opportunity and turn it into a legitimate site.

One piece of advice I have for founders is that using a waitlist is really helpful for generating hype and excitement. We put the first version of GPTZero on a waitlist because it had reached capacity. So I think that artificial scarcity was also very helpful in the success.

We had a lucky combination of very talented engineers and some traction and buzz, so we started reaching out to VCs. Many of our early VC partners went to my alma mater, and kind of all knew each other. Jack Altman is also an investor, and I remember we had a call where I was in my dorm room, and he was like, "Oh, I recognize that dorm room too."

For founders raising funding for the first time, my advice is not to optimize for the flashiest name or the biggest brand because you think it will attract future talent. Go for where there's familiarity and trust; trust is the most important thing when working with an investor.

We raised around $3.5 million in our first funding round. I stayed at Princeton to finish my senior year and graduate, and we kept growing the business. My cofounder Alex left his Ph.D. program to focus on the business.

It was bittersweet to sell the company

When Shishir, the new CEO of Superhuman, joined in 2025, we spoke with him about his broader platform vision for a suite of products. He thought we could be part of the authenticity suite he wanted to create.

It was bittersweet to think about giving up something that we started from scratch and put so much energy and care into. At the same time, it was a lot easier because the team stayed on. I'm now a director of product at Superhuman.

For company acquisitions, a lot of folks think the three most important things for a great fit are product match, people fit, and economic sense. We had similar people philosophies, and the deal made sense financially. Then, product-wise, we realized we're definitely not against AI use anywhere in education. We just want to make sure there's some authenticity and truth with that usage.

Over the next few years, we're going to take our shot at building a startup within a larger company. I've seen a lot of startup founders go to larger companies and start their moonshots from within.

The bigger mission we have is to take steps to ensure people are being respectful of the person who's on the receiving end of AI generations and productivity now. We want it to be that we're reaping the benefits of AI without making other people deal with more work.

I wouldn't major in computer science anymore

When we first started GPTZero, I think I was actually more pro-AI than I am now. I believe people should know when something is AI-generated, but I wasn't saying not to outsource anything at all.

In the past year, though, I've started to see an over-reliance on AI among people who finished university after ChatGPT was launched, especially with writing. If I went back to college right now, I wouldn't major in computer science. I'd probably major in journalism and get a minor in computer science. I'd get a humanities degree because those are the important skills now.

I've started to see a friction point at work when people can't write or edit, and everything they send reads like AI. Part of what I'm doing now at Superhuman is working on responsible AI usage policies and guidance.

People are allowed to use these tools however they see fit. At the same time, I feel a profound sadness for the internet at large. It's important to make sure we still have human-written content online.

Do you have a story to share about working on a tiny team? If so, please reach out to the reporter at aapplegate@businessinsider.com.

• PHP, the open-source computer programming language, had two major vulnerabilities exposed.
• Yonaton Keller woke on Wednesday to panicked messages about the two PHP vulnerabilities.
• He shares three steps you can take to protect your website.

This as-told-to essay is based on a conversation with Yonaton Keller, a 46-year-old product manager at Zafran Security, based in Tel Aviv. His words have been edited for length and clarity.

When I woke up at 6:30 a.m. on Wednesday, I had multiple messages from around 4:45 a.m. alerting me that two vulnerabilities in the PHP programming language had been disclosed.

I immediately understood that this was a very serious situation.

Websites run different versions of PHP, and it's estimated that around 70% of websites worldwide use it. This isn't the first time PHP vulnerabilities have been found, but these ones require essentially no authentication on the attacker's part.

It's a very tricky situation. If it were a year and a half ago, nobody would have really responded to this so urgently. But this might be one of the first major incidents of its kind in this AI era, and the cycle of how attackers operate and how we typically respond is broken.

AI enhances detection and response times, but it also means that any limited-technical person could exploit these vulnerabilities within minutes.

My team was very concerned and had to act fast

I'm based in Israel, so when it was 6:30 a.m., my time, it was the middle of the night in the US. This time gap worked in our team's favor, as we had time to figure out what was going on before our customers woke up.

PHP is an open-source computer programming language used to create websites and web applications. It's such a widely used programming language that we immediately understood that every one of our customers, which includes major corporations and businesses, would likely be affected by this.

With bugs or critical flaws in the infrastructure, like the two that were found in PHP, exploitation is actually quite easy, especially if you use AI agents. That was the first thing we understood: even completely unskilled attackers can use these vulnerabilities to take down sites.

The PHP Foundation said it would disclose the details of the vulnerabilities and release a fix for newer versions of the language around 5 p.m. Israel time. But some details had already been informally disclosed on an online forum. The post was deleted minutes afterward, but screenshots spread around the internet quite quickly in unofficial forums.

So, my team and I dropped everything else and spent all day on Wednesday gathering informal information to see whether we could mitigate the risk of exploitation before an official fix was released.

How to tell if you're at risk

The first step people can take to figure out if they're impacted is to look at their websites and web applications, and try to understand where PHP is involved. You can also assume that most, if not all, of them will use PHP in some way, unless you have very basic HTML-based pages.

The second step would be to look at what vulnerability scanners online are telling you. Tenable, Qualys, and Rapid7 are usually the big three for releasing detection rules and actually detecting the vulnerability. In this case, these vulnerabilities have caused such widespread panic worldwide that they were quick to respond. This is also a way to understand the exact vulnerabilities in your internet-facing assets.

After taking these steps, immediately look online to upgrade your website to the current PHP version. It's quite easy to upgrade that, and it's free. There are some technical steps to do after the fix, so you might need a tech guy to implement them. If you don't update your PHP version, the impact on your business and website can be very, very serious.

Some people are also fully taking their sites offline, and I think that can be the right call if you have evidence that you are being targeted. However, 70% of the internet can't and shouldn't be taken offline just because those sites have some vulnerabilities. It's an emergency step to take if you have evidence of potential exploitation, but it can't be a step taken by everyone.

This was not just about attackers disrupting your website or web application; it was about them taking control of your server, stealing sensitive documents, moving inside your network, and then carrying out malicious operations, such as deploying ransomware or other actions they intended.

The situation has calmed down, but my cybersecurity team is still very concerned

Things have calmed down a bit since Wednesday, but we're still very, very concerned. Patching 70% of worldwide websites doesn't take a minute or two.

Hours after the fix was disclosed by the PHP Foundation, there were already tons of exploitation attempts popping up online. Attackers are getting quicker. I think that in this AI era, when in a matter of minutes, many attackers can attack, you don't have the time you used to.

The whole traditional process of scoping the attack surface, establishing a remediation plan, then calling a guy who's going to be responsible for this remediation plan, et cetera, is broken.

For a long period of time, organizations were investing a lot in what we call post-compromise scenarios. I think the AI era of cybersecurity will involve a lot more security investments in the pre-compromise realm, so defenses can be pre-built and ready for attacks in situations like this.