00:39:55 · Thai Duong, Tracy Alloway, S1, Bruce Dang
[00:39:55] S4: Yeah, keep going. [00:39:55] S3: We used to hang out in Abu Dhabi a lot. [00:39:58] S1: Oh, okay, yeah. Like, I'm no Matt Fawkes. [00:40:01] S2: I mean, like, now he's like, he gave a talk with our team the other day, and he showed his rack, you know, in his apartment, and he's sitting there, you know, like, hacking stuff, like, while he's sitting there talking. It's just insane. We have people that, let's say, for example, we've been hacking the iPhone. To build a full chain on the iPhone, it's not an easy task. Sometimes it takes several people to do this. And our team was able to do this within. [00:40:35] S1: A few days. [00:40:36] S2: Wow. [00:40:37] S1: You know, as a one person. And we have multiple of these chains. [00:40:40] S2: It really compresses the time, like the exploitation, the time to build exploits. [00:40:49] S1: We see customers getting hacked. [00:40:52] S2: By AI, you know, in the financials, in the banks, basically. You know, defenders cannot, you know, actually, Ty, why don't you tell these stories? [00:41:01] S1: And, you know, just a little bit, this has happened in the last few weeks, you know. Yeah. how things changed.
00:41:01 · S1, Thai Duong, Bruce Dang
[00:41:01] S1: And, you know, just a little bit, this has happened in the last few weeks, you know. Yeah. how things changed. [00:41:07] S4: Yeah, basically we saw like, you know, in the OpenAI and Hugging Face incident, there's one detail that is very interesting. I'm not sure if people noticed, but OpenAI noticed that like the people who handled incidents on the OpenAI side, they said that they have handled a lot of incidents, but this is the first time they saw that, you know, an incident where you have like a hundred people points within your networks that were compromised at the same time. Like there were a hundred like hackers within your system. Normally you have maybe one or two, right? Now you have a hundred. And I saw that I was like, wow, that was pretty interesting, but maybe because OpenAI have lots of tokens, so their agents can just go, you know, hack everything. And then just two weeks ago, we have like two clients in the banking industry. And they got hacked and they called us to help them with like the incident response. We came in because we do hacking as well. We know like usually it took us like maybe a month or something. Once we come in a network and then took a month for us to spread out. For the AI, it took like, they came in, they brought inside the network on Monday. By Tuesday, they're everywhere. [00:42:23] S2: Everywhere.
00:42:23 · Bruce Dang, Thai Duong, Tracy Alloway
[00:42:23] S2: Everywhere. [00:42:24] S4: And like, it's like cancer is spread like at a machine speed. And it was like mind blowing, right? Because how could you defend against that? Like in the past, we were telling our clients, you know, you have to invest in detection. Well, how can you help yourself? If you see it, you can detect it, but there's a hundred of them. [00:42:45] S2: Noted. [00:42:45] S3: We have a hundred hackers in our system right now. It's not really helpful. [00:42:49] S2: Exactly.
00:42:50 · Thai Duong
[00:42:50] S4: How could you do it, right? And then you have to shut down everything. But shut down is not an option because you are a bank. So that's actually true. requires us to sit down and think about how to redesign the defense system. What we have right now is not working very well. But to come back to your question, as a hacker, how does it feel? I love history. So I always come back to history to see, did it happen before? It actually did happen with chess, for example. You remember in 1997, You know, IBM Deep Blue defeated Garry Kasparov. That was a big moment, right? And then 20 years later, AlphaGo defeated like Lee Sedol in the game of Go. But those two moments are actually quite different. Like the first moment, the Deep Blue moment, after Deep Blue, the best chess player wasn't a computer because Deep Blue was a mainframe, right? Not something that you can run on your computer. And it took 10 years for someone to go from Deep Blue to develop a computer software that you can run on your computer that defeated everybody. But the 10 years, it took 10 years. During that 10 years, the best chess player was a centaur player. This is a term coined by Garry Kasparov. It's a combination of computer and human. It took 10 years. For AlphaGo, it took like three years. Like after AlphaGo, Then 2019, somebody come up with a computer software that defeated anybody without any human input at all. At Calif, we think like, you know, we are enter the era of the central hackers. Basically, the best hacker right now is a combination of AI and humans. And, you know, our work and our friends' work as well show that AI is powerful. It can hack anything. but it still requires a human expert to arrive at it. And we don't know how long this is going to last, maybe three months. Maybe we come back here and by the end of the year, we tell you we retire now. There's nothing else for us to do. Maybe it lasts like three years. And this is actually pretty exciting to find out. That's exactly what we want to do. And we think like, That's like a pessimistic view, right? AI is going to do everything. Let's just retire and hate AI. Or you can see AI as a tool. It's like humanity just discovered fire. And without fire, we wouldn't be here today. So, of course, we have to think about how to control fire.
00:45:36 · Thai Duong, Tracy Alloway, Bruce Dang, Joe Weisenthal, S1
At the same time, a very important question that we need to ask is, what should we cook, right? That's very important, and we want to find out What can we cook with AI and how can we do it in a safe way that helps everybody? [00:45:53] S3: Protein that makes our brains get bigger. [00:45:55] S2: Yeah. All right. [00:45:56] S3: Well, Ty and Bruce from Calif, thank you so much for coming on Odd Lots. [00:46:00] S0: That was a lot of fun. You're both excellent. Thank you both. [00:46:04] S4: Thanks. [00:46:05] S1: Thanks, Joe. Thanks, Tracy. [00:46:06] S4: Thank you. [00:46:06] S1: Bye-bye. [00:46:06] S2: Bye-bye. [00:46:19] S3: Joe, I thought that was a fantastic conversation. Not exactly uplifting. I was surprised at Ty's response. I thought maybe people would say we're in this weird, awkward moment where a lot of legacy issues are being discovered. But once AI actually gets deployed and starts redesigning some of the architecture, it'll be a lot more resilient. Apparently that's not the case. That's a little bit worrying. [00:46:44] S0: I agree. There was so much in there that was interesting. And like I could, you know, all this stuff about how, yes, you could have provably secure software, but it's small. You can't even do it for something that says the browser. I love that last point about how we're in the centaur age where the strongest hacker is the computer working with a human, but that may not be there for much longer. Three months, a year. We have no idea, but the presumption should be that it won't last very long. etc.
00:46:44 · Joe Weisenthal, Tracy Alloway, Thai Duong
[00:46:44] S0: I agree. There was so much in there that was interesting. And like I could, you know, all this stuff about how, yes, you could have provably secure software, but it's small. You can't even do it for something that says the browser. I love that last point about how we're in the centaur age where the strongest hacker is the computer working with a human, but that may not be there for much longer. Three months, a year. We have no idea, but the presumption should be that it won't last very long. etc. [00:47:12] S3: Also, the idea of like a computer, an agent that can code is inherently a hacker. And so you can't just tell it not to hack. [00:47:23] S0: Just teach it not to hack. What's wrong with you? Just teach it not to hack. If coding is going to be big business, which it is, you're going to be building a lot of good hackers. [00:47:31] S4: Yeah. [00:47:31] S3: And so the hackers proliferate. On that note, shall we leave it there? [00:47:35] S0: Let's leave it there. [00:47:35] S3: This has been another episode of the Odd Lots Podcast. I'm Tracy Alloway. You can follow me at Tracy Alloway. [00:47:41] S0: And I'm Joe Weisenthal. You can follow me at The Stalwart. Follow our producers, Carmen Rodriguez at Carmen Arman, Dashiell Bennett at Dashbot, Cale Brooks at Cale Brooks. and Kevin Lozano at Kevin Lloyd Lozano. And of course, you can chat about all of these topics 24-7 in our Discord, discord.gg slash oddlots. And for more Oddlots content, you can check out our daily newsletter, which you can find at bloomberg.com slash oddlots.