No Priors: Artificial Intelligence | Technology | Startups
00:03:35 · Dane Knecht, Sarah Guo
There's one that's kind of coming out today and has been started to be blogged about and tweeted about where one of the keys on the Internet that protects all TLS and WebPKI, which just secures all your connections, was secured by the number four. Literally, they basically used... If know about cryptography, it's all about randomness, right? That's why software has our lava lamps is so that you can get good randomness. And when a key out there is they use the seed, they use the initial thing to kind of create it with a single number four is going to be reverse engineered. AI can just do all these things that doesn't sleep. It's not like the one engineer you had that was red teaming things. Last week, think OpenAI found the seeds for the NIST curves were back in 2000 that were released. These things are just moving so fast and the bar is going up and the models are just getting so good at cybersecurity. Midtest was just kind of the tip of the iceberg there where... Since then, it's not just been the models getting better, it's the harnesses. It's how people know how to... How humans know how to use them and use those frontier models in order to find those exploits. [00:04:59] S1: Given your, you know, visibility, what do you know about the humans behind, you know, these attacks and harnessing these models taking the volume of vulnerability discovery up so quickly? Like, are they, you know, nation state actors? Are they script kitties? Like, what what can you say about how the the attacker landscape has changed?
00:04:59 · Sarah Guo, Dane Knecht
[00:04:59] S1: Given your, you know, visibility, what do you know about the humans behind, you know, these attacks and harnessing these models taking the volume of vulnerability discovery up so quickly? Like, are they, you know, nation state actors? Are they script kitties? Like, what what can you say about how the the attacker landscape has changed? [00:05:25] S0: Well, I actually think for some of these some of these larger vulnerabilities that have come out more recently actually haven't been nation states. They've they've been, you know, high school kids even that are [00:05:38] S1: We're gonna call them agent kitties now. [00:05:39] S0: Yeah. Yeah. That are that are just spending their time, you know, like they used to do, kinda capture the flag security contest. They're pointing their agents at an area and doing that. There's also... And there's financial award for them. There's bug bounties that they get paid out of sizable amounts. But it's given the tools that, honestly, the nation states have had in some forms for much longer either through agents or just through, you know, sure number of people that were working on the problems, giving it to the masses. [00:06:12] S1: This is the first time in fifteen years I've heard serious technical people say things like, well, we should just like air gap everything important. And we're like, you know, not gonna be able to trust the Internet for a while. And we just assume all the critical infrastructure and and government services fall down at some point. Is that your expectation for what happens?
00:06:12 · Sarah Guo, Dane Knecht
[00:06:12] S1: This is the first time in fifteen years I've heard serious technical people say things like, well, we should just like air gap everything important. And we're like, you know, not gonna be able to trust the Internet for a while. And we just assume all the critical infrastructure and and government services fall down at some point. Is that your expectation for what happens? [00:06:35] S0: Humans, we are pretty adaptable and we can move fast when we need to. And I've seen the industry kind of partner together. When things like this happen. People that usually think of competitors are no longer competitors. We are just literally protecting critical infrastructure, as you said. And I think when those kind of critical moments happen, people will rise to that challenge. So I'm a little less doomsday. I do think that a lot of the things that we've done over the past five to ten years, moving away from a kind of a castle moat infrastructure for security to moving to more of a zero trust does put a lot of companies in a better position where, you know, you're saying this office is completely air gapped. You're saying, you know, these devices, these these flows are secured in a different way, everything's going to be tightened.
00:06:35 · Dane Knecht, Sarah Guo
[00:06:35] S0: Humans, we are pretty adaptable and we can move fast when we need to. And I've seen the industry kind of partner together. When things like this happen. People that usually think of competitors are no longer competitors. We are just literally protecting critical infrastructure, as you said. And I think when those kind of critical moments happen, people will rise to that challenge. So I'm a little less doomsday. I do think that a lot of the things that we've done over the past five to ten years, moving away from a kind of a castle moat infrastructure for security to moving to more of a zero trust does put a lot of companies in a better position where, you know, you're saying this office is completely air gapped. You're saying, you know, these devices, these these flows are secured in a different way, everything's going to be tightened. [00:07:28] S1: What is it going to take for organizations to do what you're describing? Like, 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on No Priors podcast last week, and he said that he thought in 2027, people are going to spend as much money on tokens for security as engineering? Like you're saying, related idea. What is going to drive that shift?
00:07:28 · Sarah Guo, Dane Knecht
[00:07:28] S1: What is it going to take for organizations to do what you're describing? Like, 50% of engineers do not work on security right now. I had Greg Brockman from OpenAI on No Priors podcast last week, and he said that he thought in 2027, people are going to spend as much money on tokens for security as engineering? Like you're saying, related idea. What is going to drive that shift? [00:07:58] S0: Just emergency. Right? So you're going to move forward all your security spend over the next eighteen months, both from the red team side, which is more of the offensive, trying to actively try to exploit things as well as the defensive side, how you prepare things. But I don't think that's going to be last forever. I see a world in eighteen months where new software productivity goes way up because all those resources are back focused on that. But there's definitely this period where security usually on everybody's mind. [00:08:35] S1: What are some of the key elements of getting to a better place in terms of overall software and Internet security? I think people discover, of course, that there are libraries and services everyone use that had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What else is important there? Because part of the concern that I have is the rate of software production is also going up a great deal. Right? So to some degree, we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery.
00:08:35 · Sarah Guo, Dane Knecht
[00:08:35] S1: What are some of the key elements of getting to a better place in terms of overall software and Internet security? I think people discover, of course, that there are libraries and services everyone use that had vulnerabilities that took effort to discover and now do not. And I think we'll hit some of those. What else is important there? Because part of the concern that I have is the rate of software production is also going up a great deal. Right? So to some degree, we got to go like patch everything that we have already made and then keep up and get ahead of the pace of delivery. [00:09:13] S0: Yeah. Well, so I mean, for one, we're right now we're patching seventy years of of software out there. So so some of it is just catch up. And then on on a go forward basis, you know, I think this the software development life cycle, the agent development life cycle is going to need to change. Luckily, the same way that we can use security right now for Red King and things like that, it'll just be built into the process every step of the way. I think the software will just get more secure over time. [00:09:46] S1: What have you learned about building secure production software internally already that you think people can learn from? Like, does that mean? Like shift left and like can we... And there are there are many theories of how to do this including, you know, broader use of formal verification, using agents for security in the development process. Like what what do you think is going to create better software from first delivery?