AI Coding, Exploits & Agent Security: The Risks of Going Too Fast | TSG Ep. 896

Hey everybody. Welcome to Textron Gang. And yes, we've been waiting for it forever now, or at least it feels like forever, but a different way of thinking about AI and processors and how we're gonna run code.

Stay tuned. We'll be back in a minute. Hello, everybody.

Welcome back. We have some of the usual faces for the show today. Mitch Ashley.

How you doing, Mitch? Good, Good, good. Mike, thanks.

Guy Currier from the Futurum Group. Dy And Chris Blask. How you doing buddy?

Loving life. And Kate Scarcella, who's joining us from Kate. I forgot where you are again.

Southern Maine. All right. Awesome.

I think I haven't been in Maine in a very long time, but I was close. I was in upstate New York last week, so that's relatively in my mind somewhere nearby. All right guys, I'm gonna jump right into this first topic here 'cause I'm kind of excited about it, but I might be the only one.

So we'll see. Um, there is a, uh, new approach to, uh, creating silicon wafers, I think in terms of how we stack the chip together that uses AI accelerators, but depends less on GPUs, at least is how I understand it. And it's a different architecture and it winds up being among other things, enabling the ability to run 2000 tokens in, in a timely fashion so that when you're writing code, it feels more streamlined or smooth as part of the whole process versus today it's a little jenky as a technical word for you.

But Mitch, you looked at this a little bit and you know, what's your take on this? Is this the beginning of something? Are we gonna see a lot more of these things?

Or is this some sort of weird one-off thing? Well, I think what with one of the things that's interesting about this is they recognize as the patterns of how we use tokens for different types of work. Um, software developers do are very iterative type process.

It's not just writing code. There's a lot of check this, try that, what is that? Let's, let's change this here, see what the result is, test it, whatever it might be.

It, it's a highly iterative process and if you're constrained it, it's kinda like if you're driving a car and you had to stop every five, five miles for gas, you know, 'cause you're got such a small tank where you only get a little bit and you have a really big tank. And that's the whole idea of this generating a lot more tokens per second that you can consume. Of course, you can argue are you using those tokens efficiently?

And a lot of people have kind of focused on how do I write more efficient, uh, prompts to be able to use less tokens. But then again, if they're kind of coming to you, yeah, you high and fast, you may not be thinking about, uh, saving money on 'em necessarily unless the cost is right there in front of you. So it's kind of a double-edged sword, but I think the main point here is it, it addresses the flow issue of, it's like reading a book and you have to set it down for five minutes after every page right before you can pick up the next page and start reading again.

No, that is how I read. And I, I wasn't picking on you specifically, Mike. Just a generic reader.

Sorry, I mouth the words too as I go. Oh, no, I'm just kidding Out out loud Guy. Courier, what's your take on this whole thing?

'cause I know you follow a lot of the hardware stuff out there, but is this something that has legs? Uh, I guess what you're saying is, are we gonna see this as a, a new model for hosting training ai? Um, I don't think so.

Um, so you, you said this is a new way, uh, this is 10 years old, roughly. Um, and it's not necessarily a new way. Um, so, uh, the, the company, um, uh, CEL cbra, what do they, what do they call it?

I I always wanna say Cereus, so I do Too. Sure. So, but let's go with Cereus for now and we'll apologize.

Yeah. Uh, they, they, they've been around about 10 years. Mm-hmm.

Um, and um, what they really did was add real estate to a monolithic silicon, um, uh, production method. Um, I don't wanna get into like all these, you know, different types of manufacturing, uh, chips, but kind of have three main ones right now. Um, a sort a monolithic one, um, a chip lit one, and then mainframe, which is a whole different, you know, kettle fish.

Um, chips are what a MD uses video uses them. Um, they are making smaller chips, assembling them together. There are some speed trade-offs there, but there's great flexibility.

And you can do things like load tons of memory onto a chip, um, or have the same basic architecture, but less memory and a lot more processing. Um, what, uh, CEUs has done, uh, Celebrex CEUs, uh, what they've, what they did starting 10 years ago is they said, um, well, um, why don't we just make a giant honking single microprocessor or chip? Um, so these things are huge, and this is the third generation.

And, um, how many, uh, how many AI processors does it have on it? Uh, That was a lot. The cores, I mean, yeah.

90,000, 900,000 on a bumper. Um, here's the point. The point is that, um, it's a whole specialized fabrication process.

It has not taken the world by storm in 10 years. It's, um, you know, generates its terrifics feed. It allows you to put a ton of memory, but they've had three chips in 10 years.

Third generation, it's a specialty chip, but it's not a programmable specialty chip, which is, um, what a lot of specialty chips are right now. Like if you've heard neuro processing units or NPUs, they tend to be programmable field, programmable gator arrays, um, that are programmed and then put as a chip into another chip. So a lot of wonkiness aside, um, what you would need for this to take the world by storm is more fabs that can make giant honking chips, um, and more companies making specialized chips this way.

So why is this one company doing this? Well, uh, I'm not sure, since it was founded 10 years ago, that this is a response to the AI craze. I think their announcement and their ability to produce this high volume tokens, it's very interesting.

Um, but it's not what they were built for. What were they built for? I'm not entirely sure, but seeing as they are, uh, something like 70% owned by an Emirati company called G 42, which is owned in turn by the Emirati Minister of Defense and their one supercomputer that they're putting together, which, uh, put together, I'm sorry, it's called Condor Galaxy.

It's based outta Dallas, um, is has one customer, which is G 42. I'm not exactly sure that generation of code tokens was what they had in mind when they founded the company and started building it. So I think, Mike, you put together today's show with three segments, right?

And one's the AI segment, and two of them are the security segments. But I have a feeling that's actually three security segments. And this is the first one.

Chris, you're nodding your head a lot. So jump in here. Yeah.

Hold my coffee. Right. You know, so Mitch is right, right.

You know, this is the, you know, we are going down this path. Speed, speed, speed. Right?

And it is not just writing the code, it's iterating and testing, feeding back in. So whatever numbers you're at now, Moore's log and, and there you go. And, and Guy, you're exactly right as well.

You know, that was the point I was gonna bring to this. I mean, we've done speed, right? You know, what matters now is traceability.

You know, we can write the world faster than we can secure it. So what's the provenance of your logic stacked? Who attested it?

Right? And velocity, you know, without integrity is just another in attack, attack service. So I could take either threads, you're going just the sheer speed or guy or guide chips, infrastructure, what's underneath that?

Where are the decisions? Who's keeping track? You know, largely the answer is nobody.

So if you, if we think that is sustainable over time, I've got some land to sell you. So we'll See. And I've got a bridge, Right?

Just from a guy that lives on a boat. So, you know, is this, is this near Arizona? Is this in Arizona where I can build the data center?

No. Hold on. Yeah.

And that's one of the things that we, that from a cybersecurity perspective, right? That we keep coming across as, you know, cybersecurity comes as an afterthought and it keeps biting us, and it's gonna keep biting us at the end end. You know, we just, um, as we will see, I'm sure that this, um, theme will continue to come up in the next few segments is the idea that that it, there is such a speed with ai, but with that, there's also, uh, that the surface just expands enormously as far as the attack goes.

So yeah, Exponentially, It's, it's amazing how many more security vulnerabilities you can create with 50 times the AI cores on your chip and all this SRAM available as well. Yeah. 50 times.

It's more than 50 times as many, right? Because it gets exponential. 500.

I don't remember. I just, Yeah. But I mean, even if it's 50, you know, we're getting into the, it, it, when we start adding vulnerabilities at that speed, it, it hairballs right?

Gets larger and larger exponentially, you're adding zeros everywhere. And, and Kate, right? You know, as a security person, I love when necessity drives security.

And I do not believe security is aside. You can operate, we can operate these systems much longer without attestation systems keep keeping track of things. io, which is still out there, there are ways to do this.

There's lots of driving factors been coming along for particularly the last five, 10 years. And this, no, a year, 1, 2, 3 years from now, we're not gonna be doing it this way. Not in stacks that aren't falling over all the time.

All right, let's come back to the beginning here for a second. Security is great guys, but there's a goal, we're trying to get to what Mitch was talking about, which is, can we find a way to cost, effectively get to 200 tokens per second? This, just because it's 10 years old, I would argue doesn't disqualify.

It may be too costly, I'll buy that. But I would remind everybody that GPUs were 10 years old before we figured out that they work for AI as well. So I'm not seeing GPUs are really optimized for AI either.

So I'm pretty much sure that we need processors that are gonna be optimized for ai. The question is, Mitch, um, can we get that outta GPUs in a cost effective way? Or do we need some other type of AI accelerator?

And maybe we got too much betting on, you know, Nvidia is the god of all things for processors, when in reality it's a moment in time. Well, there's, there's one path we, we may head down, and that is all prompting goes through optimizers before it actually is executed. So, you know, today we do meta, you can do meta prompting.

There's something called contract prompting, which is structurally laying out, uh, you know, ways that you do a prompt to, to keep the, keep the eye from going kind of na you know, native, native and going everywhere that shouldn't go. Uh, but I think that's, that's one of the ways is let's just use AI to economize how we're, uh, accessing or using tokens, you know, kind of use the same tool, what they're, they're trying to use smartly for other tasks. I think that's a pretty obvious path that we'll head down.

Not that I'll invoke an optimizer. I think that'll become part of the front end of any of these tools, maybe built into the id, BE maybe built into the LLMs, that type of thing. I'm gonna add another thing onto this.

Uh, am I the only one who thinks tokens are a bit of a scam? The whole pricing model is artificial. It's kind of based on an input and an output.

And I get charged for the input and the output, and each one of those is called a token. And it looks like a reasonable price till I start adding up all the tokens. And the next thing you know, I'm spending a fortune to go build something.

Isn't there a better way to think about pricing these AI services than just using tokens? 'cause right now it seems like it's kind of a, a money pit. Well, I'll go where Mitch was taking it, right?

Mm-hmm. You know, I, I, I, we've talked about this in the show in the past. I do not believe in the near and particularly midterm future, we're gonna be using AI the same way and asking every, every single, to your point, uh, Mike, you know, I can you add two plus two, you know, that actually uses tokens out the wazoo because we're asking an LLM to interpret what English two plus two even means and do a bunch of other things.

So I think, yeah. What, what optimizers, like I saying, Mitch, I think the inputs we we're putting into an AI or into a computer system are gonna parse themselves out and use AI for AI things. 'cause it's, it's ridiculous, uh, economically, energy wise, resource wise, the way we're using the bottles now doesn't make any sense.

Mm-hmm. And to that, I'm Not sure the tokens are any better or worse than any other method, Mike. I, I, I, I'd rather think they are better, but I think it's the same.

It's the cloud cost problem all over again, only in a different sphere, which is yeah, avoiding blood, avoiding, uh, uh, over provisioning, uh, or whatever. Like all that sort of stuff that we started to deal with. And I'm sure a new pocket industry and monitoring your tokens is gonna appear just like, you know, cloud service monitoring, you know, has appeared and become its own industry.

Yeah. And I agree with guy on that. Totally.

It like the cloth model, it's, you know, um, I I think it's just becoming, um, it's, it's just a way to monitor it. But, you know, in the long run, I, I don't think it's the way to go. I Can, I, can I bring this kind of back home here though?

I think, Mike, your initial postulate was, wow, this is impressive. Maybe it's something that'll spread and we will be able to gain these kinds of amazing speeds, um, uh, you know, through competition or through growth of this particular model or that sort of thing. Um, and I think that's an important question for the, the, the viewers of this, or listeners here, because they're trying to figure out how to make decisions.

So, um, I, I'll just say that you knows super computers aside, you know, like, like this supercomputer in Dallas conduct Galaxy. Um, I wanted to know like, hey, what, what would it cost me if I'm a developer or development team? What do I need to do to, to get this?

Maybe I can just buy one hour with this thing in it and stick it under a desk and all my developers can use it, and you can do that costs about $9 million or $8 million, nevermind maintenance and all that other sort of stuff. So then I asked myself, okay, can this scale? I don't think it can scale because there's a whole supply chain question and issue.

There's a completely, uh, different model than all the other, like the, the advantage here is conceptual. Instead of it being a GPU or a field program gateway, or any of these things that follow a certain model, these cores are custom made and have been for 10 years for ai. And that gives these incredible performance abilities.

But I just feel that the market is limited and, um, uh, TSMC amongst others are getting better and better and better at getting more performance in all these various ways out of slightly more general purpose chips. So, I, I just don't see it as having likes Mike, not in that way. And I'm really trying to burst your bubble because when you get optimistic about something, I get extremely scared because that is such an anomaly.

I tell, I tell you why I am jumping on this though. I don't really care too much about the processor one way or the other. I do care about that 2000 tokens per second.

'cause that's what developers need to have a, a, a, a streamline workflow process. And that's the goal. And I'm just dubious that we're gonna get there using the existing GPU architectures in a cost effective way.

So I'm kind of looking around the mobile world here saying, Hey, there's gotta be a better, smarter way to do this thing. You know, Mike, this is also in addition to the hardware side of it, the, they use the, uh, Quinn three model, which is created by Alibaba specialized doing software development. So it's an optimized model for software development.

How much of that op, how much of that, uh, consumption is, uh, is more efficient because of that model. That would be an interesting exercise, right? So I can generate X thousands of tokens per second.

Do I need to consume less? How much less do I need to consume when I've got a model optimized for software development for that specific task versus medical diagnosis or other types of models? So we, we always talk about small language models.

This is still an LLM, but it's optimized for a specific type of class of problem information it relies upon, et cetera. So that, that's gotta also be factored into the equation of how efficiently are we Using these. Yeah, I think there's efficiencies to be found everywhere in this.

I think you're exactly right. All right, I'm gonna leave it there on the, on, on this political slogan. 2000 tokens per second are bust.

Here we go. All right. All right, folks.

We'll be back in a minute to talk about, well, some actual cybersecurity Discover Techron group, the epicenter of tech innovation. We are your go-to for reaching IT leaders and practitioners worldwide. Our secret impactful content that sparks awareness, engagement, and top quality leads with us.

You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more. Join our satisfied clients. Let's revolutionize your tech journey.

Contact us today and tell your story to the world in the most powerful way with Textron Group. All right, folks, we're back, and the folks over at Cypress Data have a new report talking about, well, just how often are vulnerabilities actually being put into code and that we know about, nevermind the ones we don't know about, but the ones that we just deliberately ignore and add to our technical debt. And we've been talking about DevSecOps now for many years, and you would think that this was getting better, but the report suggests that maybe not, and I guess we'll start with, uh, Chris here on this one.

But, um, what's going on here? I mean, are we just deliberately ignoring all this stuff be and the name of speed and how can it be speedy if I gotta go back and fix it later? Anyway, it seems like it's a vicious cycle of being counterproductive no matter how much I think I'm being productive.

So the audience doesn't know this because Taylor's gonna cut it out, but we're talking about software bill materials in the break, right? And, you know, we're working with side beats. You know, my, I'm, you know, clarity, you know, I'm vice president of the strategy with site meets having been for a number of years.

It's an s om platform, uh, tool. And I've been pleased both with the company and the platform, but you know, to our purpose here of the market in general, s oms and that sort of visibility in supply chain, you know, has actually helped dev, uh, DevSecOps work with the rest of the company. You know, help break through some of those, you know, cliche cultural barriers.

Um, I think what we're talking about here is the opposite, right? We're, we're once again running up against misalignment of teams and motivations, and we're getting bad results. And I would argue is perhaps usual that we can force the issue and force people to do the right things, or we can recognize the problem, right?

And we've got brittle governance, you know, evolving roles, and we need, we have a agent AI coming into this, and we need a flexible, flexible, participatory framework that can all work together. Or DevSecOps, you know, God bless our community, we'll stick their heels in the ground and and generate articles like this one. What do you think would happen, Chris, If, um, uh, and Kate, if, um, instead of, um, addressing, uh, security breaches or vulnerabilities that come up because of this code, um, you just fired a person who reported it to you and pretend that it never happened.

We had the same, we had the same conclusion on another story yesterday, but yeah. So I can't understand where that's going. If you, if You don't test for it, either you won't, you have your vulnerabilities go down.

So, I mean, when someone, when someone damage sues you, you can just say, that didn't happen. That's why I fired a person. Just didn't take place.

I I, my entire career, right? You know, I've, I, I've worked in security for 30 something years now, and, you know, I'm a pragmatic person. We can do what we can do, but at every opportunity, be really clear test to what you're doing, do that, right?

You know, because you want your adversaries to see it, your friends to see it, whatever, right? And it's not just, you know, hippie philosophy. It's a structural part of security.

You know, either you're going to believe that you can hide everything from everything and keep that hidden forever. So nothing bad happens to you, or you'll make it as clear as possible. And this is the, you know, this is literally a, a, a, the, this is this acting on in real time.

We have, you know, for brevity, I'll say a standard corporate philosophy that we can just, you know, fire the people and force the, the issue. And in, in security and dev sec and so forth, you have people that really know and really care. And no, they're not gonna do the, the what they see as the wrong thing.

You need to actually address across the, in the, uh, as they say. So with supply chain, getting SBOs in there was helping DevSecOps explain to, you know, operations and dev and so forth, why they're being so insistent about things. You know, this is sort of doing the opposite, you know, but we can fix this, you know, put the visibility into the system, get all the players to, to agree.

And, you know, without getting all AI about this conversation, like every other one, I think we have the tools who can speak to us and help us speak to each other so we can say what we need to do and do it. Write the stuff down. Yeah, Go ahead, Mike.

Sorry, I was gonna come to you anyway, Kate, with this one. But, um, are we just over emphasizing the wrong things here in DevOps all these years? Because it seems like it was, you know, right code and get code and deploy, code dev will be damned that, but the quality of the code, and can we strike a balance or we just too far gone on the, we gotta be fast and everything else is the secondary consideration.

So I'm always hopeful. So I definitely think, uh, that we can, um, we, we can all play well together. And I want that.

It's one of the reasons I think it's so important to talk about why it's important. You know, it, it, cybersecurity really is it, it, so often we are looked at, we are looked at as the bad guys, right? Chris?

I mean, we are the ones who are stopping the speed. We are the ones who are stopping, you know, true development and true innovation and everything else. But the truth is, is that I have found that even if you provide them with tools, even if you provide them with the, with the knowledge that they are writing vulnerabilities into code, there is a resistance of, you know, I like, I don't care.

You know, I just wanna get this out. And, and this whole idea about speed is so, it, it is so important to business that everything else we're gonna, you know, throw the baby and the bath water out. You know, we don't care.

Um, well, you Sorry, go ahead. Go ahead. You know, I, I, I, I feel very passionate about this and be clear, I have sold billions of dollars worth of security product all over the world for decades by understanding the story.

And the story isn't that you need to secure your digital certificates. So the story is that you need to get code out there so your customers can achieve something and like you, so they'll keep buying your stuff so you can keep paying your employees and keep doing this, you know, all of it. So in, in a scenario like this, I just feel a disconnect that the people telling DevSecOps what to do, don't understand their own story.

Why is the company even here? You know, we're not buying a firewall because we need to keep be bad people outta the company. We're buying a firewall because we're a shirt company and we need to keep selling shirts and spending our time thinking about shirts.

So the button manufacturing people should be aligned with our customers out there, not our internal process on thread weaving, right? We get lost in the details and we forget why we're doing anything. Yeah.

Like Chris, yeah, you're absolutely right. Absolutely. But I think this is a deeper problem.

And, and Mitch and Mike, I, I wonder what, I wonder if you agree with this. I mean, a, a a a software vendor CEO many years ago, um, a real smart one told me, or, you know, revealed to me something that was obvious once he said it, which is that there are two types of developers, two types of coders, there are perfectionists, and then there are ones that release. He was kind of trying to say that, uh, he doesn't want any perfectionists around 'cause he wants to release.

But, um, it's very easy as a perfectionist never to release because there's, it's a bottom, uh, coding is a bottomless pit of, of, of opportunities to improve, uh, an application, whether it's the innards of it or the user interface, or anywhere in between. And I think that I, I, I, I'm trying to wonder if I've been wrong all along to say the developers are like everybody else, and they don't care about security. I kind of think that developers that release don't care about anything, that security is just another one.

Another part of that, um, and and willful ignorance of security goes hand in hand with willful ignorance of, uh, uh, data hygiene, willful ignorance of the user experience, willful ignorance of whatever, even of regression testing so that they, they release and they, and those are the folks that get promoted. Those are the folks who make their name because they got, they got more and more features out they can. So anyway, Mitch might keep you guys, I'm gonna stand up for the developers here.

All you communist, whatever you people are I what your, I what your Problem is. I, I'm a Democratic socialist. Yeah.

Communist Supports communism. So Not true, not true. Well, first of all, you say one thing.

What I've found, and I've run many product development teams, software teams, the best developers write the least amount of code. Interestingly enough, it's not about creating lots of code, it's actually creating less code solving problems efficiently, meaning efficient with your time and your work. 'cause every, you know, every line code is tomorrow's technical debt.

So why do I want to create stuff that I've gotta worry about, maintain, and my technical debt could be an hour from now when I gotta go back and fix this damn thing. So it, you know, developers, developers are, are stitching together more than just code, right? They're designing an approach to solving a problem.

They're in some part of it, they're embedding it in a design of code that they're creating, but more so they're leveraging other code that they didn't write. Matter of fact, most of the code that's running in the stack is not their stack, even in the application stack is not their code. So when we say developers are introducing vulnerabilities, they, it could be as simple as the library I used has a vulnerability in it.

I didn't know that. Is that my fault that I didn't go examine every library to see if there's a vulnerability in it? Yeah, you could say, well, yeah, it's your code.

So you're, it's your job to do that. Well, if I did that for everything, then I would never do anything else. So my point is, is it has, it's a systemic problem.

It's not a person problem. If auto complete fixed vulnerabilities when we wrote 'em, we wouldn't have vulnerabilities If auto complete and includes of libraries or other code scanned for vulnerabilities, the second that you included it and it could fix it, then you wouldn't have vulnerabilities. So I'm saying ask asking people, it's like saying, let's pull over to the side of the road and check the, the air pressure on our tires every five minutes.

No, let's put an air pressure sensing system in our car to tell us when we've got a bad situation to go fix it. Right? That's what we need.

So developers unite, stand against the communist hate developers. I, I always, uh, I always said that, um, a good coder knows where to get their code. Okay?

With that being said, it brings maybe a totally different topic that we'll have to, you know, talk a different time about. But software bloating, like what if we actually, from a cybersecurity point of view, came at this from a different side and we actually went after the code that is just, that we know is bad, you know, and just finally get rid of it. I mean, we have so much code out there that just really needs to go bye-bye.

And, you know, and then get coders, like, can we attack this from a different angle and actually provide coders as they go to look for code with safe code Instead, instead of going to the developer, Mike, what do you think? Oh, guys, I gotta come bring this to an end. But I wanna also bring in this one last point.

So when I talk to people about this story before the show, one of them looked at me and said, so we're shipping known vulnerabilities in code? And they were like, yes. And there's gambling in Las Vegas to use Mitch's phrase.

However, one of the things that is gonna happen out there is, if I look at it historically, maybe 5% of vulnerabilities are actually exploited by some cyber criminal. But in the age of ai, they got all these fancy new tools, and it's gonna take 'em a third of the time, maybe a 10th of the time, to reverse engineer and exploit for vulnerabilities. So it seems to me a much greater percentage of those vulnerabilities out there are about to get exploited and all that old bloated code that Kate's been talking about, Mitch probability assessment, Oh, don't ask me for that.

That's, you're gonna put this, you're gonna plaster it all over every article for the next three weeks. If I do that, let me, let me answer a question, a question you didn't ask. We aren't, we aren't providing developers with the right tools.

If we provide developers with the right tools, they wouldn't have to fix the vulnerabilities in the first place. That's my premise. I like it.

Mitch. There you go. 55% probability of something happening.

Wait, i i 25% that it won't, whatever that something is. Wait, I mean, New York, Yankee and I made an error and it must be my glove. Is that what you're saying?

Yes, that's right. This is totally their fault. Totally.

Well, It is, Mitch is describe, I feel, Mitch, you're describing an arms race, right? So, you know, uh, agentic, AI and ag agentic takes that 5%. Mike's talking about the 15 to 55 or whatever it is, but the tools evolve or actually are developed to counter, um, my take was culturally, this is impossible to bring it into, and Mitch said, I'm insulting developers.

So, um, I object to that. And then Kate's saying, fire the code, don't fire the developer, fire the code. So I like all of these takes except for mine, which is apparently communistic.

So, so I gotta close on this point, Mike, if, if we're gonna generate, pick a number, 10 times, 50 times as much code, it is impossible to have developers fix vulnerabilities in the code that's generated, period. It is just, you're, you're, you're, you have an escalating, uh, curve of which there is not enough people on the planet to fix vulnerabilities. So you've got to generate code that doesn't have vulnerabilities in it, that that's what we have to do.

Otherwise, the whole thing crumbles, and we're gonna reach a tipping point where people will see, I have to use models that generate secure code because I'm not gonna spend my developers at the, the rate I'm paying them. I need more developers than are on the planet to support this code. So we've gotta find a better way.

That's why I'm saying we don't give developers the right tools yet. All right, guys, they're taking Betson Vegas on Legacy Code, Armageddon because all these AI tools, and we'll see what happens from there. We'll be back in a minute.

com is the leading resource for news analysis and education on challenges facing the cybersecurity industry. com covers all aspects of cybersecurity, including data security, DevSecOps, cloud security, application security, network security, security threats, and more. com has the largest selection of security content featuring breaking news, blog posts, podcasts, and more.

com to learn more. com, home of security bloggers network. Hey, folks, we're back and kind of continuing this conversation, but we have an article on Security Boulevard talking about all the ways that Gentech AI might be insecure.

And I gotta tell you, it's a really long article, so you might wanna just jump in and take a look at that. But, um, Kate, I know you looked at this and, um, and, and you've been thinking about this subject for a while, but it seems a little bit like we're way out ahead of this one and maybe not thinking about the security implications once again. Uh, absolutely.

Uh, one of the things that I have talked about as we talk about ai, um, agent AI systems, and this just goes right into, um, just this massive scale, you know, changing the attack, um, vector and using, um, this new threat landscape from an AI perspective and now identity based vulnerabilities at scale. I, you know, I, I hate to say I love it because there's just parts of this that just, I've had so many issues with. Like, I've had issues with zero trust forever, and this, for me, um, really highlights the zero trust, um, issues that I've had.

And one of it being with identity, you know, identity aware attacks. So I'll, I'll hand this off to Chris very soon, but I will say that the top three, um, areas that I have always been asked about when talking to C-level people have been, um, privilege escalation, uh, command and control and lateral movement, and with identity-based vulnerabilities with, um, agent AI systems. I mean, this plays beautifully into that.

So, wait, I just wanna check one thing here. You love this in the sense like of a tornado has awesome power, kinda love, or what are we on With that? You know, it just, um, so after coming back from this, from my sabbatical and looking at, it's the same attack methodology.

It's just bigger. It's just faster. It is just so, I love how, how it, it threads through how it, how it, how it's connecting.

And you know, we have to be proactive, relentlessly a proactive security strategy. Forget about resilience. I, I forget about, let's just throw that out too.

I believe in having, if we're gonna win, we have to have a proactive strategy. So I'll leave it with that. And thank you for predicting that I couldn't leave this one alone, right?

So I I was saving this from the last segment. So, uh, uh, you know, uh, in Socrates and thymus in the Republic, you have this great argument about whether might make, right, might, makes right, or whether role equals responsibility, right? And I've always loved that one.

You know, if you are, you know, a, a a teacher, your focus is not on making a living and everything else, when you're being a teacher, your focus is on the subject. And so I will stack the responsibility all the way back, starting with investors, you know, looking at you really clearly boards absolutely no excuse whatsoever, uh, c-suites, you took the job, right? You agreed to it all the way down before we can start picking on, you know, Mitch, you know, think about the dev folks.

You're exactly right. You know, they're motivated to not get fired, you know, keep their job, feed their families, you know, get through life and the business structure they've been put into leads up to all these problems. Absolutely not their fault, right?

It goes all the way down. And this one, yes. You know, we salt typhoon, right?

We all know salt typhoon. We've heard the phrase, did we, we were doing a lot of analysis over this over the weekend, and this is to your point, Kate, right? So, but all this, all typhoon is the difference between what, you know, the elders in, in our security community said we need to do all along.

And what we actually did, you know, what percentage of vulnerabilities are exploited? When I look at salt typhoon, I just assume a hundred, you know, how many configuration files in A PLC in a water system have been already compromised and not actually triggered all of them. All of them.

So the only way to deal with this is, I think it's where you're going, Kate. You know, I, I love it because I think the solution to salt, typhoon and all of this is more ai. You know, it actually look at these systems, find that gap, enunciate it, say that we know about it and deal with it instead of pretending it's not there because people will always use it against us, which is obvious.

Let me take that more. Hold on. Mitch.

Mitch, I'll let you go with, okay, but Chris, go ahead. Did you just, Chris, did you just blame capitalism for this problem? I think you did.

I possibly, go ahead. Stop. I'm a capitalist pig, right?

This is the, this is point that I've been trying to make in business. All along all this, you know, being nice, you know, ethical business stuff. I've been arguing all my life.

To be clear, billions of dollars, 90 plus percent, you know, has, has worked multiple times because it is better, faster, cheaper. I like capitalism. I think the way we're running it now is stupid and inefficient and expensive.

And we're losing business opportunities because we think just being cold and calculating works, it does not, I'm just saying, I just need one more. And I have a majority communist podcast. I don't know, man.

I, I'm watching, you know, Chris, the Reagan publican arguing with the social democrat over there. So I'm not quite clear where this is going. We to jump in here.

Yeah, go ahead. So, so let, let me throw out a a an odd way to look at this, but it's actually a positive and you said more ai, Chris. So in the theory of constraints, when you remove a constraint, right, that creates flow through a system.

And in, in effect, if our constraint is how much code we can generate, how fast because of humans and how fast we can do it, and AI can do that in, in, you know, exponentially or multiples of that. Okay, well, that removal of that constraint now moves the problem elsewhere. As I was saying before, the next con, one of the next constraints down the line somewhere is people can't fix vulnerability problems.

Um, so, so in, in a way, in maybe a perverse way, but in a way, us generating so much volume of code will force us to, to fix this problem without involving humans in it. It might even forces Kate to implement more of the zero trust framework. 'cause we just don't have a choice.

There's not a human way around to solve it. And the current methods of incident response and everything else, you know, the three, the three things, the three, three deadly sins, we continue to, to commit that you talked about, you know, can't continue at that kind of a scale. So it may force us to look at very different solutions.

Yeah, I live in, I live in the New York City area, and I would tell you that, you know, breaking things doesn't lead to forcing a solution. I said it was perverse way. I'm like, I'm trying to look at a, this could be a positive.

Yeah, I actually believe that that's possible. Well, Mike did this. It's an overwhelming thing, right?

You know, so this is, this is why I'm always ran about inevitability, curves. Everything you've said, Mitch, you know, is happening regardless, we can just wait a little longer or we can, you know, you know, and if I was in Dev right now, I might just do it on purpose. Let's just amp up the amount of code because very soon, I would say in the recent past, we can't do it the old way anymore at all.

And in the future, we're absolutely not going to be able to stop trying and I'll finish my ran and let you get in, guy. But you know, Kate, you touched on zero trust, you know, love it, hate it. You know's a stupid idea, but it's what we had to work with.

That's not how any of this works. We need to have appropriate trust and that has to have appropriate attestations or records so that automated tools can be relied on and not just optimized by, again, investors and board making bad choices. Okay?

And, And, you know, to, to circle back and to con or to continue with zero trust, the idea that, um, and something that I've seen it forever. I mean, stolen cred credentials, manipulated tokens have not been enough. And we continue to push that story where it is.

But the problem is, is that the, these AI agents actually become double agents. And, you know, and totally, you know, we can exploit the entire system with that. And the reason why I love it is because it, it finally breaks down that myth, the myth that this is good architecture.

It, it just, it's not sustainable. That's a problem. We have non-sustainable architectures, and that is something that we need to change and we need to actually change it.

You know, to your point, Chris, with, um, a and Mitch, I mean, we talked about ai. We, we do need to change this on how we think about it. Well, and it, it, it'd be cliche to say it, but, but again, you know, I i, I make the point quite often that, that someone with my inclination of skillset will get your information, will always right, highly motivated enough.

I'll just stare at the organization, find the weakness, go in and take it it, you're right, Kate, with these tools today, and you know that, 'cause every time I said that's not literally true. Probably, you know, you should expect it absolutely true today. You know, highly motivated, skilled adversary with good AI skills and good tools will absolutely exploit any vulnerability you have.

As before you can get lunch today. Oh yeah. So you have Colonel Sandra's secret recipe.

What's where you doing with that? Yeah, I'm not a good book. I wouldn't, I wouldn't know what to do with it.

Wait, what? There's gambling going on here. Yeah.

Hold on. I know on Just a second. I know that was my First tore from Casa Blanca.

Yeah. So, so it's all well and good to stand up and say we need a new architecture, Mitch, who's in charge of building that new architecture? Who's gonna wake up in the morning and go do that?

And how do we get that done across, you know, thousands of enterprises? So, so in a systemic view of it is if you, if you believe that we're gonna be generating so much code that it's generating so many vulnerabilities that it's, it reaches an intolerable point. The people won't buy your product or won't use your product.

'cause they can't afford to introduce that many security issues into their environment. Guess what? The vendors have to respond to it and they just haven't had to yet.

Right? It's, it's kind of to Chris's point of we don't need security yet, so we're not gonna fund it, right? We haven't needed it yet.

And so Alan talks about this all the time. You know, the, the, when, when security is important is when customers start asking for it, right? That's one of, one of his investor friends said, it's kind of the same thing when the market says we have to have this, um, we wanna use your stuff, but it's just in, I just can't implement that at that scale, at that speed.

I'd have to throttle it down and then why am I paying for, for a, a tool that'll go a thousand miles an hour and I'm running it at 50. So I, I think, I think the dollar is what solves the problem. May maybe not solves it, but moves the needle to addressing it.

Because the market won't buy products if they can't maintain what's being put out there, even if they're using AI to maintain it. All right, guy then to Mitch's point, how long do we have to wait again, gambling in Las Vegas for this cataclysmic AI agent that gets hijacked and takes over some businesses processes and results in, you know, a I guess these days it would have to be what a $50 million error that to, for anybody to take notice and not treat it just as if it was, you know, the cost of doing business. What's that number?

I'm gonna answer your question, but I want to ask you a question first, which is, did this story, um, make you feel sad or neutral or good? Like remember the first segment that made you feel like hopeful? What, what, what was your reaction to this story As, as, as a journalist, I'm with Kate man, I'm like, wow, this is gonna be one hell of an awesome traffic accident and it's gonna be, you know, this is going for months.

Yeah. So, but as a, but as a, you know, as, as a person invested in our technological process, you're like, oh no, this is gonna be a huge traffic accident. I think that this is a neat opposite day because I disagree with you yet again.

And I'm gonna signal an unusual, uh, uh, ring of hope here. And that answers your question. This traffic accident is going to happen very fast compared to, I mean, MCP itself is like not even a year old yet here we are.

And I take the speed with which there is recognition of the dangers to be a very hopeful sign. And I don't think it's due to the dollar, Mitch, I hate to say it, but I think it's due to like culture distrust. Nobody wants robots to be in charge.

Everybody's getting suspicious of ai. Now I'm using these terms, I don't like to use nobody, everybody, but don't you all feel this general sentiment? And I think there's survey data to back it up that people don't trust where AI is going a mere two years after gen ai, like less actually splashed upon all of us and started taking over the world.

So I think that this has the potential, it makes me hopeful to be one of the few areas of technology, maybe the only major area of technology I have seen in my career where people are gonna start to get proactive because their friends and neighbors and everybody else are do not trust where any of this is going. And I So you're saying The future looks like Blade Runner, is that what you're saying? You know, we're gonna hunt down the Replicants, I think, I think it's our best chance to avoid the future looking like Blade Runner really well.

Have you seen who's in charge lately? 'cause I might consider the robots. I mean, go look at umpires, you know, the strike zones are all over the place and after every game everybody's like going, well, maybe we should give robots a shot.

I'm just saying I'll riff on that the same way I was going to because that's, you know, to, to Diane, uh, and Kate's points, the forcing functions we're getting forced into this point to make these decisions, right? And you know, it's not about the security perimeter, you know, to zero trust is about trust apology, right? You know, everything you just said guy, literally your neighbors.

This is not just tech people. Nobody trusts anything. These, and, and to your question, Mitch, at the rate of things I do not expect, uh, one way or the other, you know, not to have that, that the, the, the question you asked not resolve itself before this goes to air tomorrow, right?

That's the world we're living in. 12 hours, 24 hours. Yeah.

That's as likely to happen in the next 24 hours in the next week or two. And it's not gonna be a year from now that's gonna happen this summer maybe today. Yep.

It's gonna happen. Announce sure could. Yeah.

Yeah. Yep. All right.

Well I'm gonna leave it there. And you know, what was that like from the sixties? My kid was just in the production of hair at summer camp and so they were doing the whole thing, but trust no one over 30.

And now we're just like, trust no one. Right? That's where we're Trust.

Trust appropriately. Right? That's, that's the thing.

You know, don't trust because of this, a digital signature, that doesn't mean anything. All right. Hey guys, I want to thank you all for being on the show, as as awesome, great conversation.

I wanna thank you all for watching this latest episode of Text on Gang. Please stay tuned for the rest of the lineup, for the text on TV is right behind us, and I promise you it's gonna be just as awesome. We'll see you guys next time.