Today, I’m talking with Alex Stamos, chief security officer at Cognition and longtime cybersecurity expert, about what a mess cybersecurity is right now. This episode is part one of a special series looking at AI in real life. I’ve always enjoyed talking to Alex because he’s so direct, and you’re going to hear him say that the multibillion-dollar cybersecurity industry as we’ve known it is essentially overdue to the unrelenting, AI-boosted waves of hacks, breaches, and attacks — and this is only the beginning of how much AI is changing security. Verge subscribers, don’t forget you get exclusive access to ad-free Decoder wherever you get your podcasts. Head here . Not a subscriber? You can sign up here . Both private actors and also state actors, like Russia or North Korea, are breaking into systems all over thanks to AI helping them both detect and exploit vulnerabilities all at the same time. It’s got a real frontier feel to it, Alex notes, just like the ’90s, when the whole idea of an always-online world was brand-new. That much disruption means a lot of places where bad guys can get in while everyone else is left scrambling. Alex isn’t a doomer in the long run, but he does think we’re in for a “dark age” while we try to figure out how on earth to adapt to the new era. There’s a lot going on here — we even got all the way to how AI-powered misinformation and slop might be managed on our social networks. Before we get going, do me a favor and subscribe to Decoder on YouTube, where we put out new episodes every Monday and Thursday. Okay: Alex Stamos on how AI is upending cybersecurity. Here we go. This interview has been lightly edited for length and clarity. Alex Stamos, you’re the chief security officer at Cognition. You’re also a lecturer at Stanford University Cyber Policy Center. Welcome back to Decoder . Hey, thanks for having me, man. I’m excited to talk to you. It’s been a long time since you and I chatted in what you might call the “content moderation era” of internet policy discourse. I feel like you and I talked a lot about how all that was working, about election security, all those sorts of things. We’re in a new era of big problems on the internet, particularly around cyber defense, cybersecurity. You’ve been thinking about this stuff a lot. You referred to the past few weeks as “security awareness month.” Tell me what’s going on. Just give me the lay of land right now. October is traditionally security awareness month. Lots of companies run events and deal both internally and then tell people, “Change your password, use multiple passwords, use a password manager.” What has happened over the last month is we’ve had a couple of these big bugs, PHP, Node and such. What’s been less discussed is a huge number of companies have been breached. You have a series of AI-related companies, the neoclouds that have been breached in succession. You have the Binance hack, which is the largest heist of anything in human history. You have the Cursor incident where one of the things that’s going on here is these hacks are being chained together. From what we know right now, one of the companies that was broken into was Fireworks, which is a prominent provider of AI services to a number of companies. From the Fireworks hack, API keys were stolen that allowed people to break into Cursor. Once they got into Cursor, they then pushed a bad plugin, which went to 5,000 more companies and that caused 5,000 potential breaches. It’s just this kind of permanent continuous breach that is going on throughout the tech industry. A CISO friend of mine said to a bunch of us, “Is anybody else tired?” And everybody said yes, because effectively we have been at DEFCON 2 for all of October and now going into November. I’m going to ask you some really dumb questions here. Who is behind all these attacks? Is it Russia? Is it North Korea? Do we know? It’s a variety of different groups. It is not just because adversaries have decided, but what has happened is, from my perspective, we are at the start of the takeoff of adversary capability enabled by AI, that the open-weight models have now gotten to the point at which you can automate most of the kill chain. This “kill chain” term is something we stole from the military. In the military, they mean to actually kill something. They’re the steps you do to blow something up. In cyber, the kill chain is the things you do to have an effect on a target. So to steal information, to turn something off, to steal money, to steal Bitcoin. Traditionally, you do research upfront, you look at a piece of software, you find a vulnerability, you write exploits, and you do that all way ahead of time. And then you have a human being go and take that stuff you built and deploy it against either one target — because maybe you’re a government and you’re going against Lockheed Martin or you’re going against another government or you’re a ransomware actor — and you take all that work you did and you deploy it against hundreds or thousands of targets really fast. Now with AI, what’s happening is this kill chain has inverted where you can run an AI system that just goes hog wild and it looks at the targets and it finds the bugs in real time and it writes the exploits in real time and it breaks into these companies. One of the things that’s happening is that these systems are going and they’re so good at finding bugs that they are finding the bugs in real time and writing the exploits in real time. The system that everybody’s talking about is not the only one, but the system we’re talking about is a thing called ARTEX, which is a Chinese open-source tool that anybody can go look at. There’s an English translation on GitHub that you can check out. And if you power it on the back end by something like an obliterated GLM-5. 3, it will let you break into a shocking number of organizations. This started with three South Korean banks. This week, about 200 more companies have been hit. I’ve been helping a couple of companies. Cognition is not an incident response company, but we do go in and help people fix their bugs afterwards by using our tools. It is shocking the companies that are getting hit by something you could just download. It has been a long time since you’ve been able to go and just download an open-source tool and break into multi-billion dollar companies. It’s like the ‘90s. That’s-
That’s what I was thinking about. I think about Windows in the late ’90s, early 2000s when it was a security disaster. I started saying this actually in the beginning of this year, that it’s an incredibly exciting and terrifying time, because the last time it felt like this was when I was a much younger man and I would go to the very early DEFCONs. DEFCON these days is like 40,000–60,000 people. Back then [in the 1990s] it was a couple hundred people and it was one track and you’d go in and somebody would give a talk and you’d leave the room and you’d think, “Every company in the world is vulnerable to this attack.” The difference was that the entire world didn’t run on the internet. You could go do bad things, but you couldn’t ruin the world and you certainly couldn’t automate it in the way you can now. It’s back to those days where tools you could just get and build yourself could do crazy things. It’s back to the Wild West days. Back in those days, there were a couple hundred people who had those skills and we were all in one room in Las Vegas and most of them were actually good guys. They didn’t want to be criminals. And now you have a much larger ecosystem of people, many of whom live in places where the law enforcement can’t touch and who have a big economic incentive and have access to these tools. The other big thing is they no longer have to use frontier models that have protections, that have logs that are available to law enforcement. My M5 Mac Ultra Studio finally showed up and I’ve been running a quantized obliterated GLM-5. 3 and oh my God, what you can do is incredible. You mentioned the economics of frontier models. The economy of cyber is one of those things that has gotten sophisticated over the years. One of the things that our systems got safer is you could pay the number of people at DEF CON a whole bunch of money to protect all the systems and it was economically smart to pay them to be defenders instead of attackers. I’m just rewinding my own brain through this history. There was a long conversation in our industry about security through obscurity by hiding all the bugs and hiding all the code versus open source and being really transparent. There was an etiquette that developed about how to reveal the bugs and when to give people notification. There were transparency reports and bug bounties. You could call it an etiquette, you could call it an economy. We built a culture around cybersecurity and cyber defense and how the attackers and defenders would operate. What you are describing changes it all for a whole number of reasons, but the one that sticks out to me is the economics of it. I can go buy a Mac Studio, I can get an open-weight model and I can just start and that does not place me inside of the culture. There’s not going to be some old man, an Obi-Wan Kenobi saying, “Here’s how you act like a cybersecurity Jedi.” I’m just going to start doing stuff. Tell me how that’s changing right now. Effectively, the last era of security from my perspective started with the Microsoft, the Bill Gates “trustworthy computing” memo in the early 2000s. And that is when we started designing how we do software security and these big companies, Microsoft and Oracle and then later Amazon and Salesforce and these folks, started hiring ex-hackers. I was part of that generation of the ex-hackers who were at DEF CON and Black Hat and got hired by the companies to go break their stuff. We started coming up with responsible disclosure, bug bounties, consulting companies, so the Foundstone and @stake and then Mandiant and CrowdStrike, these companies grow up and we get this huge industry that is now RSA and Black Hat. This multi-billion dollar security industry grew up in the 2000s and 2010s. That era is over, like you said, because it was based upon a couple of assumptions. One was that there was a hierarchy of skillsets of people who could do this stuff. You had the script kiddies who could download tools to do things and then the next level up of the people who could write those tools and that was a more rarefied skill set. There were the vulnerability researchers and then there were the gods, and that god tier was in the hundreds of people and those are the people who could do the really, really good vulnerability research, who could write the really, really good shell code, who could reverse engineer patches from Microsoft or somebody like that. There was also the assumption that there were a limited number of people who could be operational in an attack. If you wanted to build an attack team, then you have a small R&D component and then you have a much larger operational component. If you were a professional attack team at U. S. Cyber Command, at Russia SVR, at Chinese MSS, that you build the structure of your R&D team of elite people and then your less elite operational people, and that was copied then by the Russian ransomware actors. You have to have a conspiracy of people to do this stuff. A lot of this stuff also fell apart with the invention of Bitcoin because one of the assumptions was that you had to have people who could launder money and Bitcoin meant that nerds could launder money. So that started to change the economics of the entire thing. All this stuff is falling apart because of AI, because the skillset issue is that now script kiddies have a bunch of the skillset of the Dave Vitales and the other cyber gods who could do these things, such that with this Mac that’s sitting on my desktop, I can reverse engineer a Microsoft patch and walk through and then write stable exploit code. It’s not quite there yet to be automatic. You still have to have a bunch of skills, but we’re really, really close. What’s really concerning, and what you see with the ARTEX stuff, is you can now kind of let loose on the operational side. We were never secure. It was all a fantasy. These vulnerabilities have always existed. These companies have never been safe. And that is what we’ve seen over the last decade is these mostly Russian ransomware actors nailing the mid-size companies that most people have never heard of that are actually really important, like some midsize industrial company that makes some widget that we all depend upon. I once did work for the largest distributor of medical and dental supplies in the country, and they got really hit badly by a Russian ransomware actor and then dental offices across the country were canceling appointments. Didn’t even make the news, but it was because they couldn’t get gloves, because they couldn’t get supplies. It’s because a company like that’s got one security guy and a 10 person, 12 person IT team and they’re going up against a 20 person Russian ransomware team, they’re toast. But it’s just because there’s only a handful of Russian teams that could do that. Now two or three Russian kids can have a whole bank of Macs or, if they have the money, they can buy Nvidia H-100s and they can run a ton of agents who do this all day and that is what is changing. I’m sorry, you asked who was doing this. For Binance, it’s North Koreans and they have an entire team where all they do is steal Bitcoin. Other people have gotten out of it because it’s really hard to compete against a foreign intelligence agency that recruits their smartest kids and all they do is steal Bitcoin. They’re extremely good at it. And for the Binance hack, we could talk about it. There’s probably some AI component, but mostly that was actually human intelligence and very, very smart social engineering and the North Koreans are… I mean, you have to give it to them. They’re very, very good at that. But for the other stuff, it looks like for the people who are breaking into the AI companies is what’s called the Chinese cottage access industry, which are small Chinese contractors who break into companies and then sell the information to much larger Chinese companies. That diffusion of skill changing the economics of cyber is really fascinating to me. We ran a headline ages ago called “ Attack of the Killer Script Kiddies ” at the very beginning of all this, and I feel bad because it is much more suited to now than it was to then, because then it was just a lot of automated mischief. Now —
Because you wasted the headline. You wish you held it back. We wasted the headline. Every now and again you get a lightning bolt of a headline. You got to get it out there. It’s a great piece of art. We’ll put it in the show notes, but it feels like the diffusion you’re talking about is not that a bunch of teenagers are going to be even more malicious. It’s a bunch of bad actors with real incentives to do harm are now vastly more capable than they were before. And that doesn’t seem like you can re-jigger the economics of that unless you somehow make it really expensive to do the attacks. I think it’s going to be extremely hard to make it expensive to do the attacks. We’re going to have to lower the cost of defense. You’re completely right to look at this economic problem because what’s happening is attacks are becoming agentic. The cost per token for attackers is going towards zero, and the cost of defense for defenders is staying quite high. It is very important for us to find ways for defenders to have cheaper options. I think that is critical. That’s something I am personally extremely focused on. To be frank, very few people are. There are a couple of problems here. One, there’s a ton of focus on the defensive side of AI on finding and fixing bugs. That’s great. It’s important. But software security as a CISO… I work for an AI software company, Cognition. Even as a CISO of a software product company, software security is 25% of my job. I have all kinds of other responsibilities. And software security is the part of my job that has been both the most revolutionized and the most improved by AI. The other 75% has been helped a bit and in some cases made much worse. There’s so much more we need to do than just hill climb on finding and fixing bugs. There’s been so much less hill climbing on all these other things. And the next area needs to be the operational security side. Wait, give me an example of the other things, the 75%. Okay. So the operational security side is watching your logs, saying, “Ah, somebody is running our techs against us. I am now going to trigger an investigation. I am going to look to see what is going on and I’m going to make an intelligent decision of what I am going to do to respond to this without shutting down the entire company.” That is SOC (security operations center) work. Companies that want to survive this era are going to have to replace human beings who do that work with the first tier and then eventually the second tier with AI. And you can do that with current LLMs. The first tier actually has to be not an LLM. It has to be something much dumber because you’re looking at terabytes or petabytes of logs and it is just completely uneconomical to do that with an actual LLM. We have other things — TF-IDFs, MLBERTs, traditional classifiers — that can operate much faster, but then that sets off an alarm and then you send it to a small LLM and then the small LLM calls its bigger brother and that might call an even bigger brother. But for those models, we need to do a lot more work to optimize them and we need to make them cheap. I have a colleague who works at one of the large security platform companies who said that doing an investigation on one of the big frontier model cyber models costs $900 on their product to do an investigation. That is not going to work when the Russian ransomware guys are either using Macs or they’re using throwaway crypto mining rigs and their marginal cost is zero. This is one of the things we’re working on at Cognition: We train our own models, retrain open weights, and we’re trying to drive this cost way down. It’s something we’ve done, but we have a lot more work to do here and a lot of other people have work to do here. This is where, as an industry, we have to focus on the Pareto frontier between cost and efficiency on cyber because it’s not just bug-finding. The other place here is, people talk about Mythos. Mythos is great, Astra Cyber is great. They’re incredible models, but even the people who have access to it, which is a tiny number of companies, they only scan their most important code. And there are hundreds of billions of lines of code out there that are not the Linux kernel, that are the crap C# and J2E code that was written by Infosys 15 years ago. All of that code is not going to go through a frontier cyber model that costs a gazillion dollars. That’s the kind of stuff that we need to work on cost efficiency for. It feels like you’re describing this cliche that I hear all the time: Everything’s going to get so much worse before it gets totally secure forever. And it doesn’t seem like the model you’re describing leads to that result. We’re not going to fix all the bugs forever in some valley of despair and then always have perfect code. At some point, there’s some cost advantage to the attacker, always. You’re running a company, you can’t write defense that has zero marginal costs. Someone has to do it even if the attackers are so infinite that their marginal cost is effectively zero. So are we going to go through a period where everything is so much worse and then it’s perfect forever? Or how does the cost manage itself out, into balance? I am neither the hardest doomer nor the most positive person about this. I feel like we are not going to be doomed. We’re not all going to die or be uploaded to the singularity in the next two years, nor do I think when things get better, they’re going to be perfect. The metaphor I’ve been using is that we are entering a dark age. Things are going to get more bleak and the responsibility of those of us who work in cybersecurity — especially those of us who work in cybersecurity at the AI companies, and we are a lab if a smaller one compared to the big-L Labs — is to help shorten that dark age. The Dark Ages were bad, but we survived them. And then we had the Enlightenment and the Renaissance, but it’s not like the Renaissance was perfect. It wasn’t utopia and everything was perfect. We will still have hacks. All kinds of bad things happen even when you don’t have a security flaw. There are tons of security breaches that do not require a flaw in the software itself. And we still will have flaws in software, even if LLMs are writing all of them in strong languages and it will take a long period of time to get rid of all the flaws. I do think, however, things will start to get better as the median code becomes code that was written by an LLM in a memory-safe and type-safe language. But the problem is we have a couple of decades of stuff that human beings wrote and that wrote in languages that we should have replaced years ago. My feeling is that to shorten this age, we have to do a couple of things. One is we have to stop to get out of this like we’re just going to find bugs and patch them. A bunch of stuff just needs to be refactored. If you’re looking at your code base and you scan it and you’ve got 10,000 bugs, then probably now we are at the point where rewriting it is actually cheaper. That is my observation from looking at these customers of ours: If you can get a working build, then it is actually much easier to write a whole humongous suite of tests and to spec out how this thing works and then to rebuild it within that spec and those tests securely than it is to find all the bugs and fix them. It actually is. I don’t know what is going on through the mind of the Linux kernel developers, but again, in that talk I gave at the beginning of this year, I posited two possible futures and one was that we’re now at superhuman bug finding. Maybe we just have a pool of superhuman bugs and we’re going to drain it. That’s the good future. But the bad future is every time we get a new model, there’s a new superhuman bug pool that’s a little more superhuman. And unfortunately we seem to be closer to that in that the Linux kernel got a bunch of fixes for Mythos and then Mythos Preview and then we had Mythos 5. 1 and there was another pool. And then we got Astra Cyber and we just got another 1,000 Linux kernel patches. It’s not slowing down yet. I don’t think we’re just going to scan our way through the C code of the Linux kernel. There are only two companies, honestly, in the world who could probably do this. It’d be Google or Amazon. I wish instead of the Fuchsia project or rebooting the Google book or the Chromebook again, Google would take all of those incredibly brilliant engineers and just tell them, “Take the Linux kernel and rewrite this in Rust.” That would be their gift to the world. And it would be an incredible advertisement for Gemini, for Carbon or whatever would be like, “Get rid of all the drivers that nobody needs. This thing doesn’t have to run on the 46 DX3 or whatever.” I mean, I know it doesn’t, but you know what I’m saying. Yeah. And then just release it and call it whatever you want, the G Linux kernel, just like they did this with OpenSSL. And I would run that. Cognition would run that on our servers or have Google and Amazon do it together and it would cost them $100 million, but compared to the societal cost that this is costing us every time we have to patch the Linux kernel and you have to reboot every Linux machine on the entire planet, that’s what has to happen. But for whatever reason, the technology industry has not been able to get together and make these hard decisions of these fundamental things that underlie the entire human race, we have to completely rebuild. This is why I started by talking about how the economics of cyber led to the culture of cyber. This is the most Decoder way of approaching this conversation, I know, but when you describe the research teams, the NSA and then the operational teams, that is an org chart that comes out of economics of the work. You’re saying, “Someone has to make a big decision here.” You need to look at it from a very high level and say it is cheaper to spend $100 million to fix Linux, rewrite Linux today, than it is to successively patch new bugs when every new model comes out. I don’t think anyone’s in that position. I don’t think Linus Torvalds is in that position. No, I think Sundar Pichai and Andy Jassy are. I think they literally have each other’s cell phone numbers. If one of them… Maybe they don’t listen to Decoder , but I expect one of their direct reports does. And I would like one of them to go into their one-on-one and say, “Sir, I listened to the most handsome, best spoken CISO I’ve ever heard, and he had a great idea. And you could get incredible credit if you’re the one … We’ll both do it, but we’ll leak to the Wall Street Journal , that was your idea first. You should call the other and we should spend 100 million, maybe a billion dollars.” We can’t do this anymore. The problem with rewriting the Linux kernel is half of it is driver code and nobody has that hardware anymore. Somebody had to be in the presence of that hardware with a ThinkPad T40 when they wrote that driver and they don’t have it anymore. But the good thing is that a huge number of the really important uses of Linux kernel are production server hardware. So fork it. Linus will never do it because Linus wants to support all that stuff and he’s got all these politics, but Google and Amazon don’t have to care about Linus Torvalds. Google and Amazon can create a new version, a new fork of the Linux kernel, and they don’t have to call it Linux, that can be ABI binary compatible with the glibc and everything above it. In fact, they can eventually fork glibc. They can build it and they can call it whatever they want and it only runs on production hardware and then they can use it for their clouds. Eventually all the clouds will move to it. If you want, other people can run the insecure thing that has to be patched all the time and that’s fine. But for the things that our containers run on, I would feel a lot better if it was written in a type-safe, memory-safe language that also has the ability now to have contracts. So these languages have the ability … You don’t have to do full formal verification, which is incredibly hard, but you can do kind of these things that approach formal verification. I’m a little over my skis here because there are people much smarter than me that study this. But basically you define how this function’s supposed to work, here’s the contract it has. Very, very smart software engineers would love to write these things because they had time on their hands. No person who had a real job used to write these things, but LLMs have tons of time on their hands because we’re frozen in time while they’re thinking at that incredible machine speed. And so you could totally have them rewrite the Linux kernel with this not quite formal verification. Please, if you’re listening and you work at Google or Amazon, go pitch this. Anyway, there’s my pitch. I’m just saying, I know Jason [Post] is listening, so you heard it. I’m not even going to —
I’m saying that is the kind of thinking we’re going to need to make it through this. It’s like We can’t just patch our way through this because it’s killing us. Because the other thing that’s killing us is we are not set up… You talked about how we do security for the last 20 years. The assumption is that we can get a patch and apply the patch and you’re okay. What’s happened is the exploitation timelines are so incredibly fast that that does not work. That’s what we just saw with the PHP bug. We got incredibly lucky that the PHP bug turned out to be really hard to exploit in the wild. If it was a much more wormable bug, it would be a disaster. That was the kind of near-miss asteroid thing that now the world should build an asteroid—
Wait, can I ask you about this? Yeah. We should definitely put Bruce Willis on a space shuttle. [Sings] Don’t want to miss a thing…
There’s a lot going on in this conversation already. My pessimism about all these things is very simply expressed. Americans in particular, we are very bad at doing anything until a bad thing happens. We love a cure. We hate prevention. A lot of bad things have happened. There’s the Hugging Face attack. You recently said you were happy that happened. It woke people up. There’s the PHP bug. We’ve just had a crazy month of all these breaches…
