00:05:58 · Max Justicz, Ruby Justice Thelot
[00:05:58] S0: Oh, really? Yeah. I messaged him on LinkedIn the other day just to say thank you for making my life easier. But, yeah, I would recommend throwing $100 their way and aiming it at your code base as well. It's probably gonna be more effective. [00:06:11] S1: Do you think that companies like Obliteration and those that offer obliterated versions of very cyber capable models are net good or net bad for the world? [00:06:20] S0: I think in the longer term, net bad to be providing kind of misaligned AI as a service. I think in the short term, it's actually good in that it's going to allow defenders to audit their code more quickly. So I think I think right now, it's... There's also just weird, like, second order effects. Right? Like, I was able to use that service in a way that might be raising some awareness to these issues. And I think that has a significantly good impact right now. So yeah, I think in the long term, the normalizing, providing access to AI models that are willing to do harmful things is is probably not good. [00:07:14] S1: Right. That makes sense.
00:07:14 · Ruby Justice Thelot, S2
[00:07:14] S1: Right. That makes sense. Ad[00:07:17] S2: I wanna shout out our sponsor, Lovable. You know, the app you've been meaning to build? The internal tool, side project, or product you'd otherwise lose a weekend to? With Lovable, you get software you can ship today. That includes an editable code base you can inspect and change, plus two way GitHub sync. Lovable also handles the backend infrastructure, including managed Postgres, auth, storage, hosting, payments, and more so you don't have to wire it all up yourself. And through Lovable's MCP server, you can create and deploy your project directly from the agents you already use. Turn ideas into software people love with Lovable. Lovable. Dev. Now on to the episode. [00:07:56] S1: So is there any way in which this should affect the things that ordinary users do with their computers to stay safe on the Internet?
00:07:56 · Ruby Justice Thelot, Max Justicz
[00:07:56] S1: So is there any way in which this should affect the things that ordinary users do with their computers to stay safe on the Internet? [00:08:06] S0: Unfortunately, I think ordinary users are in a pretty bad spot right now. I don't think there's much you can do as a user besides, like, use fewer services. I mean, I I would stick with my advice pre AI security apocalypse, which is, you know, stick with major smartphone brands that are likely to get patched more quickly, you know, use major operating systems, keep things up to date. But it's a little bit futile right now. One of the other projects that I took on recently, actually, after finding this bug, was I just bought a modern fully patched Android phone, aimed the same models at it, and very quickly got kind of the worst of the worst finding where I could send a malicious message, just over cell networks to an Android phone and and take it over, run arbitrary code. And the patch for that one's still being rolled out. But, you know, we're in a world where me, as someone with a full time job not doing security stuff, could just kinda, like, dick around one afternoon and find that in a few hours and exploit it. And, yeah, there's there's not really much you can do as a normal person to protect yourself against that right now. Yeah. But, like, how [00:09:18] S1: good are you? Like, could anybody point models at software like you did and get similar results? Or is there some sort of cybersecurity expertise that you have that makes it easier for you to do that?
00:09:18 · Ruby Justice Thelot, Max Justicz
[00:09:18] S1: good are you? Like, could anybody point models at software like you did and get similar results? Or is there some sort of cybersecurity expertise that you have that makes it easier for you to do that? [00:09:29] S0: Well, this is why I think I'm kind of an interesting case study here. I think that I'm okay. I'm not one of the world's best hackers or anything, but I'm someone who had some success doing bug bounties. And I've seen just a massive uplift in what I can do because of these models. And I think that, like, marginal difference due to my skills is just gonna quickly diminish to the point where, you you know, if if you're completely unskilled, you'll be able to do the same thing. Like, I have a little bit of taste in, like, being able to aim the models at at things that I think are worth looking at. But, like, I mean, what kind of mode is that? Like, I I I don't think that's gonna last very long. So I think I'm kind of on the bleeding edge of... Like, think I view this work as kind of like a canary. Like, I think that, you know, I have a little... Like, you know, probably a couple months ago, like the most skilled hackers were seeing additional results due to this. Now I am. And pretty soon, just normal computer users will be able to find stuff like this. I'm pretty confident. [00:10:38] S1: Mean, will they or will the software maintainers have already found it and patched it first?
00:10:38 · Ruby Justice Thelot, Max Justicz, S3
[00:10:38] S1: Mean, will they or will the software maintainers have already found it and patched it first? [00:10:45] S0: Well, I think there's another issue here, which is, is anyone looking? The fact that I was able to find this app bug as quickly as I was indicates to me that no one's even bothered to aim an AI model at this code. Yeah, maybe for the most popular devices, the bar will still be pretty high, and and normal folks won't be able to find bugs like this. But consider, you know, the... Whatever random radio firmware is running on a on a... An aircraft, you know, decoding information from from other planes. Like, if no one aim... If no one bothers to aim AI tools at that looking for bugs, then it's kind of just on whoever's first [00:11:23] S1: to do it to to [00:11:24] S0: find them. So, unfortunately, I think just, like, the surface area of modern life is so large that it's going be hard to get complete coverage. Right. [00:11:34] S1: Well, we're coming up on time, but it's really interesting to learn about the shifting nature of cyber risk. Yeah, I mean, was one of the big topics of the last month. It'll continue to be relevant. So Max, thanks so much for coming on MTS. [00:11:48] S0: Yeah, thanks for having me. I appreciate [00:11:49] S1: it. Absolutely. [00:11:51] S3: A huge thanks to MTS sponsors.
00:11:51 · S3, Ruby Justice Thelot, S2
[00:11:51] S3: A huge thanks to MTS sponsors. [00:11:53] S1: ElevenLabs, AI that communicates at human level across every channel and modality. 11labs.io/mts. Scale your startup on Neon. Millions of developers and startups have already chosen Neon for their back end. Start on the free plan or get up to a $100,000 in credits for your startup at neon.com/mts. Special thanks to our sponsor, Kong, the AI connectivity platform. Connect APIs, LLMs, agents, and systems with serious security and governance. Konghq.com. [00:12:24] S2: Finally prove what your AI investment is worth with Larridin. Head to lairdon.com today to start measuring your AI's bottom line. MongoDB, trusted to run critical applications by 75% of the Fortune one hundred, the intelligent data platform for the era. Apply today for access to up to $15,000 in Atlas credits, dedicated technical support, and exclusive events and go to market opportunities. Mongodb.com. Chargebee, billing and monetization infrastructure for the AI era. Chargebee.com. [00:12:57] S3: Blitzy, autonomous software development for enterprise code bases. Ship five x faster. Blitzy.com. Adquick, make your brand a billboard out of home advertising as easy to scale as digital. Adquick.com. Arena, measuring AI performance in the real world. Arena.ai. Support for the